Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

Procesor na 100%

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Odpovědět
Zpráva
Autor
Jand
Návštěvník
Návštěvník
Příspěvky: 18
Registrován: 04 dub 2010 10:49

Procesor na 100%

#1 Příspěvek od Jand »

Zdravim
nejaky proces mi vytazuje procesor na 100% a v spravci uloh ho nevidim, robi to hned o zapnutia
PC som presiel cely s Avast CZ free a nenaslo ani jedne virus v celom PC

prosim o pomoc, tu je log :

Kód: Vybrat vše

Logfile of random's system information tool 1.08 (written by random/random)
Run by TichoLieci at 2010-07-30 12:23:55
Microsoft Windows 7 Home Premium  
System drive C: has 18 GB (35%) free of 50 GB
Total RAM: 3070 MB (73% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:24:06, on 30. 7. 2010
Platform: Windows 7  (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\Mouse Driver\StartAutorun.exe
C:\Program Files\CyberLink\PowerDVD10\PDVD10Serv.exe
C:\Program Files\CyberLink\Shared files\brs.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Mouse Driver\KMConfig.exe
C:\Program Files\Mouse Driver\KMProcess.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\TichoLieci\Downloads\RSIT.exe
C:\Program Files\trend micro\TichoLieci.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: (no name) -  - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [KMCONFIG] C:\Program Files\Mouse Driver\StartAutorun.exe KMConfig.exe
O4 - HKLM\..\Run: [TQ566808] "G:\Setup.exe"
O4 - HKLM\..\Run: [RemoteControl10] "C:\Program Files\CyberLink\PowerDVD10\PDVD10Serv.exe"
O4 - HKLM\..\Run: [BDRegion] C:\Program Files\Cyberlink\Shared files\brs.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe" -automount
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Program Files\ICQ7.1\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Program Files\ICQ7.1\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: Keyboard And Mouse Communication Service (KMWDSERVICE) - UASSOFT.COM - C:\Program Files\Mouse Driver\KMWDSrv.exe

--
End of file - 4915 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-04-07 41760]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"WinampAgent"=C:\Program Files\Winamp\winampa.exe [2010-01-12 37888]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-02-18 248040]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-12-22 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-12-11 948672]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2010-03-02 98304]
"KMCONFIG"=C:\Program Files\Mouse Driver\StartAutorun.exe [2008-05-30 212992]
"TQ566808"=G:\Setup.exe []
"RemoteControl10"=C:\Program Files\CyberLink\PowerDVD10\PDVD10Serv.exe [2010-02-03 87336]
"BDRegion"=C:\Program Files\Cyberlink\Shared files\brs.exe [2010-06-28 75048]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-07-14 1173504]
"AlcoholAutomount"=C:\Program Files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [2009-11-15 33120]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2009-10-30 369200]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-07-30 12:23:55 ----D---- C:\rsit
2010-07-30 12:17:49 ----D---- C:\Program Files\Trend Micro
2010-07-30 06:36:41 ----D---- C:\ProgramData\Alwil Software
2010-07-30 06:36:41 ----D---- C:\Program Files\Alwil Software
2010-07-21 18:47:42 ----D---- C:\Program Files\Lavalys
2010-07-20 18:09:10 ----D---- C:\Users\TichoLieci\AppData\Roaming\CyberLink
2010-07-20 18:08:14 ----D---- C:\ProgramData\CyberLink
2010-07-20 18:07:51 ----D---- C:\Program Files\Common Files\CyberLink
2010-07-20 18:06:31 ----D---- C:\Program Files\CyberLink
2010-07-20 18:06:31 ----A---- C:\Windows\system32\msxml3a.dll
2010-07-20 18:06:31 ----A---- C:\Windows\system32\msvcr71.dll
2010-07-20 18:06:31 ----A---- C:\Windows\system32\msvcp71.dll
2010-07-20 18:05:58 ----D---- C:\ProgramData\Temp
2010-07-17 10:26:29 ----D---- C:\Users\TichoLieci\AppData\Roaming\Mumble
2010-07-17 10:25:49 ----D---- C:\Program Files\Mumble
2010-07-10 20:49:00 ----A---- C:\Windows\system32\XAudio2_6.dll
2010-07-10 20:49:00 ----A---- C:\Windows\system32\XAPOFX1_4.dll
2010-07-10 20:49:00 ----A---- C:\Windows\system32\xactengine3_6.dll
2010-07-10 20:49:00 ----A---- C:\Windows\system32\X3DAudio1_7.dll
2010-07-01 13:13:56 ----D---- C:\Users\TichoLieci\AppData\Roaming\Ventrilo
2010-07-01 13:13:24 ----D---- C:\Program Files\Ventrilo
2010-07-01 13:12:40 ----D---- C:\Program Files\Common Files\Wise Installation Wizard

