[Rozwiązano] CMD pojawia się na sekundę i minimalizuje gry – Windows 11, logi FRST do analizy

Od pewnego czasu mam problem z wyskakującym okienkiem CMD na ułamek sekundy, które znika, a które dostaje priorytet i np. podczas gry minimalizuje mi ją. Co może być powodem, bo przeglądnąłem masę forów i nic nie pomaga. Czytałem, że dobrze zrobić skanowanie FRST, więc tutaj wyniki skanowania. System Windows 11, 64 bity.

Nie sciagaj zainfekowanych plikow to nie bedziesz mial problemu.

Odinstaluj: WebAdvisor firmy McAfee

Zrob skan przy pomocy mbam oraz adwcleaner i usun to co wykryja.

Wykonaj Fixlist.txt dla FRST:
CloseProcesses:
AV: McAfee (Disabled - Up to date) {0BE13B34-492A-21C0-AE43-C1742279CCB6}
FW: McAfee (Enabled) {33DABA11-0345-2098-851C-6841DCAA8BCD}
(C:\Program Files\McAfee\WebAdvisor\servicehost.exe ->) (McAfee, LLC -> McAfee, LLC) C:\Program Files\McAfee\WebAdvisor\uihost.exe
(services.exe ->) (McAfee, LLC -> McAfee, LLC) C:\Program Files\McAfee\WebAdvisor\servicehost.exe
HKLM\...\RunOnce: [Delete Cached Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Program Files\Microsoft OneDrive\Update\OneDriveSetup.exe" [90808104 2025-06-26] (Microsoft Corporation -> Microsoft Corporation)
HKLM\...\RunOnce: [Delete Cached Standalone Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Program Files\Microsoft OneDrive\StandaloneUpdater\OneDriveSetup.exe" (Brak pliku)
HKU\S-1-5-21-2866688635-1610370102-3854180215-1001\...\MountPoints2: H - "H:\setup.exe"
HKU\S-1-5-21-2866688635-1610370102-3854180215-1001\...\MountPoints2: {5dfb9f57-29f7-11f0-8e89-5076af07d955} - "J:\setup.exe"
HKU\S-1-5-21-2866688635-1610370102-3854180215-1001\...\MountPoints2: {5dfba2db-29f7-11f0-8e89-5076af07d955} - "H:\setup.exe"
HKU\S-1-5-21-2866688635-1610370102-3854180215-1001\...\MountPoints2: {5dfba2f0-29f7-11f0-8e89-5076af07d955} - "I:\setup.exe"
HKU\S-1-5-21-2866688635-1610370102-3854180215-1001\...\MountPoints2: {924119bf-5031-11f0-8e92-5076af07d955} - "K:\setup.exe"
Task: {18F3552A-3A48-456F-AB7E-64BEA2BCEB20} - System32\Tasks\Firefox Default Browser Agent D6D767D9F34A0B5C => C:\Users\ariel\AppData\Roaming\ugwvsau [58856 2024-03-13] (Microsoft Corporation -> Microsoft Corporation) <==== UWAGA
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Ograniczenia <==== UWAGA
CHR HomePage: Default -> hxxp://search.yac.mx/?utm_source=b&utm_medium=iSafe&from=iSafe&uid=hitachixhts547575a9e384_j2140059e5txvae5txvax
CHR StartupUrls: Default -> "hxxps://www.google.pl/","hxxp://www.youndoo.com/?z=9e6f0ae98c006d59d567392g0z3mfg4w4q3e4tazce&from=wak&uid=HitachiXHTS547575A9E384_J2140059E5TXVAE5TXVAX&type=hp","hxxp://www.trotux.com/?z=ecd5f85d625bdaded79f7acg7z9b0c3cbtdg1e3ofe&from=isr&uid=HitachiXHTS547575A9E384_J2140059E5TXVAE5TXVAX&type=hp"
CHR Extension: (McAfee® WebAdvisor) - C:\Users\ariel\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho [2025-06-26]
CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho]
CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho]
2025-06-25 20:45 - 2025-06-25 20:45 - 004385888 _____ () C:\Users\ariel\Downloads\OperaGXSetup(6).exe
2025-06-22 00:59 - 2025-06-22 00:59 - 004385888 _____ () C:\Users\ariel\Downloads\OperaGXSetup(5).exe
2025-06-14 09:48 - 2025-06-14 09:48 - 004385248 _____ () C:\Users\ariel\Downloads\OperaGXSetup(4).exe
2025-06-14 09:35 - 2025-06-14 09:36 - 004385256 _____ () C:\Users\ariel\Downloads\OperaGXSetup(3).exe
2025-06-14 01:04 - 2025-06-14 01:04 - 004385192 _____ () C:\Users\ariel\Downloads\OperaGXSetup(2).exe
2025-06-12 21:00 - 2025-06-12 21:00 - 002611288 _____ () C:\Users\ariel\Downloads\OperaSetup(11).exe
2024-08-31 17:29 - 2024-08-31 17:29 - 000000335 _____ () C:\ProgramData\temp_Delete.bat
2024-08-31 17:29 - 2024-08-31 17:29 - 000000096 _____ () C:\ProgramData\temp_runbat.vbs
2024-03-13 07:02 - 2024-03-13 07:02 - 000058856 ___SH (Microsoft Corporation) C:\Users\ariel\AppData\Roaming\ugwvsau

>>21592022 Wygląda na to, że zadziałało. Dzięki za pomoc.

