VIRY.CZ

Dobrý den, při otevírání oken ve Firefoxu se otevírá i okno s odkazem na alibaba.com. Prosím o pomoc. Díky

Zdravím!
Dejte log FRST: http://forum.viry.cz/viewtopic.php?f=13&t=133100 .

Additional scan result of Farbar Recovery Scan Tool (x64) Version:12-10-2015
Ran by Leoš (2015-10-14 18:17:54)
Running from C:\Users\Leoš\Downloads
Windows 8.1 Pro (X64) (2015-09-20 10:51:14)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-3346216350-3353850354-1984704180-500 - Administrator - Disabled)
Guest (S-1-5-21-3346216350-3353850354-1984704180-501 - Limited - Disabled)
Leoš (S-1-5-21-3346216350-3353850354-1984704180-1001 - Administrator - Enabled) => C:\Users\Leoš

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Acrobat Reader DC - Czech (HKLM-x32\...\{AC76BA86-7AD7-1029-7B44-AC0F074E4100}) (Version: 15.008.20082 - Adobe Systems Incorporated)
Adobe Flash Player 19 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 19.0.0.207 - Adobe Systems Incorporated)
Ashampoo Burning Studio FREE v.1.14.5 (HKLM-x32\...\{91B33C97-91F8-FFB3-581B-BC952C901685}_is1) (Version: 1.14.5 - Ashampoo GmbH & Co. KG)
Brother MFL-Pro Suite DCP-L2520DW series (HKLM-x32\...\{F8ECC2FD-CE2B-4ED4-BDCC-90D0D34206FD}) (Version: 1.0.2.0 - Brother Industries, Ltd.)
Canon Utilities Digital Photo Professional (HKLM-x32\...\Digital Photo Professional) (Version: 3.14.40.0 - Canon Inc.)
Canon Utilities PhotoStitch (HKLM-x32\...\PhotoStitch) (Version: 3.1.23.47 - Canon Inc.)
Canon Utilities Picture Style Editor (HKLM-x32\...\Picture Style Editor) (Version: 1.14.20.0 - Canon Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 3.20 - Piriform)
Cool & Quiet (HKLM-x32\...\{1ADE1AA0-7F82-4BB1-B1BD-727DE438057B}) (Version: - )
FastShare.cz verze 2.3.1 (HKLM-x32\...\FastShare.cz_is1) (Version: 2.3.1 - )
KMSpico (HKLM\...\{8B29D47F-92E2-4C20-9EE0-F710991F5D7C}_is1) (Version: - )
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 41.0.1 (x86 cs) (HKLM-x32\...\Mozilla Firefox 41.0.1 (x86 cs)) (Version: 41.0.1 - Mozilla)
SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 6.0.1206 - SUPERAntiSpyware.com)
Total Commander 64-bit (Remove or Repair) (HKLM\...\Totalcmd64) (Version: 8.0 - Ghisler Software GmbH)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.1 - VideoLAN)
WinRAR 4.01 (64-bit) (HKLM\...\WinRAR archiver) (Version: 4.01.0 - win.rar GmbH)
Zoner Photo Studio 17 (HKLM\...\ZonerPhotoStudio17_CZ_is1) (Version: 17.0.1.12 - ZONER software)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Restore Points =========================

07-10-2015 11:11:29 Naplánovaný kontrolní bod
12-10-2015 20:21:29 Installed Cool & Quiet

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts


==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0213C973-3997-4893-9B29-BA7AFDA637C9} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2012-06-22] (Piriform Ltd)
Task: {07182133-F64F-44CE-A60C-C250893AE81D} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-09-14] (Adobe Systems Incorporated)
Task: {23C5457B-A269-45AC-8F28-498832E5FD9C} - System32\Tasks\LaunchPreSignup => C:\Program Files (x86)\OLBPre\OLBPre.exe <==== ATTENTION
Task: {58EC93DD-6BC6-46F3-B5E7-CB9457E718C7} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-10-14] (Adobe Systems Incorporated)
Task: {6FD28D37-844D-4B2D-B570-96A4BB23E954} - System32\Tasks\AutoPico Daily Restart => C:\Program Files\KMSpico\AutoPico.exe [2015-08-30] (@ByELDI)
Task: {806314E0-EB4F-47FD-ADA6-BEB5C6CCCDAB} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-08-26] (Microsoft Corporation)
Task: {AA6BCA07-44C6-4E18-B628-B249AF61C5F4} - System32\Tasks\LuckyBrowse => C:\Program Files (x86)\LuckyBrowse\app\luckybrowse.exe

