VIRY.CZ

ESET mi našiel 2 viry Win 32 Protector N a jeden zmazal.Jeden tam ostal,preto posielam log.PC sa zatiaľ chová normálne,len v poslednej dobe je nmestabilný na internet.



Logfile of random's system information tool 1.10 (written by random/random)
Run by Martin at 2015-01-17 15:19:01
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 82 GB (75%) free of 110 GB
Total RAM: 8154 MB (86% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:19:08, on 17. 1. 2015
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Users\Martin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
C:\Program Files\trend micro\Martin.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hao.360.cn/?src=lm&ls=n72df441090
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AFFAC708-93F0-E899-48CB-0B6F848DF109 Class - {AFFAC708-93F0-E899-48CB-0B6F848DF109} - C:\Program Files (x86)\BaiduAddr\{AFFAC708-93F0-E899-48CB-0B6F848DF109}\AddressBar.dll (file missing)
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun
O4 - HKCU\..\Run: [Spotify Web Helper] "C:\Users\Martin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&oslať do programu OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
O10 - Unknown file in Winsock LSP: c:\users\public\funacce\funacce.dll
O10 - Unknown file in Winsock LSP: c:\users\public\funacce\funacce.dll
O10 - Unknown file in Winsock LSP: c:\users\public\funacce\funacce.dll
O10 - Unknown file in Winsock LSP: c:\users\public\funacce\funacce.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: kuwo - {3050F3DA-98B5-11CF-BB82-00AA00BDCE0C} - (no file)
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe
O23 - Service: BDSGRTP Service (BDSGRTP) - ????????(??)???? - C:\Program Files (x86)\Common Files\Baidu\BaiduProtect\1.1.0.34\BaiduProtect.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 5669 bytes

======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
"C:\Program Files (x86)\Common Files\Baidu\BaiduProtect\1.1.0.34\BaiduProtect.exe" -r
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
atieclxx
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe" /launchService
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Users\Martin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
"C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM" PriorityLow
"C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe" 0
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\system32\sppsvc.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Users\Martin\Downloads\RSITx64.exe"

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AFFAC708-93F0-E899-48CB-0B6F848DF109}]
AFFAC708-93F0-E899-48CB-0B6F848DF109 Class - C:\Program Files (x86)\BaiduAddr\{AFFAC708-93F0-E899-48CB-0B6F848DF109}\AddressBar.dll []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Spotify Web Helper"=C:\Users\Martin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [2015-01-16 1676344]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [2014-11-20 767176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=" "

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2015-01-17 15:19:01 ----D---- C:\rsit
2015-01-17 15:19:01 ----D---- C:\Program Files\trend micro
2015-01-17 14:39:50 ----D---- C:\Program Files (x86)\ESET
2015-01-15 12:46:08 ----A---- C:\Windows\SYSWOW64\FlashPlayerInstaller.exe
2015-01-11 18:10:50 ----D---- C:\ProgramData\a47e8fa600002314
2015-01-04 13:38:45 ----D---- C:\Users\Martin\AppData\Roaming\foobar2000
2014-12-26 12:42:59 ----D---- C:\Users\Martin\AppData\Roaming\Zoo
2014-12-26 12:42:43 ----D---- C:\Users\Martin\AppData\Roaming\CloudMedia
2014-12-26 12:37:43 ----D---- C:\Users\Martin\AppData\Roaming\DataRepair
2014-12-26 12:10:22 ----D---- C:\ProgramData\{plbackup-CFE0-66E8-660553B4C955}
2014-12-24 19:58:47 ----A---- C:\Windows\system32\drivers\BDMWrench.sys
2014-12-24 19:58:30 ----D---- C:\Users\Martin\AppData\Roaming\Baidu
2014-12-24 19:58:30 ----D---- C:\ProgramData\Baidu
2014-12-24 19:58:29 ----A---- C:\Windows\system32\drivers\bd0004.sys
2014-12-24 19:58:29 ----A---- C:\Windows\system32\drivers\bd0001.sys
2014-12-24 19:58:29 ----A---- C:\Windows\system32\bd64_x86.dll
2014-12-24 19:58:29 ----A---- C:\Windows\system32\bd64_x64.dll
2014-12-24 19:52:56 ----D---- C:\ProgramData\kuwodata
2014-12-24 12:43:32 ----SHD---- C:\Config.Msi

======List of files/folders modified in the last 1 month======

2015-01-17 15:19:04 ----D---- C:\Windows\Temp
2015-01-17 15:19:01 ----RD---- C:\Program Files
2015-01-17 15:14:13 ----D---- C:\Windows\Microsoft.NET
2015-01-17 15:14:08 ----SHD---- C:\Windows\Installer
2015-01-17 15:14:00 ----D---- C:\ProgramData\Microsoft Help
2015-01-17 15:13:57 ----RSD---- C:\Windows\assembly
2015-01-17 15:13:26 ----SD---- C:\ProgramData\Microsoft
2015-01-17 15:13:26 ----RD---- C:\Program Files (x86)
2015-01-17 15:13:26 ----D---- C:\Windows
2015-01-17 15:13:26 ----D---- C:\Program Files (x86)\Microsoft.NET
2015-01-17 15:13:16 ----RSD---- C:\Windows\Fonts
2015-01-17 15:13:11 ----D---- C:\Windows\SysWOW64
2015-01-17 15:13:11 ----D---- C:\Program Files (x86)\MSBuild
2015-01-17 15:13:11 ----D---- C:\Program Files (x86)\Common Files
2015-01-17 15:11:57 ----D---- C:\Windows\ShellNew
2015-01-17 15:11:49 ----A---- C:\Windows\win.ini
2015-01-17 15:11:15 ----D---- C:\Windows\system32\config
2015-01-17 15:11:02 ----SHD---- C:\System Volume Information
2015-01-17 15:01:17 ----D---- C:\ProgramData\3872871776
2015-01-17 13:20:49 ----D---- C:\Users\Martin\AppData\Roaming\Spotify
2015-01-17 12:03:45 ----D---- C:\Windows\System32
2015-01-17 12:03:45 ----D---- C:\Windows\inf
2015-01-17 12:03:45 ----A---- C:\Windows\system32\PerfStringBackup.INI
2015-01-15 12:46:10 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2015-01-11 18:10:50 ----HD---- C:\ProgramData
2015-01-09 20:54:22 ----D---- C:\Windows\system32\catroot2
2015-01-08 22:31:50 ----D---- C:\Windows\system32\Tasks
2014-12-31 15:20:44 ----D---- C:\Program Files (x86)\Opera
2014-12-30 13:35:31 ----D---- C:\Windows\Tasks
2014-12-24 19:58:47 ----D---- C:\Windows\system32\drivers

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2012-04-22 213888]
R1 bd0001;bd0001; C:\Windows\system32\DRIVERS\bd0001.sys [2013-12-10 104264]
R1 bd0004;bd0004; C:\Windows\system32\DRIVERS\bd0004.sys [2013-12-10 168264]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2012-04-22 60416]
R2 AODDriver4.3;AODDriver4.3; \??\C:\Program Files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys [2014-02-11 59616]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2014-11-21 18959360]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2014-11-21 589312]
R3 athur;Wireless Network Adapter Service; C:\Windows\system32\DRIVERS\athurx.sys [2010-01-05 1847296]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW76.sys [2014-06-21 94720]
S1 SBRE;SBRE; \??\C:\Windows\system32\drivers\SBREdrv.sys []
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2014-12-19 81088]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2014-11-21 244736]
R2 AMD FUEL Service;AMD FUEL Service; C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe [2014-11-20 344064]
R2 BDSGRTP;BDSGRTP Service; C:\Program Files (x86)\Common Files\Baidu\BaiduProtect\1.1.0.34\BaiduProtect.exe [2013-12-10 1101152]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2012-07-08 104912]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2012-07-08 123856]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-30 267440]
S4 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2012-07-08 51648]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2012-07-08 139696]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2012-07-08 139696]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2012-07-08 139696]

-----------------EOF-----------------

Zdravim

V jakem umisteni ESET viry nasel?

V ramci cisteni Vam budou vyprazdneny docasne adresare (vcetne Kose).

Ulozte na plochu AdwCleaner https://toolslib.net/downloads/viewdown ... dwcleaner/

• ukoncete vsechny programy
• kliknete pravym na ikonu AdwCleaneru a vyberte Spustit jako spravce (v pripade Win XP spustte obycejne dvojklikem)
• kliknete na Scan, pote na Clean
• po restartu na Vas vyskoci log (pripadne jej najdete v C:\AdwCleaner\AdwCleaner [Sx].txt), jehoz obsah mi zkopirujte do pristi odpovedi

Viry boli na disku C //Users/Martin/Appdata, niečo ako toto.


