VIRY.CZ

Ahoj. Poslední dobou si některé aplikace berou až 99% z CPU. Zaznamenal jsem to u aplikací, které používají připojení k internetu. Jde o všechny webové prohlížeče a o MMO hry.
Tady je log s RSIT(Zde je kompletní)

Logfile of random's system information tool 1.07 (written by random/random)
Run by Owner at 2010-05-23 19:32:50
Microsoft Windows XP Home Edition Service Pack 3
System drive E: has 5 GB (11%) free of 45 GB
Total RAM: 2038 MB (38% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:34:26, on 23.5.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
E:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
E:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
E:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\Explorer.EXE
E:\Program Files\Google\Update\1.2.183.23\GoogleCrashHandler.exe
E:\PROGRA~1\LAUNCH~1\LManager.exe
E:\WINDOWS\RTHDCPL.EXE
E:\WINDOWS\system32\igfxtray.exe
E:\WINDOWS\system32\hkcmd.exe
E:\WINDOWS\system32\igfxpers.exe
E:\Program Files\Common Files\Symantec Shared\ccApp.exe
E:\WINDOWS\system32\igfxsrvc.exe
E:\Program Files\Common Files\Java\Java Update\jusched.exe
E:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
E:\Program Files\Synaptics\SynTP\SynTPEnh.exe
E:\WINDOWS\system32\igfxext.exe
E:\WINDOWS\system32\bgsvcgen.exe
E:\Program Files\Bonjour\mDNSResponder.exe
E:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
E:\WINDOWS\runservice.exe
C:\Acer\Mobility Center\MobilityService.exe
E:\Program Files\Norton AntiVirus\navapsvc.exe
E:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
E:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
E:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
E:\DOCUME~1\Owner\LOCALS~1\Temp\RtkBtMnt.exe
E:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
E:\Documents and Settings\Owner\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
E:\Documents and Settings\Owner\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
E:\Documents and Settings\Owner\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
E:\Documents and Settings\Owner\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
E:\Documents and Settings\Owner\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
E:\Program Files\Mozilla Firefox\firefox.exe
E:\rsit\RSIT.exe
E:\Program Files\trend micro\Owner.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/av ... x_homepage
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.qip.ru/search?query=%s&from=IE
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Folder Castle - {783840E6-0A18-4087-9EC7-A1CC131DF0D4} - E:\PROGRA~1\MAGNET~1\FOLDER~1\FCTOOL~1.DLL
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - E:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - E:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - E:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - E:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: Folder Castle - {783840E6-0A18-4087-9EC7-A1CC131DF0D4} - E:\PROGRA~1\MAGNET~1\FOLDER~1\FCTOOL~1.DLL
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - E:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [LManager] E:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [AzMixerSel] E:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [ADMTray.exe] "C:\Acer\Empowering Technology\admtray.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [IgfxTray] E:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] E:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] E:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [ccApp] "E:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Adobe ARM] "E:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "E:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "E:\Documents and Settings\Owner\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [swg] E:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DriverUpdaterPro] E:\Program Files\XPC Tools\Driver Updater Pro\DriverUpdaterPro.exe -t
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] E:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] E:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] E:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] E:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Zástupce - SynTPEnh.exe.lnk = E:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - E:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: e:\windows\system32\nwprovau.dll
O16 - DPF: {210D0CBC-8B17-48D1-B294-1A338DD2EB3A} (VatCtrl Class) - http://85.193.52.237/VatDec.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - E:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - E:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - E:\WINDOWS\System32\browseui.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - E:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - E:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - E:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - E:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - E:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - E:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Služba Google Update (gupdate1ca096815e95a46) (gupdate1ca096815e95a46) - Google Inc. - E:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - E:\Program Files\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - E:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - E:\WINDOWS\runservice.exe
O23 - Service: LiveUpdate - Symantec Corporation - E:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - E:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Unknown owner - E:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe (file missing)
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - E:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: PnkBstrA - Unknown owner - E:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - E:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - E:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ServiceLayer - Nokia. - E:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - E:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Symantec Core LC - Unknown owner - E:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - E:\Program Files\RealVNC\VNC4\WinVNC4.exe
O23 - Service: ePower Service (WMIService) - acer - E:\Acer\Empowering Technology\ePower\ePowerSvc.exe