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\ctzBkfUaX2zSeSUBp6XCUand.job => C:\Users\Leo�\AppData\Roaming\ctzBkfUaX2zSeSUBp6XCUand.exe <==== ATTENTION

==================== Loaded Modules (Whitelisted) ==============


==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3346216350-3353850354-1984704180-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Leoš\AppData\Local\Microsoft\Windows\Themes\Reflectio\DesktopBackground\reflections7.jpg
DNS Servers: 88.146.192.1 - 8.8.8.8
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: SUPERAntiSpyware => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
MSCONFIG\startupreg: Zoner Photo Studio Autoupdate => "C:\Program Files\Zoner\Photo Studio 17\Program32\ZPSTRAY.EXE"
HKLM\...\StartupApproved\Run32: => "ControlCenter4"
HKLM\...\StartupApproved\Run32: => "GrooveMonitor"
HKU\S-1-5-21-3346216350-3353850354-1984704180-1001\...\StartupApproved\Run: => "Zoner Photo Studio Autoupdate"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [WCF-NetTcpActivator-In-TCP-64bit] => (Allow) LPort=808
FirewallRules: [{C390DE01-DB0A-4DA7-9044-47E7EF3AF440}] => (Allow) LPort=1688
FirewallRules: [{20F133B0-5B86-4757-8F58-8FE0BCA12724}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe
FirewallRules: [{1631D45A-B090-4E07-931A-37035FD02267}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe
FirewallRules: [{AD630641-2548-42FD-BFAD-2B035EA7BBF0}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{19848951-2065-42A7-B480-A0339A9A13A7}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{6421DE1F-C973-4EAD-A9DC-39D2D9DDA57D}] => (Allow) C:\Program Files\Zoner\Photo Studio 17\Program32\MediaServer.exe

==================== Faulty Device Manager Devices =============

Name: Standardní řadič disketové jednotky
Description: Standardní řadič disketové jednotky
Class Guid: {4d36e969-e325-11ce-bfc1-08002be10318}
Manufacturer: (Standardní řadiče disketových jednotek)
Service: fdc
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Myš Microsoft pro port PS/2
Description: Myš Microsoft pro port PS/2
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: Standardní klávesnice PS/2
Description: Standardní klávesnice PS/2
Class Guid: {4d36e96b-e325-11ce-bfc1-08002be10318}
Manufacturer: (Standardní klávesnice)
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (10/12/2015 08:21:36 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Služba Šifrování selhala při volání OnIdentity() v objektu System Writer.

Details:
AddLegacyDriverFiles: Unable to back up image of binary Protokol Microsoft LLDP (Link-Layer Discovery Protocol).

System Error:
Přístup byl odepřen.
.

Error: (10/07/2015 11:11:35 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Služba Šifrování selhala při volání OnIdentity() v objektu System Writer.

Details:
AddLegacyDriverFiles: Unable to back up image of binary Protokol Microsoft LLDP (Link-Layer Discovery Protocol).

System Error:
Přístup byl odepřen.
.

Error: (10/03/2015 10:59:44 PM) (Source: ESENT) (EventID: 215) (User: )
Description: WinMail (1404) WindowsMail0: Zálohování bylo ukončeno, protože bylo zastaveno klientem nebo protože se nezdařilo připojení ke klientovi.

Error: (09/29/2015 12:02:38 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Služba Šifrování selhala při volání OnIdentity() v objektu System Writer.

Details:
AddLegacyDriverFiles: Unable to back up image of binary Protokol Microsoft LLDP (Link-Layer Discovery Protocol).

System Error:
Přístup byl odepřen.
.

Error: (09/27/2015 03:40:23 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Program Zps.exe verze 17.0.1.12 přestal spolupracovat se systémem Windows a byl ukončen. Chcete-li zjistit, zda je k dispozici více informací o tomto problému, vyhledejte historii problému v ovládacím panelu Centrum akcí.

ID procesu: 7a8

Čas spuštění: 01d0f91ecae8283b

Čas ukončení: 105

Cesta k aplikaci: C:\Program Files\Zoner\Photo Studio 17\Program64\Zps.exe

ID hlášení: 4a638e80-651d-11e5-825f-001d606e62cd

Úplný název chybujícího balíčku:

ID aplikace související s chybujícím balíčkem:

Error: (09/27/2015 12:00:01 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Služba Šifrování selhala při volání OnIdentity() v objektu System Writer.

