Otwórz notatnik systemowy i wklej:
HKLM\...\Run: [RTHDVCPL] = C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13653720 2013-09-25] (Realtek Semiconductor)
HKLM-x32\...\Run: [SunJavaUpdateSched] = C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)
ShellIconOverlayIdentifiers: [SkyDrive1] - {F241C880-6982-4CE5-8CF7-7085BA96DA5A} = No File
ShellIconOverlayIdentifiers: [SkyDrive2] - {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} = No File
ShellIconOverlayIdentifiers: [SkyDrive3] - {BBACC218-34EA-4666-9D7A-C78F2274A524} = No File
ShellIconOverlayIdentifiers-x32: [SkyDrive1] - {F241C880-6982-4CE5-8CF7-7085BA96DA5A} = No File
ShellIconOverlayIdentifiers-x32: [SkyDrive2] - {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} = No File
ShellIconOverlayIdentifiers-x32: [SkyDrive3] - {BBACC218-34EA-4666-9D7A-C78F2274A524} = No File
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction ======= ATTENTION
SearchScopes: HKU\.DEFAULT - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2446228121-2089974853-4202462278-1001 - {1B7CC99D-353D-4491-BE9A-B7774D06D759} URL =
CHR Extension: (Búsqueda de Google) - C:\Users\Agata\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-11-04]
CHR Extension: (BueyNsauVVe) - C:\ProgramData\ekakilkdahmbbkconhnnjdpbehkilbcd\ [2014-11-04]
2015-01-13 18:11 - 2015-01-13 18:20 - 00000000 ____ D () C:\AdwCleaner
2014-12-20 14:51 - 2014-12-20 14:51 - 00000000 ____ D () C:\ProgramData\ekakilkdahmbbkconhnnjdpbehkilbcd
2014-12-20 14:47 - 2014-12-20 15:05 - 00000000 ____ D () C:\Program Files (x86)\YYouutubEiAdBLockkEE
2014-12-20 14:47 - 2014-12-20 14:47 - 00000000 ____ D () C:\Program Files (x86)\Share the Wealth
2014-12-20 14:46 - 2014-12-20 16:52 - 00000000 ____ D () C:\Program Files (x86)\BuyNsavee
2014-12-20 14:46 - 2014-12-20 14:46 - 00000000 ____ D () C:\Program Files (x86)\BuYNNsAove
2014-12-20 14:45 - 2014-12-20 14:45 - 00000000 ____ D () C:\ProgramData\oioicoecepfimahnghapaciliabkhoeg
EmptyTemp:
Plik zapisz pod nazwą fixlist.txt i umieść obok FRST w tym samym folderze.
