Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 22-02-2015 Ran by Kuba at 2015-02-23 16:10:16 Run:3 Running from C:\Users\Kuba\Desktop\logi\nowe Loaded Profiles: Kuba (Available profiles: Kuba & Gość) Boot Mode: Normal ============================================== Content of fixlist: ***************** CloseProcesses: Task: {10B77EDF-C057-403D-A743-CAC4B85058EA} - System32\Tasks\wecutil => C:\Users\Kuba\AppData\Roaming\Microsoft\Windows\IEUpdate\wecutil.exe HKU\S-1-5-21-3839221274-3043303846-3843884880-1000\...\Run: [wecutil] => "C:\Users\Kuba\AppData\Roaming\Microsoft\Windows\IEUpdate\wecutil.exe" HKU\S-1-5-21-3839221274-3043303846-3843884880-1000\...\RunOnce: [79m1gM3g] => C:\Users\Kuba\AppData\Roaming\79m1gM3g.exe [801792 2015-02-22] (Cortado AG) HKU\S-1-5-21-3839221274-3043303846-3843884880-1000\...\Policies\Explorer: [Run] "C:\Users\Kuba\AppData\Roaming\Microsoft\Windows\IEUpdate\wecutil.exe" HKU\S-1-5-21-3839221274-3043303846-3843884880-1000\...\Command Processor: "C:\Users\Kuba\AppData\Roaming\Microsoft\Windows\IEUpdate\wecutil.exe" <===== ATTENTION! Startup: C:\Users\Kuba\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wecutil.lnk C:\Users\Kuba\AppData\Roaming\Microsoft\Windows\IEUpdate C:\Users\Kuba\AppData\Roaming\79m1gM3g.exe EmptyTemp: ***************** Processes closed successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{10B77EDF-C057-403D-A743-CAC4B85058EA}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{10B77EDF-C057-403D-A743-CAC4B85058EA}" => Key deleted successfully. C:\Windows\System32\Tasks\wecutil => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\wecutil" => Key deleted successfully. HKU\S-1-5-21-3839221274-3043303846-3843884880-1000\Software\Microsoft\Windows\CurrentVersion\Run\\wecutil => value deleted successfully. HKU\S-1-5-21-3839221274-3043303846-3843884880-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\\79m1gM3g => Value not found. HKU\S-1-5-21-3839221274-3043303846-3843884880-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\Run => value deleted successfully. HKU\S-1-5-21-3839221274-3043303846-3843884880-1000\Software\Microsoft\Command Processor\\AutoRun => value deleted successfully. C:\Users\Kuba\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wecutil.lnk => Moved successfully. "C:\Users\Kuba\AppData\Roaming\Microsoft\Windows\IEUpdate" => File/Directory not found. "C:\Users\Kuba\AppData\Roaming\79m1gM3g.exe" => File/Directory not found. EmptyTemp: => Removed 1.8 GB temporary data. The system needed a reboot. ==== End of Fixlog 16:11:22 ====