Details:
AddLegacyDriverFiles: Unable to back up image of binary Protokol Microsoft LLDP (Link-Layer Discovery Protocol).

System Error:
Přístup byl odepřen.
.

Error: (09/25/2015 08:48:34 PM) (Source: Microsoft-Windows-WMI) (EventID: 10) (User: NT AUTHORITY)
Description: Filtr událostí s dotazem select * from __InstanceModificationEvent where targetinstance isa '__ArbitratorConfiguration' nebylo možné znovu aktivovat v oboru názvů //./root, protože došlo k chybě 0x80041033. Dokud nebude problém odstraněn, nebude možné události prostřednictvím tohoto filtru doručovat.

Error: (09/25/2015 08:48:34 PM) (Source: Microsoft-Windows-WMI) (EventID: 24) (User: NT AUTHORITY)
Description: Zprostředkovatel událostí $Core se pokusil zaregistrovat dotaz select * from __TimerEvent, jehož cílová třída __TimerEvent v oboru názvů //./root/subscription neexistuje. Dotaz bude ignorován.

Error: (09/25/2015 08:48:34 PM) (Source: Microsoft-Windows-WMI) (EventID: 24) (User: NT AUTHORITY)
Description: Zprostředkovatel událostí $Core se pokusil zaregistrovat dotaz select * from __SystemEvent, jehož cílová třída __SystemEvent v oboru názvů //./root/subscription neexistuje. Dotaz bude ignorován.

Error: (09/25/2015 08:48:34 PM) (Source: Microsoft-Windows-WMI) (EventID: 24) (User: NT AUTHORITY)
Description: Zprostředkovatel událostí $Core se pokusil zaregistrovat dotaz select * from __NamespaceOperationEvent, jehož cílová třída __NamespaceOperationEvent v oboru názvů //./root/subscription neexistuje. Dotaz bude ignorován.


System errors:
=============
Error: (10/14/2015 11:23:22 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Služba ASInsHelp neuspěla při spuštění v důsledku následující chyby:
%%2

Error: (10/13/2015 05:18:23 PM) (Source: DCOM) (EventID: 10010) (User: nadoma)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}

Error: (10/13/2015 05:17:53 PM) (Source: DCOM) (EventID: 10010) (User: nadoma)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}

Error: (10/12/2015 08:47:21 PM) (Source: DCOM) (EventID: 10010) (User: nadoma)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}

Error: (10/12/2015 08:46:50 PM) (Source: DCOM) (EventID: 10010) (User: nadoma)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}

Error: (10/12/2015 08:36:12 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Služba ASInsHelp neuspěla při spuštění v důsledku následující chyby:
%%2

Error: (10/12/2015 07:37:57 PM) (Source: Microsoft-Windows-Kernel-Boot) (EventID: 29) (User: NT AUTHORITY)
Description: 32212265135626510238285008

Error: (10/12/2015 07:38:30 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Předchozí vypnutí systému (23:21:54, ‎11. ‎10. ‎2015) bylo neočekávané.

Error: (10/11/2015 01:31:12 PM) (Source: DCOM) (EventID: 10010) (User: nadoma)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}

Error: (10/11/2015 01:30:42 PM) (Source: DCOM) (EventID: 10010) (User: nadoma)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}


==================== Memory info ===========================

Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 4400+
Percentage of memory in use: 34%
Total physical RAM: 3071.3 MB
Available physical RAM: 2021.63 MB
Total Virtual: 6143.3 MB
Available Virtual: 5154.28 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:298.09 GB) (Free:265.96 GB) NTFS ==>[drive with boot components (obtained from BCD)]
Drive d: (Data) (Fixed) (Total:931.51 GB) (Free:620.38 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 0DB4331A)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 822A94F3)
Partition 1: (Active) - (Size=298.1 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

Toto je log Additional. Je také důležitý, ale ještě je tam jeden - FRST. Ten potřebuji vidět.

Log z FRST se mi sem ale nevejde.

Klidně rozdělte na více částí, nebo někam upněte a dejte odkaz.

Spusťte nyní tuto utilitu:

Stáhněte AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner
Uložte na plochu
Ukončete všechny programy
Klikněte nejprve na >Scan< a pak na >Clean<.
Proběhne skenováni a pak se objeví log, který sem vložte.