# AdwCleaner v4.108 - Report created 17/01/2015 at 15:59:49
# Updated 17/01/2015 by Xplode
# Database : 2015-01-13.2 [Live]
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Martin - MARTIN-PC
# Running from : C:\Users\Martin\Downloads\adwcleaner_4.108.exe
# Option : Clean

***** [ Services ] *****

[#] Service Deleted : bd0001
Service Deleted : BDSGRTP
[#] Service Deleted : bd0004

***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\baidu
Folder Deleted : C:\ProgramData\367494974035915134
Folder Deleted : C:\ProgramData\a47e8fa600002314
Folder Deleted : C:\Program Files (x86)\LiveSupport
[!] Folder Deleted : C:\Program Files (x86)\Common Files\baidu
Folder Deleted : C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\baidu
Folder Deleted : C:\Users\Martin\AppData\LocalLow\baidu
Folder Deleted : C:\Users\Martin\AppData\Roaming\baidu
Folder Deleted : C:\Users\Martin\AppData\Roaming\Browser Extensions
Folder Deleted : C:\Users\Martin\AppData\Roaming\Search Protection
Folder Deleted : C:\Users\Martin\AppData\Roaming\SecureSearch
File Deleted : C:\Users\Martin\AppData\Roaming\LiveSupport.exe_log.txt
File Deleted : C:\Users\Martin\AppData\Roaming\regsvr32.exe_log.txt

***** [ Scheduled Tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6C97A91E-4524-4019-86AF-2AA2D567BF5C}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A7F05EE4-0426-454F-8013-C41E3596E9E9}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{62155D33-3CE2-401E-8967-5A270628A3D5}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}
Key Deleted : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{62155D33-3CE2-401E-8967-5A270628A3D5}
Key Deleted : HKCU\Software\Optimizer Pro
Key Deleted : HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}
Key Deleted : HKCU\Software\AppDataLow\Software\adawarebp
Key Deleted : HKCU\Software\AppDataLow\Software\Baidu
Key Deleted : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Key Deleted : HKLM\SOFTWARE\Baidu
Key Deleted : HKLM\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4820778D-AB0D-6D18-C316-52A6A0E1D507}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Toolbar Cleaner
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{842C4394-47F7-60DE-480B-C09116B63559}

***** [ Browsers ] *****

-\\ Internet Explorer v9.0.8112.16421


-\\ Google Chrome v


-\\ Opera v26.0.1656.60


*************************

AdwCleaner[R0].txt - [3200 octets] - [17/01/2015 15:58:09]
AdwCleaner[S0].txt - [3142 octets] - [17/01/2015 15:59:49]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3202 octets] ##########

Dejte novy log FRST.txt, prilozte i Addition.txt - http://forum.viry.cz/viewtopic.php?f=30&t=133101

zkopiruju si sem log, ktery jste dal vedle... nic se nedeje


Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-01-2015 01
Ran by Martin at 2015-01-17 16:27:50
Running from C:\Users\Martin\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.257 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Slovak (HKLM-x32\...\{AC76BA86-7AD7-1051-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{F2A7CE36-57BF-5C86-952D-90DBF3746D82}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
Microsoft .NET Framework 4.5 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50709 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Opera Stable 26.0.1656.60 (HKLM-x32\...\Opera 26.0.1656.60) (Version: 26.0.1656.60 - Opera Software ASA)
Spotify (HKU\S-1-5-21-515885200-768628804-3900138106-1000\...\Spotify) (Version: 0.9.15.27.g87efe634 - Spotify AB)
Tomb Raider III (HKLM-x32\...\Tomb Raider III) (Version: - )
TP-LINK Wireless Client Utility (HKLM-x32\...\{7A2A107B-9695-423F-9462-8F17C178BD35}) (Version: 7.0 - TP-LINK)
VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
WinRAR 5.00 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.00.0 - win.rar GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points =========================

28-12-2014 18:10:33 Plánovaný kontrolný bod
06-01-2015 18:16:18 Plánovaný kontrolný bod
13-01-2015 19:04:43 Plánovaný kontrolný bod
17-01-2015 15:10:54 Removed Microsoft Office Professional Plus 2010

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {85DA7BFB-5D2E-4EFF-8260-3549C2ECFD96} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {A2EF47E5-283A-4B74-991A-B9D4D4F93640} - System32\Tasks\Opera scheduled Autoupdate 1406566310 => C:\Program Files (x86)\Opera\launcher.exe [2014-12-17] (Opera Software)
Task: {AF6F4E7D-FEFD-466D-952F-05925AEC0916} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-30] (Adobe Systems Incorporated)
Task: {F783080C-6BA3-4589-9055-781E295ECAEF} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {F96B2165-AA32-4349-B138-0B738423926C} - System32\Tasks\{F529C778-212F-4A4C-A435-C1F3B293A60A} => pcalua.exe -a C:\Windows\IsUninst.exe -c -f"d:\Thomb raider 3\Uninst.isu"
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2014-12-24 19:58 - 2013-12-10 08:53 - 00426824 _____ () C:\Program Files (x86)\Common Files\Baidu\BaiduProtect\1.1.0.34\bdsg0002.dll
2014-11-20 21:23 - 2014-11-20 21:23 - 00127488 _____ () C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2014-11-20 21:23 - 2014-11-20 21:23 - 00102400 _____ () C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Proxy.Native.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-515885200-768628804-3900138106-500 - Administrator - Disabled)
Guest (S-1-5-21-515885200-768628804-3900138106-501 - Limited - Disabled)
Martin (S-1-5-21-515885200-768628804-3900138106-1000 - Administrator - Enabled) => C:\Users\Martin

==================== Faulty Device Manager Devices =============

Name: SBRE
Description: SBRE
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: SBRE
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: Ethernet Controller
Description: Ethernet Controller
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Universal Serial Bus (USB) Controller
Description: Universal Serial Bus (USB) Controller
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (01/17/2015 04:05:18 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)
Description: Unable to read the performance counter strings defined for the 01B language ID. The first DWORD in the Data section contains the Win32 error code.

Error: (01/17/2015 04:05:18 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)
Description: Unable to read the performance counter strings defined for the 01B language ID. The first DWORD in the Data section contains the Win32 error code.

Error: (01/17/2015 04:02:44 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/17/2015 03:57:26 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (01/17/2015 03:20:16 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)
Description: Unable to read the performance counter strings defined for the 01B language ID. The first DWORD in the Data section contains the Win32 error code.

Error: (01/17/2015 03:20:16 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)
Description: Unable to read the performance counter strings defined for the 01B language ID. The first DWORD in the Data section contains the Win32 error code.

Error: (01/17/2015 03:17:11 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/17/2015 02:39:50 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (01/17/2015 00:03:45 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)
Description: Unable to read the performance counter strings defined for the 01B language ID. The first DWORD in the Data section contains the Win32 error code.

Error: (01/17/2015 00:03:45 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)
Description: Unable to read the performance counter strings defined for the 01B language ID. The first DWORD in the Data section contains the Win32 error code.


System errors:
=============
Error: (01/17/2015 04:01:55 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Služba Rýchle načítanie bola ukončená s nasledujúcou chybou:
%%2

Error: (01/17/2015 04:01:10 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Nasledujúce ovládače pre spustenie zavedenia alebo spustenie systému zlyhali pri načítaní:
SBRE

Error: (01/17/2015 04:01:04 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10000) (User: NT AUTHORITY)
Description: Modul WLAN Extensibility Module sa nepodarilo spustiť.

Cesta k modulu: C:\Windows\system32\athExt.dll
Kód chyby: 126

Error: (01/17/2015 03:59:51 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Služba Microsoft .NET Framework NGEN v4.0.30319_X64 sa neočakávane ukončila. Služba sa týmto spôsobom ukončila už 1 krát. O 120000 ms bude vykonaná nasledujúca opravná akcia: Reštartovať službu.

Error: (01/17/2015 03:59:51 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Služba Microsoft .NET Framework NGEN v4.0.30319_X86 sa neočakávane ukončila. Služba sa týmto spôsobom ukončila už 1 krát. O 120000 ms bude vykonaná nasledujúca opravná akcia: Reštartovať službu.

Error: (01/17/2015 03:59:51 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Služba AMD FUEL Service sa neočakávane ukončila. Služba sa týmto spôsobom ukončila už 1-krát.

Error: (01/17/2015 03:59:51 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Služba Adobe Acrobat Update Service sa neočakávane ukončila. Služba sa týmto spôsobom ukončila už 1-krát.

Error: (01/17/2015 03:59:51 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Služba AMD External Events Utility sa neočakávane ukončila. Služba sa týmto spôsobom ukončila už 1-krát.

