avast - zagrożenie zablokowane - zarażenie URL:Mal

Witam,
Wyskakuje mi okienko avasta z napisem:
Zagrożenie zablokowane
Obiekt https : //org.publicvm.com/is-ready
Zarażenie URL:Mal
Proces C:\WINDOWS\system32\wscript.exe

Zrobiłam skanowanie Malwarebytes Anti-Malware, usunęłam 3 problemy.
Użyłam FRST
Logi w załącznikach

Bardzo proszę o pomoc

Odinstaluj:
GetPrivate
IncrementMonitor
PathInstance

Uruchom system w trybie awaryjnym i tam wykonaj Fixlist.

Obok frst.exe utworz plik Fixlist.txt z zawartoscia:
CloseProcesses:
CustomCLSID: HKU\S-1-5-21-802858288-1201305002-1991273458-1001_Classes\CLSID\{E68D0A55-3C40-4712-B90D-DCFA93FF2534}\InprocServer32 -> C:\Users\xxx\AppData\Roaming\GG\ggdrive\ggdrive-menu.dll => Brak pliku
Task: {4379A66D-9725-49B0-8295-C5C7375B6BAD} - System32\Tasks\{9BC346C4-E4C6-4AD4-BE28-34C38C334FE6} => pcalua.exe -a F:\autorun.exe -d F:\
HKLM\...\Run: [GetPrivate] => C:\Program Files\GetPrivate\GetPrivate.exe [481704 2013-08-15] ()
HKU\S-1-5-21-802858288-1201305002-1991273458-1001\...\Run: [home] => wscript.exe //B "C:\Users\xxx\AppData\Roaming\home.vbe"
HKU\S-1-5-21-802858288-1201305002-1991273458-1001\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x95000000
HKU\S-1-5-21-802858288-1201305002-1991273458-1001\...\MountPoints2: D - D:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-802858288-1201305002-1991273458-1001\...\MountPoints2: G - G:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-802858288-1201305002-1991273458-1001\...\MountPoints2: {0f192daa-6ed7-11e5-a1e1-18a90596b9ec} - H:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-802858288-1201305002-1991273458-1001\...\MountPoints2: {91bb3ebd-9d06-11e5-9ffa-18a90596b9ec} - D:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-802858288-1201305002-1991273458-1001\...\MountPoints2: {f1d76383-a34a-11e5-a5ae-18a90596b9ec} - G:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-802858288-1201305002-1991273458-1001\...\MountPoints2: {fd178a4a-a28b-11e5-9cbe-18a90596b9ec} - D:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\windows\System32\SPReview\SPReview.exe [280576 2014-03-08] (Microsoft Corporation)
Startup: C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\home.vbe [2015-09-08] ()
C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\home.vbe
C:\Users\xxx\AppData\Roaming\home.vbe
HKU\S-1-5-21-802858288-1201305002-1991273458-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.interia.pl/#utm_source=instalki1&utm_medium=installer&utm_campaign=instalki1&iwa_source=installer_instalki
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.sweet-page.com/?type=sc&ts=1413984886&from=cor&uid=HitachiXHTS723232L9A360_091019FCC400NEHJMG1GX
FF user.js: detected! => C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\7u5pd1gd.default\user.js [2016-06-21]
FF HKLM\...\Firefox\Extensions: [defsearchp@gmail.com] - C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\7u5pd1gd.default\extensions\defsearchp@gmail.com => nie znaleziono
FF HKLM\...\Firefox\Extensions: [deskCutv2@gmail.com] - C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\7u5pd1gd.default\extensions\deskCutv2@gmail.com => nie znaleziono
FF HKLM\...\Firefox\Extensions: [sidebarff@gmail.com] - C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\7u5pd1gd.default\extensions\sidebarff@gmail.com => nie znaleziono
FF HKLM\...\Firefox\Extensions: [default_newtabff@gmail.com] - C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\7u5pd1gd.default\extensions\default_newtabff@gmail.com => nie znaleziono
FF HKLM\...\Firefox\Extensions: [yahooprotected@gmail.com] - C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\7u5pd1gd.default\extensions\yahooprotected@gmail.com => nie znaleziono
FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\itms.js [2016-04-27]
CHR Extension: (YouTube) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-02-05] [UpdateUrl: hxxp://mynamedomain.koko/00] <==== UWAGA
CHR Extension: (Google Search) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-03-29] [UpdateUrl: hxxp://mynamedomain.koko/00] <==== UWAGA
CHR Extension: (Google Wallet) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-06-23] [UpdateUrl: hxxps://epicunitscan.info/00service/update2/crx] <==== UWAGA
CHR Extension: (Gmail) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-29] [UpdateUrl: hxxp://mynamedomain.koko/00] <==== UWAGA
S2 IhPul; C:\Users\xxx\AppData\Roaming\TSv\TSvr.exe [X]
S2 SSFK; C:\Program Files\SFK\SSFK.exe -s [X]
U3 ar3gpir1; C:\windows\system32\Drivers\ar3gpir1.sys [0 ] (LSI Corporation) <==== UWAGA (zerobajtowy plik/folder)
2016-07-03 21:41 - 2015-09-08 21:04 - 00092629 ____N C:\Users\xxx\AppData\Roaming\home.vbe
2016-07-03 19:17 - 2016-07-03 19:17 - 00749592 _____ C:\Users\xxx\Desktop\GetPrivateSetup.exe
2016-07-03 19:17 - 2016-07-03 19:17 - 00000000 ____D C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GetPrivate
2016-07-03 19:17 - 2016-07-03 19:17 - 00000000 ____D C:\Program Files\GetPrivate
2016-07-03 19:08 - 2016-07-03 19:08 - 00000000 ____D C:\Users\xxx\AppData\Local\CEF
2016-07-03 21:41 - 2015-09-08 21:04 - 0092629 ____N () C:\Users\xxx\AppData\Roaming\home.vbe
2015-06-29 00:40 - 2015-06-29 00:40 - 0000000 _____ () C:\Users\xxx\AppData\Local\Temp.dat
EmptyTemp:

W FRST wybierz Napraw.

Po wykonaniu zamiesc nowe logi z FRST, ze skanowania.

Nie mogę odinstalować IncrementMonitor i PathInstance. Komunikat "Nie można odnaleźć określonego modułu"

Pomin, uzyj AdwCleaner, opcja Scan i Clean/Szukaj i Usun: http://www.bleepingcomputer.com/download/adwcleaner/

Wrzucam nowe logi

Otwórz notatnik i wklej:
FF Homepage: about:home
CHR dev: Chrome dev build wykryto! <======= UWAGA
CHR Extension: (YouTube) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-02-05] [UpdateUrl: hxxp://mynamedomain.koko/00] <==== UWAGA
CHR Extension: (Google Search) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-03-29] [UpdateUrl: hxxp://mynamedomain.koko/00] <==== UWAGA
CHR Extension: (Google Wallet) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-06-23] [UpdateUrl: hxxps://epicunitscan.info/00service/update2/crx] <==== UWAGA
CHR Extension: (Gmail) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-29] [UpdateUrl: hxxp://mynamedomain.koko/00] <==== UWAGA
U3 a73mzld2; C:\windows\system32\Drivers\a73mzld2.sys [0 ] (QLogic Corporation) <==== UWAGA (zerobajtowy plik/folder)
2016-07-06 23:11 - 2016-07-06 23:17 - 00000000 ____D C:\AdwCleaner

EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść w folderze gdzie znajduje się FRST.exe
Uruchom FRST i kliknij w Fix/Napraw.

Zresetuj Chrome: https://support.google.com/chrome/answer/3296214?hl=pl lub calkiem odinstaluj.

Lepiej żeby odinstalował tym bardziej, że posiada wersję developerską i zainstalował wersję stabilną.

Tylko, że nie używam Chrome a Firefoxa