======List of files/folders modified in the last 1 months======

2010-07-30 12:24:06 ----D---- C:\Windows\Prefetch
2010-07-30 12:24:01 ----D---- C:\Windows\Temp
2010-07-30 12:17:50 ----SHD---- C:\Windows\Installer
2010-07-30 12:17:49 ----RD---- C:\Program Files
2010-07-30 12:17:49 ----HD---- C:\Config.Msi
2010-07-30 12:17:44 ----SHD---- C:\System Volume Information
2010-07-30 08:46:49 ----D---- C:\Windows\Tasks
2010-07-30 08:46:49 ----D---- C:\Windows\system32\wfp
2010-07-30 08:46:49 ----D---- C:\Windows\system32\wbem
2010-07-30 08:46:49 ----D---- C:\Windows
2010-07-30 08:46:09 ----D---- C:\Windows\system32\config
2010-07-30 08:46:05 ----D---- C:\Windows\system32\DriverStore
2010-07-30 08:46:05 ----D---- C:\Windows\system32\catroot2
2010-07-30 08:46:05 ----D---- C:\Windows\System32
2010-07-30 08:46:04 ----D---- C:\Windows\system32\Tasks
2010-07-30 08:46:04 ----D---- C:\Users\TichoLieci\AppData\Roaming\Winamp
2010-07-30 08:46:04 ----D---- C:\Users\TichoLieci\AppData\Roaming\PhotoFiltre
2010-07-30 08:46:04 ----D---- C:\Users\TichoLieci\AppData\Roaming\GHISLER
2010-07-30 08:46:03 ----D---- C:\Windows\registration
2010-07-30 08:46:01 ----HD---- C:\ProgramData
2010-07-25 08:00:52 ----D---- C:\Program Files\Mozilla Firefox
2010-07-24 16:20:13 ----D---- C:\Program Files\TeamSpeak 3 Client
2010-07-20 18:07:51 ----D---- C:\Program Files\Common Files
2010-07-20 18:07:50 ----HD---- C:\Program Files\InstallShield Installation Information
2010-07-18 21:52:07 ----D---- C:\Users\TichoLieci\AppData\Roaming\Skype
2010-07-18 21:50:08 ----D---- C:\Users\TichoLieci\AppData\Roaming\skypePM
2010-07-18 12:42:36 ----D---- C:\Users\TichoLieci\AppData\Roaming\ICQ
2010-07-15 17:58:54 ----RSD---- C:\Windows\assembly
2010-07-15 17:53:45 ----D---- C:\Windows\winsxs
2010-07-01 13:14:44 ----SD---- C:\Users\TichoLieci\AppData\Roaming\Microsoft

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-04-05 691696]
R2 {1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC};Power Control [2010/07/20 18:08:04]; \??\C:\Program Files\CyberLink\PowerDVD10\NavFilter\000.fcl [2010-06-28 87536]
R2 lirsgt;lirsgt; C:\Windows\system32\DRIVERS\lirsgt.sys [2010-06-26 25416]
R2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atipmdag.sys [2010-03-03 5340160]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2010-03-03 152064]
R3 AtiHdmiService;ATI Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\AtiHdmi.sys [2010-01-28 100352]
R3 Dot4;MS IEEE-1284.4 Driver; C:\Windows\system32\DRIVERS\Dot4.sys [2009-07-14 131072]
R3 Dot4Print;Print Class Driver for IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Prt.sys [2009-07-14 16384]
R3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys [2009-07-14 36864]
R3 KMWDFILTERx86;HIDServiceDesc; C:\Windows\system32\DRIVERS\KMWDFILTER.sys [2009-04-29 25088]
R3 RTL8167;Ovladač Realtek 8167 NT; C:\Windows\system32\DRIVERS\Rt86win7.sys [2009-07-14 139776]
R3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 35840]
S2 atksgt;atksgt; C:\Windows\system32\DRIVERS\atksgt.sys [2010-06-26 278984]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 ajflo4iw;ajflo4iw; C:\Windows\system32\drivers\ajflo4iw.sys []
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 at5afb1g;at5afb1g; C:\Windows\system32\drivers\at5afb1g.sys []
S3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2010-03-03 5340160]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 usbbus;LGE Mobile Composite USB Device; C:\Windows\system32\DRIVERS\lgusbbus.sys [2008-11-19 13056]
S3 UsbDiag;LGE Mobile USB Serial Port; C:\Windows\system32\DRIVERS\lgusbdiag.sys [2008-11-19 19968]
S3 USBModem;LGE Mobile USB Modem; C:\Windows\system32\DRIVERS\lgusbmodem.sys [2008-11-19 24832]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 34944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2010-03-03 172032]
R2 hpqddsvc;Služba HP CUE DeviceDiscovery; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 HPSLPSVC;HP Network Devices Support; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 KMWDSERVICE;Keyboard And Mouse Communication Service; C:\Program Files\Mouse Driver\KMWDSrv.exe [2009-08-31 1821184]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 hpqcxs08;hpqcxs08; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]