Error: (01/17/2015 03:16:35 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Služba Rýchle načítanie bola ukončená s nasledujúcou chybou:
%%2

Error: (01/17/2015 03:15:51 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Nasledujúce ovládače pre spustenie zavedenia alebo spustenie systému zlyhali pri načítaní:
SBRE


Microsoft Office Sessions:
=========================
Error: (01/17/2015 04:05:18 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)
Description: 01B8020000002D010000

Error: (01/17/2015 04:05:18 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)
Description: 01B120200000000000000AF000000

Error: (01/17/2015 04:02:44 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/17/2015 03:57:26 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Martin\Downloads\esetsmartinstaller_enu.exe

Error: (01/17/2015 03:20:16 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)
Description: 01B8020000002D010000

Error: (01/17/2015 03:20:16 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)
Description: 01B120200000000000000AF000000

Error: (01/17/2015 03:17:11 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/17/2015 02:39:50 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Martin\Downloads\esetsmartinstaller_enu.exe

Error: (01/17/2015 00:03:45 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)
Description: 01B8020000002D010000

Error: (01/17/2015 00:03:45 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)
Description: 01B120200000000000000AF000000


==================== Memory info ===========================

Processor: AMD Athlon(tm) II X3 460 Processor
Percentage of memory in use: 12%
Total physical RAM: 8154.46 MB
Available physical RAM: 7104.59 MB
Total Pagefile: 16307.11 MB
Available Pagefile: 15085.7 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:107.32 GB) (Free:80.35 GB) NTFS
Drive d: () (Fixed) (Total:358.34 GB) (Free:356.69 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: A4C80B1C)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=107.3 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=358.3 GB) - (Type=07 NTFS)

==================== End Of Log ============================













Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-01-2015 01
Ran by Martin (administrator) on MARTIN-PC on 17-01-2015 16:27:15
Running from C:\Users\Martin\Downloads
Loaded Profiles: Martin (Available profiles: Martin)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Slovenčina (Slovensko)
Internet Explorer Version 9 (Default browser: Opera)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe
(Spotify Ltd) C:\Users\Martin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2014-11-20] (Advanced Micro Devices, Inc.)
HKU\S-1-5-21-515885200-768628804-3900138106-1000\...\Run: [Spotify Web Helper] => C:\Users\Martin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1676344 2015-01-16] (Spotify Ltd)
ShellIconOverlayIdentifiers: [FunOverlay] -> {A5662DF9-0C2E-4A56-9FE1-BACFF6966D88} => C:\Users\Public\Fundata\Lucifer.dll (Funshion)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-515885200-768628804-3900138106-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://hao.360.cn/?src=lm&ls=n72df441090
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-515885200-768628804-3900138106-1000 -> {B8E20CD7-BAC2-4820-9AA6-1060B3AF25E2} URL = http://www.baidu.com/s?wd={searchTerms} ... 8051076_cb
SearchScopes: HKU\S-1-5-21-515885200-768628804-3900138106-1000 -> {C2B6FCDF-505F-4E61-9F64-71C746BBBF55} URL = https://search.yahoo.com/search?fr=chr- ... =198484&p={searchTerms}
BHO-x32: AFFAC708-93F0-E899-48CB-0B6F848DF109 Class -> {AFFAC708-93F0-E899-48CB-0B6F848DF109} -> C:\Program Files (x86)\BaiduAddr\{AFFAC708-93F0-E899-48CB-0B6F848DF109}\AddressBar.dll No File
Handler: kuwo - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0C} - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_257.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_257.dll ()
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

Chrome:
=======
CHR Profile: C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Docs) - C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-07-29]
CHR Extension: (Disk Google) - C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-07-29]
CHR Extension: (YouTube) - C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-07-29]
CHR Extension: (Hľadať v Google) - C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-07-29]
CHR Extension: (Linkclump) - C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfpjkncokllnfokkgpkobnkbkmelfefj [2014-12-05]
CHR Extension: (Peňaženka Google) - C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-07-29]
CHR Extension: (Gmail) - C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-07-29]
CHR Extension: (BuyNsave) - C:\ProgramData\ajalbjplilnomafjmbipcklccebcnplb\ [2014-07-29]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD FUEL Service; C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe [344064 2014-11-20] (Advanced Micro Devices, Inc.) [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AODDriver4.3; C:\Program Files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
S1 SBRE; \??\C:\Windows\system32\drivers\SBREdrv.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-17 16:27 - 2015-01-17 16:27 - 00006260 _____ () C:\Users\Martin\Downloads\FRST.txt
2015-01-17 16:26 - 2015-01-17 16:27 - 00000000 ____D () C:\FRST
2015-01-17 16:25 - 2015-01-17 16:25 - 00015327 _____ () C:\Users\Martin\Desktop\LM.bat
2015-01-17 16:23 - 2015-01-17 16:25 - 00029696 _____ () C:\Users\Martin\AppData\Local\MSGBOX.EXE
2015-01-17 16:22 - 2015-01-17 16:23 - 00001492 _____ () C:\Users\Martin\Desktop\FRSTLauncher - odkaz.lnk
2015-01-17 16:22 - 2015-01-17 16:22 - 00112640 _____ (forum.viry.cz) C:\Users\Martin\Downloads\FRSTLauncher.exe
2015-01-17 16:19 - 2015-01-17 16:19 - 02125824 _____ (Farbar) C:\Users\Martin\Downloads\FRST64.exe
2015-01-17 15:58 - 2015-01-17 15:59 - 00000000 ____D () C:\AdwCleaner
2015-01-17 15:57 - 2015-01-17 15:57 - 00001528 _____ () C:\Users\Martin\Desktop\adwcleaner_4.108 - odkaz.lnk
2015-01-17 15:56 - 2015-01-17 15:56 - 02186752 _____ () C:\Users\Martin\Downloads\adwcleaner_4.108.exe
2015-01-17 15:19 - 2015-01-17 15:19 - 00000000 ____D () C:\rsit
2015-01-17 15:19 - 2015-01-17 15:19 - 00000000 ____D () C:\Program Files\trend micro
2015-01-17 15:18 - 2015-01-17 15:18 - 01222144 _____ () C:\Users\Martin\Downloads\RSITx64.exe
2015-01-17 14:39 - 2015-01-17 14:39 - 02347384 _____ (ESET) C:\Users\Martin\Downloads\esetsmartinstaller_enu.exe
2015-01-17 14:39 - 2015-01-17 14:39 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-01-16 21:11 - 2015-01-16 21:11 - 00001772 _____ () C:\Users\Martin\Desktop\Spotify.lnk
2015-01-16 21:11 - 2015-01-16 21:11 - 00001758 _____ () C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2015-01-16 21:11 - 2015-01-16 21:11 - 00000000 ____D () C:\Users\Martin\AppData\Local\Spotify
2015-01-16 21:10 - 2015-01-16 21:10 - 00137888 _____ (Spotify Ltd) C:\Users\Martin\Downloads\SpotifySetup (1).exe
2015-01-15 12:46 - 2015-01-15 12:46 - 04877488 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2015-01-10 17:13 - 2015-01-10 17:16 - 168341243 _____ () C:\Users\Martin\Downloads\uschovna-2015-01-10.zip
2015-01-08 23:46 - 2015-01-08 23:47 - 00137888 _____ (Spotify Ltd) C:\Users\Martin\Downloads\SpotifySetup.exe
2015-01-08 22:31 - 2015-01-08 22:31 - 00003116 _____ () C:\Windows\System32\Tasks\{F529C778-212F-4A4C-A435-C1F3B293A60A}
2015-01-04 13:38 - 2015-01-04 13:38 - 00000000 ____D () C:\Users\Martin\AppData\Roaming\foobar2000
2015-01-01 21:04 - 2015-01-01 21:04 - 00374145 _____ () C:\Users\Martin\Downloads\Sťahovanie (5)
2015-01-01 21:04 - 2015-01-01 21:04 - 00374145 _____ () C:\Users\Martin\Downloads\Sťahovanie (4)
2015-01-01 21:02 - 2015-01-01 21:02 - 00578315 _____ () C:\Users\Martin\Downloads\Sťahovanie (3)
2015-01-01 21:02 - 2015-01-01 21:02 - 00578315 _____ () C:\Users\Martin\Downloads\Sťahovanie (2)
2015-01-01 21:00 - 2015-01-01 21:00 - 01161337 _____ () C:\Users\Martin\Downloads\Sťahovanie (1)
2015-01-01 21:00 - 2015-01-01 21:00 - 01161337 _____ () C:\Users\Martin\Downloads\Sťahovanie
2015-01-01 20:54 - 2015-01-01 20:54 - 00038705 _____ () C:\Users\Martin\Downloads\usenethub_com_ed114ebe-6c67-a0fb-17bf-e1cd7610f548.nzb
2014-12-31 15:15 - 2015-01-17 16:01 - 00001344 _____ () C:\Windows\setupact.log
2014-12-31 15:15 - 2015-01-17 16:00 - 00007234 _____ () C:\Windows\PFRO.log
2014-12-31 15:15 - 2014-12-31 15:15 - 00000000 _____ () C:\Windows\setuperr.log
2014-12-26 12:42 - 2015-01-17 12:09 - 00000000 ____D () C:\Users\Martin\AppData\Roaming\Zoo
2014-12-26 12:42 - 2014-12-26 12:42 - 00000000 ____D () C:\Users\Martin\AppData\Roaming\CloudMedia
2014-12-26 12:37 - 2014-12-26 12:37 - 00000000 ____D () C:\Users\Martin\AppData\Roaming\DataRepair
2014-12-26 12:32 - 2015-01-17 12:45 - 00000000 ___HD () C:\Users\Public\FunAcce
2014-12-26 12:10 - 2014-12-26 12:10 - 00000000 ____D () C:\ProgramData\{plbackup-CFE0-66E8-660553B4C955}
2014-12-25 12:23 - 2015-01-17 16:06 - 00000000 ___HD () C:\Users\Public\Fundata
2014-12-24 19:58 - 2014-12-24 19:58 - 00056648 _____ (Baidu) C:\Windows\system32\Drivers\BDMWrench.sys
2014-12-24 19:58 - 2013-12-10 08:53 - 00168264 _____ (Baidu) C:\Windows\system32\Drivers\bd0004.sys
2014-12-24 19:58 - 2013-12-10 08:53 - 00104264 _____ (Baidu) C:\Windows\system32\Drivers\bd0001.sys
2014-12-24 19:58 - 2013-12-10 08:53 - 00041800 _____ (Baidu) C:\Windows\system32\bd64_x64.dll
2014-12-24 19:58 - 2013-12-10 08:53 - 00039056 _____ (Baidu) C:\Windows\system32\bd64_x86.dll
2014-12-24 19:52 - 2014-12-24 19:52 - 00000000 ____D () C:\ProgramData\kuwodata
2014-12-24 12:43 - 2014-12-24 12:43 - 00003886 _____ () C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2014-12-23 18:08 - 2014-12-23 18:09 - 07416524 _____ () C:\Users\Martin\Downloads\7742409

