Otwórz notatnik systemowy i wklej:
CloseProcesses:
Task: {23804861-3382-48AA-81F2-9072E4BBC64E} - System32\Tasks\{C1FDE651-D070-4508-8EAD-03ED4F70D9E9} => C:\Windows\system32\pcalua.exe -a C:\Users\Kowal\Desktop\AutoHotkey104805_Install.exe -d C:\Users\Kowal\Desktop
Task: {248C4AD8-119D-4C63-896B-B3C5C7E69A61} - System32\Tasks\{72039AFF-BDBB-45C5-B68F-DDD099A94CC2} => C:\Windows\system32\pcalua.exe -a C:\Users\Kowal\AppData\Local\PPTAssist\utility\uninst.exe
Task: {28AF6DF5-DB33-42FA-8045-B3FD94E84BBA} - System32\Tasks\{5EFB0E72-096A-4F09-A14E-6A18C9105242} => C:\Windows\system32\pcalua.exe -a "C:\Program Files (x86)\WinRAR\uninstall.exe" -d "C:\Program Files (x86)\WinRAR" -c /setup
Task: {35D585DA-D11C-4FA1-923F-073A8EF6E8F4} - System32\Tasks\{A0769AB0-5628-48D1-B216-15A641F6A0F7} => C:\Windows\system32\pcalua.exe -a "C:\Users\Kowal\AppData\Local\Kingsoft\WPS Office\9.1.0.5218\utility\uninst.exe"
Task: {49374E41-2279-4052-80F4-E8D8957C8BD1} - System32\Tasks\{627503EC-DE2C-49D2-8BCB-C337D48BCC57} => C:\Windows\system32\pcalua.exe -a C:\Users\Kowal\AppData\Local\PPTAssist\utility\uninst.exe
Task: {4E2C72EE-8BCC-4C69-8054-C5728F567137} - System32\Tasks\{ACCCA892-E30B-45D6-9D35-2A11722A7501} => C:\Windows\system32\pcalua.exe -a "C:\Program Files (x86)\YouTube Accelerator\YTAUninstall.exe"
Task: {56A3887B-6CC9-4161-B19A-7DEEEE5D1692} - System32\Tasks\{33FBDE44-486C-40A3-9865-41B7B9F86CE7} => C:\Windows\system32\pcalua.exe -a F:\INSTALL.EXE -d F:\
Task: {76060DCD-7EB2-4128-A482-FD151FB67C32} - \{EC46380C-9AE4-47BE-9AEC-D7C9D0CF3220} -> Brak pliku <==== UWAGA
Task: {89D2B942-69C6-45A9-8AE9-61F6149E1535} - System32\Tasks\{DF4658DE-0645-408D-AC0F-8B399D17DA61} => C:\Windows\system32\pcalua.exe -a C:\Users\Kowal\AppData\Roaming\uTorrent\uTorrent.exe -c /UNINSTALL
Task: {8A61CA02-39BE-46A2-A6B3-493E80DB3897} - System32\Tasks\{33EDAB3A-1CA7-4CB6-8ECC-CFB5DCDD8CD4} => C:\Windows\system32\pcalua.exe -a F:\OriginInstaller.exe -d F:\
Task: {C77D3C56-DD0E-4FD9-8E5E-E7A3117D63E9} - System32\Tasks\{24A3613E-435E-4BED-9B1B-AA6A40D0F1B0} => C:\Windows\system32\pcalua.exe -a "C:\Users\Kowal\AppData\Local\Kingsoft\WPS Office\9.1.0.5218\utility\uninst.exe"
Task: {E5647000-3748-47A8-8EB7-BB1C6D972D83} - System32\Tasks\{7F439D71-AA41-46D0-8F3D-A3E8A5D322AC} => C:\Windows\system32\pcalua.exe -a "C:\Program Files (x86)\a2zLyrics-16\Uninstall.exe" -c /fromcontrolpanel=1
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Ograniczenia <==== UWAGA
Hosts: 127.0.0.1 d3oxij66pru1i3.cloudfront.net
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
SearchScopes: HKLM -> DefaultScope {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL =
SearchScopes: HKLM-x32 -> DefaultScope {8C31F27B-BE8A-4e4b-A478-17760AF1F5D9} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSERBM&pc=MSERT1
SearchScopes: HKLM-x32 -> {8C31F27B-BE8A-4e4b-A478-17760AF1F5D9} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSERBM&pc=MSERT1
SearchScopes: HKU\S-1-5-21-102792617-3158731002-742234582-1000 -> DefaultScope {8C31F27B-BE8A-4e4b-A478-17760AF1F5D9} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSERBM&pc=MSERT1
SearchScopes: HKU\S-1-5-21-102792617-3158731002-742234582-1000 -> {8C31F27B-BE8A-4e4b-A478-17760AF1F5D9} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSERBM&pc=MSERT1
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617912&ResetID=131033004207924501&GUID=5F9FDABD-47C2-4B1C-994C-5AA46C503FA9
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617912&ResetID=131033004207934502&GUID=5F9FDABD-47C2-4B1C-994C-5AA46C503FA9
HKU\S-1-5-21-102792617-3158731002-742234582-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617912&ResetID=131555090674681988&GUID=5F9FDABD-47C2-4B1C-994C-5AA46C503FA9
FF Plugin HKU\S-1-5-21-102792617-3158731002-742234582-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [Brak pliku]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [X]
S3 ew_usbenumfilter; system32\DRIVERS\ew_usbenumfilter.sys [X]
S3 huawei_cdcacm; system32\DRIVERS\ew_jucdcacm.sys [X]
S3 huawei_cdcecm; system32\DRIVERS\ew_jucdcecm.sys [X]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
S3 huawei_ext_ctrl; system32\DRIVERS\ew_juextctrl.sys [X]
S3 hwusb_cdcacm; system32\DRIVERS\ew_cdcacm.sys [X]
S3 hwusb_wwanecm; system32\DRIVERS\ew_wwanecm.sys [X]
S3 NTIOLib_1_0_C; \??\D:\NTIOLib_X64.sys [X]
2018-09-10 02:56 - 2018-09-10 03:04 - 000000000 ____D C:\AdwCleaner
2009-07-14 03:14 - 2009-07-14 03:14 - 000186368 ____N (Microsoft Corporation) C:\Program Files (x86)\Common Files\hXZuYiuE.exe
2009-07-14 03:14 - 2009-07-14 03:14 - 000073216 ____N (Microsoft Corporation) C:\Users\Kowal\AppData\Roaming\iivvFelqdYiJA.exe
2013-10-21 01:37 - 2015-05-20 00:37 - 000000086 _____ () C:\Users\Kowal\AppData\Roaming\WB.CFG
2013-12-31 12:44 - 2014-01-01 03:17 - 000000005 _____ () C:\Users\Kowal\AppData\Roaming\WBPU-Q5-TTL.DAT
2013-10-21 01:37 - 2014-01-31 01:37 - 000000005 _____ () C:\Users\Kowal\AppData\Roaming\WBPU-TTL.DAT
2013-11-13 22:49 - 2013-11-13 22:49 - 000003584 _____ () C:\Users\Kowal\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2018-09-03 01:17 - 2018-09-03 01:17 - 000000002 _____ () C:\Users\Kowal\AppData\Local\imw.ini
2013-10-16 11:10 - 2018-08-06 16:35 - 000007620 _____ () C:\Users\Kowal\AppData\Local\resmon.resmoncfg
EmptyTemp:
Plik zapisz pod nazwą fixlist.txt i umieść w folderze, gdzie masz FRST.exe.
Uruchom FRST i kliknij w Fix/Napraw.
