Obok frst.exe utworz plik Fixlist.txt z zawartoscia:
HKLM-x32\...\RunOnce: ["C:\WINDOWS\system32\cmd.exe"] => "C:\WINDOWS\system32\cmd.exe" /c "rmdir /s /q "C:\Program Files (x86)\Decrap my Computer""
HKU\S-1-5-21-2899343238-3569729800-2069508636-1000\...\Run: [Gaijin.Net Agent] => C:\Users\Rafał\AppData\Local\Gaijin\Program Files (x86)\NetAgent\gjagent.exe [1798664 2016-12-29] ()
GroupPolicy: Ograniczenia - Chrome <======= UWAGA
CHR DefaultSearchURL: Default ->
hxxp://www.trotux.com/search/?q={searchTerms}&z=a807a1156c7d3fb32ebcb82gdz5b3z3b2e6tam8q5m&from=icb&uid=ST2000DM001-1CH164_Z1E6DRF2XXXXZ1E6DRF2&type=sp
CHR DefaultSearchKeyword: Default -> trotux
2017-01-19 08:49 - 2017-01-19 08:49 - 05663088 _____ C:\Users\Rafał\Downloads\Decrap_Setup.exe
2017-01-19 08:10 - 2017-01-19 08:10 - 00000000 ____D C:\Program Files (x86)\IObit
2017-01-19 08:09 - 2017-01-19 08:35 - 00000000 ____D C:\ProgramData\AVAST Software
2017-01-19 08:09 - 2017-01-19 08:16 - 00000000 ____D C:\Users\Rafał\AppData\Roaming\Druwing
2017-01-19 08:09 - 2017-01-19 08:16 - 00000000 ____D C:\Program Files (x86)\Dcultperpty
2017-01-19 08:09 - 2017-01-19 08:09 - 00140288 _____ C:\Users\Rafał\AppData\Roaming\Installer.dat
2017-01-19 08:09 - 2017-01-19 08:09 - 00006158 _____ C:\WINDOWS\System32\Tasks\Faboentatomuy Schedule
2017-01-19 08:09 - 2017-01-19 08:09 - 00000000 ____D C:\Users\Rafał\AppData\Roaming\win-svc
2017-01-19 08:09 - 2017-01-19 08:09 - 00000000 ____D C:\Users\Rafał\AppData\Roaming\IObit
2017-01-19 08:09 - 2017-01-19 08:09 - 00000000 ____D C:\Users\Rafał\AppData\Local\Aroperck
2017-01-19 08:09 - 2017-01-19 08:09 - 00000000 ____D C:\Users\Public\Thunder Network
2017-01-19 08:09 - 2017-01-19 08:09 - 00000000 ____D C:\ProgramData\Avira
2017-01-19 08:09 - 2017-01-19 08:09 - 00000000 ____D C:\Program Files\Q10DDQSLIS
2017-01-19 08:09 - 2017-01-19 08:09 - 00000000 ____D C:\Program Files\GCS9165MEQ
2017-01-19 08:09 - 2017-01-19 08:09 - 00000000 ____D C:\Program Files (x86)\Faboentatomuy Schedule
2017-01-19 08:27 - 2016-11-06 19:14 - 00000000 ____D C:\AdwCleaner
2017-01-19 08:09 - 2017-01-19 08:09 - 0140288 _____ () C:\Users\Rafał\AppData\Roaming\Installer.dat
EmptyTemp:
W FRST wybierz Napraw.