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-17 16:08 - 2009-07-14 05:45 - 00021392 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-17 16:08 - 2009-07-14 05:45 - 00021392 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-17 16:05 - 2009-07-14 06:13 - 00785302 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-17 16:04 - 2014-09-23 11:23 - 01575337 _____ () C:\Windows\WindowsUpdate.log
2015-01-17 16:01 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-17 15:46 - 2014-07-29 12:15 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-17 15:16 - 2014-07-28 17:35 - 00106808 _____ () C:\Users\Martin\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-17 15:15 - 2009-07-14 05:45 - 00411112 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-01-17 15:14 - 2014-09-23 11:15 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-01-17 15:13 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files (x86)\MSBuild
2015-01-17 15:11 - 2010-11-21 16:10 - 00000000 ____D () C:\Windows\ShellNew
2015-01-17 15:11 - 2009-07-14 03:34 - 00000387 _____ () C:\Windows\win.ini
2015-01-17 15:01 - 2014-12-05 11:59 - 00000000 ____D () C:\ProgramData\3872871776
2015-01-17 13:20 - 2014-08-16 19:49 - 00000000 ____D () C:\Users\Martin\AppData\Roaming\Spotify
2015-01-15 12:46 - 2014-07-29 12:15 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-01-15 12:46 - 2014-07-29 12:15 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-15 12:46 - 2014-07-29 12:15 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-12-31 15:20 - 2014-07-28 17:51 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-12-31 15:07 - 2014-10-04 14:25 - 00000000 ____D () C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2014-12-30 13:34 - 2009-07-14 06:08 - 00032604 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-12-30 13:26 - 2014-07-29 12:14 - 00000000 ____D () C:\Users\Martin\AppData\Local\Adobe

==================== Files in the root of some directories =======
2015-01-17 16:23 - 2015-01-17 16:25 - 0029696 _____ () C:\Users\Martin\AppData\Local\MSGBOX.EXE

Some content of TEMP:
====================
C:\Users\Martin\AppData\Local\Temp\Quarantine.exe
C:\Users\Martin\AppData\Local\Temp\sqlite3.dll
C:\Users\Martin\AppData\Local\Temp\vlc-2.1.5-win32.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-14 12:27

==================== End Of Log ============================

Pardon

Nic se nedeje

Doporucuju nahradit Windows Defender (na win7 plni jen funkci antispywaru, nikoliv antiviru) jinym resenim - z free reseni doporucuju avast! Free nabo Aviru (ve free verzi anglicky).

• Pokud jeste nemate, presunte frst.exe/frst64.exe na plochu
• Do Poznamkoveho bloku (Start -> spustit -> notepad) zkopirujte obsah bileho pole
• ulozte na plochu jako fixlist (Typ souboru: Textovy dokument)
• znovu spustte FRST a kliknete na Fix
• po restartu na Vas vyskoci fixlog (pripadne bude ulozen na Plose), jehoz obsah mi vlozte do pristi odpovedi

  Kód: Vybrat vše

  Start
  CloseProcesses:
  CreateRestorePoint:
  Task: {F96B2165-AA32-4349-B138-0B738423926C} - System32\Tasks\{F529C778-212F-4A4C-A435-C1F3B293A60A} => pcalua.exe -a C:\Windows\IsUninst.exe -c -f"d:\Thomb raider 3\Uninst.isu"
  ShellIconOverlayIdentifiers: [FunOverlay] -> {A5662DF9-0C2E-4A56-9FE1-BACFF6966D88} => C:\Users\Public\Fundata\Lucifer.dll (Funshion)
  CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
  HKU\S-1-5-21-515885200-768628804-3900138106-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://hao.360.cn/?src=lm&ls=n72df441090
  SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
  SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
  SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
  SearchScopes: HKU\S-1-5-21-515885200-768628804-3900138106-1000 -> {B8E20CD7-BAC2-4820-9AA6-1060B3AF25E2} URL = http://www.baidu.com/s?wd={searchTerms}&ie={inputEncoding}&oe={outputEncoding}&bar=13&tn=58051076_cb
  SearchScopes: HKU\S-1-5-21-515885200-768628804-3900138106-1000 -> {C2B6FCDF-505F-4E61-9F64-71C746BBBF55} URL = https://search.yahoo.com/search?fr=chr- ... =198484&p={searchTerms}
  BHO-x32: AFFAC708-93F0-E899-48CB-0B6F848DF109 Class -> {AFFAC708-93F0-E899-48CB-0B6F848DF109} -> C:\Program Files (x86)\BaiduAddr\{AFFAC708-93F0-E899-48CB-0B6F848DF109}\AddressBar.dll No File
  Handler: kuwo - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0C} - No File
  
  CHR Extension: (BuyNsave) - C:\ProgramData\ajalbjplilnomafjmbipcklccebcnplb\ [2014-07-29]
  S1 SBRE; \??\C:\Windows\system32\drivers\SBREdrv.sys [X]
  
  2015-01-17 16:27 - 2015-01-17 16:27 - 00006260 _____ () C:\Users\Martin\Downloads\FRST.txt
  2015-01-17 16:25 - 2015-01-17 16:25 - 00015327 _____ () C:\Users\Martin\Desktop\LM.bat
  2015-01-17 16:23 - 2015-01-17 16:25 - 00029696 _____ () C:\Users\Martin\AppData\Local\MSGBOX.EXE
  2015-01-17 16:22 - 2015-01-17 16:23 - 00001492 _____ () C:\Users\Martin\Desktop\FRSTLauncher - odkaz.lnk
  2015-01-17 16:22 - 2015-01-17 16:22 - 00112640 _____ (forum.viry.cz) C:\Users\Martin\Downloads\FRSTLauncher.exe
  2015-01-17 15:57 - 2015-01-17 15:57 - 00001528 _____ () C:\Users\Martin\Desktop\adwcleaner_4.108 - odkaz.lnk
  2015-01-17 15:56 - 2015-01-17 15:56 - 02186752 _____ () C:\Users\Martin\Downloads\adwcleaner_4.108.exe
  2015-01-16 21:10 - 2015-01-16 21:10 - 00137888 _____ (Spotify Ltd) C:\Users\Martin\Downloads\SpotifySetup (1).exe
  2014-12-24 19:52 - 2014-12-24 19:52 - 00000000 ____D () C:\ProgramData\kuwodata
  C:\Users\Public\Fundata
  Hosts:
  EmptyTemp:
  End
  

Spustil som,ale vyšiel tento log a fix sa nedalo stlačiť.

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-01-2015 01
Ran by Martin (administrator) on MARTIN-PC on 17-01-2015 16:27:15
Running from C:\Users\Martin\Downloads
Loaded Profiles: Martin (Available profiles: Martin)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Slovenčina (Slovensko)
Internet Explorer Version 9 (Default browser: Opera)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe
(Spotify Ltd) C:\Users\Martin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2014-11-20] (Advanced Micro Devices, Inc.)
HKU\S-1-5-21-515885200-768628804-3900138106-1000\...\Run: [Spotify Web Helper] => C:\Users\Martin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1676344 2015-01-16] (Spotify Ltd)
ShellIconOverlayIdentifiers: [FunOverlay] -> {A5662DF9-0C2E-4A56-9FE1-BACFF6966D88} => C:\Users\Public\Fundata\Lucifer.dll (Funshion)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-515885200-768628804-3900138106-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://hao.360.cn/?src=lm&ls=n72df441090
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-515885200-768628804-3900138106-1000 -> {B8E20CD7-BAC2-4820-9AA6-1060B3AF25E2} URL = http://www.baidu.com/s?wd={searchTerms} ... 8051076_cb
SearchScopes: HKU\S-1-5-21-515885200-768628804-3900138106-1000 -> {C2B6FCDF-505F-4E61-9F64-71C746BBBF55} URL = https://search.yahoo.com/search?fr=chr- ... earchTerms}
BHO-x32: AFFAC708-93F0-E899-48CB-0B6F848DF109 Class -> {AFFAC708-93F0-E899-48CB-0B6F848DF109} -> C:\Program Files (x86)\BaiduAddr\{AFFAC708-93F0-E899-48CB-0B6F848DF109}\AddressBar.dll No File
Handler: kuwo - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0C} - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_257.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_257.dll ()
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

