Otwórz notatnik systemowy i wklej:
CloseProcesses:
RemoveProxy:
Task: {134023D1-C1EB-42D7-B16C-D0387D28067D} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION
Task: {58A70B28-D33E-42C1-8A2D-BBB9BE1E3F2D} - System32\Tasks\Opera scheduled Autoupdate 1510515996 => C:\Program Files\Opera\launcher.exe (Opera Software AS -> Opera Software)
Task: {F0D17968-901F-4070-9CA6-5A7EF024F8BF} - \Optimize Thumbnail Cache Files -> No File <==== ATTENTION
Hosts:
HKU\S-1-5-21-906645553-3319935851-3779379625-1001\...\MountPoints2: {103d6b00-5a2d-11e7-975b-80fa5b45245a} - "G:\setup.exe"
HKU\S-1-5-21-906645553-3319935851-3779379625-1001\...\MountPoints2: {6e5143ab-6548-11e7-975c-80fa5b45245a} - "J:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-906645553-3319935851-3779379625-1001\...\MountPoints2: {7d24cb73-c24c-11e8-97bb-0028f89bfdc4} - "J:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-906645553-3319935851-3779379625-1001\...\MountPoints2: {7d24cb8d-c24c-11e8-97bb-0028f89bfdc4} - "J:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-906645553-3319935851-3779379625-1001\...\MountPoints2: {8f8180e0-dc0d-11e8-97c1-0028f89bfdc4} - "F:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-906645553-3319935851-3779379625-1001\...\MountPoints2: {cb0b830a-9c03-11e7-9769-0028f89bfdc4} - "J:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-906645553-3319935851-3779379625-1001\...\Winlogon: [Shell] %comspec% <==== ATTENTION
HKU\S-1-5-21-906645553-3319935851-3779379625-1001\...\Command Processor: @mode 20,5 & tasklist /FI "IMAGENAME eq SoundMixer.exe" 2>NUL | find /I /N "SoundMixer.exe">NUL && exit & if exist "C:\Users\Baks\AppData\Roaming\Microsoft\SoundMixer\SoundMixer.exe" ( start /MIN "" "C:\Users\Baks\AppData\Roaming\Microsoft\SoundMixer\SoundMixer.exe" & tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) else ( tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) <==== ATTENTION
IFEO\OSppSvc.exe: [Debugger] KMS-R(_at_)1nHook.exe
IFEO\SppExtComObj.exe: [Debugger] C:\WINDOWS\SECOH-QAD.exe
GroupPolicy: Restriction ? <==== ATTENTION
GroupPolicy\User: Restriction ? <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings: [ProxySettingsPerUser] 0 <==== ATTENTION (Restriction - ProxySettings)
ProxyEnable: [HKLM] => Proxy is enabled.
ProxyEnable: [HKLM-x32] => Proxy is enabled.
ProxyServer: [HKLM] => http=127.0.0.1:8080;https=127.0.0.1:8080
ProxyServer: [HKLM-x32] => http=127.0.0.1:8080;https=127.0.0.1:8080
AutoConfigURL: [HKLM] => http=127.0.0.1:8080;https=127.0.0.1:8080
Tcpip\Parameters: [DhcpNameServer] 37.8.214.2 31.11.202.254
Tcpip\..\Interfaces\{192f0dd7-77e9-457f-b14c-45aa4cd97e58}: [DhcpNameServer] 37.8.214.2 31.11.202.254
Tcpip\..\Interfaces\{e2315ba6-a291-4255-a487-593224ee8a5f}: [DhcpNameServer] 37.8.214.2 31.11.202.254
Tcpip\..\Interfaces\{192f0dd7-77e9-457f-b14c-45aa4cd97e58}: [NameServer] 156.154.70.25,156.154.71.25
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
SearchScopes: HKLM -> DefaultScope value is missing
SearchScopes: HKU\S-1-5-21-906645553-3319935851-3779379625-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE04
SearchScopes: HKU\S-1-5-21-906645553-3319935851-3779379625-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE04
SearchScopes: HKU\S-1-5-21-906645553-3319935851-3779379625-1001 -> {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL =
CHR HKLM-x32\...\Chrome\Extension: [bhjhnafpiilpffhglajcaepjbnbjemci] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [hcadgijmedbfgciegjomfpjcdchlhnif] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lhemechcanjmilllmccjbjldonmnnjjj] - hxxps://clients2.google.com/service/update2/crx
EmptyTemp:
Plik zapisz pod nazwą fixlist.txt i umieść w folderze, gdzie masz FRST.exe.
Uruchom FRST i kliknij w Fix/Napraw.