Prosím o kontrolu logu. Zpomalený PC...

[Roman]

Zdravím, koukněte mi proím na logy, nechutně se mi zpomalil PC... PC za chodu, jenom prohlížeč je zaplý, jede: vytížení procesoru: 5% ( to je OK) , vytizeni paměti : 35 % !! (1.32 GB cca.. ) to je šílenost... nevíte čím to může být ?


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:16:53, on 10.4.2011
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16722)
Boot mode: Normal

Running processes:
C:\Program Files\Smart PDF Creator Pro\SmartSoft PDF Printer Agent.exe
C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
C:\Program Files (x86)\Hewlett-Packard\HP Mouse Suite\hpMonitor.exe
C:\ProgramData\HP Mouse Suite Config\hpwmsd.exe
C:\Windows\SysWOW64\RunDll32.exe
C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Users\Roman\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Roman\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Roman\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Roman\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Users\Roman\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Roman\AppData\Local\Google\Chrome\Application\chrome.exe
D:\Downloads\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.facemoods.com/?a=bf
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=bf&s={searchTerms}&f=4
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O1 - Hosts: 64.186.152.140 embedded.garena.com
O1 - Hosts: 64.186.152.140 embedded.garenanow.com
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Increase performance and video formats for your HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
O2 - BHO: Use the DivX Plus Web Player to watch web videos with less interruptions and smoother playback on supported sites - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\18.5.0.125\coIEPlg.dll
O2 - BHO: facemoods Helper - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.5\bh\facemoods.dll (file missing)
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\18.5.0.125\IPS\IPSBHO.DLL
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\programy\OFFICE~1\Office12\GR469A~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.5.0.125\coIEPlg.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: facemoods Toolbar - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.5\facemoodsTlbr.dll (file missing)
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [GrooveMonitor] "D:\programy\Office 2007\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [facemoods] "C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.5\facemoodssrv.exe" /md I
O4 - HKLM\..\Run: [QLBController] C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe /start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [Google Update] "C:\Users\Roman\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [RegistryBooster] "C:\Program Files (x86)\Uniblue\RegistryBooster\launcher.exe" delay 20000
O4 - HKCU\..\Run: [ICQ] "C:\Program Files (x86)\ICQ7.2\ICQ.exe" silent loginmode=4
O4 - HKCU\..\Run: [Steam] "D:\HRY\Team Fortress\steam.exe" -silent
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: HPMonitor.exe.lnk = C:\Program Files (x86)\Hewlett-Packard\HP Mouse Suite\hpMonitor.exe
O4 - Global Startup: hpwmsd.exe.lnk = C:\ProgramData\HP Mouse Suite Config\hpwmsd.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://D:\programy\OFFICE~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Odeslat obrázek do zařízení &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Odeslat stránku do zařízení &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\programy\OFFICE~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\programy\OFFICE~1\Office12\ONBttnIE.dll
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\programy\OFFICE~1\Office12\REFIEBAR.DLL
O9 - Extra button: Odeslat do zařízení Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: Odeslat do zařízení &Bluetooth... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O10 - Unknown file in Winsock LSP: c:\windows\system32\hmipcore.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\hmipcore.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\hmipcore.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\hmipcore.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\hmipcore.dll
O13 - Gopher Prefix:
O16 - DPF: {1851174C-97BD-4217-A0CC-E908F60D5B7A} (Hewlett-Packard Online Support Services) - http://h50203.www5.hp.com/HPISWeb/Custo ... anager.CAB
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\programy\OFFICE~1\Office12\GRA32A~1.DLL
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - LSI Corporation - C:\Program Files\LSI SoftModem\agr64svc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files (x86)\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service 64 - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: HideMyIpSRV - HideMyIP - C:\Program Files (x86)\Hide My IP\HideMyIpSrv.exe
O23 - Service: HP Quick Synchronization Service (HPDrvMntSvc.exe) - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
O23 - Service: HP Hotkey Monitor (hpHotkeyMonitor) - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe
O23 - Service: HP Software Framework Service (hpqwmiex) - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files (x86)\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 12275 bytes

[Roli]

Zdravím, tohle fixni v HJT :

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.facemoods.com/?a=bf
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=bf&s={searchTerms}&f=4
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: facemoods Toolbar - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.5\facemoodsTlbr.dll (file missing)
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [GrooveMonitor] "D:\programy\Office 2007\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [facemoods] "C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.5\facemoodssrv.exe" /md I
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Users\Roman\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (file missing)

Fix znamená že spustíš HJT jako admin

v okně které se ti otevře klikneš na Do a system scan only

v dalším okně najdeš řádky které jsem ti vypsal,

vedle nich je čtvereček do kterého uděláš zatržítko,

pak klikneš na Fix checked které je vlevo dole,

program se ti zeptá zda opravdu ANO s tím samozřejmě souhlasíš a je hotovo.


