Odinstaluj:
Amazon Assistant
Browser-Security
Intel Security True Key
System Table
Uzyj AdwCleaner, opcja Scan/Szukaj i Clean/Usun:
http://www.bleepingcomputer.com/download/adwcleaner/ Wykonaj Fixlist.txt dla FRST:
Task: {0292CD24-48EC-4815-A685-D4921D10BCB1} - \Microsoft\Windows\UNP\RunCampaignManager -> Brak pliku <==== UWAGA
Task: {2375429E-EE08-4AFF-98F7-1D0FFF4DB512} - System32\Tasks\DistromaticUpdater-periodic => C:\Program Files (x86)\Amazon Browser Settings\updater.exe <==== UWAGA
Task: {3A20CBB8-D23D-4BE8-ABA4-6ACE996BF5F8} - System32\Tasks\DistromaticSearchProtect-logon => C:\Program Files (x86)\Amazon Browser Settings\AmznSearchProtect.exe <==== UWAGA
Task: {3C50F4B0-3F46-4539-B301-1246EF0BA129} - System32\Tasks\DistromaticSearchProtect-hourly => C:\Program Files (x86)\Amazon Browser Settings\AmznSearchProtect.exe <==== UWAGA
Task: {53F56D20-D2C7-4864-9CFF-C01C42FAE39F} - System32\Tasks\Praosh Nodifier => C:\Program Files (x86)\Praosh\PraoshnodifierTask.exe <==== UWAGA
Task: {56F05FE9-5273-451D-AFB0-D709C081C74E} - System32\Tasks\{ABA7CAB9-A1AB-4BE9-9B9A-3E22403E5D05} => "c:\program files (x86)\mozilla firefox\firefox.exe" hxxp://ui.skype.com/ui/0/7.18.0.112/pl/go/help.faq.installer?source=lightinstaller&LastError=1618
Task: {8752F830-E487-41CA-9521-0221CA526FFC} - System32\Tasks\{89C6DD28-1B6A-4013-9D63-1790929F1797} => C:\WINDOWS\system32\pcalua.exe -a D:\steam\Drivers\UpdaterBootstrapper.exe -c 0 -uninstall "D:\steam\UninstallerScript.xml"
Task: {94D28369-B17B-490A-8454-F31BFD3CB24D} - System32\Tasks\Opera scheduled Autoupdate 1490893783 => C:\Users\Adam\AppData\Local\Programs\Opera\launcher.exe
Task: {DA7F8099-9838-4789-A7A6-19CBDE602BDA} - System32\Tasks\DistromaticUpdater-logon => C:\Program Files (x86)\Amazon Browser Settings\updater.exe <==== UWAGA
Task: {E7926287-0280-40B4-86E1-A5B5DE1E1951} - System32\Tasks\Opera scheduled suite Autoupdate 1490893786 => C:\Users\Adam\AppData\Local\Programs\Opera\launcher.exe
Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe
ShortcutWithArgument: C:\Users\Adam\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> %SNF%
2016-06-19 13:24 - 2016-05-15 18:04 - 002089472 _____ () C:\ProgramData\Logic Handler\set.exe
() C:\ProgramData\Logic Handler\set.exe
(McAfee, Inc.) C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe
(McAfee, Inc.) C:\Program Files\TrueKey\McTkSchedulerService.exe
AppInit_DLLs: C:\ProgramData\Ronzap\Holdcom.dll => Brak pliku
Lsa: [Notification Packages] scecli C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter
HKU\S-1-5-21-1394522281-2860274102-1845149695-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGIjVkxlyIP4NYe17aVLWuxkYK9BNIFBtjCIijF8CAZ7ZR35wc6PiejbZEoxqM9SROsrl0fKbxfjOK0gvSR40VHY8USeM41tfu3a1PMiR2tayTe5OVtdYzWxYBW11Y1TeLvq1QduPWagUOVwNevisy0X5wyPdDSfxwXLBsem28jp6u6Vj6PeZMniVCcvi&q={searchTerms}
HKU\S-1-5-21-1394522281-2860274102-1845149695-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://mail.ru/cnt/10445?gp=811600
SearchScopes: HKLM-x32 -> DefaultScope {ielnksrch} URL =