Odinstalowałem WebAdvisor firmy McAfee

Zrobiłem skan przy pomocy mbam oraz adwcleaner i usunąłem to co wykryja.

Wykonałem Fixlist.txt dla FRST:
CloseProcesses:
AV: McAfee (Disabled - Up to date) {0BE13B34-492A-21C0-AE43-C1742279CCB6}
FW: McAfee (Enabled) {33DABA11-0345-2098-851C-6841DCAA8BCD}
(C:\Program Files\McAfee\WebAdvisor\servicehost.exe ->) (McAfee, LLC -> McAfee, LLC) C:\Program Files\McAfee\WebAdvisor\uihost.exe
(services.exe ->) (McAfee, LLC -> McAfee, LLC) C:\Program Files\McAfee\WebAdvisor\servicehost.exe
HKLM\...\RunOnce: [Delete Cached Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Program Files\Microsoft OneDrive\Update\OneDriveSetup.exe" [90808104 2025-06-26] (Microsoft Corporation -> Microsoft Corporation)
HKLM\...\RunOnce: [Delete Cached Standalone Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Program Files\Microsoft OneDrive\StandaloneUpdater\OneDriveSetup.exe" (Brak pliku)
HKU\S-1-5-21-2866688635-1610370102-3854180215-1001\...\MountPoints2: H - "H:\setup.exe"
HKU\S-1-5-21-2866688635-1610370102-3854180215-1001\...\MountPoints2: {5dfb9f57-29f7-11f0-8e89-5076af07d955} - "J:\setup.exe"
HKU\S-1-5-21-2866688635-1610370102-3854180215-1001\...\MountPoints2: {5dfba2db-29f7-11f0-8e89-5076af07d955} - "H:\setup.exe"
HKU\S-1-5-21-2866688635-1610370102-3854180215-1001\...\MountPoints2: {5dfba2f0-29f7-11f0-8e89-5076af07d955} - "I:\setup.exe"
HKU\S-1-5-21-2866688635-1610370102-3854180215-1001\...\MountPoints2: {924119bf-5031-11f0-8e92-5076af07d955} - "K:\setup.exe"
Task: {18F3552A-3A48-456F-AB7E-64BEA2BCEB20} - System32\Tasks\Firefox Default Browser Agent D6D767D9F34A0B5C => C:\Users\ariel\AppData\Roaming\ugwvsau [58856 2024-03-13] (Microsoft Corporation -> Microsoft Corporation) <==== UWAGA
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Ograniczenia <==== UWAGA
CHR HomePage: Default -> hxxp://search.yac.mx/?utm_source=b&utm_medium=iSafe&from=iSafe&uid=hitachixhts547575a9e384_j2140059e5txvae5txvax
CHR StartupUrls: Default -> "hxxps://www.google.pl/","hxxp://www.youndoo.com/?z=9e6f0ae98c006d59d567392g0z3mfg4w4q3e4tazce&from=wak&uid=HitachiXHTS547575A9E384_J2140059E5TXVAE5TXVAX&type=hp","hxxp://www.trotux.com/?z=ecd5f85d625bdaded79f7acg7z9b0c3cbtdg1e3ofe&from=isr&uid=HitachiXHTS547575A9E384_J2140059E5TXVAE5TXVAX&type=hp"
CHR Extension: (McAfee® WebAdvisor) - C:\Users\ariel\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho [2025-06-26]
CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho]
CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho]
2025-06-25 20:45 - 2025-06-25 20:45 - 004385888 _____ () C:\Users\ariel\Downloads\OperaGXSetup(6).exe
2025-06-22 00:59 - 2025-06-22 00:59 - 004385888 _____ () C:\Users\ariel\Downloads\OperaGXSetup(5).exe
2025-06-14 09:48 - 2025-06-14 09:48 - 004385248 _____ () C:\Users\ariel\Downloads\OperaGXSetup(4).exe
2025-06-14 09:35 - 2025-06-14 09:36 - 004385256 _____ () C:\Users\ariel\Downloads\OperaGXSetup(3).exe
2025-06-14 01:04 - 2025-06-14 01:04 - 004385192 _____ () C:\Users\ariel\Downloads\OperaGXSetup(2).exe
2025-06-12 21:00 - 2025-06-12 21:00 - 002611288 _____ () C:\Users\ariel\Downloads\OperaSetup(11).exe
2024-08-31 17:29 - 2024-08-31 17:29 - 000000335 _____ () C:\ProgramData\temp_Delete.bat
2024-08-31 17:29 - 2024-08-31 17:29 - 000000096 _____ () C:\ProgramData\temp_runbat.vbs
2024-03-13 07:02 - 2024-03-13 07:02 - 000058856 ___SH (Microsoft Corporation) C:\Users\ariel\AppData\Roaming\ugwvsau