Divné chování PC

[Lavinian]

Funkčnost videa na YouTube je asi 50-50. I normální stránky a celkově počítač se sekají. Pevný disk zbytecně hrabe.
Tady je log z RSIT:
Logfile of random's system information tool 1.08 (written by random/random)
Run by o at 2011-06-21 18:10:38
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 728 GB (76%) free of 954 GB
Total RAM: 4094 MB (73% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:10:49, on 21.6.2011
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files\trend micro\o.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tsbohemia.cz
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Pomocná služba pro přihlášení ke službě Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - Startup: hamachi.lnk = C:\Program Files (x86)\Hamachi\hamachi.exe
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files (x86)\WinPcap\rpcapd.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 6956 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
"c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe"
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\nvvsvc.exe -session -first
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe" -s
C:\Windows\SysWOW64\PnkBstrA.exe
"C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
"C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe"
WLIDSvcM.exe 1760
"c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe"
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
"C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
"C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
"C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
"C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel=3332.db15fa0.1105132391 "C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll" 3332 plugin \\.\pipe\gecko-crash-server-pipe.3332
taskhost.exe $(Arg0)
"C:\Users\o\Desktop\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 529280]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocná služba pro přihlášení ke službě Windows Live ID - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 439168]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9FDDE16B-836F-4806-AB1F-1455CBEFF289}]
Windows Live Messenger Companion Helper - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll [2010-11-10 393600]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2010-04-30 10806816]
"MSC"=c:\Program Files\Microsoft Security Client\msseces.exe [2010-11-30 1436224]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2010-04-01 357696]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"=C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2011-06-08 37296]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-03-30 937920]
"DivXUpdate"=C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [2011-03-21 1230704]
"LogMeIn Hamachi Ui"=C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [2011-05-25 1951112]

C:\Users\o\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
hamachi.lnk - C:\Program Files (x86)\Hamachi\hamachi.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\system32\webcheck.dll [2011-05-25 249344]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"= []

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"= []

