@Piter3040 po co piszesz w tym dziale skoro nie wiesz o co chodzi i nie potrafisz pomoc? To juz nie pierwszy Twoj post w dzialach komputerowych, ktory tylko zasmieca watek.
@r3v0lut1on wykonaj Fixlist.txt dla FRST:
HKU\S-1-5-21-4061270252-3579649601-3246211094-1001\...\Run: [GalaxyClient] => [X]
HKU\S-1-5-21-4061270252-3579649601-3246211094-1001\...\MountPoints2: {1223402c-10fd-11ea-9a40-6245b4fe14d1} - "M:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-4061270252-3579649601-3246211094-1001\...\MountPoints2: {25d074c8-7c89-11ea-9b3c-04d4c457ac31} - "L:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-4061270252-3579649601-3246211094-1001\...\MountPoints2: {9e7feca9-27b4-11ea-9a6e-04d4c457ac31} - "L:\setup_normality_1.0_(german)_(28044).exe"
HKU\S-1-5-21-4061270252-3579649601-3246211094-1001\...\Winlogon: [Shell] %comspec% <==== UWAGA
HKU\S-1-5-21-4061270252-3579649601-3246211094-1001\...\Command Processor: @mode 20,5 & tasklist /FI "IMAGENAME eq FirewallModule.exe" 2>NUL | find /I /N "FirewallModule.exe">NUL && exit & if exist "C:\Users\r3v0lut1on\AppData\Roaming\Microsoft\FirewallModule\FirewallModule.exe" ( start /MIN "" "C:\Users\r3v0lut1on\AppData\Roaming\Microsoft\FirewallModule\FirewallModule.exe" & tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) else ( tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) <==== UWAGA
Task: {0BC9AEB0-9E46-4C47-8599-E4F7CE923E31} - System32\Tasks\Nero\Nero Info => C:\Program Files (x86)\Common Files\Nero\Nero Info\NeroInfo.exe [7018264 2018-07-19] (Nero AG -> Nero AG)
FF user.js: detected! => C:\Users\r3v0lut1on\AppData\Roaming\Mozilla\Firefox\Profiles\2t3pma6j.default-1507058915523\user.js [2019-10-11]
2019-12-23 12:34 - 2020-02-15 22:43 - 000000016 _____ () C:\Users\r3v0lut1on\AppData\Roaming\msregsvv.dll
2019-11-16 21:10 - 2019-11-16 21:10 - 000000788 _____ () C:\Users\r3v0lut1on\AppData\Roaming\qnapi.ini
Po wykonaniu usun katalog C:\FRST i to wszystko.