Chrome:
=======
CHR Profile: C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Docs) - C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-07-29]
CHR Extension: (Disk Google) - C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-07-29]
CHR Extension: (YouTube) - C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-07-29]
CHR Extension: (Hľadať v Google) - C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-07-29]
CHR Extension: (Linkclump) - C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfpjkncokllnfokkgpkobnkbkmelfefj [2014-12-05]
CHR Extension: (Peňaženka Google) - C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-07-29]
CHR Extension: (Gmail) - C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-07-29]
CHR Extension: (BuyNsave) - C:\ProgramData\ajalbjplilnomafjmbipcklccebcnplb\ [2014-07-29]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD FUEL Service; C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe [344064 2014-11-20] (Advanced Micro Devices, Inc.) [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AODDriver4.3; C:\Program Files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
S1 SBRE; \??\C:\Windows\system32\drivers\SBREdrv.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-17 16:27 - 2015-01-17 16:27 - 00006260 _____ () C:\Users\Martin\Downloads\FRST.txt
2015-01-17 16:26 - 2015-01-17 16:27 - 00000000 ____D () C:\FRST
2015-01-17 16:25 - 2015-01-17 16:25 - 00015327 _____ () C:\Users\Martin\Desktop\LM.bat
2015-01-17 16:23 - 2015-01-17 16:25 - 00029696 _____ () C:\Users\Martin\AppData\Local\MSGBOX.EXE
2015-01-17 16:22 - 2015-01-17 16:23 - 00001492 _____ () C:\Users\Martin\Desktop\FRSTLauncher - odkaz.lnk
2015-01-17 16:22 - 2015-01-17 16:22 - 00112640 _____ (forum.viry.cz) C:\Users\Martin\Downloads\FRSTLauncher.exe
2015-01-17 16:19 - 2015-01-17 16:19 - 02125824 _____ (Farbar) C:\Users\Martin\Downloads\FRST64.exe
2015-01-17 15:58 - 2015-01-17 15:59 - 00000000 ____D () C:\AdwCleaner
2015-01-17 15:57 - 2015-01-17 15:57 - 00001528 _____ () C:\Users\Martin\Desktop\adwcleaner_4.108 - odkaz.lnk
2015-01-17 15:56 - 2015-01-17 15:56 - 02186752 _____ () C:\Users\Martin\Downloads\adwcleaner_4.108.exe
2015-01-17 15:19 - 2015-01-17 15:19 - 00000000 ____D () C:\rsit
2015-01-17 15:19 - 2015-01-17 15:19 - 00000000 ____D () C:\Program Files\trend micro
2015-01-17 15:18 - 2015-01-17 15:18 - 01222144 _____ () C:\Users\Martin\Downloads\RSITx64.exe
2015-01-17 14:39 - 2015-01-17 14:39 - 02347384 _____ (ESET) C:\Users\Martin\Downloads\esetsmartinstaller_enu.exe
2015-01-17 14:39 - 2015-01-17 14:39 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-01-16 21:11 - 2015-01-16 21:11 - 00001772 _____ () C:\Users\Martin\Desktop\Spotify.lnk
2015-01-16 21:11 - 2015-01-16 21:11 - 00001758 _____ () C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2015-01-16 21:11 - 2015-01-16 21:11 - 00000000 ____D () C:\Users\Martin\AppData\Local\Spotify
2015-01-16 21:10 - 2015-01-16 21:10 - 00137888 _____ (Spotify Ltd) C:\Users\Martin\Downloads\SpotifySetup (1).exe
2015-01-15 12:46 - 2015-01-15 12:46 - 04877488 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2015-01-10 17:13 - 2015-01-10 17:16 - 168341243 _____ () C:\Users\Martin\Downloads\uschovna-2015-01-10.zip
2015-01-08 23:46 - 2015-01-08 23:47 - 00137888 _____ (Spotify Ltd) C:\Users\Martin\Downloads\SpotifySetup.exe
2015-01-08 22:31 - 2015-01-08 22:31 - 00003116 _____ () C:\Windows\System32\Tasks\{F529C778-212F-4A4C-A435-C1F3B293A60A}
2015-01-04 13:38 - 2015-01-04 13:38 - 00000000 ____D () C:\Users\Martin\AppData\Roaming\foobar2000
2015-01-01 21:04 - 2015-01-01 21:04 - 00374145 _____ () C:\Users\Martin\Downloads\Sťahovanie (5)
2015-01-01 21:04 - 2015-01-01 21:04 - 00374145 _____ () C:\Users\Martin\Downloads\Sťahovanie (4)
2015-01-01 21:02 - 2015-01-01 21:02 - 00578315 _____ () C:\Users\Martin\Downloads\Sťahovanie (3)
2015-01-01 21:02 - 2015-01-01 21:02 - 00578315 _____ () C:\Users\Martin\Downloads\Sťahovanie (2)
2015-01-01 21:00 - 2015-01-01 21:00 - 01161337 _____ () C:\Users\Martin\Downloads\Sťahovanie (1)
2015-01-01 21:00 - 2015-01-01 21:00 - 01161337 _____ () C:\Users\Martin\Downloads\Sťahovanie
2015-01-01 20:54 - 2015-01-01 20:54 - 00038705 _____ () C:\Users\Martin\Downloads\usenethub_com_ed114ebe-6c67-a0fb-17bf-e1cd7610f548.nzb
2014-12-31 15:15 - 2015-01-17 16:01 - 00001344 _____ () C:\Windows\setupact.log
2014-12-31 15:15 - 2015-01-17 16:00 - 00007234 _____ () C:\Windows\PFRO.log
2014-12-31 15:15 - 2014-12-31 15:15 - 00000000 _____ () C:\Windows\setuperr.log
2014-12-26 12:42 - 2015-01-17 12:09 - 00000000 ____D () C:\Users\Martin\AppData\Roaming\Zoo
2014-12-26 12:42 - 2014-12-26 12:42 - 00000000 ____D () C:\Users\Martin\AppData\Roaming\CloudMedia
2014-12-26 12:37 - 2014-12-26 12:37 - 00000000 ____D () C:\Users\Martin\AppData\Roaming\DataRepair
2014-12-26 12:32 - 2015-01-17 12:45 - 00000000 ___HD () C:\Users\Public\FunAcce
2014-12-26 12:10 - 2014-12-26 12:10 - 00000000 ____D () C:\ProgramData\{plbackup-CFE0-66E8-660553B4C955}
2014-12-25 12:23 - 2015-01-17 16:06 - 00000000 ___HD () C:\Users\Public\Fundata
2014-12-24 19:58 - 2014-12-24 19:58 - 00056648 _____ (Baidu) C:\Windows\system32\Drivers\BDMWrench.sys
2014-12-24 19:58 - 2013-12-10 08:53 - 00168264 _____ (Baidu) C:\Windows\system32\Drivers\bd0004.sys
2014-12-24 19:58 - 2013-12-10 08:53 - 00104264 _____ (Baidu) C:\Windows\system32\Drivers\bd0001.sys
2014-12-24 19:58 - 2013-12-10 08:53 - 00041800 _____ (Baidu) C:\Windows\system32\bd64_x64.dll
2014-12-24 19:58 - 2013-12-10 08:53 - 00039056 _____ (Baidu) C:\Windows\system32\bd64_x86.dll
2014-12-24 19:52 - 2014-12-24 19:52 - 00000000 ____D () C:\ProgramData\kuwodata
2014-12-24 12:43 - 2014-12-24 12:43 - 00003886 _____ () C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2014-12-23 18:08 - 2014-12-23 18:09 - 07416524 _____ () C:\Users\Martin\Downloads\7742409

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-17 16:08 - 2009-07-14 05:45 - 00021392 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-17 16:08 - 2009-07-14 05:45 - 00021392 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-17 16:05 - 2009-07-14 06:13 - 00785302 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-17 16:04 - 2014-09-23 11:23 - 01575337 _____ () C:\Windows\WindowsUpdate.log
2015-01-17 16:01 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-17 15:46 - 2014-07-29 12:15 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-17 15:16 - 2014-07-28 17:35 - 00106808 _____ () C:\Users\Martin\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-17 15:15 - 2009-07-14 05:45 - 00411112 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-01-17 15:14 - 2014-09-23 11:15 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-01-17 15:13 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files (x86)\MSBuild
2015-01-17 15:11 - 2010-11-21 16:10 - 00000000 ____D () C:\Windows\ShellNew
2015-01-17 15:11 - 2009-07-14 03:34 - 00000387 _____ () C:\Windows\win.ini
2015-01-17 15:01 - 2014-12-05 11:59 - 00000000 ____D () C:\ProgramData\3872871776
2015-01-17 13:20 - 2014-08-16 19:49 - 00000000 ____D () C:\Users\Martin\AppData\Roaming\Spotify
2015-01-15 12:46 - 2014-07-29 12:15 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-01-15 12:46 - 2014-07-29 12:15 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-15 12:46 - 2014-07-29 12:15 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-12-31 15:20 - 2014-07-28 17:51 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-12-31 15:07 - 2014-10-04 14:25 - 00000000 ____D () C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2014-12-30 13:34 - 2009-07-14 06:08 - 00032604 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-12-30 13:26 - 2014-07-29 12:14 - 00000000 ____D () C:\Users\Martin\AppData\Local\Adobe

==================== Files in the root of some directories =======
2015-01-17 16:23 - 2015-01-17 16:25 - 0029696 _____ () C:\Users\Martin\AppData\Local\MSGBOX.EXE

Some content of TEMP:
====================
C:\Users\Martin\AppData\Local\Temp\Quarantine.exe
C:\Users\Martin\AppData\Local\Temp\sqlite3.dll
C:\Users\Martin\AppData\Local\Temp\vlc-2.1.5-win32.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-14 12:27

