Solved Blank Web site loads every morning

$Output = @()

# --------------------------
# 1. User Run Entries
# --------------------------
$Output += "`r`n=== HKCU Run Entries ==="
$Output += (Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" | Select-Object PSChildName, Value | Out-String)

# --------------------------
# 2. Machine Run Entries
# --------------------------
$Output += "`r`n=== HKLM Run Entries ==="
$Output += (Get-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" | Select-Object PSChildName, Value | Out-String)

# --------------------------
# 3. All Scheduled Tasks
# --------------------------
$Output += "`r`n=== ALL Scheduled Tasks ==="
$AllTasks = Get-ScheduledTask | ForEach-Object {
    $Task = $_
    $Info = New-Object PSObject -Property @{
        URI        = $Task.URI
        Author        = $Task.Principal.UserId
        State         = $Task.State
        LastRunTime   = ($Task | Get-ScheduledTaskInfo).LastRunTime
        Actions       = ($Task.Actions | ForEach-Object { $_.Execute + " " + $_.Arguments }) -join "; "
        Triggers      = ($Task.Triggers | ForEach-Object { $_.StartBoundary }) -join "; "
    }
    $Info
}
$Output += ($AllTasks | Sort-Object TaskName | Format-Table -AutoSize | Out-String)

# --------------------------
# 4. Startup Services
# --------------------------
$Output += "`r`n=== Startup Services (Auto-Start) ==="
$StartupServices = Get-Service | Where-Object {$_.StartType -eq "Automatic"} | Select-Object DisplayName, Status, StartType
$Output += ($StartupServices | Sort-Object DisplayName | Format-Table -AutoSize | Out-String)

# --------------------------
# 5. Currently Running Suspicious Processes
# --------------------------
$Output += "`r`n=== Currently Running Suspicious Processes (Filtered) ==="
$Running = Get-Process | Where-Object {
    $_.Path -and (
        $_.Path -like "*AppData*" -or
        $_.Path -like "*Temp*" -or
        $_.Path -like "*brave*" -or
        $_.Path -like "*.ru*" -or
        $_.Path -like "*update*" -or
        $_.Path -like "*.exe"
    )
} | Select-Object Name, Id, Path
$Output += ($Running | Sort-Object Name | Format-Table -AutoSize | Out-String)

# --------------------------
# 6. Browser Startup URLs
# --------------------------
$Output += "`r`n=== Brave/Chrome/Edge Startup URLs ==="

$BrowserStartupPaths = @(
    "$env:LOCALAPPDATA\BraveSoftware\Brave-Browser\User Data\Default\Preferences",
    "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Preferences",
    "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\Preferences"
)

foreach ($Path in $BrowserStartupPaths) {
    if (Test-Path $Path) {
        $Output += "`r`n--- Startup URLs in: $Path ---"
        $RawJson = Get-Content $Path -Raw
        $StartupUrls = ($RawJson | ConvertFrom-Json -ErrorAction SilentlyContinue).session.startup_urls
        if ($StartupUrls) {
            $Output += ($StartupUrls -join "`r`n")
        } else {
            $Output += "(No startup URLs found)"
        }
    }
}

# --------------------------
# Save to custom Desktop path (F:\User\Desktop)
# --------------------------
$CustomDesktop = "F:\User\Desktop"
$FilePath = Join-Path $CustomDesktop "Startup_Check_Full.txt"
$Output | Out-File -FilePath $FilePath -Encoding UTF8

Write-Host "`nFull startup and task info saved to: $FilePath" -ForegroundColor Green

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

powershell Unregister-ScheduledTask -TaskName "MicrosoftEdgeUpdateTaskMachineUА"

# Search for a scheduled task using mshta and referencing the malicious domain
Get-ScheduledTask | ForEach-Object {
    $task = $_
    $info = $task | Get-ScheduledTaskInfo
    $matches = $false

    foreach ($action in $task.Actions) {
        if ($action.Execute -match "mshta" -and $action.Arguments -match "yrewdvnkl\.ru") {
            $matches = $true
        }
    }

    if ($matches -and $task.Principal.UserId -match "Spike Baron") {
        [PSCustomObject]@{
            TaskName     = $task.TaskName
            Path         = $task.TaskPath
            User         = $task.Principal.UserId
            Execute      = ($task.Actions | ForEach-Object { $_.Execute }) -join "; "
            Arguments    = ($task.Actions | ForEach-Object { $_.Arguments }) -join "; "
            Triggers     = ($task.Triggers | ForEach-Object { $_.StartBoundary }) -join "; "
            LastRunTime  = $info.LastRunTime
            State        = $task.State
        }
    }
}

# Define the malicious domain and user
$MaliciousDomain = "yrewdvnkl.ru"
$TargetUser = "Spike Baron"

# Find and optionally remove malicious tasks
$MaliciousTasks = Get-ScheduledTask | ForEach-Object {
    $task = $_
    $info = $task | Get-ScheduledTaskInfo
    $match = $false

    foreach ($action in $task.Actions) {
        if ($action.Execute -match "mshta" -and $action.Arguments -match [regex]::Escape($MaliciousDomain)) {
            $match = $true
        }
    }

    if ($match -and $task.Principal.UserId -match [regex]::Escape($TargetUser)) {
        [PSCustomObject]@{
            TaskName    = $task.TaskName
            Path        = $task.TaskPath
            User        = $task.Principal.UserId
            Execute     = ($task.Actions | ForEach-Object { $_.Execute }) -join "; "
            Arguments   = ($task.Actions | ForEach-Object { $_.Arguments }) -join "; "
            Triggers    = ($task.Triggers | ForEach-Object { $_.StartBoundary }) -join "; "
            LastRunTime = $info.LastRunTime
            State       = $task.State
        }
    }
} | Where-Object { $_ -ne $null }

# If tasks found, display and remove
if ($MaliciousTasks.Count -gt 0) {
    Write-Host "`n=== Suspicious Task(s) Found ===" -ForegroundColor Yellow
    $MaliciousTasks | Format-List

    foreach ($task in $MaliciousTasks) {
        $confirm = Read-Host "`nDo you want to remove task '$($task.TaskName)'? (Y/N)"
        if ($confirm -match '^[Yy]$') {
            try {
                Unregister-ScheduledTask -TaskName $task.TaskName -TaskPath $task.Path -Confirm:$false
                Write-Host "✔ Removed task: $($task.TaskName)" -ForegroundColor Green
            } catch {
                Write-Host "✘ Failed to remove task: $($task.TaskName)" -ForegroundColor Red
                Write-Host "Error: $_"
            }
        } else {
            Write-Host "⏭ Skipped task: $($task.TaskName)" -ForegroundColor Cyan
        }
    }
} else {
    Write-Host "`n✔ No matching scheduled tasks found." -ForegroundColor Green
}