Fix result of Farbar Recovery Scan Tool (x64) Version:16-08-2015 Ran by Ikar (2015-08-17 20:53:22) Run:1 Running from C:\Users\Ikar\Downloads Loaded Profiles: Ikar (Available Profiles: Ikar) Boot Mode: Normal ============================================== fixlist content: ***************** C:\WINDOWS\65F1CF6331E0450B96F34A88BE7361A6.TMP S3 vmci; \SystemRoot\System32\drivers\vmci.sys [X] S3 VMnetAdapter; \SystemRoot\system32\DRIVERS\vmnetadapter.sys [X] SearchScopes: HKU\S-1-5-21-3326815062-3995382162-3647125834-1002 -> {7EF9427A-40C8-4670-8F22-77B4A92B561F} URL = Startup: C:\Users\Ikar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.vbs [2015-08-16] () Startup: C:\Users\Ikar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe [2015-08-16] (Microsoft) C:\Users\Ikar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe C:\Users\Ikar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.vbs AppInit_DLLs-x32: C:\PROGRA~2\Amazon\AMAZON~1\AMAZON~3.DLL => "C:\PROGRA~2\Amazon\AMAZON~1\AMAZON~3.DLL" File not found AppInit_DLLs: C:\PROGRA~2\Amazon\AMAZON~1\AMAZON~2.DLL => C:\PROGRA~2\Amazon\AMAZON~1\AMAZON~2.DLL File not found HKU\S-1-5-21-3326815062-3995382162-3647125834-1002\...\Run: [csrss] => wscript.exe //B "C:\Users\Ikar\AppData\Local\Temp\csrss.vbs" <===== ATTENTION HKU\S-1-5-21-3326815062-3995382162-3647125834-1002\...\Run: [2d059fe3b8bce1556560e5f5ca3462c4] => C:\Users\Ikar\AppData\Local\Temp\svchost.exe [183808 2015-08-17] ({???????????????????) <===== ATTENTION HKLM-x32\...\Run: [2d059fe3b8bce1556560e5f5ca3462c4] => C:\Users\Ikar\AppData\Local\Temp\svchost.exe [183808 2015-08-17] ({???????????????????) <===== ATTENTION HKLM-x32\...\Run: [] => [X] EmptyTemp: ***************** C:\WINDOWS\65F1CF6331E0450B96F34A88BE7361A6.TMP => moved successfully. vmci => service removed successfully VMnetAdapter => service removed successfully "HKU\S-1-5-21-3326815062-3995382162-3647125834-1002\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{7EF9427A-40C8-4670-8F22-77B4A92B561F}" => key removed successfully HKCR\CLSID\{7EF9427A-40C8-4670-8F22-77B4A92B561F} => key not found. C:\Users\Ikar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.vbs => moved successfully. C:\Users\Ikar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe => moved successfully. "C:\Users\Ikar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe" => File/Folder not found. "C:\Users\Ikar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.vbs" => File/Folder not found. " C:\PROGRA~2\Amazon\AMAZON~1\AMAZON~3.DLL" => Value data removed successfully. " C:\PROGRA~2\Amazon\AMAZON~1\AMAZON~2.DLL" => Value data removed successfully. HKU\S-1-5-21-3326815062-3995382162-3647125834-1002\Software\Microsoft\Windows\CurrentVersion\Run\\csrss => value removed successfully HKU\S-1-5-21-3326815062-3995382162-3647125834-1002\Software\Microsoft\Windows\CurrentVersion\Run\\2d059fe3b8bce1556560e5f5ca3462c4 => value removed successfully HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\2d059fe3b8bce1556560e5f5ca3462c4 => value removed successfully HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value removed successfully EmptyTemp: => 1.9 GB temporary data Removed. The system needed a reboot.. ==== End of Fixlog 20:54:33 ====