Odinstaluj ICQ6Toolbar


Pak použij Mbam z mého podpisu a dej mi sem z něj log, předem nic nemazat !!!


P.S. příště sem raději dávej log z Rsit, je podrobnější než HJT

[Roman]

Roli píše:
Zdravím, tohle fixni v HJT :

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.facemoods.com/?a=bf
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=bf&s={searchTerms}&f=4
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: facemoods Toolbar - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.5\facemoodsTlbr.dll (file missing)
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [GrooveMonitor] "D:\programy\Office 2007\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [facemoods] "C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.5\facemoodssrv.exe" /md I
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Users\Roman\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (file missing)

Fix znamená že spustíš HJT jako admin

v okně které se ti otevře klikneš na Do a system scan only

v dalším okně najdeš řádky které jsem ti vypsal,

vedle nich je čtvereček do kterého uděláš zatržítko,

pak klikneš na Fix checked které je vlevo dole,

program se ti zeptá zda opravdu ANO s tím samozřejmě souhlasíš a je hotovo.


Odinstaluj ICQ6Toolbar


Pak použij Mbam z mého podpisu a dej mi sem z něj log, předem nic nemazat !!!


P.S. příště sem raději dávej log z Rsit, je podrobnější než HJT


Pěkný večer, udělal jsem, to co jste si přál, posílám log z Mbam..


Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Verze databáze: 6344

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

12.4.2011 21:33:36
mbam-log-2011-04-12 (21-33-36).txt

Typ kontroly: Rychlý test
Testované objekty: 169628
Uplynulý čas: 4 minut, 31 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 0
Infikované hodnoty v registru: 0
Infikované datové položky v registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
(Žádné škodlivé položky nebyly zjištěny)

I mé laické oko vidí, že asi nic se nezjistilo.. u Hthis mi nešly fixnout ( O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (file missing)[/color] ) Jinak vše šlo, po fixnutí ( O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [GrooveMonitor] "D:\programy\Office 2007\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [facemoods] "C:\Program Files ´) se většina z nich zase obnovila.. Pěkně mě to s prominutím začíná srát, že ten PC je takhle špatnej ....



PLUS PŘIDÁVÁM LOG Z COMBOFIX:


ComboFix 11-04-12.01 - Roman 12.04.2011 21:41:52.1.2 - x64
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1029.18.3830.2029 [GMT 2:00]
Spuštěný z: d:\downloads\ComboFix.exe
AV: Norton Internet Security *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Internet Security *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Roman\AppData\Local\Temp\18070.tmp
c:\users\Roman\AppData\Local\Temp\9473.tmp
c:\windows\Readme.txt
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-03-12 do 2011-04-12 )))))))))))))))))))))))))))))))
.
.
2011-04-12 19:46 . 2011-04-12 19:46 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-04-12 19:28 . 2011-04-12 19:28 -------- d-----w- c:\users\Roman\AppData\Roaming\Malwarebytes
2011-04-12 19:28 . 2011-04-12 19:28 -------- d-----w- c:\programdata\Malwarebytes
2011-04-12 19:28 . 2010-12-20 16:09 38224 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-04-12 19:28 . 2011-04-12 19:28 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-04-12 19:28 . 2010-12-20 16:08 24152 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-04-07 15:34 . 2011-04-07 15:34 -------- d-----w- c:\users\Roman\AppData\Local\VT_Software
2011-04-06 19:06 . 2010-02-08 17:19 8038944 ----a-w- c:\windows\system32\RTSUSTORicon.dll
2011-04-06 19:05 . 2011-04-06 19:05 -------- d-----w- c:\program files (x86)\Realtek
2011-04-06 19:05 . 2010-02-08 19:57 239136 ----a-w- c:\windows\system32\drivers\RtsUStor.sys
2011-04-06 19:05 . 2010-02-08 17:19 8038944 ----a-w- c:\windows\SysWow64\RtsUStoricon.dll
2011-04-06 19:05 . 2010-02-08 17:19 422432 ----a-w- c:\windows\system32\RtsUStor.dll
2011-04-06 19:03 . 2010-01-18 13:34 381824 ----a-w- c:\windows\system32\vsnp2uvc.dll
2011-04-06 19:03 . 2010-01-18 13:34 1803904 ----a-w- c:\windows\system32\drivers\snp2uvc.sys
2011-04-06 19:03 . 2010-01-18 13:34 249728 ----a-w- c:\windows\system32\rsnp2uvc.dll
2011-04-06 19:03 . 2010-01-18 13:34 255360 ----a-w- c:\windows\SysWow64\rsnp2uvc.dll
2011-04-06 19:03 . 2011-04-06 19:03 -------- d-----w- c:\program files (x86)\Common Files\SNP2UVC
2011-04-06 19:03 . 2010-01-18 13:34 40064 ----a-w- c:\windows\system32\drivers\sncduvc.sys
2011-04-06 19:03 . 2010-01-18 13:34 244096 ----a-w- c:\windows\system32\csnp2uvc.dll
2011-04-06 19:03 . 2010-01-18 13:34 312192 ----a-w- c:\windows\SysWow64\vsnp2uvc.dll
2011-04-06 19:03 . 2010-01-18 13:34 25984 ----a-w- c:\windows\snuvcdsm.exe
2011-04-06 19:02 . 2009-06-09 11:28 64000 ------w- c:\windows\SysWow64\agrsmdel.exe
2011-04-06 19:02 . 2009-03-27 16:12 13824 ------w- c:\windows\SysWow64\agrscoin.dll
2011-04-06 19:02 . 2009-03-27 16:12 14848 ------w- c:\windows\SysWow64\agrsco64.dll
2011-04-06 19:02 . 2011-04-06 19:02 -------- d-----w- c:\program files\LSI SoftModem
2011-04-06 19:02 . 2011-04-06 19:02 -------- d-----w- c:\windows\Options
2011-04-05 16:35 . 2011-04-05 16:35 -------- d-----w- c:\program files (x86)\Common Files\Java
2011-04-05 16:30 . 2011-04-08 12:52 -------- d-----w- c:\users\Roman\AppData\Roaming\.minecraft
2011-04-04 09:58 . 2011-04-04 09:58 -------- d-----w- c:\users\Roman\AppData\Local\Electronic Arts
2011-04-04 09:57 . 2011-04-04 09:57 -------- d-----w- c:\program files (x86)\Electronic Arts
2011-03-27 15:40 . 2011-04-04 09:57 -------- d-----w- c:\programdata\Electronic Arts
2011-03-27 15:40 . 2011-03-27 15:40 -------- d-----w- c:\programdata\EA Core
2011-03-26 13:23 . 2011-03-26 13:23 -------- d-----w- c:\program files\Hewlett-Packard
2011-03-26 13:21 . 2011-03-26 13:23 -------- d-----w- c:\users\Roman\AppData\Roaming\Hewlett-Packard
2011-03-26 00:46 . 2011-03-26 00:49 -------- d-----w- C:\Downloads
2011-03-26 00:45 . 2011-04-10 20:52 -------- d-----w- c:\users\Roman\AppData\Roaming\BitComet
2011-03-26 00:45 . 2011-03-26 00:45 -------- d-----w- c:\program files (x86)\BitComet
2011-03-26 00:44 . 2011-03-26 00:44 -------- d-----w- c:\programdata\InstallMate
2011-03-21 08:34 . 2011-04-04 10:34 -------- d-----w- c:\programdata\Solidshield
2011-03-21 08:32 . 2011-03-21 08:32 -------- d-----w- c:\users\Roman\AppData\Roaming\PunkBuster
2011-03-21 08:31 . 2011-03-21 08:31 -------- d-----w- c:\program files (x86)\Ubisoft
2011-03-18 16:22 . 2011-03-18 16:22 -------- d-----w- c:\users\Roman\AppData\Local\GHISLER
2011-03-18 16:20 . 2011-04-11 10:56 -------- d-----w- c:\users\Roman\AppData\Roaming\GHISLER
2011-03-18 16:20 . 2011-03-18 16:21 -------- d-----w- C:\totalcmd
2011-03-18 16:20 . 2010-12-17 06:56 545 ----a-w- c:\windows\UC.PIF
2011-03-18 16:20 . 2010-12-17 06:56 545 ----a-w- c:\windows\RAR.PIF
2011-03-18 16:20 . 2010-12-17 06:56 545 ----a-w- c:\windows\PKZIP.PIF
2011-03-18 16:20 . 2010-12-17 06:56 545 ----a-w- c:\windows\PKUNZIP.PIF
2011-03-18 16:20 . 2010-12-17 06:56 545 ----a-w- c:\windows\NOCLOSE.PIF
2011-03-18 16:20 . 2010-12-17 06:56 545 ----a-w- c:\windows\LHA.PIF
2011-03-18 16:20 . 2010-12-17 06:56 545 ----a-w- c:\windows\ARJ.PIF
2011-03-18 15:45 . 2011-03-18 15:45 -------- d-----w- c:\users\Roman\AppData\Roaming\Smart PDF Creator Pro
2011-03-18 15:45 . 2011-03-18 15:45 -------- d-----w- c:\program files\Common Files\Smart Soft
2011-03-18 15:45 . 2011-03-18 15:45 -------- d-----w- c:\program files\Smart PDF Creator Pro
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-06 18:54 . 2010-11-26 13:40 6656 ----a-w- c:\windows\system32\bcmwlrc.dll
2011-04-06 18:54 . 2010-11-26 13:40 95544 ----a-w- c:\windows\system32\SET30E0.tmp
2011-04-06 18:54 . 2010-11-26 13:40 3891200 ----a-w- c:\windows\system32\SET2F58.tmp