==================== End Of Log ============================

Jdu ted na par hodin pryc, takze tam pustte MBAM... pak budeme pokracovat
Nainstalujte MBAM a udelejte vlastni sken vsech disku - http://forum.viry.cz/viewtopic.php?f=29&t=137928

• Upozorneni: tento sken zabere od 30 minut po nekolik hodin

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-01-2015 01
Ran by Martin (administrator) on MARTIN-PC on 17-01-2015 16:27:15
Running from C:\Users\Martin\Downloads
Loaded Profiles: Martin (Available profiles: Martin)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Slovenčina (Slovensko)
Internet Explorer Version 9 (Default browser: Opera)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe
(Spotify Ltd) C:\Users\Martin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2014-11-20] (Advanced Micro Devices, Inc.)
HKU\S-1-5-21-515885200-768628804-3900138106-1000\...\Run: [Spotify Web Helper] => C:\Users\Martin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1676344 2015-01-16] (Spotify Ltd)
ShellIconOverlayIdentifiers: [FunOverlay] -> {A5662DF9-0C2E-4A56-9FE1-BACFF6966D88} => C:\Users\Public\Fundata\Lucifer.dll (Funshion)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-515885200-768628804-3900138106-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://hao.360.cn/?src=lm&ls=n72df441090
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-515885200-768628804-3900138106-1000 -> {B8E20CD7-BAC2-4820-9AA6-1060B3AF25E2} URL = http://www.baidu.com/s?wd={searchTerms} ... 8051076_cb
SearchScopes: HKU\S-1-5-21-515885200-768628804-3900138106-1000 -> {C2B6FCDF-505F-4E61-9F64-71C746BBBF55} URL = https://search.yahoo.com/search?fr=chr- ... earchTerms}
BHO-x32: AFFAC708-93F0-E899-48CB-0B6F848DF109 Class -> {AFFAC708-93F0-E899-48CB-0B6F848DF109} -> C:\Program Files (x86)\BaiduAddr\{AFFAC708-93F0-E899-48CB-0B6F848DF109}\AddressBar.dll No File
Handler: kuwo - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0C} - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_257.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_257.dll ()
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

Chrome:
=======
CHR Profile: C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Docs) - C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-07-29]
CHR Extension: (Disk Google) - C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-07-29]
CHR Extension: (YouTube) - C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-07-29]
CHR Extension: (Hľadať v Google) - C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-07-29]
CHR Extension: (Linkclump) - C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfpjkncokllnfokkgpkobnkbkmelfefj [2014-12-05]
CHR Extension: (Peňaženka Google) - C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-07-29]
CHR Extension: (Gmail) - C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-07-29]
CHR Extension: (BuyNsave) - C:\ProgramData\ajalbjplilnomafjmbipcklccebcnplb\ [2014-07-29]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD FUEL Service; C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe [344064 2014-11-20] (Advanced Micro Devices, Inc.) [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AODDriver4.3; C:\Program Files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
S1 SBRE; \??\C:\Windows\system32\drivers\SBREdrv.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-17 16:27 - 2015-01-17 16:27 - 00006260 _____ () C:\Users\Martin\Downloads\FRST.txt
2015-01-17 16:26 - 2015-01-17 16:27 - 00000000 ____D () C:\FRST
2015-01-17 16:25 - 2015-01-17 16:25 - 00015327 _____ () C:\Users\Martin\Desktop\LM.bat
2015-01-17 16:23 - 2015-01-17 16:25 - 00029696 _____ () C:\Users\Martin\AppData\Local\MSGBOX.EXE
2015-01-17 16:22 - 2015-01-17 16:23 - 00001492 _____ () C:\Users\Martin\Desktop\FRSTLauncher - odkaz.lnk
2015-01-17 16:22 - 2015-01-17 16:22 - 00112640 _____ (forum.viry.cz) C:\Users\Martin\Downloads\FRSTLauncher.exe
2015-01-17 16:19 - 2015-01-17 16:19 - 02125824 _____ (Farbar) C:\Users\Martin\Downloads\FRST64.exe
2015-01-17 15:58 - 2015-01-17 15:59 - 00000000 ____D () C:\AdwCleaner
2015-01-17 15:57 - 2015-01-17 15:57 - 00001528 _____ () C:\Users\Martin\Desktop\adwcleaner_4.108 - odkaz.lnk
2015-01-17 15:56 - 2015-01-17 15:56 - 02186752 _____ () C:\Users\Martin\Downloads\adwcleaner_4.108.exe
2015-01-17 15:19 - 2015-01-17 15:19 - 00000000 ____D () C:\rsit
2015-01-17 15:19 - 2015-01-17 15:19 - 00000000 ____D () C:\Program Files\trend micro
2015-01-17 15:18 - 2015-01-17 15:18 - 01222144 _____ () C:\Users\Martin\Downloads\RSITx64.exe
2015-01-17 14:39 - 2015-01-17 14:39 - 02347384 _____ (ESET) C:\Users\Martin\Downloads\esetsmartinstaller_enu.exe
2015-01-17 14:39 - 2015-01-17 14:39 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-01-16 21:11 - 2015-01-16 21:11 - 00001772 _____ () C:\Users\Martin\Desktop\Spotify.lnk
2015-01-16 21:11 - 2015-01-16 21:11 - 00001758 _____ () C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2015-01-16 21:11 - 2015-01-16 21:11 - 00000000 ____D () C:\Users\Martin\AppData\Local\Spotify
2015-01-16 21:10 - 2015-01-16 21:10 - 00137888 _____ (Spotify Ltd) C:\Users\Martin\Downloads\SpotifySetup (1).exe
2015-01-15 12:46 - 2015-01-15 12:46 - 04877488 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2015-01-10 17:13 - 2015-01-10 17:16 - 168341243 _____ () C:\Users\Martin\Downloads\uschovna-2015-01-10.zip
2015-01-08 23:46 - 2015-01-08 23:47 - 00137888 _____ (Spotify Ltd) C:\Users\Martin\Downloads\SpotifySetup.exe
2015-01-08 22:31 - 2015-01-08 22:31 - 00003116 _____ () C:\Windows\System32\Tasks\{F529C778-212F-4A4C-A435-C1F3B293A60A}
2015-01-04 13:38 - 2015-01-04 13:38 - 00000000 ____D () C:\Users\Martin\AppData\Roaming\foobar2000
2015-01-01 21:04 - 2015-01-01 21:04 - 00374145 _____ () C:\Users\Martin\Downloads\Sťahovanie (5)
2015-01-01 21:04 - 2015-01-01 21:04 - 00374145 _____ () C:\Users\Martin\Downloads\Sťahovanie (4)
2015-01-01 21:02 - 2015-01-01 21:02 - 00578315 _____ () C:\Users\Martin\Downloads\Sťahovanie (3)
2015-01-01 21:02 - 2015-01-01 21:02 - 00578315 _____ () C:\Users\Martin\Downloads\Sťahovanie (2)
2015-01-01 21:00 - 2015-01-01 21:00 - 01161337 _____ () C:\Users\Martin\Downloads\Sťahovanie (1)
2015-01-01 21:00 - 2015-01-01 21:00 - 01161337 _____ () C:\Users\Martin\Downloads\Sťahovanie
2015-01-01 20:54 - 2015-01-01 20:54 - 00038705 _____ () C:\Users\Martin\Downloads\usenethub_com_ed114ebe-6c67-a0fb-17bf-e1cd7610f548.nzb
2014-12-31 15:15 - 2015-01-17 16:01 - 00001344 _____ () C:\Windows\setupact.log
2014-12-31 15:15 - 2015-01-17 16:00 - 00007234 _____ () C:\Windows\PFRO.log
2014-12-31 15:15 - 2014-12-31 15:15 - 00000000 _____ () C:\Windows\setuperr.log
2014-12-26 12:42 - 2015-01-17 12:09 - 00000000 ____D () C:\Users\Martin\AppData\Roaming\Zoo
2014-12-26 12:42 - 2014-12-26 12:42 - 00000000 ____D () C:\Users\Martin\AppData\Roaming\CloudMedia
2014-12-26 12:37 - 2014-12-26 12:37 - 00000000 ____D () C:\Users\Martin\AppData\Roaming\DataRepair
2014-12-26 12:32 - 2015-01-17 12:45 - 00000000 ___HD () C:\Users\Public\FunAcce
2014-12-26 12:10 - 2014-12-26 12:10 - 00000000 ____D () C:\ProgramData\{plbackup-CFE0-66E8-660553B4C955}
2014-12-25 12:23 - 2015-01-17 16:06 - 00000000 ___HD () C:\Users\Public\Fundata
2014-12-24 19:58 - 2014-12-24 19:58 - 00056648 _____ (Baidu) C:\Windows\system32\Drivers\BDMWrench.sys
2014-12-24 19:58 - 2013-12-10 08:53 - 00168264 _____ (Baidu) C:\Windows\system32\Drivers\bd0004.sys
2014-12-24 19:58 - 2013-12-10 08:53 - 00104264 _____ (Baidu) C:\Windows\system32\Drivers\bd0001.sys
2014-12-24 19:58 - 2013-12-10 08:53 - 00041800 _____ (Baidu) C:\Windows\system32\bd64_x64.dll
2014-12-24 19:58 - 2013-12-10 08:53 - 00039056 _____ (Baidu) C:\Windows\system32\bd64_x86.dll
2014-12-24 19:52 - 2014-12-24 19:52 - 00000000 ____D () C:\ProgramData\kuwodata
2014-12-24 12:43 - 2014-12-24 12:43 - 00003886 _____ () C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2014-12-23 18:08 - 2014-12-23 18:09 - 07416524 _____ () C:\Users\Martin\Downloads\7742409