SearchScopes: HKLM-x32 -> ielnksrch URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGIjVkxlyIP4NYe17aVLWuxkYK9BNIFBtjCIijF8CAZ7ZR35wc6PiejbZEoxqM9SROsrl0fKbxfjOK0gvSR40VHY8USeM41tfu3a1PMiR2tayTe5OVtdYzWxYBW11Y1TeLvq1QduPWagUOVwNevisy0X5wyPdDSfxwXLBsem28jp6u6Vj6PeZMniVCcvi&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1394522281-2860274102-1845149695-1001 -> DefaultScope {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/distib/ep/?q={searchTerms}&fr=ntg&product_id=%7BC0E08559-C40F-487B-9666-38023C2F803C%7D&gp=811610
SearchScopes: HKU\S-1-5-21-1394522281-2860274102-1845149695-1001 -> {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/distib/ep/?q={searchTerms}&fr=ntg&product_id=%7BC0E08559-C40F-487B-9666-38023C2F803C%7D&gp=811610
SearchScopes: HKU\S-1-5-21-1394522281-2860274102-1845149695-1001 -> {ielnksrch} URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGIjVkxlyIP4NYe17aVLWuxkYK9BNIFBtjCIijF8CAZ7ZR35wc6PiejbZEoxqM9SROsrl0fKbxfjOK0gvSR40VHY8USeM41tfu3a1PMiR2tayTe5OVtdYzWxYBW11Y1TeLvq1QduPWagUOVwNevisy0X5wyPdDSfxwXLBsem28jp6u6Vj6PeZMniVCcvi&q={searchTerms}
BHO-x32: True Key Helper -> {0F4B8786-5502-4803-8EBC-F652A1153BB6} -> C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll [2016-07-15] (Intel Security)
BHO-x32: Search(_at_)Mail.Ru -> {8E8F97CD-60B5-456F-A201-73065652D099} -> C:\Users\Adam\AppData\Local\Mail.Ru\Sputnik\ie_addon_dll.dll [2018-04-06] (Mail.Ru)
Toolbar: HKLM-x32 - True Key - {4BAAC1B8-0800-42C9-8FA6-08B211F356B8} - C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll [2016-07-15] (Intel Security)
FF user.js: detected! => C:\Users\Adam\AppData\Roaming\Mozilla\Firefox\Profiles\qm4vkzv5.default-1513718035189\user.js [2017-06-30]
CHR HKU\S-1-5-21-1394522281-2860274102-1845149695-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [fcfenmboojpjinhpgggodefccipikbpd] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx
R2 backlh; C:\ProgramData\Logic Handler\set.exe [2089472 2016-05-15] () [Brak podpisu cyfrowego] <==== UWAGA
C:\ProgramData\Logic Handler\
R2 TrueKey; C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe [908256 2016-07-22] (McAfee, Inc.)
R2 TrueKeyScheduler; C:\Program Files\TrueKey\McTkSchedulerService.exe [15736 2016-07-22] (McAfee, Inc.)
S3 TrueKeyServiceHelper; C:\Program Files\TrueKey\McAfee.TrueKey.ServiceHelper.exe [86864 2016-07-22] (McAfee, Inc.)
2018-04-06 18:30 - 2018-04-06 18:30 - 000000000 ____D C:\Users\Adam\EasternGraphics
2018-04-06 18:30 - 2018-04-06 18:30 - 000000000 ____D C:\Users\Adam\AppData\Local\III
2018-04-06 18:29 - 2018-04-06 18:29 - 000000000 ____D C:\Users\Adam\AppData\Roaming\OneSystemCare
2018-04-06 18:29 - 2018-04-06 18:29 - 000000000 ____D C:\Program Files (x86)\Mail.Ru
2018-04-06 18:28 - 2018-04-06 18:31 - 000000000 ____D C:\Users\Adam\Downloads\crack-assassins-creed-origins
2018-04-06 18:28 - 2018-04-06 18:29 - 000000000 ____D C:\Users\Adam\AppData\Local\Mail.Ru
2018-04-06 18:28 - 2018-04-06 18:29 - 000000000 ____D C:\ProgramData\Mail.Ru
2017-12-03 14:04 - 2017-12-03 14:04 - 000086016 _____ (PRO GAME) C:\Program Files (x86)\Common Files\atiecls.dll