2011-04-06 18:54 . 2010-11-26 13:40 3555840 ----a-w- c:\windows\system32\bcmihvui64.dll
2011-04-06 18:54 . 2010-11-26 13:40 3060800 ----a-w- c:\windows\system32\drivers\BCMWL664.SYS
2011-03-21 08:32 . 2010-12-01 16:27 189248 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2011-03-21 08:32 . 2010-12-01 16:27 75136 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2011-02-02 19:40 . 2010-12-23 12:49 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll
2011-01-26 06:53 . 2011-03-10 12:27 982912 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2011-01-26 06:53 . 2011-03-10 12:27 265088 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2011-01-26 06:31 . 2011-03-10 12:27 144384 ----a-w- c:\windows\system32\cdd.dll
2010-10-01 00:11 . 2010-12-23 12:52 462112 ----a-w- c:\program files (x86)\Common Files\ZugoInstaller.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
"Steam"="d:\hry\Team Fortress\steam.exe" [2011-01-30 1242448]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-09-30 98304]
"GrooveMonitor"="d:\programy\Office 2007\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-02-15 1230704]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2010-11-15 35736]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-15 932288]
"QLBController"="c:\program files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe" [2010-10-01 256056]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2010-7-29 1132320]
HPMonitor.exe.lnk - c:\program files (x86)\Hewlett-Packard\HP Mouse Suite\hpMonitor.exe [2009-11-5 87312]
hpwmsd.exe.lnk - c:\programdata\HP Mouse Suite Config\hpwmsd.exe [2009-11-16 376592]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Služba Google Update (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-06 136176]
R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2010-11-20 1436424]
R3 GGSAFERDriver;GGSAFER Driver;c:\program files (x86)\Garena\safedrv.sys [x]
R3 HP8207_8307;Hewlett-Packard;c:\windows\system32\drivers\HP8207_8307.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1205000.07D\SYMDS64.SYS [x]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1205000.07D\SYMEFA64.SYS [x]
S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20110309.001\BHDrvx64.sys [2011-02-25 1124472]
S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20110411.001\IDSvia64.sys [2011-03-14 476792]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1205000.07D\Ironx64.SYS [x]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NISx64\1205000.07D\SYMNETS.SYS [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2010-09-27 92216]
S2 hpHotkeyMonitor;HP Hotkey Monitor;c:\program files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe [2010-10-01 280120]
S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe [2010-11-24 130000]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys [x]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2010-11-06 132656]
S3 HideMyIpSRV;HideMyIpSRV;c:\program files (x86)\Hide My IP\HideMyIpSrv.exe [2010-07-06 3039536]
S3 RTL8167;Ovladač Realtek 8167 NT;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2011-04-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-16 14:18]
.
2011-04-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-16 14:18]
.
2011-04-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-924249201-3181747236-3875159349-1000Core.job
- c:\users\Roman\AppData\Local\Google\Update\GoogleUpdate.exe [2010-11-06 14:18]
.
2011-04-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-924249201-3181747236-3875159349-1000UA.job
- c:\users\Roman\AppData\Local\Google\Update\GoogleUpdate.exe [2010-11-06 14:18]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SmartSoft PDF Printer Agent"="c:\program files\Smart PDF Creator Pro\SmartSoft PDF Printer Agent.exe" [2011-03-11 50568]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - d:\programy\OFFICE~1\Office12\EXCEL.EXE/3000
IE: Odeslat obrázek do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Odeslat stránku do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
BHO-{64182481-4F71-486b-A045-B233BD0DA8FC} - c:\program files (x86)\facemoods.com\facemoods\1.4.17.5\bh\facemoods.dll
Toolbar-{DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - c:\program files (x86)\facemoods.com\facemoods\1.4.17.5\facemoodsTlbr.dll
Wow6432Node-HKCU-Run-RegistryBooster - c:\program files (x86)\Uniblue\RegistryBooster\launcher.exe
Wow6432Node-HKCU-Run-ICQ - c:\program files (x86)\ICQ7.2\ICQ.exe
Wow6432Node-HKLM-Run-facemoods - c:\program files (x86)\facemoods.com\facemoods\1.4.17.5\facemoodssrv.exe
AddRemove-facemoods - c:\program files (x86)\facemoods.com\facemoods\1.4.17.5\uninstall.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NIS]
"ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\18.5.0.125\diMaster.dll\" /prefetch:1"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-924249201-3181747236-3875159349-1000\Software\SecuROM\License information*]
"datasecu"=hex:f0,03,48,d4,67,8a,f0,c8,ba,1c,4a,f8,cd,90,fd,01,3b,83,43,10,90,
96,4b,44,f9,0a,c6,21,39,9e,a2,71,30,7d,a8,08,7b,a3,a0,fe,be,d7,38,d0,36,f2,\
"rkeysecu"=hex:ec,9f,b1,6f,05,be,56,b7,c5,f8,78,24,4a,46,3b,16
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2011-04-12 21:48:26
ComboFix-quarantined-files.txt 2011-04-12 19:48
.
Před spuštěním: 2 109 775 872
Po spuštění: 4 634 710 016
.
- - End Of File - - 8A257C42C77D68F95187BD2A45636EA2