-----------------EOF-----------------

Uživatelský avatar
stell
VIP in memoriam
VIP in memoriam
Příspěvky: 5175
Registrován: 09 pro 2007 09:27
Bydliště: SK-REVUCA
Kontaktovat uživatele:

Re: Procesor na 100%

#2 Příspěvek od stell »

Zdravim
no mas tam jeden podozrivy proces,logy nedavaj do code,
PROSIM CITAJTE POZORNE NAVODY!!!,

Stáhněte na plochu, ukončete všechna aktivní okna a spusťte>>
http://download.bleepingcomputer.com/sUBs/ComboFix.exe


- ComboFix je třeba spustit pod účtem s právy administrátora.
- Po spuštění se zobrazí podmínky užití, potvrďte je stiskem tlačítka Ano;

A este raz >ANO<

- Dále postupujte dle pokynů, během aplikování ComboFixu neklikejte do zobrazujícího modreho okna

- Po dokončení skenování, trvajícího maximálně 10-15 minut, by měl program vytvořit log - C:\ComboFix.txt, zkopírujte celý jeho obsah do svého threadu na forum
- Před použitím ComboFixu je treba vypnout všechny rezidentní bezpečnostní programy - antiviry, firewally, antispywary. NAVOD: http://www.bleepingcomputer.com/forums/topic114351.html
Mohou zasahovat do činnosti ComboFixu, což může způsobit, že nebude fungovat korektně.

V případě detekce antiviru u ComboFixu se jedná o falešný poplach.


Dôležité informácie.
NEŠLAPE Vám počítač?
Je zavirovaný? Šlape pomalu? Nefunguje program? Problém s instalací?
Využíjte služby vzdálené pomoci!
Obrázek
e-mail: stell(zavináč)forum.viry.cz
Thanks! Vďaka!

Obrázek

Jand
Návštěvník
Návštěvník
Příspěvky: 18
Registrován: 04 dub 2010 10:49

Re: Procesor na 100%

#3 Příspěvek od Jand »

tak to je to s combofixu :
ComboFix 10-07-29.02 - TichoLieci . 07. 2010 13:20:20.1.2 - x86
Microsoft Windows 7 Home Premium 6.1.7600.0.1250.421.1029.18.3070.2273 [GMT 2:00]
Running from: c:\users\TichoLieci\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2010-06-28 to 2010-07-30 )))))))))))))))))))))))))))))))
.

