Why do all requests go through "esrver.net"?

Question

Browsers

Hello, what's the point: I recently installed windows 10, after some time I caught a nasty virus, because of which all sites load slowly, since all requests go through "esrver.net".

Also, when you go to sites from search engines, a page with an advertisement for the "Reimage Repair" software is often loaded. This happens in all browsers except Edge, namely chrome, opera, mozilla latest versions. I didn’t notice anything suspicious in chrome extensions, I even tried to disable everything to hell. There is nothing supernatural in "Installation and removal" either - browsers, a couple of Microsoft plug-ins and Nvidia and Intel drivers.
What I did: I checked the computer with StopZill and dr.Web CureIt. Nothing.
Now I'm here to help you :)

Answer 1

Look at the hosts file.
Reset Windows to factory settings.

Answer 2

See browser plugins and add-ons. Also look at the DNS settings, including on the router.

Answer 3

try looking at files like user.js in the folder ...AppData\Roaming\Mozilla\FireFox\Profiles\bla-bla-bla.default\ - A script processing your requests can be sewn inside.
In the control panel Appearance and Personalization - Explorer Options - Show hidden files and folders, check the box "Show hidden files and folders (it is at the very end) and make sure that there are no hidden browser shortcuts on the desktop. If there are any, these are most likely your old working shortcuts, and those that are not hidden on the desktop now are clones created by the virus with malicious settings.Look at the
properties of these shortcuts, perhaps changes have been made in the path to the file launched through the shortcut.
Well, the hosts.txt file - if there is something abnormal in it, then click on the magnifying glass icon to the right of the start menu, type cmd, select cmd.exe and right-click to run it as administrator, then type notepad.exe in the window that opens, look for file hosts.txt m edit it as needed