# AdwCleaner v5.013 - Logfile created 14/10/2015 at 21:36:19
# Updated 09/10/2015 by Xplode
# Database : 2015-10-13.2 [Server]
# Operating system : Windows 8.1 Pro (x64)
# Username : Leoš - NADOMA
# Running from : C:\Users\Leoš\Desktop\adwcleaner_5.013.exe
# Option : Cleaning
# Support : http://toolslib.net/forum

***** [ Services ] *****


***** [ Folders ] *****

[-] Folder Deleted : C:\Program Files (x86)\globalUpdate
[-] Folder Deleted : C:\ProgramData\LuckyBrowse
[-] Folder Deleted : C:\Users\Leoš\AppData\Local\globalUpdate

***** [ Files ] *****

[-] File Deleted : C:\Users\Leoš\AppData\Roaming\Mozilla\Firefox\Profiles\tp7dqh5i.default\user.js

***** [ DLLs ] *****


***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****

[-] Task Deleted : LaunchPreSignup
[-] Task Deleted : amiupdaterExd
[-] Task Deleted : amiupdaterExi
[-] Task Deleted : LuckyBrowse

***** [ Registry ] *****

[-] Key Deleted : HKCU\Software\Mozilla\Extends
[-] Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [deskCutv2@gmail.com]
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F83D1872-D9FF-47F8-B5A0-49CC51E24EE8}
[-] Key Deleted : HKU\.DEFAULT\Software\AppDataLow\Software\_CrossriderRegNamePlaceHolder_
[-] Key Deleted : HKCU\Software\GlobalUpdate
[-] Key Deleted : HKCU\Software\OCS
[-] Key Deleted : HKCU\Software\Crossbrowse
[-] Key Deleted : HKCU\Software\YorkNewCin
[-] Key Deleted : HKCU\Software\HighDefAction
[-] Key Deleted : HKCU\Software\ArenaHD
[-] Key Deleted : HKCU\Software\PRODUCTSETUP
[-] Key Deleted : HKCU\Software\AppDataLow\Software\Crossrider
[-] Key Deleted : HKLM\SOFTWARE\AppDataLow\SOFTWARE\Crossrider
[-] Key Deleted : HKLM\SOFTWARE\AppDataLow\SOFTWARE\_CrossriderRegNamePlaceHolder_
[-] Key Deleted : HKLM\SOFTWARE\YorkNewCin
[-] Key Deleted : HKLM\SOFTWARE\HighDefAction
[-] Key Deleted : HKLM\SOFTWARE\oursurfingSoftware
[-] Key Deleted : HKLM\SOFTWARE\ArenaHD
[-] Key Deleted : HKLM\SOFTWARE\RayDld
[-] Key Deleted : HKLM\SOFTWARE\ihpmserver
[-] Key Deleted : HKLM\SOFTWARE\LuckyBrowse
[!] Key Not Deleted : [x64] HKCU\Software\GlobalUpdate
[!] Key Not Deleted : [x64] HKCU\Software\OCS
[!] Key Not Deleted : [x64] HKCU\Software\Crossbrowse
[!] Key Not Deleted : [x64] HKCU\Software\YorkNewCin
[!] Key Not Deleted : [x64] HKCU\Software\HighDefAction
[!] Key Not Deleted : [x64] HKCU\Software\ArenaHD
[!] Key Not Deleted : [x64] HKCU\Software\PRODUCTSETUP
[-] Key Deleted : [x64] HKLM\SOFTWARE\YorkNewCin
[-] Key Deleted : [x64] HKLM\SOFTWARE\HighDefAction
[-] Key Deleted : [x64] HKLM\SOFTWARE\ArenaHD
[!] Key Not Deleted : HKU\.DEFAULT\Software\AppDataLow\Software\_CrossriderRegNamePlaceHolder_
[!] Key Not Deleted : HKU\S-1-5-21-3346216350-3353850354-1984704180-1001\Software\AppDataLow\Software\Crossrider
[!] Key Not Deleted : HKU\S-1-5-18\Software\AppDataLow\Software\_CrossriderRegNamePlaceHolder_
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GLOBALUPDATE.EXE
[-] Data Restored : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
[-] Data Restored : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Page_URL]
[-] Data Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
[-] Data Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
[-] Data Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
[-] Data Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
[-] Data Restored : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
[-] Data Restored : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
[-] Data Restored : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
[-] Data Restored : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
[-] Data Restored : HKU\S-1-5-21-3346216350-3353850354-1984704180-1001\Software\Microsoft\Internet Explorer\Main [Start Page]
[-] Data Restored : HKU\S-1-5-21-3346216350-3353850354-1984704180-1001\Software\Microsoft\Internet Explorer\Main [Default_Page_URL]
[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
[-] Data Restored : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [DefaultScope]
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
[-] Data Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes [DefaultScope]
[!] Key Not Deleted : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
[-] Data Restored : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes [DefaultScope]
[-] Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
[-] Data Restored : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes [DefaultScope]
[!] Key Not Deleted : HKU\S-1-5-21-3346216350-3353850354-1984704180-1001\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
[-] Data Restored : HKU\S-1-5-21-3346216350-3353850354-1984704180-1001\Software\Microsoft\Internet Explorer\SearchScopes [DefaultScope]