Zdravím, tohle fixni v HJT :

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.qip.ru/search?query=%s&from=IE
O4 - HKLM\..\Run: [Adobe ARM] "E:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "E:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Google Update] "E:\Documents and Settings\Owner\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [swg] E:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DriverUpdaterPro] E:\Program Files\XPC Tools\Driver Updater Pro\DriverUpdaterPro.exe -t
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] E:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] E:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] E:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] E:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

HJT najdeš zde :

E:\Program Files\trend micro\Owner.exe

Fix znamená že spustíš HJT

v okně které se ti otevře klikneš na Do a system scan only

v dalším okně najdeš řádky které jsem ti vypsal,

vedle nich je čtvereček do kterého uděláš zatržítko,

pak klikneš na Fix checked které je vlevo dole,

program se ti zeptá zda opravdu ANO s tím samozřejmě souhlasíš a je hotovo.


Přes Start >> Spustit >> napiš - services.msc >> OK. Najdi službu :

Služba Google Update

Google Software Updater

ero BackItUp Scheduler 4.0

klikni na ni pravým myšítkem, zvol vlastnosti, na další kartě nejprve službu zastav tlačítkem Zastavit a u položky Typ spouštění zvol Zakázáno.


Smaž nepotřebné soubory

pomocí CCleaneru

návod :

Čistič - tady vyčistíš PC od nepotřebných souborů a vysypeš Koš

Registry - tady vyčistíš registry (před použitím doporučuji udělat jejich zálohu kterou CCleaner nabízí)

Čištění registru je třeba několikrát zopakovat !


Nakonec použij Mbam z mého podpisu.


P.S. logy sem normálně nakopíruj, pokud by byl náhodou dlouhý pečlivě ho rozděl.

Roli píše:Zdravím, tohle fixni v HJT :
Hotovo


Přes Start >> Spustit >> napiš - services.msc >> OK. Najdi službu :
Služba Google Update
Google Software Updater
Nero BackItUp Scheduler 4.0
Hotovo


Smaž nepotřebné soubory pomocí CCleaneru
Hotovo

Nakonec použij Mbam z mého podpisu.
Hotovo

Log z Mbamu:
Malwarebytes' Anti-Malware 1.46
http://www.malwarebytes.org

Verze databáze: 4133

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

23.5.2010 21:02:25
mbam-log-2010-05-23 (21-02-25).txt

Typ skenu: Rychlý sken
Skenované objekty: 139109
Uplynulý čas: 12 minuta(y), 12 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 1
Infikované hodnoty registru: 0
Infikované datové položky registru: 1
Infikované složky: 1
Infikované soubory: 2

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
HKEY_CLASSES_ROOT\sexvid (Trojan.DNSChanger) -> No action taken.

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Infikované složky:
E:\resycled (Trojan.DNSChanger) -> No action taken.

Infikované soubory:
E:\resycled\boot.com (Trojan.DNSChanger) -> No action taken.
E:\WINDOWS\system32\h@tkeysh@@k.dll (Trojan.Agent) -> No action taken.


Log z rsit udělám až smažeme ty viry ne?
"DNSChanger" to by mohla být asi trefa do černého ne?

Vše co Mbam našel nech smazat.

Tuhle službu odpal, jen se mi ztratilo písmenko, promiň.

Nero BackItUp Scheduler 4.0


Stáhni a ulož na plochu ComboFix,

spusť aplikaci jako Administrátor a povol instalaci Konzole pro zotavení - Recovery Console.

Poté se zobrazí okno s licenčními podmínkami které potvrdíš kliknutím na ANO,

pak ještě jednou klik na ANO a už to jede.