Dík, Roli.

[Roli]

K tomu fixnutí, HJT musíš spustit kliknutím pravého myšítka a vybrat Spustit jako admin.


Pokud jsi tak ještě neučinil, přesuň Combofix na plochu

otevři si Poznámkový blok

do něj zkopíruj skript z následujícího okna:

Kód: Vybrat vše

File::  
c:\windows\system32\SET30E0.tmp
c:\windows\system32\SET2F58.tmp

RegLock::
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

ulož Tebou vytvořený TXT soubor jako CFScript.txt na plochu,

po uložení uchop vytvořený skript levým myšítkem a přesuň ho nad ikonu Combofixu, kde ho upustíš:



Po aplikaci na Tebe vypadne další log, zkopíruj ho sem

Upozornění : může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou,

v tom případě znovu restartuj a přitom mačkej F8 poté zvol Poslední známou funkční konfiguraci

[Roman]

O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (file missing)

Po spuštění HJT a FIX těchto dvou ?? ( viz. nahoře) mi to píše nějaký error..

po aplikaci to s tim Combfixem, se hned jak připravuje na spuštění to napíše : CFC script chyba názvu (Název CFC script se zdá být nesprávně hláskovaný)

[Roli]

To fixnutí zatím neřeš a skript ComboFixu musí být uložený jako CFScript.txt

tak si to překontroluj abys neměl třeba CFScript.txt.txt a podobně.

[Roman]