***** [ Web browsers ] *****

[-] [C:\Users\Leoš\AppData\Roaming\Mozilla\Firefox\Profiles\tp7dqh5i.default\prefs.js] [Preference] Deleted : user_pref("browser.newtab.url", "chrome://quick_start/content/index.html");
[-] [C:\Users\Leoš\AppData\Roaming\Mozilla\Firefox\Profiles\tp7dqh5i.default\prefs.js] [Preference] Deleted : user_pref("browser.search.defaultenginename", "oursurfing");
[-] [C:\Users\Leoš\AppData\Roaming\Mozilla\Firefox\Profiles\tp7dqh5i.default\prefs.js] [Preference] Deleted : user_pref("extensions.crossrider.bic", "1502ab7d5b68b1141ff8a434e20a33c5");
[-] [C:\Users\Leoš\AppData\Roaming\Mozilla\Firefox\Profiles\tp7dqh5i.default\prefs.js] [Preference] Deleted : user_pref("extensions.quick_start.enable_search1", false);
[-] [C:\Users\Leoš\AppData\Roaming\Mozilla\Firefox\Profiles\tp7dqh5i.default\prefs.js] [Preference] Deleted : user_pref("extensions.quick_start.sd.closeWindowWithLastTab_prev_state", false);

*************************

:: Winsock settings cleared

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [6233 bytes] ##########

Dejte nový log FRST.

https://sdilej.cz/7355378/FRST3.txt
Pořád vyskakuje okno alibaba.com

Otevřte poznámkový blok a zkopírujte do něj:

Start
SearchScopes: HKU\S-1-5-21-3346216350-3353850354-1984704180-1001 -> {1A95DC8F-4A6D-4938-B715-50B59B516306} URL =
C:\Windows\Tasks\ctzBkfUaX2zSeSUBp6XCUand.job
C:\Users\Leoš\AppData\Roaming\ctzBkfUaX2zSeSUBp6XCUand
C:\Users\Leoš\AppData\Roaming\ctzBkfUaX2zSeSUBp6XCUand.exe
C:\Users\Leoš\AppData\Local\Temp
End

Uložte na plochu jako fixlist.txt. Spusťte znovu FRST a klikněte na >Fix<. Po skončení akce se objeví log, který sem zkopírujte.

Fix result of Farbar Recovery Scan Tool (x64) Version:15-10-2015
Ran by Leoš (2015-10-15 19:35:47) Run:1
Running from C:\Users\Leoš\Desktop
Loaded Profiles: Leoš (Available Profiles: Leoš)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start
SearchScopes: HKU\S-1-5-21-3346216350-3353850354-1984704180-1001 -> {1A95DC8F-4A6D-4938-B715-50B59B516306} URL =
C:\Windows\Tasks\ctzBkfUaX2zSeSUBp6XCUand.job
C:\Users\Leoš\AppData\Roaming\ctzBkfUaX2zSeSUBp6XCUand
C:\Users\Leoš\AppData\Roaming\ctzBkfUaX2zSeSUBp6XCUand.exe
C:\Users\Leoš\AppData\Local\Temp
End
*****************

"HKU\S-1-5-21-3346216350-3353850354-1984704180-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{1A95DC8F-4A6D-4938-B715-50B59B516306}" => key removed successfully
HKCR\CLSID\{1A95DC8F-4A6D-4938-B715-50B59B516306} => key not found.
C:\Windows\Tasks\ctzBkfUaX2zSeSUBp6XCUand.job => moved successfully
C:\Users\Leoš\AppData\Roaming\ctzBkfUaX2zSeSUBp6XCUand => moved successfully
C:\Users\Leoš\AppData\Roaming\ctzBkfUaX2zSeSUBp6XCUand.exe => moved successfully
C:\Users\Leoš\AppData\Local\Temp => moved successfully

==== End of Fixlog 19:35:48 ====

Smazáno. Nastala nějaká změna?

Zatim to vypadá dobře takže moc děkuju.