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-17 16:08 - 2009-07-14 05:45 - 00021392 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-17 16:08 - 2009-07-14 05:45 - 00021392 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-17 16:05 - 2009-07-14 06:13 - 00785302 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-17 16:04 - 2014-09-23 11:23 - 01575337 _____ () C:\Windows\WindowsUpdate.log
2015-01-17 16:01 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-17 15:46 - 2014-07-29 12:15 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-17 15:16 - 2014-07-28 17:35 - 00106808 _____ () C:\Users\Martin\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-17 15:15 - 2009-07-14 05:45 - 00411112 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-01-17 15:14 - 2014-09-23 11:15 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-01-17 15:13 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files (x86)\MSBuild
2015-01-17 15:11 - 2010-11-21 16:10 - 00000000 ____D () C:\Windows\ShellNew
2015-01-17 15:11 - 2009-07-14 03:34 - 00000387 _____ () C:\Windows\win.ini
2015-01-17 15:01 - 2014-12-05 11:59 - 00000000 ____D () C:\ProgramData\3872871776
2015-01-17 13:20 - 2014-08-16 19:49 - 00000000 ____D () C:\Users\Martin\AppData\Roaming\Spotify
2015-01-15 12:46 - 2014-07-29 12:15 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-01-15 12:46 - 2014-07-29 12:15 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-15 12:46 - 2014-07-29 12:15 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-12-31 15:20 - 2014-07-28 17:51 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-12-31 15:07 - 2014-10-04 14:25 - 00000000 ____D () C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2014-12-30 13:34 - 2009-07-14 06:08 - 00032604 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-12-30 13:26 - 2014-07-29 12:14 - 00000000 ____D () C:\Users\Martin\AppData\Local\Adobe

==================== Files in the root of some directories =======
2015-01-17 16:23 - 2015-01-17 16:25 - 0029696 _____ () C:\Users\Martin\AppData\Local\MSGBOX.EXE

Some content of TEMP:
====================
C:\Users\Martin\AppData\Local\Temp\Quarantine.exe
C:\Users\Martin\AppData\Local\Temp\sqlite3.dll
C:\Users\Martin\AppData\Local\Temp\vlc-2.1.5-win32.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-14 12:27

==================== End Of Log ============================

ardon tu je ten log z Malwarebytes


Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 17. 1. 2015
Scan Time: 17:28:19
Logfile: malwarebytes log.txt
Administrator: Yes

Version: 2.00.4.1028
Malware Database: v2015.01.17.04
Rootkit Database: v2015.01.14.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Martin

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 319306
Time Elapsed: 15 min, 12 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 1
PUP.Funshion, C:\Users\Martin\AppData\Roaming\CloudMedia\JadeHe.dat, , [47318d6b92f75ed8292a4d43d42cf808],

Registry Keys: 32
PUP.Optional.Funshion, HKLM\SOFTWARE\CLASSES\APPID\{1DD31B76-C57E-49ba-94BC-BF53F0C82CD4}, , [b6c29464513852e4b9f820e4f21110f0],
PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\{1DD31B76-C57E-49BA-94BC-BF53F0C82CD4}, , [b6c29464513852e4b9f820e4f21110f0],
PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{1DD31B76-C57E-49BA-94BC-BF53F0C82CD4}, , [b6c29464513852e4b9f820e4f21110f0],
PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{11CC93E4-0BE6-4f8f-82AA-D577FB955B05}, , [83f535c3bdcc85b104aca26249ba629e],
PUP.Optional.Funshion, HKLM\SOFTWARE\CLASSES\TYPELIB\{F9BC0421-BB5C-447d-8547-BB45AFA80A4D}, , [83f535c3bdcc85b104aca26249ba629e],
PUP.Optional.Funshion, HKLM\SOFTWARE\CLASSES\INTERFACE\{4D89001B-5B5B-4E76-A1F5-638E49DB7A58}, , [83f535c3bdcc85b104aca26249ba629e],
PUP.Optional.Funshion, HKLM\SOFTWARE\CLASSES\INTERFACE\{FA677CC1-D6FA-4B55-825D-6C493F56ED84}, , [83f535c3bdcc85b104aca26249ba629e],
PUP.Optional.Funshion, HKLM\SOFTWARE\CLASSES\INTERFACE\{FE575A61-09BD-4F3A-B8B5-B55B813B44EC}, , [83f535c3bdcc85b104aca26249ba629e],
PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{4D89001B-5B5B-4E76-A1F5-638E49DB7A58}, , [83f535c3bdcc85b104aca26249ba629e],
PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{FA677CC1-D6FA-4B55-825D-6C493F56ED84}, , [83f535c3bdcc85b104aca26249ba629e],
PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{FE575A61-09BD-4F3A-B8B5-B55B813B44EC}, , [83f535c3bdcc85b104aca26249ba629e],
PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{F9BC0421-BB5C-447d-8547-BB45AFA80A4D}, , [83f535c3bdcc85b104aca26249ba629e],
PUP.Optional.Funshion, HKLM\SOFTWARE\CLASSES\AddressSearch.JsObject.1, , [83f535c3bdcc85b104aca26249ba629e],
PUP.Optional.Funshion, HKLM\SOFTWARE\CLASSES\AddressSearch.JsObject, , [83f535c3bdcc85b104aca26249ba629e],
PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\CLASSES\AddressSearch.JsObject, , [83f535c3bdcc85b104aca26249ba629e],
PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\CLASSES\AddressSearch.JsObject.1, , [83f535c3bdcc85b104aca26249ba629e],
PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{11CC93E4-0BE6-4F8F-82AA-D577FB955B05}, , [83f535c3bdcc85b104aca26249ba629e],
PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{91878E42-FC03-4785-B513-1F9E613D1027}, , [3d3b9662771274c2a10e05ff2dd65ca4],
PUP.Optional.Funshion, HKLM\SOFTWARE\CLASSES\TYPELIB\{D02E3AB9-7796-40cb-BDFC-20D834FE1F75}, , [3d3b9662771274c2a10e05ff2dd65ca4],
PUP.Optional.Funshion, HKLM\SOFTWARE\CLASSES\INTERFACE\{FCB380C4-D350-44BE-8791-50216F4747AC}, , [3d3b9662771274c2a10e05ff2dd65ca4],
PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{FCB380C4-D350-44BE-8791-50216F4747AC}, , [3d3b9662771274c2a10e05ff2dd65ca4],
PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{D02E3AB9-7796-40cb-BDFC-20D834FE1F75}, , [3d3b9662771274c2a10e05ff2dd65ca4],
PUP.Optional.Funshion, HKLM\SOFTWARE\CLASSES\ASBarBroker.BDBroker.1, , [3d3b9662771274c2a10e05ff2dd65ca4],
PUP.Optional.Funshion, HKLM\SOFTWARE\CLASSES\ASBarBroker.BDBroker, , [3d3b9662771274c2a10e05ff2dd65ca4],
PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\CLASSES\ASBarBroker.BDBroker, , [3d3b9662771274c2a10e05ff2dd65ca4],
PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\CLASSES\ASBarBroker.BDBroker.1, , [3d3b9662771274c2a10e05ff2dd65ca4],
PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{FBEDBA6C-44A2-43b9-BD49-20EB6E0C4E86}, , [5226c335a2e7e94d7c32cf35b053e11f],
PUP.Optional.Funshion, HKLM\SOFTWARE\CLASSES\AddressSearch.SnavHttpProtocol.1, , [5226c335a2e7e94d7c32cf35b053e11f],
PUP.Optional.Funshion, HKLM\SOFTWARE\CLASSES\AddressSearch.SnavHttpProtocol, , [5226c335a2e7e94d7c32cf35b053e11f],
PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\CLASSES\AddressSearch.SnavHttpProtocol, , [5226c335a2e7e94d7c32cf35b053e11f],
PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\CLASSES\AddressSearch.SnavHttpProtocol.1, , [5226c335a2e7e94d7c32cf35b053e11f],
Adware.BDSearch, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{E5D5D4A1-17F0-41D7-B1C6-0979F91E6F46}, , [aacea6529cedb482a96247c1838056aa],

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 2
Rogue.Multiple, C:\ProgramData\3872871776, , [1a5e9c5cbdcc2016442e61c8719253ad],
PUP.Optional.MultiPlug.A, C:\Program Files (x86)\YoutubeAdBlocke, , [ff798c6c3356aa8cddb94908b35029d7],