2010-07-30 11:39 . 2010-07-30 11:39 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-07-30 10:23 . 2010-07-30 10:24 -------- d-----w- C:\rsit
2010-07-30 10:17 . 2010-07-30 10:24 -------- d-----w- c:\program files\Trend Micro
2010-07-30 10:17 . 2010-07-30 10:17 388096 ----a-r- c:\users\TichoLieci\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-07-30 04:36 . 2010-07-30 04:36 -------- d-----w- c:\programdata\Alwil Software
2010-07-30 04:36 . 2010-07-30 04:36 -------- d-----w- c:\program files\Alwil Software
2010-07-21 16:47 . 2010-07-21 16:47 -------- d-----w- c:\program files\Lavalys
2010-07-20 16:09 . 2010-07-20 16:09 -------- d-----w- c:\users\TichoLieci\AppData\Local\Cyberlink
2010-07-20 16:09 . 2010-07-20 16:09 -------- d-----w- c:\users\Public\CyberLink
2010-07-20 16:09 . 2010-07-20 16:09 -------- d-----w- c:\users\TichoLieci\AppData\Roaming\CyberLink
2010-07-20 16:08 . 2010-07-20 16:09 -------- d-----w- c:\programdata\CyberLink
2010-07-20 16:07 . 2010-07-20 16:07 -------- d-----w- c:\program files\Common Files\CyberLink
2010-07-20 16:06 . 2010-07-20 16:08 -------- d-----w- c:\program files\CyberLink
2010-07-20 16:06 . 2010-07-20 16:05 29480 ----a-w- c:\windows\system32\msxml3a.dll
2010-07-20 16:06 . 2010-07-20 16:05 505128 ----a-w- c:\windows\system32\msvcp71.dll
2010-07-20 16:06 . 2010-07-20 16:05 353576 ----a-w- c:\windows\system32\msvcr71.dll
2010-07-20 16:05 . 2010-07-20 16:05 53319 ----a-w- c:\programdata\Temp\{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}\PostBuild.exe
2010-07-17 08:34 . 2010-07-17 08:34 -------- d-----w- c:\users\TichoLieci\AppData\Local\Mumble
2010-07-17 08:26 . 2010-07-17 15:11 -------- d-----w- c:\users\TichoLieci\AppData\Roaming\Mumble
2010-07-17 08:25 . 2010-07-17 08:26 -------- d-----w- c:\program files\Mumble
2010-07-10 18:49 . 2010-02-04 08:01 74072 ----a-w- c:\windows\system32\XAPOFX1_4.dll
2010-07-10 18:49 . 2010-02-04 08:01 528216 ----a-w- c:\windows\system32\XAudio2_6.dll
2010-07-10 18:49 . 2010-02-04 08:01 238936 ----a-w- c:\windows\system32\xactengine3_6.dll
2010-07-10 18:49 . 2010-02-04 08:01 22360 ----a-w- c:\windows\system32\X3DAudio1_7.dll
2010-07-01 11:13 . 2010-07-30 06:46 -------- d-----w- c:\users\TichoLieci\AppData\Roaming\Ventrilo
2010-07-01 11:13 . 2010-07-01 11:13 -------- d-----w- c:\program files\Ventrilo
2010-07-01 11:12 . 2010-07-01 11:12 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-30 06:46 . 2010-06-02 16:16 -------- d-----w- c:\users\TichoLieci\AppData\Roaming\PhotoFiltre
2010-07-30 06:46 . 2010-04-05 14:18 -------- d-----w- c:\users\TichoLieci\AppData\Roaming\Winamp
2010-07-30 06:46 . 2010-04-05 13:07 -------- d-----w- c:\users\TichoLieci\AppData\Roaming\GHISLER
2010-07-24 14:20 . 2010-05-22 13:46 -------- d-----w- c:\program files\TeamSpeak 3 Client
2010-07-20 16:07 . 2010-04-05 14:46 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-07-18 19:52 . 2010-04-05 15:45 -------- d-----w- c:\users\TichoLieci\AppData\Roaming\Skype
2010-07-18 19:50 . 2010-04-05 15:45 -------- d-----w- c:\users\TichoLieci\AppData\Roaming\skypePM
2010-07-18 10:42 . 2010-04-07 17:24 -------- d-----w- c:\users\TichoLieci\AppData\Roaming\ICQ
2010-06-29 09:07 . 2010-04-07 17:24 -------- d-----w- c:\program files\ICQ7.1
2010-06-26 15:51 . 2010-06-26 15:51 278984 ----a-w- c:\windows\system32\drivers\atksgt.sys
2010-06-26 15:51 . 2010-06-26 15:51 25416 ----a-w- c:\windows\system32\drivers\lirsgt.sys
2010-06-26 14:34 . 2010-06-26 14:34 -------- d-----w- c:\program files\Electronic Arts
2010-06-22 15:40 . 2010-06-22 15:40 -------- d-----w- c:\program files\Mouse Driver
2010-06-04 13:28 . 2010-06-04 13:28 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2010-06-02 16:16 . 2010-06-02 16:16 -------- d-----w- c:\program files\PhotoFiltre
2010-06-02 16:11 . 2010-06-02 16:11 -------- d-----w- c:\users\TichoLieci\AppData\Roaming\PhotoFiltre Studio X
2010-06-02 16:11 . 2010-06-02 16:11 -------- d-----w- c:\program files\PhotoFiltre Studio X
2010-05-31 18:19 . 2009-07-27 19:14 614314 ----a-w- c:\windows\system32\perfh005.dat
2010-05-31 18:19 . 2009-07-27 19:14 118486 ----a-w- c:\windows\system32\perfc005.dat
2010-05-26 08:33 . 2010-04-05 13:32 109536 ----a-w- c:\users\TichoLieci\AppData\Local\GDIPFONTCACHEV1.DAT
2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
2006-05-03 10:06 . 2010-04-17 19:48 163328 --sh--r- c:\windows\System32\flvDX.dll
2007-02-21 11:47 . 2010-04-17 19:48 31232 --sh--r- c:\windows\System32\msfDX.dll
2008-03-16 13:30 . 2010-04-17 19:48 216064 --sh--r- c:\windows\System32\nbDX.dll
2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe" [2009-11-15 33120]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2010-01-12 37888]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-21 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-03-02 98304]
"KMCONFIG"="c:\program files\Mouse Driver\StartAutorun.exe" [2008-05-29 212992]
"RemoteControl10"="c:\program files\CyberLink\PowerDVD10\PDVD10Serv.exe" [2010-02-02 87336]
"BDRegion"="c:\program files\Cyberlink\Shared files\brs.exe" [2010-06-28 75048]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-9-20 270336]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2010-04-05 691696]
S2 {1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC};Power Control [2010/07/20 18:08];c:\program files\CyberLink\PowerDVD10\NavFilter\000.fcl [2010-06-28 20:50 87536]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-03-03 172032]
S2 KMWDSERVICE;Keyboard And Mouse Communication Service;c:\program files\Mouse Driver\KMWDSrv.exe [2009-08-31 1821184]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [2010-03-03 5340160]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-03-03 152064]
S3 KMWDFILTERx86;HIDServiceDesc;c:\windows\system32\DRIVERS\KMWDFILTER.sys [2009-04-29 25088]
S3 RTL8167;Ovladač Realtek 8167 NT;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://start.icq.com/
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{71BFC818-0CED-42D6-9C87-5142918957EE} - c:\program files\ICQ7.1\ICQ.exe
FF - ProfilePath - c:\users\TichoLieci\AppData\Roaming\Mozilla\Firefox\Profiles\oj6fb20x.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://games.tiscali.cz/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.0.2&q=
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-TQ566808 - G:\Setup.exe