Celá akce trvá okolo 10 minut ale může i déle, během skenu se nepokoušej spouštět nic jiného.

Při skenovaní může být PC i restartováno nelekat se.

Upozornění: po dobu skenu vypni rezidentní štít Antiviru a AntiSpy programu,

protože Combofix se pokouší napadené soubory smazat a tyto programy mu můžou bránit.

Po dokončení skenu nebo následném restartu aplikace vytvoří log, uložený na C:/Combofix.txt

(při opakovaném použití jsou logy číslovány Combofix2.txt atd.), jeho obsah zkopíruj sem.

ComboFix 10-05-23.01 - Owner 23.05.2010 21:53:31.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.2038.1636 [GMT 2:00]
Spuštěný z: e:\documents and settings\Owner\Dokumenty\DownloadChrome\ComboFix.exe
AV: Norton AntiVirus 2006 *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Worm Protection *enabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\resycled
c:\resycled\boot.com
e:\documents and settings\Owner\Data aplikací\Microsoft\HTML Help\hh.dat
e:\windows\system32\zlibwapi.dll
e:\windows\wpe pro.INI

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-04-23 do 2010-05-23 )))))))))))))))))))))))))))))))
.

2010-05-23 18:40 . 2010-04-29 13:39 38224 ----a-w- e:\windows\system32\drivers\mbamswissarmy.sys
2010-05-23 18:40 . 2010-05-23 18:40 -------- d-----w- e:\program files\Malwarebytes' Anti-Malware
2010-05-23 18:40 . 2010-04-29 13:39 20952 ----a-w- e:\windows\system32\drivers\mbam.sys
2010-05-23 16:33 . 2010-05-23 18:21 -------- d-----w- e:\program files\trend micro
2010-05-23 16:33 . 2010-05-23 17:36 -------- d-----w- E:\rsit
2010-05-21 13:06 . 2010-05-23 17:17 -------- d-----w- e:\program files\Crayon Physics Deluxe
2010-05-05 08:09 . 2010-05-05 08:09 -------- d-----w- e:\program files\RealVNC
2010-04-28 16:48 . 2010-04-12 15:29 411368 ----a-w- e:\windows\system32\deployJava1.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-23 19:45 . 2009-11-12 14:07 825 --sha-w- e:\windows\system32\mmf.sys
2010-05-17 09:18 . 2008-12-21 17:04 -------- d-----w- e:\program files\uTorrent
2010-05-16 14:58 . 2010-03-17 13:40 -------- d-----w- e:\program files\Common Files\Symantec Shared
2010-05-16 10:06 . 2009-07-20 18:28 -------- d-----w- e:\program files\Google
2010-05-13 14:25 . 2009-10-14 13:21 -------- d-----w- e:\program files\Burn4Free
2010-04-28 16:48 . 2008-12-26 14:46 -------- d-----w- e:\program files\Java
2010-04-28 16:47 . 2008-12-26 14:46 -------- d-----w- e:\program files\Common Files\Java
2010-04-17 19:59 . 2010-01-28 20:37 0 ---ha-w- e:\windows\hfdriver.dat
2010-04-17 11:21 . 2008-12-21 15:19 -------- d--h--w- e:\program files\InstallShield Installation Information
2010-04-08 05:22 . 2008-12-26 14:32 -------- d-----w- e:\program files\Common Files\Adobe
2010-03-31 08:42 . 2010-03-31 08:42 -------- d-----w- e:\program files\LogMeIn Hamachi
2010-03-30 11:39 . 2010-03-30 11:39 -------- d-----w- e:\program files\Common Files\Skype
2010-03-29 13:46 . 2010-03-17 13:42 -------- d-----w- e:\program files\Norton AntiVirus
2010-03-28 10:37 . 2003-04-16 12:00 79440 ----a-w- e:\windows\system32\perfc005.dat
2010-03-28 10:37 . 2003-04-16 12:00 432516 ----a-w- e:\windows\system32\perfh005.dat
2010-03-17 13:41 . 2010-03-17 13:41 10344 ----a-w- e:\windows\system32\drivers\symlcbrd.sys
2010-03-09 11:11 . 2003-04-16 12:00 430080 ----a-w- e:\windows\system32\vbscript.dll
2010-03-04 13:01 . 2006-07-11 17:43 1060864 ----a-w- e:\windows\system32\MFC71.DLL
2010-02-26 05:43 . 2006-06-23 12:27 668160 ----a-w- e:\windows\system32\wininet.dll
2010-02-26 05:43 . 2004-08-17 22:49 81920 ------w- e:\windows\system32\ieencode.dll
2010-02-24 13:11 . 2003-04-16 12:00 455680 ----a-w- e:\windows\system32\drivers\mrxsmb.sys
2009-03-04 13:26 . 2010-01-28 10:58 461312 ----a-w- e:\program files\Common Files\sputil.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- e:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- e:\program files\mozilla firefox\plugins\ssldivx.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LManager"="e:\progra~1\LAUNCH~1\LManager.exe" [2006-12-09 614400]
"AzMixerSel"="e:\program files\Realtek\InstallShield\AzMixerSel.exe" [2006-07-17 53248]
"ADMTray.exe"="c:\acer\Empowering Technology\admtray.exe" [2005-10-24 2462208]
"RTHDCPL"="RTHDCPL.EXE" [2007-05-28 16132608]
"IgfxTray"="e:\windows\system32\igfxtray.exe" [2008-02-15 135168]
"HotKeysCmds"="e:\windows\system32\hkcmd.exe" [2008-02-15 159744]
"Persistence"="e:\windows\system32\igfxpers.exe" [2008-02-15 131072]
"ccApp"="e:\program files\Common Files\Symantec Shared\ccApp.exe" [2005-09-17 52848]

