Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 26-04-2015 Ran by Kaczor at 2015-04-26 15:47:54 Run:2 Running from C:\Users\Kaczor\Downloads Loaded Profiles: Kaczor (Available profiles: Kaczor) Boot Mode: Normal ============================================== Content of fixlist: ***************** Task: {3C2E12AF-F44E-421F-8ED3-5B406F5C3779} - System32\Tasks\YourFile DownloaderUpdate => C:\Program Files (x86)\YourFileDownloader\YourFileUpdater.exe <==== ATTENTION C:\ProgramData\nvxasync C:\Users\Kaczor\AppData\Roaming\nvxasync Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\nvxasync" /f HKLM-x32\...\Run: [TaskTray] => [X] HKU\S-1-5-21-3442134853-2633566657-2367740593-1000\...\Run: [nvxasync] => C:\Users\Kaczor\AppData\Roaming\nvxasync\nvxasync.exe [142679040 2015-04-07] () HKU\S-1-5-21-3442134853-2633566657-2367740593-1000\...\Winlogon: [Shell] C:\ProgramData\nvxasync\cvxasync.exe [142679040 2015-04-07] () <==== ATTENTION CHR HKU\S-1-5-21-3442134853-2633566657-2367740593-1000\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION FF HKLM-x32\...\Firefox\Extensions: [fftoolbar2014@etech.com] - C:\Users\Kaczor\AppData\Roaming\Mozilla\Firefox\Profiles\qg57o1fo.default\extensions\fftoolbar2014@etech.com FF HKLM-x32\...\Firefox\Extensions: [faststartff@gmail.com] - C:\Users\Kaczor\AppData\Roaming\Mozilla\Firefox\Profiles\qg57o1fo.default\extensions\faststartff@gmail.com FF HKLM-x32\...\Firefox\Extensions: [{C7AE725D-FA5C-4027-BB4C-787EF9F8248A}] - C:\Program Files (x86)\RelevantKnowledge\firefox C:\Program Files (x86)\RelevantKnowledge FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File Toolbar: HKLM - DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll No File Toolbar: HKU\S-1-5-21-3442134853-2633566657-2367740593-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File OPR StartupUrls: "hxxp://www.surfvox.com/" S2 IHProtect Service; C:\Program Files (x86)\XTab\ProtectService.exe [X] S2 Update BringStar; "C:\Program Files (x86)\BringStar\updateBringStar.exe" [X] S2 Util BringStar; "C:\Program Files (x86)\BringStar\bin\utilBringStar.exe" [X] S2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe -service [X] C:\Users\Kaczor\AppData\Roaming\fpacked.exe C:\Program Files (x86)\XTab C:\Program Files (x86)\BringStar EmptyTemp: ***************** HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3C2E12AF-F44E-421F-8ED3-5B406F5C3779} => Key not found. C:\Windows\System32\Tasks\YourFile DownloaderUpdate not found. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\YourFile DownloaderUpdate => Key not found. "C:\ProgramData\nvxasync" => File/Directory not found. "C:\Users\Kaczor\AppData\Roaming\nvxasync" => File/Directory not found. ========= reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\nvxasync" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\TaskTray => value deleted successfully. HKU\S-1-5-21-3442134853-2633566657-2367740593-1000\Software\Microsoft\Windows\CurrentVersion\Run\\nvxasync => Value not found. HKU\S-1-5-21-3442134853-2633566657-2367740593-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value not found. "HKU\S-1-5-21-3442134853-2633566657-2367740593-1000\SOFTWARE\Policies\Google" => Key deleted successfully. HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions\\fftoolbar2014@etech.com => value deleted successfully. HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions\\faststartff@gmail.com => value deleted successfully. HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions\\{C7AE725D-FA5C-4027-BB4C-787EF9F8248A} => value deleted successfully. "C:\Program Files (x86)\RelevantKnowledge" => File/Directory not found. "HKLM\Software\Wow6432Node\MozillaPlugins\@pandonetworks.com/PandoWebPlugin" => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} => value deleted successfully. HKCR\CLSID\{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} => Key not found. HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{32099AAC-C132-4136-9E9A-4E364A424E17} => Value not found. HKCR\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17} => Key not found. HKU\S-1-5-21-3442134853-2633566657-2367740593-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => value deleted successfully. HKCR\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => Key not found. Opera StartupUrls deleted successfully. IHProtect Service => Service not found. Update BringStar => Service deleted successfully. Util BringStar => Service deleted successfully. WindowsMangerProtect => Service not found. C:\Users\Kaczor\AppData\Roaming\fpacked.exe => Moved successfully. "C:\Program Files (x86)\XTab" => File/Directory not found. "C:\Program Files (x86)\BringStar" => File/Directory not found. EmptyTemp: => Removed 150.3 MB temporary data. The system needed a reboot. ==== End of Fixlog 15:48:17 ====