svchost - 100% CPU usage (skrytý rootkit ?)

[WhySoSad]

rUpdater schválně nemám, může letět...

V příloze je log z PCHunter a Addition.txt a FRST.txt z FRST

[altrok]

• Do Poznamkoveho bloku (Start -> spustit -> notepad) zkopirujte obsah bileho pole
• ulozte na plochu jako fixlist (Typ souboru: Textovy dokument)
• znovu spustte FRST a kliknete na Fix
• po restartu bude na plose ulozen fixlog, jehoz obsah mi vlozte do pristi odpovedi

  Kód: Vybrat vše

  Start
  CloseProcesses:
  Task: {0CD8017E-E222-48F4-9281-F69320070B36} - System32\Tasks\Origin => C:\ProgramData\Origin\update.vbe [2015-04-20] () <==== ATTENTION
  Task: {2529DED2-D656-4DD3-ADDF-C0B7119D62A7} - System32\Tasks\{B759C828-3D3D-4298-9475-E1CD5A3F449E} => pcalua.exe -a C:\Users\Vašek\Downloads\dxwebsetup(3).exe -d C:\Users\Vašek\Downloads
  Task: {4FF75B9D-4C51-47EC-9B81-0CDBB789D98C} - System32\Tasks\{63DD9998-9D10-42C5-9BF3-CEC07EC9F60A} => pcalua.exe -a C:\Users\Vašek\Downloads\dxwebsetup(5).exe -d C:\Users\Vašek\Downloads
  Task: {61A657E2-3F52-4600-AB89-7076FD05C5E5} - System32\Tasks\{B7504F28-BE5E-4840-9F2D-0EB7F1706BF4} => pcalua.exe -a E:\RGSC\setup.exe -d E:\RGSC
  Task: {922C0B62-3A1A-43B2-A6BE-F3E155A3B938} - System32\Tasks\{F54BCD02-87F5-4B8C-810C-46F4004A9B99} => pcalua.exe -a C:\Users\Vašek\Downloads\dxwebsetup(1).exe -d C:\Users\Vašek\Downloads
  AlternateDataStreams: C:\Users\Marek\AppData\Local\Temporary Internet Files:ijisQ2zflRxkv9EHwlVHqr8LNR
  AlternateDataStreams: C:\Users\Vašek\AppData\Local\Temporary Internet Files:ijisQ2zflRxkv9EHwlVHqr8LNR
  IE trusted site: HKU\S-1-5-21-266349663-400684417-2290147511-1003\...\clonewarsadventures.com -> clonewarsadventures.com
  IE trusted site: HKU\S-1-5-21-266349663-400684417-2290147511-1003\...\freerealms.com -> freerealms.com
  IE trusted site: HKU\S-1-5-21-266349663-400684417-2290147511-1003\...\soe.com -> soe.com
  IE trusted site: HKU\S-1-5-21-266349663-400684417-2290147511-1003\...\sony.com -> sony.com
  
  CHR StartupUrls: Default -> "hxxp://search.phpnuke.org/?lang=en&cid=457c4dfc"
  R2 rUpdater; C:\Program Files\rUpdater\rUpdater_srv.exe [98304 2015-04-25] () [File not signed]
  
  2015-05-22 12:49 - 2015-05-22 12:49 - 00000000 ____D () C:\Users\Vašek\Desktop\FRST-OlderVersion
  2015-05-22 12:29 - 2015-05-22 12:50 - 00000000 ____D () C:\Users\Vašek\Desktop\PCHunter_free
  2015-05-21 07:13 - 2015-05-21 07:13 - 16502728 _____ (Malwarebytes Corp.) C:\Users\Vašek\Downloads\mbar-1.09.1.1004.exe
  2015-05-21 07:13 - 2015-05-21 07:13 - 00000000 ____D () C:\Users\Vašek\Desktop\mbar
  2015-05-20 14:12 - 2015-05-20 14:12 - 00029696 _____ () C:\Users\Vašek\AppData\Local\MSGBOX.EXE
  2015-05-20 14:12 - 2015-05-20 14:12 - 00015327 _____ () C:\Users\Vašek\Desktop\LM.bat
  2015-05-02 10:19 - 2015-05-02 10:19 - 00000000 ____D () C:\Windows\rUpdater
  2015-05-02 10:19 - 2015-05-02 10:19 - 00000000 ____D () C:\Program Files\rUpdater
  C:\Users\Vašek\AppData\Local\Temp
  C:\Windows\Temp
  C:\ProgramData\Origin\update.vbe
  End