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 months======

2011-06-20 14:51:53 ----SHD---- C:\ProgramData\SecuROM
2011-06-20 14:45:54 ----D---- C:\ArcaniA - Gothic 4 Demo
2011-06-16 19:06:37 ----D---- C:\Program Files (x86)\MyPlayCity.com
2011-06-15 21:12:42 ----A---- C:\Windows\system32\mshtmled.dll
2011-06-15 21:12:41 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2011-06-15 21:12:41 ----A---- C:\Windows\system32\iertutil.dll
2011-06-15 21:12:40 ----A---- C:\Windows\SYSWOW64\ieui.dll
2011-06-15 21:12:40 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2011-06-15 21:12:40 ----A---- C:\Windows\system32\ieui.dll
2011-06-15 21:12:39 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2011-06-15 21:12:39 ----A---- C:\Windows\SYSWOW64\jscript.dll
2011-06-15 21:12:39 ----A---- C:\Windows\system32\jscript9.dll
2011-06-15 21:12:39 ----A---- C:\Windows\system32\jscript.dll
2011-06-15 21:12:38 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2011-06-15 21:12:38 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2011-06-15 21:12:38 ----A---- C:\Windows\system32\urlmon.dll
2011-06-15 21:12:36 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2011-06-15 21:12:36 ----A---- C:\Windows\system32\mshtml.dll
2011-06-15 21:12:36 ----A---- C:\Windows\system32\ieframe.dll
2011-06-15 21:01:24 ----A---- C:\Windows\system32\drivers\tcpip.sys
2011-06-15 21:01:23 ----A---- C:\Windows\system32\drivers\afd.sys
2011-06-15 21:01:20 ----A---- C:\Windows\system32\drivers\srvnet.sys
2011-06-15 21:01:20 ----A---- C:\Windows\system32\drivers\srv2.sys
2011-06-15 21:01:20 ----A---- C:\Windows\system32\drivers\srv.sys
2011-06-15 21:01:16 ----A---- C:\Windows\system32\win32k.sys
2011-06-15 21:01:15 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2011-06-15 21:01:15 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2011-06-15 21:01:15 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2011-06-15 21:01:14 ----A---- C:\Windows\SYSWOW64\oleaut32.dll
2011-06-15 21:01:14 ----A---- C:\Windows\system32\oleaut32.dll
2011-06-15 21:00:35 ----A---- C:\Windows\SYSWOW64\inetcomm.dll
2011-06-15 21:00:35 ----A---- C:\Windows\system32\inetcomm.dll
2011-06-11 09:57:27 ----D---- C:\ProgramData\Trymedia
2011-06-11 09:28:36 ----D---- C:\FEAR
2011-06-06 17:34:31 ----D---- C:\KaM - The Peasants Rebellion
2011-06-05 09:34:21 ----AH---- C:\Windows\system32\hamachi.sys
2011-06-05 09:34:18 ----D---- C:\Program Files (x86)\LogMeIn Hamachi
2011-06-01 19:21:57 ----D---- C:\ProgramData\WeGame
2011-05-26 17:54:46 ----D---- C:\Program Files (x86)\PikPakPok
2011-05-25 16:03:32 ----A---- C:\Windows\SYSWOW64\wininet.dll
2011-05-25 16:03:32 ----A---- C:\Windows\SYSWOW64\wextract.exe
2011-05-25 16:03:32 ----A---- C:\Windows\SYSWOW64\webcheck.dll
2011-05-25 16:03:32 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2011-05-25 16:03:32 ----A---- C:\Windows\SYSWOW64\url.dll
2011-05-25 16:03:32 ----A---- C:\Windows\SYSWOW64\SetIEInstalledDate.exe
2011-05-25 16:03:32 ----A---- C:\Windows\SYSWOW64\RegisterIEPKEYs.exe
2011-05-25 16:03:32 ----A---- C:\Windows\SYSWOW64\pngfilt.dll
2011-05-25 16:03:32 ----A---- C:\Windows\SYSWOW64\occache.dll
2011-05-25 16:03:32 ----A---- C:\Windows\SYSWOW64\msrating.dll
2011-05-25 16:03:32 ----A---- C:\Windows\SYSWOW64\msls31.dll
2011-05-25 16:03:32 ----A---- C:\Windows\SYSWOW64\mshtmler.dll
2011-05-25 16:03:32 ----A---- C:\Windows\SYSWOW64\mshta.exe
2011-05-25 16:03:32 ----A---- C:\Windows\SYSWOW64\msfeedssync.exe
2011-05-25 16:03:32 ----A---- C:\Windows\SYSWOW64\msfeedsbs.dll
2011-05-25 16:03:32 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2011-05-25 16:03:32 ----A---- C:\Windows\SYSWOW64\licmgr10.dll
2011-05-25 16:03:32 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2011-05-25 16:03:32 ----A---- C:\Windows\SYSWOW64\inseng.dll