ComboFix 11-04-12.01 - Roman 13.04.2011 17:43:26.2.2 - x64
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1029.18.3830.1971 [GMT 2:00]
Spuštěný z: d:\downloads\ComboFix.exe
Použité ovládací přepínače :: c:\users\Roman\Desktop\CFScript.txt.txt
AV: Norton Internet Security *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Internet Security *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-03-13 do 2011-04-13 )))))))))))))))))))))))))))))))
.
.
2011-04-13 15:47 . 2011-04-13 15:47 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-04-12 19:28 . 2011-04-12 19:28 -------- d-----w- c:\users\Roman\AppData\Roaming\Malwarebytes
2011-04-12 19:28 . 2011-04-12 19:28 -------- d-----w- c:\programdata\Malwarebytes
2011-04-12 19:28 . 2010-12-20 16:09 38224 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-04-12 19:28 . 2011-04-12 19:28 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-04-12 19:28 . 2010-12-20 16:08 24152 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-04-07 15:34 . 2011-04-07 15:34 -------- d-----w- c:\users\Roman\AppData\Local\VT_Software
2011-04-06 19:06 . 2010-02-08 17:19 8038944 ----a-w- c:\windows\system32\RTSUSTORicon.dll
2011-04-06 19:05 . 2011-04-06 19:05 -------- d-----w- c:\program files (x86)\Realtek
2011-04-06 19:05 . 2010-02-08 19:57 239136 ----a-w- c:\windows\system32\drivers\RtsUStor.sys
2011-04-06 19:05 . 2010-02-08 17:19 8038944 ----a-w- c:\windows\SysWow64\RtsUStoricon.dll
2011-04-06 19:05 . 2010-02-08 17:19 422432 ----a-w- c:\windows\system32\RtsUStor.dll
2011-04-06 19:03 . 2010-01-18 13:34 381824 ----a-w- c:\windows\system32\vsnp2uvc.dll
2011-04-06 19:03 . 2010-01-18 13:34 1803904 ----a-w- c:\windows\system32\drivers\snp2uvc.sys
2011-04-06 19:03 . 2010-01-18 13:34 249728 ----a-w- c:\windows\system32\rsnp2uvc.dll
2011-04-06 19:03 . 2010-01-18 13:34 255360 ----a-w- c:\windows\SysWow64\rsnp2uvc.dll
2011-04-06 19:03 . 2011-04-06 19:03 -------- d-----w- c:\program files (x86)\Common Files\SNP2UVC
2011-04-06 19:03 . 2010-01-18 13:34 40064 ----a-w- c:\windows\system32\drivers\sncduvc.sys
2011-04-06 19:03 . 2010-01-18 13:34 244096 ----a-w- c:\windows\system32\csnp2uvc.dll
2011-04-06 19:03 . 2010-01-18 13:34 312192 ----a-w- c:\windows\SysWow64\vsnp2uvc.dll
2011-04-06 19:03 . 2010-01-18 13:34 25984 ----a-w- c:\windows\snuvcdsm.exe
2011-04-06 19:02 . 2009-06-09 11:28 64000 ------w- c:\windows\SysWow64\agrsmdel.exe
2011-04-06 19:02 . 2009-03-27 16:12 13824 ------w- c:\windows\SysWow64\agrscoin.dll
2011-04-06 19:02 . 2009-03-27 16:12 14848 ------w- c:\windows\SysWow64\agrsco64.dll
2011-04-06 19:02 . 2011-04-06 19:02 -------- d-----w- c:\program files\LSI SoftModem
2011-04-06 19:02 . 2011-04-06 19:02 -------- d-----w- c:\windows\Options
2011-04-05 16:35 . 2011-04-05 16:35 -------- d-----w- c:\program files (x86)\Common Files\Java
2011-04-05 16:30 . 2011-04-08 12:52 -------- d-----w- c:\users\Roman\AppData\Roaming\.minecraft
2011-04-04 09:58 . 2011-04-04 09:58 -------- d-----w- c:\users\Roman\AppData\Local\Electronic Arts
2011-04-04 09:57 . 2011-04-04 09:57 -------- d-----w- c:\program files (x86)\Electronic Arts
2011-03-27 15:40 . 2011-04-04 09:57 -------- d-----w- c:\programdata\Electronic Arts
2011-03-27 15:40 . 2011-03-27 15:40 -------- d-----w- c:\programdata\EA Core
2011-03-26 13:23 . 2011-03-26 13:23 -------- d-----w- c:\program files\Hewlett-Packard
2011-03-26 13:21 . 2011-03-26 13:23 -------- d-----w- c:\users\Roman\AppData\Roaming\Hewlett-Packard
2011-03-26 00:46 . 2011-03-26 00:49 -------- d-----w- C:\Downloads
2011-03-26 00:45 . 2011-04-10 20:52 -------- d-----w- c:\users\Roman\AppData\Roaming\BitComet
2011-03-26 00:45 . 2011-03-26 00:45 -------- d-----w- c:\program files (x86)\BitComet
2011-03-26 00:44 . 2011-03-26 00:44 -------- d-----w- c:\programdata\InstallMate
2011-03-21 08:34 . 2011-04-04 10:34 -------- d-----w- c:\programdata\Solidshield
2011-03-21 08:32 . 2011-03-21 08:32 -------- d-----w- c:\users\Roman\AppData\Roaming\PunkBuster
2011-03-21 08:31 . 2011-03-21 08:31 -------- d-----w- c:\program files (x86)\Ubisoft
2011-03-18 16:22 . 2011-03-18 16:22 -------- d-----w- c:\users\Roman\AppData\Local\GHISLER
2011-03-18 16:20 . 2011-04-11 10:56 -------- d-----w- c:\users\Roman\AppData\Roaming\GHISLER
2011-03-18 16:20 . 2011-03-18 16:21 -------- d-----w- C:\totalcmd
2011-03-18 16:20 . 2010-12-17 06:56 545 ----a-w- c:\windows\UC.PIF
2011-03-18 16:20 . 2010-12-17 06:56 545 ----a-w- c:\windows\RAR.PIF
2011-03-18 16:20 . 2010-12-17 06:56 545 ----a-w- c:\windows\PKZIP.PIF
2011-03-18 16:20 . 2010-12-17 06:56 545 ----a-w- c:\windows\PKUNZIP.PIF
2011-03-18 16:20 . 2010-12-17 06:56 545 ----a-w- c:\windows\NOCLOSE.PIF
2011-03-18 16:20 . 2010-12-17 06:56 545 ----a-w- c:\windows\LHA.PIF
2011-03-18 16:20 . 2010-12-17 06:56 545 ----a-w- c:\windows\ARJ.PIF
2011-03-18 15:45 . 2011-03-18 15:45 -------- d-----w- c:\users\Roman\AppData\Roaming\Smart PDF Creator Pro
2011-03-18 15:45 . 2011-03-18 15:45 -------- d-----w- c:\program files\Common Files\Smart Soft
2011-03-18 15:45 . 2011-03-18 15:45 -------- d-----w- c:\program files\Smart PDF Creator Pro
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-06 18:54 . 2010-11-26 13:40 6656 ----a-w- c:\windows\system32\bcmwlrc.dll
2011-04-06 18:54 . 2010-11-26 13:40 95544 ----a-w- c:\windows\system32\SET30E0.tmp
2011-04-06 18:54 . 2010-11-26 13:40 3891200 ----a-w- c:\windows\system32\SET2F58.tmp
2011-04-06 18:54 . 2010-11-26 13:40 3555840 ----a-w- c:\windows\system32\bcmihvui64.dll
2011-04-06 18:54 . 2010-11-26 13:40 3060800 ----a-w- c:\windows\system32\drivers\BCMWL664.SYS
2011-03-21 08:32 . 2010-12-01 16:27 189248 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2011-03-21 08:32 . 2010-12-01 16:27 75136 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2011-02-02 19:40 . 2010-12-23 12:49 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll
2011-01-26 06:53 . 2011-03-10 12:27 982912 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2011-01-26 06:53 . 2011-03-10 12:27 265088 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2011-01-26 06:31 . 2011-03-10 12:27 144384 ----a-w- c:\windows\system32\cdd.dll
2010-10-01 00:11 . 2010-12-23 12:52 462112 ----a-w- c:\program files (x86)\Common Files\ZugoInstaller.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2011-04-12_19.47.09 )))))))))))))))))))))))))))))))))))))))))
.
- 2010-11-06 15:37 . 2011-04-12 19:01 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-11-06 15:37 . 2011-04-13 15:42 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-11-06 15:37 . 2011-04-12 19:01 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-11-06 15:37 . 2011-04-13 15:42 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-11-06 17:24 . 2011-04-13 15:39 380278 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin
- 2009-07-14 02:36 . 2011-04-12 15:46 651648 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2011-04-13 15:42 651648 c:\windows\system32\perfh009.dat
+ 2009-07-14 15:18 . 2011-04-13 15:42 665944 c:\windows\system32\perfh005.dat
- 2009-07-14 15:18 . 2011-04-12 15:46 665944 c:\windows\system32\perfh005.dat
- 2009-07-14 02:36 . 2011-04-12 15:46 120580 c:\windows\system32\perfc009.dat
+ 2009-07-14 02:36 . 2011-04-13 15:42 120580 c:\windows\system32\perfc009.dat
- 2009-07-14 15:18 . 2011-04-12 15:46 139608 c:\windows\system32\perfc005.dat
+ 2009-07-14 15:18 . 2011-04-13 15:42 139608 c:\windows\system32\perfc005.dat
+ 2009-07-14 02:34 . 2011-04-13 10:24 10747904 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
- 2009-07-14 02:34 . 2011-04-12 07:49 10747904 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{64182481-4F71-486b-A045-B233BD0DA8FC}]
c:\program files (x86)\facemoods.com\facemoods\1.4.17.5\bh\facemoods.dll [BU]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{DB4E9724-F518-4dfd-9C7C-78B52103CAB9}"= "c:\program files (x86)\facemoods.com\facemoods\1.4.17.5\facemoodsTlbr.dll" [BU]
.
[HKEY_CLASSES_ROOT\clsid\{db4e9724-f518-4dfd-9c7c-78b52103cab9}]
[HKEY_CLASSES_ROOT\facemoods.dskBnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}]
[HKEY_CLASSES_ROOT\facemoods.dskBnd]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
"Steam"="d:\hry\Team Fortress\steam.exe" [2011-01-30 1242448]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"QLBController"="c:\program files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe" [2010-10-01 256056]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2010-7-29 1132320]
HPMonitor.exe.lnk - c:\program files (x86)\Hewlett-Packard\HP Mouse Suite\hpMonitor.exe [2009-11-5 87312]
hpwmsd.exe.lnk - c:\programdata\HP Mouse Suite Config\hpwmsd.exe [2009-11-16 376592]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Služba Google Update (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-06 136176]
R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2010-11-20 1436424]
R3 GGSAFERDriver;GGSAFER Driver;c:\program files (x86)\Garena\safedrv.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1205000.07D\SYMDS64.SYS [x]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1205000.07D\SYMEFA64.SYS [x]
S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20110309.001\BHDrvx64.sys [2011-02-25 1124472]
S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20110412.001\IDSvia64.sys [2011-03-14 476792]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1205000.07D\Ironx64.SYS [x]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NISx64\1205000.07D\SYMNETS.SYS [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2010-09-27 92216]
S2 hpHotkeyMonitor;HP Hotkey Monitor;c:\program files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe [2010-10-01 280120]
S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe [2010-11-24 130000]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys [x]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2010-11-06 132656]
S3 HideMyIpSRV;HideMyIpSRV;c:\program files (x86)\Hide My IP\HideMyIpSrv.exe [2010-07-06 3039536]
S3 HP8207_8307;Hewlett-Packard;c:\windows\system32\drivers\HP8207_8307.sys [x]
S3 RTL8167;Ovladač Realtek 8167 NT;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2011-04-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-16 14:18]
.
2011-04-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-16 14:18]
.
2011-04-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-924249201-3181747236-3875159349-1000Core.job
- c:\users\Roman\AppData\Local\Google\Update\GoogleUpdate.exe [2010-11-06 14:18]
.
2011-04-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-924249201-3181747236-3875159349-1000UA.job
- c:\users\Roman\AppData\Local\Google\Update\GoogleUpdate.exe [2010-11-06 14:18]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SmartSoft PDF Printer Agent"="c:\program files\Smart PDF Creator Pro\SmartSoft PDF Printer Agent.exe" [2011-03-11 50568]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - d:\programy\OFFICE~1\Office12\EXCEL.EXE/3000
IE: Odeslat obrázek do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Odeslat stránku do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NIS]
"ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\18.5.0.125\diMaster.dll\" /prefetch:1"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-924249201-3181747236-3875159349-1000\Software\SecuROM\License information*]
"datasecu"=hex:f0,03,48,d4,67,8a,f0,c8,ba,1c,4a,f8,cd,90,fd,01,3b,83,43,10,90,
96,4b,44,f9,0a,c6,21,39,9e,a2,71,30,7d,a8,08,7b,a3,a0,fe,be,d7,38,d0,36,f2,\
"rkeysecu"=hex:ec,9f,b1,6f,05,be,56,b7,c5,f8,78,24,4a,46,3b,16
.
Celkový čas: 2011-04-13 17:49:27
ComboFix-quarantined-files.txt 2011-04-13 15:49
ComboFix2.txt 2011-04-12 19:48
.
Před spuštěním: 4 310 528 000
Po spuštění: 4 254 138 368
.
- - End Of File - - FFF5B3640E41E7F6CCE22BB085DF6E47