2017-12-03 14:17 - 2017-12-03 14:17 - 000036864 ___SH (Microsoft® DEVELOPER) C:\Program Files (x86)\Common Files\cnex-demo.exe
2017-12-03 14:14 - 2017-12-03 14:14 - 000155648 ___SH (PRO_GAME) C:\Program Files (x86)\Common Files\cnex.exe
2018-04-06 18:20 - 2018-04-06 18:21 - 000001716 _____ () C:\Program Files (x86)\Common Files\hopatemp.ini
2017-12-03 15:35 - 2018-04-06 18:21 - 000057394 _____ () C:\Program Files (x86)\Common Files\unitemp.exe
2016-06-19 13:24 - 2016-06-19 13:24 - 006867968 _____ () C:\Users\Adam\AppData\Roaming\agent.dat
2016-06-19 13:24 - 2016-06-19 13:24 - 000054272 _____ () C:\Users\Adam\AppData\Roaming\ApplicationHosting.dat
2016-06-19 13:24 - 2016-06-19 13:24 - 000069072 _____ () C:\Users\Adam\AppData\Roaming\Config.xml
2016-06-19 13:23 - 2016-06-19 13:24 - 000019584 _____ () C:\Users\Adam\AppData\Roaming\InstallationConfiguration.xml
2016-06-19 13:23 - 2016-06-19 13:23 - 000128512 _____ () C:\Users\Adam\AppData\Roaming\Installer.dat
2016-06-19 13:24 - 2016-06-19 13:24 - 000072704 _____ () C:\Users\Adam\AppData\Roaming\Iszundex.tst
2016-06-19 13:24 - 2016-06-19 13:24 - 000126464 _____ () C:\Users\Adam\AppData\Roaming\lobby.dat
2016-06-19 13:24 - 2016-06-19 13:24 - 000018432 _____ () C:\Users\Adam\AppData\Roaming\Main.dat
2016-06-19 13:24 - 2016-06-19 13:24 - 000005568 _____ () C:\Users\Adam\AppData\Roaming\md.xml
2016-06-19 13:24 - 2016-06-19 13:24 - 000126464 _____ () C:\Users\Adam\AppData\Roaming\noah.dat
2016-06-19 13:24 - 2016-06-19 13:24 - 002279413 _____ () C:\Users\Adam\AppData\Roaming\Quodax.bin
2016-06-19 13:24 - 2016-06-19 13:24 - 001760384 _____ () C:\Users\Adam\AppData\Roaming\SaoFinfresh.tst
2016-06-19 13:24 - 2016-06-19 13:24 - 000189618 _____ () C:\Users\Adam\AppData\Roaming\Trishold.bin
2016-06-19 13:24 - 2016-06-19 13:24 - 000848437 _____ () C:\Users\Adam\AppData\Roaming\Zum-Tech.bin
2017-08-23 17:06 - 2017-08-23 17:06 - 000174080 _____ (Igor Pavlov) C:\Users\Adam\AppData\Local\7zxa.dll~
2017-08-23 17:06 - 2017-08-23 17:06 - 002495696 _____ () C:\Users\Adam\AppData\Local\bigup2.dll~
2017-08-23 17:06 - 2017-08-23 17:06 - 000608768 _____ (Abysmal Software) C:\Users\Adam\AppData\Local\DevIL.dll~
2017-08-23 17:06 - 2017-08-23 17:06 - 000453120 _____ (The curl library,
https://curl.haxx.se/) C:\Users\Adam\AppData\Local\libcurl.dll~
2017-08-23 17:06 - 2017-08-23 17:06 - 000249744 _____ () C:\Users\Adam\AppData\Local\lightupdate.dll~
2017-08-23 17:06 - 2017-08-23 17:06 - 005572304 _____ (MY.COM B.V.) C:\Users\Adam\AppData\Local\MyComGames.exe~
2017-08-23 17:06 - 2017-08-23 17:06 - 000076176 _____ () C:\Users\Adam\AppData\Local\pxd.dll~
2017-08-23 17:06 - 2017-08-23 17:06 - 000144896 _____ () C:\Users\Adam\AppData\Local\zlib1.dll~
2018-04-06 18:29 - 2018-03-02 14:59 - 001314008 _____ (Mail.Ru) C:\Users\Adam\AppData\Local\Temp\57bf-0b6d-30ed-cddb.exe
2018-04-06 18:29 - 2018-03-02 14:59 - 001314008 _____ (Mail.Ru) C:\Users\Adam\AppData\Local\Temp\b185-41c9-58ce-a7bd.exe
Zrob pelny skan przy pomocy Mbam i usun to co wykryje:
http://www.bleepingcomputer.com/download/malwarebytes-anti-malware/ 