e:\documents and settings\hry\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Z stupce - SynTPEnh.lnk - e:\program files\Synaptics\SynTP\SynTPEnh.exe [2008-12-21 815104]

e:\documents and settings\Owner\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Z stupce - SynTPEnh.exe.lnk - e:\program files\Synaptics\SynTP\SynTPEnh.exe [2008-12-21 815104]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Folder Castle Support]
@="Driver Group"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-04-04 05:42 36272 ----a-w- e:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2008-12-29 10:40 687560 ----a-w- e:\program files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
2010-03-30 09:16 1820040 ----a-w- e:\program files\LogMeIn Hamachi\hamachi-2-ui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
2009-06-25 13:12 1414144 ----a-w- e:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2010-03-09 08:02 26100520 ----a-r- e:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"e:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"e:\\Program Files\\QIP Infium\\infium.exe"=
"e:\\Program Files\\TmNationsForever\\TmForever.exe"=
"e:\\Program Files\\uTorrent\\utorrent.exe"=
"e:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"3306:TCP"= 3306:TCP:kuba

R1 fcmfdriver;fcmfdriver;e:\windows\system32\drivers\fcmfdriver.sys [28.1.2010 12:58 22528]
R1 fcvdisk;fcvdisk;e:\windows\system32\drivers\fcvdrive.sys [28.1.2010 12:58 79872]
R2 ASIXIo;ASIXIo;e:\windows\system32\drivers\asixio.sys [20.12.2009 19:52 3078]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;e:\program files\LogMeIn Hamachi\hamachi-2.exe [30.3.2010 11:16 1107336]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;e:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [17.3.2010 18:11 102448]
R3 MouseCap;MouseCapture Driver;e:\windows\system32\drivers\MouseCap.sys [8.8.2005 14:44 6640]
S0 sptd;sptd;e:\windows\system32\drivers\sptd.sys [13.1.2009 16:34 721904]
S2 LicCtrlService;LicCtrl Service;e:\windows\Runservice.exe [12.11.2009 16:07 2560]
S3 cpudrv;cpudrv;e:\program files\SystemRequirementsLab\cpudrv.sys [18.12.2009 11:58 11336]
S3 EverestDriver;Lavalys EVEREST Kernel Driver;e:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt [10.8.2009 15:03 26736]
S3 genmcmnUSB;Genius USB Mouse Driver;e:\windows\system32\DRIVERS\gflmouhid.sys --> e:\windows\system32\DRIVERS\gflmouhid.sys [?]
S3 NCHSSVAD;SoundTap Recorder;e:\windows\system32\drivers\nchssvad.sys [19.4.2009 13:19 27136]
S4 gupdate1ca096815e95a46;Služba Google Update (gupdate1ca096815e95a46);e:\program files\Google\Update\GoogleUpdate.exe [20.7.2009 20:29 133104]
.
Obsah adresáře 'Naplánované úlohy'