[Roli]

Něco je špatně, zkusíme to jinak.

Přes Start >> Spustit zkopíruj do okna:

ComboFix /Uninstall

a stiskni Enter

To odinstaluje ComboFix a smaže s ním související soubory a složky.


Stáhni a spusť OTMoveIt

do levého okna aplikace pod Paste Instructions for Items to be Moved zkopíruj tento text:

Kód: Vybrat vše

:processes
explorer.exe       

:files 
C:\*.tmp
C:\WINDOWS\System32\*.tmp
C:\WINDOWS\*.tmp
c:\program files (x86)\facemoods.com

:reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{DB4E9724-F518-4dfd-9C7C-78B52103CAB9}"=-
[-HKEY_CLASSES_ROOT\clsid\{db4e9724-f518-4dfd-9c7c-78b52103cab9}]
[-HKEY_CLASSES_ROOT\facemoods.dskBnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}]
[-HKEY_CLASSES_ROOT\facemoods.dskBnd]

:commands
[purity]
[emptytemp]
[start explorer]

klikni na MoveIt! a v pravém zeleném okně aplikace se Ti objeví info o provedene akci, obsah okna zkopíruj sem,

pokud aplikace bude požadovat restart, klikni na YES

v tom případě sem chci zkopírovat obsah logu uloženého na C:\_OTMoveIt\MovedFiles\

[Roman]

V tom asi bude probém... po kliknutí na MoveIt, to napíše, že tento počítač neodpovídá, u toho programu... tudíž cez správce ho musím vypnout, po druhém pokusu zmizelo vše z plochy a počítač se stal neovladatelným... musel sem vyjmout baterku a strčit zpět.. opětovně jsem zkusil a udělalo to to samé jako u pokusu č.1 .. Nejenom, že furt hapruje RAM na 46 % ... ted se k tomu přidal i procesor na 100 % '!!!! Nemám ten PC vypnout a přeinstalova windowsy ?? Nemůže se to vysrat, když to je takhle přetížený ?

[Roli]

Hardware chrání sám sebe tak že by nemělo při přetížení dojít k jeho poškození.

OTMoveIt při své činnosti "vypne" plochu aby mu nic nebránilo v mazání.

I tak je něco špatně

Ano Win 7 jsou trošku nenažrané co se týče RAM, většinou přes 1GB

Co přesně vytěžuje procesor ?