Files: 11
PUP.Funshion, C:\Users\Martin\AppData\Roaming\CloudMedia\JadeHe.dat, , [47318d6b92f75ed8292a4d43d42cf808],
Riskware.Tool.CK, C:\Users\Martin\Downloads\Win-7-Legalizator.rar, , [92e6bf39602994a2ecb4e1452adb4bb5],
PUP.Funshion, C:\Users\Public\FunAcce\Condor.dll, , [df9956a236539f97de7518786b95f10f],
PUP.Funshion, C:\Users\Public\FunAcce\Cuckoo.dll, , [572174845b2e5fd70f44aee228d840c0],
PUP.Funshion, C:\Users\Public\FunAcce\FunAcce.dll, , [4137b6427a0f71c5292a652bb050f50b],
PUP.Funshion, C:\Users\Public\FunAcce\FunAcceil.dll, , [f08835c3761390a6242fe0b05ca4b44c],
PUP.Funshion, C:\Users\Public\FunAcce\Glede.dll, , [443404f4fe8bd85e5ff4464a26dad828],
PUP.Funshion, C:\Users\Public\Fundata\drikold.zip, , [84f49464d2b71c1a094a355bdd2341bf],
PUP.Funshion, C:\Users\Public\Fundata\JadeHe.dll, , [d1a704f478116fc7d2815e324ab629d7],
PUP.Funshion, C:\Users\Public\Fundata\Turkey.dll, , [384050a8434678be9cb7e5ab619fd32d],
PUP.Funshion, C:\Users\Public\Fundata\gma.dll, , [d99fc632b0d950e6351e216f35cb9868],

Physical Sectors: 0
(No malicious items detected)


(end)

Toto byl jen sken hrozeb... nepostupujete podle navodu... dejte prosim vlastni sken vsech disku, jak je uvedeno v obrazkovem navodu http://forum.viry.cz/viewtopic.php?f=29&t=137928

Nový log:


Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 18. 1. 2015
Scan Time: 11:56:52
Logfile: text log.txt
Administrator: Yes

Version: 2.00.4.1028
Malware Database: v2015.01.18.05
Rootkit Database: v2015.01.14.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Martin

Scan Type: Custom Scan
Result: Completed
Objects Scanned: 405414
Time Elapsed: 41 min, 4 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 1
PUP.Funshion, C:\Users\Martin\AppData\Roaming\CloudMedia\JadeHe.dat, , [7b628177b2d738fe6b08b4dc5fa1e31d],

Registry Keys: 32
PUP.Optional.Funshion, HKLM\SOFTWARE\CLASSES\APPID\{1DD31B76-C57E-49ba-94BC-BF53F0C82CD4}, , [be1f39bfacdd59dd808fc04511f29c64],
PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\{1DD31B76-C57E-49BA-94BC-BF53F0C82CD4}, , [be1f39bfacdd59dd808fc04511f29c64],
PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{1DD31B76-C57E-49BA-94BC-BF53F0C82CD4}, , [be1f39bfacdd59dd808fc04511f29c64],
PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{11CC93E4-0BE6-4f8f-82AA-D577FB955B05}, , [db02ce2a3c4d300659b5e4211fe45aa6],
PUP.Optional.Funshion, HKLM\SOFTWARE\CLASSES\TYPELIB\{F9BC0421-BB5C-447d-8547-BB45AFA80A4D}, , [db02ce2a3c4d300659b5e4211fe45aa6],
PUP.Optional.Funshion, HKLM\SOFTWARE\CLASSES\INTERFACE\{4D89001B-5B5B-4E76-A1F5-638E49DB7A58}, , [db02ce2a3c4d300659b5e4211fe45aa6],
PUP.Optional.Funshion, HKLM\SOFTWARE\CLASSES\INTERFACE\{FA677CC1-D6FA-4B55-825D-6C493F56ED84}, , [db02ce2a3c4d300659b5e4211fe45aa6],
PUP.Optional.Funshion, HKLM\SOFTWARE\CLASSES\INTERFACE\{FE575A61-09BD-4F3A-B8B5-B55B813B44EC}, , [db02ce2a3c4d300659b5e4211fe45aa6],
PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{4D89001B-5B5B-4E76-A1F5-638E49DB7A58}, , [db02ce2a3c4d300659b5e4211fe45aa6],
PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{FA677CC1-D6FA-4B55-825D-6C493F56ED84}, , [db02ce2a3c4d300659b5e4211fe45aa6],
PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{FE575A61-09BD-4F3A-B8B5-B55B813B44EC}, , [db02ce2a3c4d300659b5e4211fe45aa6],
PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{F9BC0421-BB5C-447d-8547-BB45AFA80A4D}, , [db02ce2a3c4d300659b5e4211fe45aa6],
PUP.Optional.Funshion, HKLM\SOFTWARE\CLASSES\AddressSearch.JsObject.1, , [db02ce2a3c4d300659b5e4211fe45aa6],
PUP.Optional.Funshion, HKLM\SOFTWARE\CLASSES\AddressSearch.JsObject, , [db02ce2a3c4d300659b5e4211fe45aa6],
PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\CLASSES\AddressSearch.JsObject, , [db02ce2a3c4d300659b5e4211fe45aa6],
PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\CLASSES\AddressSearch.JsObject.1, , [db02ce2a3c4d300659b5e4211fe45aa6],
PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{11CC93E4-0BE6-4F8F-82AA-D577FB955B05}, , [db02ce2a3c4d300659b5e4211fe45aa6],
PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{91878E42-FC03-4785-B513-1F9E613D1027}, , [03daca2e8207171f709d08fd0cf755ab],
PUP.Optional.Funshion, HKLM\SOFTWARE\CLASSES\TYPELIB\{D02E3AB9-7796-40cb-BDFC-20D834FE1F75}, , [03daca2e8207171f709d08fd0cf755ab],
PUP.Optional.Funshion, HKLM\SOFTWARE\CLASSES\INTERFACE\{FCB380C4-D350-44BE-8791-50216F4747AC}, , [03daca2e8207171f709d08fd0cf755ab],
PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{FCB380C4-D350-44BE-8791-50216F4747AC}, , [03daca2e8207171f709d08fd0cf755ab],
PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{D02E3AB9-7796-40cb-BDFC-20D834FE1F75}, , [03daca2e8207171f709d08fd0cf755ab],
PUP.Optional.Funshion, HKLM\SOFTWARE\CLASSES\ASBarBroker.BDBroker.1, , [03daca2e8207171f709d08fd0cf755ab],
PUP.Optional.Funshion, HKLM\SOFTWARE\CLASSES\ASBarBroker.BDBroker, , [03daca2e8207171f709d08fd0cf755ab],
PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\CLASSES\ASBarBroker.BDBroker, , [03daca2e8207171f709d08fd0cf755ab],
PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\CLASSES\ASBarBroker.BDBroker.1, , [03daca2e8207171f709d08fd0cf755ab],
PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{FBEDBA6C-44A2-43b9-BD49-20EB6E0C4E86}, , [b72620d8e0a92610010b699c8e7525db],
PUP.Optional.Funshion, HKLM\SOFTWARE\CLASSES\AddressSearch.SnavHttpProtocol.1, , [b72620d8e0a92610010b699c8e7525db],
PUP.Optional.Funshion, HKLM\SOFTWARE\CLASSES\AddressSearch.SnavHttpProtocol, , [b72620d8e0a92610010b699c8e7525db],
PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\CLASSES\AddressSearch.SnavHttpProtocol, , [b72620d8e0a92610010b699c8e7525db],
PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\CLASSES\AddressSearch.SnavHttpProtocol.1, , [b72620d8e0a92610010b699c8e7525db],
Adware.BDSearch, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{E5D5D4A1-17F0-41D7-B1C6-0979F91E6F46}, , [39a4e810b1d8171f6801aa5ed42fbd43],

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 2
Rogue.Multiple, C:\ProgramData\3872871776, , [f1ec6c8c3950122424acd752e2211ce4],
PUP.Optional.MultiPlug.A, C:\Program Files (x86)\YoutubeAdBlocke, , [419c5b9d890057df985c064bde259b65],

Files: 11
PUP.Funshion, C:\Users\Martin\AppData\Roaming\CloudMedia\JadeHe.dat, , [7b628177b2d738fe6b08b4dc5fa1e31d],
Riskware.Tool.CK, C:\Users\Martin\Downloads\Win-7-Legalizator.rar, , [3f9ed0282e5b91a5887b3fe8030245bb],
PUP.Funshion, C:\Users\Public\FunAcce\Condor.dll, , [845909ef058468ce80f3216f90707b85],
PUP.Funshion, C:\Users\Public\FunAcce\Cuckoo.dll, , [28b5c434cabf3afcd1a2d7b901ff3cc4],
PUP.Funshion, C:\Users\Public\FunAcce\FunAcce.dll, , [3da0f2060485ab8b9cd7ddb3c83802fe],
PUP.Funshion, C:\Users\Public\FunAcce\FunAcceil.dll, , [1ac37088cfbaed49a6cdc5cbfe028b75],
PUP.Funshion, C:\Users\Public\FunAcce\Glede.dll, , [f0edd91f256469cd21528f0123ddfb05],
PUP.Funshion, C:\Users\Public\Fundata\drikold.zip, , [21bcc6328900fd3990e3d1bff20e8b75],
PUP.Funshion, C:\Users\Public\Fundata\JadeHe.dll, , [39a48573c5c4f83e2c475d3337c930d0],
PUP.Funshion, C:\Users\Public\Fundata\Turkey.dll, , [706d22d6ec9d7db9e78c513f3ec28e72],
PUP.Funshion, C:\Users\Public\Fundata\gma.dll, , [2cb1c434444593a39ed596fa8b75de22],

Physical Sectors: 0
(No malicious items detected)


(end)

Jedna technicka... je tento operacni system legalne zakoupen?

Z CD mi ho dal nanštalovať kamarád.Ak máte podozrenie,že nie,dám to odinštalovať.