[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD10\NavFilter\000.fcl"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2010-07-30 13:40:51
ComboFix-quarantined-files.txt 2010-07-30 11:40

Pre-Run: Volných bajtů: 18 384 396 288
Post-Run: Volných bajtů: 19 760 406 528

- - End Of File - - E9E1848D84EA834D36952ECAEE07948D

Uživatelský avatar
stell
VIP in memoriam
VIP in memoriam
Příspěvky: 5175
Registrován: 09 pro 2007 09:27
Bydliště: SK-REVUCA
Kontaktovat uživatele:

Re: Procesor na 100%

#4 Příspěvek od stell »

ok,proces je prec,,ako je na tom pc??
Dôležité informácie.
NEŠLAPE Vám počítač?
Je zavirovaný? Šlape pomalu? Nefunguje program? Problém s instalací?
Využíjte služby vzdálené pomoci!
Obrázek
e-mail: stell(zavináč)forum.viry.cz
Thanks! Vďaka!

Obrázek

Jand
Návštěvník
Návštěvník
Příspěvky: 18
Registrován: 04 dub 2010 10:49

Re: Procesor na 100%

#5 Příspěvek od Jand »

no asi zazrak :) ide to v pohode zatial, ked tak napisem keby sa to zase spustilo :) dakujem za pomoc

Uživatelský avatar
stell
VIP in memoriam
VIP in memoriam
Příspěvky: 5175
Registrován: 09 pro 2007 09:27
Bydliště: SK-REVUCA
Kontaktovat uživatele:

Re: Procesor na 100%

#6 Příspěvek od stell »

ok, :)
Odinstaluj combofix-start-spustit-vloz prikaz combofix /uninstall
nemas zaco.
Dôležité informácie.
NEŠLAPE Vám počítač?
Je zavirovaný? Šlape pomalu? Nefunguje program? Problém s instalací?
Využíjte služby vzdálené pomoci!
Obrázek
e-mail: stell(zavináč)forum.viry.cz
Thanks! Vďaka!

Obrázek

Odpovědět