2011-05-25 16:03:32 ----A---- C:\Windows\SYSWOW64\imgutil.dll
2011-05-25 16:03:32 ----A---- C:\Windows\SYSWOW64\iexpress.exe
2011-05-25 16:03:32 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2011-05-25 16:03:32 ----A---- C:\Windows\SYSWOW64\iesysprep.dll
2011-05-25 16:03:32 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2011-05-25 16:03:32 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2011-05-25 16:03:32 ----A---- C:\Windows\SYSWOW64\iepeers.dll
2011-05-25 16:03:32 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2011-05-25 16:03:32 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2011-05-25 16:03:32 ----A---- C:\Windows\SYSWOW64\ieakui.dll
2011-05-25 16:03:32 ----A---- C:\Windows\SYSWOW64\ieaksie.dll
2011-05-25 16:03:32 ----A---- C:\Windows\SYSWOW64\ieakeng.dll
2011-05-25 16:03:32 ----A---- C:\Windows\SYSWOW64\IEAdvpack.dll
2011-05-25 16:03:32 ----A---- C:\Windows\SYSWOW64\ie4uinit.exe
2011-05-25 16:03:32 ----A---- C:\Windows\SYSWOW64\icardie.dll
2011-05-25 16:03:32 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2011-05-25 16:03:32 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2011-05-25 16:03:32 ----A---- C:\Windows\SYSWOW64\admparse.dll
2011-05-25 16:03:32 ----A---- C:\Windows\system32\wininet.dll
2011-05-25 16:03:32 ----A---- C:\Windows\system32\wextract.exe
2011-05-25 16:03:32 ----A---- C:\Windows\system32\webcheck.dll
2011-05-25 16:03:32 ----A---- C:\Windows\system32\vbscript.dll
2011-05-25 16:03:32 ----A---- C:\Windows\system32\url.dll
2011-05-25 16:03:32 ----A---- C:\Windows\system32\SetIEInstalledDate.exe
2011-05-25 16:03:32 ----A---- C:\Windows\system32\RegisterIEPKEYs.exe
2011-05-25 16:03:32 ----A---- C:\Windows\system32\pngfilt.dll
2011-05-25 16:03:32 ----A---- C:\Windows\system32\occache.dll
2011-05-25 16:03:32 ----A---- C:\Windows\system32\msrating.dll
2011-05-25 16:03:32 ----A---- C:\Windows\system32\msls31.dll
2011-05-25 16:03:32 ----A---- C:\Windows\system32\mshtmler.dll
2011-05-25 16:03:32 ----A---- C:\Windows\system32\mshta.exe
2011-05-25 16:03:32 ----A---- C:\Windows\system32\msfeedssync.exe
2011-05-25 16:03:32 ----A---- C:\Windows\system32\msfeedsbs.dll
2011-05-25 16:03:32 ----A---- C:\Windows\system32\msfeeds.dll
2011-05-25 16:03:32 ----A---- C:\Windows\system32\licmgr10.dll
2011-05-25 16:03:32 ----A---- C:\Windows\system32\jsproxy.dll
2011-05-25 16:03:32 ----A---- C:\Windows\system32\inseng.dll
2011-05-25 16:03:32 ----A---- C:\Windows\system32\imgutil.dll
2011-05-25 16:03:32 ----A---- C:\Windows\system32\iexpress.exe
2011-05-25 16:03:32 ----A---- C:\Windows\system32\ieUnatt.exe
2011-05-25 16:03:32 ----A---- C:\Windows\system32\iesysprep.dll
2011-05-25 16:03:32 ----A---- C:\Windows\system32\iesetup.dll
2011-05-25 16:03:32 ----A---- C:\Windows\system32\iernonce.dll
2011-05-25 16:03:32 ----A---- C:\Windows\system32\iepeers.dll
2011-05-25 16:03:32 ----A---- C:\Windows\system32\iedkcs32.dll
2011-05-25 16:03:32 ----A---- C:\Windows\system32\ieapfltr.dll
2011-05-25 16:03:32 ----A---- C:\Windows\system32\ieakui.dll
2011-05-25 16:03:32 ----A---- C:\Windows\system32\ieaksie.dll
2011-05-25 16:03:32 ----A---- C:\Windows\system32\ieakeng.dll
2011-05-25 16:03:32 ----A---- C:\Windows\system32\IEAdvpack.dll
2011-05-25 16:03:32 ----A---- C:\Windows\system32\ie4uinit.exe
2011-05-25 16:03:32 ----A---- C:\Windows\system32\icardie.dll
2011-05-25 16:03:32 ----A---- C:\Windows\system32\dxtrans.dll
2011-05-25 16:03:32 ----A---- C:\Windows\system32\dxtmsft.dll
2011-05-25 16:03:32 ----A---- C:\Windows\system32\admparse.dll
2011-05-25 14:57:12 ----A---- C:\Windows\system32\drivers\Diskdump.sys
2011-05-24 18:31:27 ----A---- C:\Windows\SYSWOW64\poqexec.exe
2011-05-24 18:31:27 ----A---- C:\Windows\system32\poqexec.exe
2011-05-24 11:14:40 ----D---- C:\Call of Duty Modern Warfare 3

