Thanks for your help. It has been resolved. I found it (malware files) with eset sysinspector and deleted them manually but browser was redirecting no matter what, when I started second run and it happens that in second run NOD32 found all "dirty" files and cleaned them. It looks I just needed to refresh my browser.
Sorry for the fuzz. It was my own mistake.