VIRY.CZ

Ulozte na plochu AdwCleaner https://malwarebytes.com/adwcleaner/ nebo http://www.bleepingcomputer.com/download/adwcleaner/

ukoncete vsechny programy
odsouhlaste licencni podmiky (EULA) klikem na Souhlasim
kliknete pravym na ikonu AdwCleaneru a vyberte Spustit jako spravce (v pripade Win XP spustte obycejne dvojklikem)
kliknete na Skenovat nyni (Scan now), pote na Cisteni a opravy (Clean and Repair)
po restartu na Vas vyskoci log (pripadne jej najdete v C:\AdwCleaner\Logs\AdwCleaner[Cxx].txt), jehoz obsah zkopirujte do pristi odpovedi

Start

CloseProcesses:
CustomCLSID: HKU\S-1-5-21-4148571483-3592684963-3718319802-1001_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32 -> C:\Users\Petr\AppData\Local\Microsoft\OneDrive\19.222.1110.0006\amd64\FileSyncShell64.dll => No File
CustomCLSID: HKU\S-1-5-21-4148571483-3592684963-3718319802-1001_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32 -> C:\Users\Petr\AppData\Local\Microsoft\OneDrive\19.222.1110.0006\amd64\FileSyncShell64.dll => No File
CustomCLSID: HKU\S-1-5-21-4148571483-3592684963-3718319802-1001_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32 -> C:\Users\Petr\AppData\Local\Microsoft\OneDrive\19.222.1110.0006\amd64\FileSyncShell64.dll => No File
FirewallRules: [{07EBAADB-1BD7-4B87-A8BF-C1B9C9918340}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe No File
FirewallRules: [{070527AA-7BEB-4FAA-9D79-34D9DF8E8AEF}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe No File
C:\Users\Petr\AppData\Local\Temp
HKU\S-1-5-21-4148571483-3592684963-3718319802-1001\...\Run: [BingSvc] => C:\Users\Petr\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008 2017-12-26] (Microsoft Corporation -> © 2015 Microsoft Corporation)
HKU\S-1-5-21-4148571483-3592684963-3718319802-1001\...\MountPoints2: {34a2c2d5-ec5c-11e9-9cc8-40b0765e7062} - "D:\Launch.exe"
HKU\S-1-5-21-4148571483-3592684963-3718319802-1001\...\MountPoints2: {ce33b9ab-f281-11e9-9cd2-40b0765e7062} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-4148571483-3592684963-3718319802-1001\...\MountPoints2: {ce33b9de-f281-11e9-9cd2-40b0765e7062} - "E:\HiSuiteDownLoader.exe"
C:\ProgramData\lock.dat
C:\ProgramData\rc.dat
C:\ProgramData\ts.dat
C:\Users\Petr\AppData\Roaming\brhesbb
C:\Users\Petr\AppData\Roaming\twhbagu

EmptyTemp:
End