======List of files/folders modified in the last 1 months======

2011-06-21 18:10:49 ----D---- C:\Windows\Prefetch
2011-06-21 18:10:42 ----D---- C:\Program Files\trend micro
2011-06-21 18:10:38 ----D---- C:\rsit
2011-06-21 18:08:59 ----D---- C:\Windows\temp
2011-06-21 18:04:44 ----D---- C:\Windows\system32\config
2011-06-21 17:44:02 ----D---- C:\Users\o\AppData\Roaming\Hamachi
2011-06-21 17:43:34 ----D---- C:\ProgramData\NVIDIA
2011-06-20 20:01:25 ----D---- C:\Program Files (x86)\Mozilla Firefox
2011-06-20 14:51:53 ----D---- C:\ProgramData
2011-06-20 14:50:49 ----SHD---- C:\Windows\Installer
2011-06-20 14:50:49 ----D---- C:\Windows
2011-06-20 14:50:43 ----D---- C:\Program Files (x86)\NVIDIA Corporation
2011-06-20 14:50:42 ----RD---- C:\Program Files (x86)
2011-06-20 14:50:20 ----SHD---- C:\System Volume Information
2011-06-20 14:50:03 ----D---- C:\Windows\winsxs
2011-06-19 20:35:09 ----D---- C:\Windows\System32
2011-06-19 20:35:09 ----D---- C:\Windows\inf
2011-06-19 20:35:09 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-06-17 19:37:47 ----D---- C:\Metin2
2011-06-17 14:08:54 ----D---- C:\Windows\Microsoft.NET
2011-06-17 14:08:44 ----RSD---- C:\Windows\assembly
2011-06-17 13:20:31 ----D---- C:\Windows\SysWOW64
2011-06-16 17:54:31 ----D---- C:\Program Files (x86)\Microsoft Silverlight
2011-06-15 21:21:45 ----D---- C:\Windows\system32\drivers
2011-06-15 21:21:45 ----D---- C:\Program Files\Internet Explorer
2011-06-15 21:21:45 ----D---- C:\Program Files (x86)\Internet Explorer
2011-06-15 21:14:13 ----D---- C:\Windows\debug
2011-06-15 21:14:12 ----A---- C:\Windows\system32\MRT.exe
2011-06-15 21:12:52 ----D---- C:\Windows\system32\catroot
2011-06-15 21:12:51 ----D---- C:\Windows\system32\catroot2
2011-06-15 20:57:03 ----D---- C:\Users\o\AppData\Roaming\uTorrent
2011-06-15 20:57:02 ----D---- C:\Windows\Logs
2011-06-15 20:56:22 ----D---- C:\Program Files (x86)\CCleaner
2011-06-11 09:29:11 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2011-06-10 22:03:50 ----D---- C:\ProgramData\TrackMania
2011-06-09 19:56:38 ----D---- C:\Windows\system32\DriverStore
2011-06-08 17:17:52 ----D---- C:\Gothic 3 Forsaken Gods
2011-06-05 19:50:19 ----D---- C:\Users\o\AppData\Roaming\Skype
2011-06-05 16:59:35 ----D---- C:\Users\o\AppData\Roaming\skypePM
2011-06-01 19:21:58 ----D---- C:\Program Files (x86)\WeGame
2011-05-31 11:51:23 ----D---- C:\Program Files (x86)\Mijagi-MT2
2011-05-26 17:54:43 ----N---- C:\Windows\Setup1.exe
2011-05-26 17:54:42 ----A---- C:\Windows\ST6UNST.EXE
2011-05-25 20:11:10 ----D---- C:\Windows\rescache
2011-05-25 16:04:50 ----D---- C:\Windows\servicing
2011-05-25 16:04:38 ----D---- C:\Windows\SYSWOW64\cs-CZ
2011-05-25 16:04:37 ----D---- C:\Windows\system32\cs-CZ
2011-05-25 16:03:46 ----D---- C:\Windows\SYSWOW64\migration
2011-05-25 16:03:46 ----D---- C:\Windows\SYSWOW64\en-US
2011-05-25 16:03:46 ----D---- C:\Windows\system32\migration
2011-05-25 16:03:46 ----D---- C:\Windows\PolicyDefinitions
2011-05-25 16:03:45 ----D---- C:\Windows\system32\en-US
2011-05-24 12:23:05 ----D---- C:\Gothic III
2011-05-22 22:38:25 ----D---- C:\Program Files (x86)\Microsoft Games for Windows - LIVE

