Mam nadzieje, ze to kopia explorer: Startup: C:\Users\Kasia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.exe [2018-07-06] (Microsoft Corporation) <==== UWAGA, a nie przeniesiony plik, jezeli przeniesiony to przegraj go na swoje miejsce zanim wykonasz Fixlist.
Wykonaj Fixlist.txt dla FRST:
HKU\S-1-5-21-177355069-3825575356-1080428564-1001\...\Winlogon: [Shell] C:\Windows\System32\cmd.exe [273920 2018-04-12] (Microsoft Corporation) <==== UWAGA
HKU\S-1-5-21-177355069-3825575356-1080428564-1001\...\Command Processor: @mode 20,5 & tasklist /FI "IMAGENAME eq SoundMixer.exe" 2>NUL | find /I /N "SoundMixer.exe">NUL && exit & if exist ( start /MIN "" & tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) else ( tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) <==== UWAGA
Startup: C:\Users\Kasia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.exe [2018-07-06] (Microsoft Corporation) <==== UWAGA
GroupPolicy: Ograniczenia ? <==== UWAGA
GroupPolicy\User: Ograniczenia ? <==== UWAGA
HKU\S-1-5-21-177355069-3825575356-1080428564-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://mail.ru/cnt/10445?gp=855400
SearchScopes: HKU\S-1-5-21-177355069-3825575356-1080428564-1001 -> DefaultScope {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/distib/ep/?q={searchTerms}&fr=ntg&product_id=%7BAA00BBA5-2969-45AE-8E44-6B7DBE76B349%7D&gp=855500
SearchScopes: HKU\S-1-5-21-177355069-3825575356-1080428564-1001 -> {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/distib/ep/?q={searchTerms}&fr=ntg&product_id=%7BAA00BBA5-2969-45AE-8E44-6B7DBE76B349%7D&gp=855500
BHO: Brak nazwy -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> Brak pliku
BHO-x32: Search(_at_)Mail.Ru -> {8E8F97CD-60B5-456F-A201-73065652D099} -> C:\Users\Kasia\AppData\Local\Mail.Ru\Sputnik\ie_addon_dll.dll [2018-05-05] (Mail.Ru)
CHR HomePage: Default -> inline.go.mail.ru
CHR HKLM-x32\...\Chrome\Extension: [bhjhnafpiilpffhglajcaepjbnbjemci] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [hcadgijmedbfgciegjomfpjcdchlhnif] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lhemechcanjmilllmccjbjldonmnnjjj] - hxxps://clients2.google.com/service/update2/crx
Po wykonaniu usun katalog C:\FRST i to wszystko.