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R0 speedfan;speedfan; C:\Windows\SysWOW64\speedfan.sys [2007-02-07 14104]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-09-08 834544]
R1 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2010-10-24 188928]
R2 NPF;NetGroup Packet Filter Driver; C:\Windows\system32\drivers\npf.sys [2009-10-20 47632]
R3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2011-04-23 33344]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2010-04-30 2359200]
R3 MpNWMon;Microsoft Malware Protection Network Driver; C:\Windows\system32\DRIVERS\MpNWMon.sys [2010-10-24 40832]
R3 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2010-10-24 72064]
R3 RTL8167;Ovladač Realtek 8167 NT; C:\Windows\system32\DRIVERS\Rt64win7.sys [2009-06-10 187392]
S3 ahx9k316;ahx9k316; C:\Windows\system32\drivers\ahx9k316.sys []
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 cpuz130;cpuz130; \??\C:\Users\o\AppData\Local\Temp\cpuz130\cpuz_x64.sys []
S3 EagleX64;EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys []
S3 fssfltr;FssFltr; C:\Windows\system32\DRIVERS\fssfltr.sys [2010-09-23 48488]
S3 KMWDFILTER;HIDServiceDesc; C:\Windows\system32\DRIVERS\KMWDFILTER.sys [2009-04-29 30208]
S3 nmwcd;Nokia USB Phone Parent Driver; C:\Windows\system32\drivers\ccdcmbx64.sys [2010-12-02 19968]
S3 nmwcdc;Nokia USB Communication Driver; C:\Windows\system32\drivers\ccdcmbox64.sys [2010-12-02 27136]
S3 nmwcdnsucx64;Nokia USB Flashing Generic; C:\Windows\system32\drivers\nmwcdnsucx64.sys [2010-12-02 12800]
S3 nmwcdnsux64;Nokia USB Flashing Phone Parent; C:\Windows\system32\drivers\nmwcdnsux64.sys [2010-12-02 171008]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 59392]
S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerfltx64.sys [2010-12-02 9216]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 41984]
S3 usbser;USB Modem Driver; C:\Windows\system32\drivers\usbser.sys [2010-11-20 32768]
S3 UsbserFilt;UsbserFilt; C:\Windows\system32\DRIVERS\usbser_lowerfltjx64.sys [2010-12-02 9216]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine; C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe [2011-05-25 2275720]
R2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe [2010-11-11 12784]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2010-01-11 159336]
R2 PnkBstrA;PnkBstrA; C:\Windows\syswow64\PnkBstrA.exe [2011-04-10 75136]
R2 SBSDWSCService;SBSD Security Center Service; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-01-11 240232]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2010-09-21 2286976]
R3 NisSrv;@c:\Program Files\Microsoft Security Client\Antimalware\MpAsDesc.dll,-243; c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 282616]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S3 fsssvc;Windows Live Family Safety Service; C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2010-09-23 1493352]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); C:\Program Files (x86)\WinPcap\rpcapd.exe [2009-10-20 117264]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-07-24 1255736]
S4 wlcrasvc;Windows Live Mesh remote connections service; C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]

-----------------EOF-----------------

[Rudy]

Dejte ještě log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware

[Lavinian]

velký log, kolem 500kb
http://www.ulozto.cz/9449277/log-zip

[Rudy]

I log z CF vypadá čistý. Ve virech patrně nebude problém. Co jste ionstaloval těsně před tím, než se problém objevil?

[Lavinian]

už se to zlepšilo
ale potřebuji odstranit neodstranitelný Metin2 client
C:\Users\o\Downloads\MT2 Kingdom Setup_6.0.exe

[Rudy]

Zkuste použít Avenger: http://www.viry.cz/forum/viewtopic.php?f=11&t=19832 se skriptem:

Files to delete:
C:\Users\o\Downloads\MT2 Kingdom Setup_6.0.exe

[Lavinian]

Soubor je pryč ale disk má stále velkou tendenci zbytečně hrabat.

[Rudy]

Na zkoušku vypněte aut. aktualizace.

[Lavinian]

No aktualizce jsem vypnul, žádná změna a už to zase blbne (to samé jako přetím).

[Rudy]

Udělejte kompletní sken MBAM: http://www.malwarebytes.org/mbam.php a dejte log. Předem nic nemažte.