2010-05-23 e:\windows\Tasks\Google Software Updater.job
- e:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-07-20 18:28]

2010-05-23 e:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- e:\program files\Google\Update\GoogleUpdate.exe [2009-07-20 18:29]

2010-05-23 e:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- e:\program files\Google\Update\GoogleUpdate.exe [2009-07-20 18:29]

2010-05-21 e:\windows\Tasks\Norton AntiVirus - Run Full System Scan - hry.job
- e:\progra~1\NORTON~1\Navw32.exe [2005-10-22 11:13]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://securityresponse.symantec.com/avcenter/fix_homepage
uInternet Settings,ProxyOverride = local
uInternet Settings,ProxyServer = 127.0.0.1:8080
IE: E&xport to Microsoft Excel - e:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Office Excel - e:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send To &Bluetooth - e:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
Trusted Zone: mojebanka.cz\*
Trusted Zone: mojebanka.cz\*
DPF: {210D0CBC-8B17-48D1-B294-1A338DD2EB3A} - hxxp://85.193.52.237/VatDec.cab
FF - ProfilePath - e:\documents and settings\Owner\Data aplikací\Mozilla\Firefox\Profiles\uwyg16q6.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/?
FF - component: e:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll
FF - plugin: e:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: e:\program files\Google\Google Updater\2.4.1636.7222\npCIDetect13.dll
FF - plugin: e:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: e:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - e:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

MSConfigStartUp-SaveMyWork - e:\program files\Emsa Save My Work\SaveMyWork.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-23 21:59
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\EverestDriver]
"ImagePath"="\??\e:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \EC1A69D1C0948222]
"1"=hex:b0,cd,e0,26,42,20,9e,7c,08,f1,c1,23,e7,41,66,ec,04,7d,73,7b,41,5e,94,
fd
"2"=hex:d7,7a,ea,31,a0,f7,22,dd,b6,43,6f,32,07,8b,4a,0a,e2,6f,a8,1b,53,71,0d,
78,d5,ad,68,1b,c8,4a,9b,03
"3"=hex:b0,cd,e0,26,42,20,9e,7c,08,f1,c1,23,e7,41,66,ec,aa,6b,6f,c8,5d,d1,dd,
70,c8,0c,a2,71,14,a4,b5,05,7d,2c,84,8d,ff,2b,de,6d,f8,f2,70,94,19,43,ce,bd,\

[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \EC1A69D1C0948222\48236A7EED3B8895E98434D6DCE253AC]
"1"=hex:08,26,de,b9,bd,1e,cc,2a,55,96,fd,b8,7e,1b,23,82,71,bb,5a,5f,e0,12,25,
42,0c,3f,30,d4,d3,b8,cd,35,d5,a9,6f,e0,2c,05,4e,14
"2"=hex:47,6d,e8,b1,c6,c5,94,c0
"3"=hex:9e,50,e2,a2,72,99,4f,ed,0d,15,97,c4,5d,88,a3,34,73,47,60,d1,f6,ca,8c,
54,08,b1,46,1b,98,47,6e,66,5a,46,69,30,22,02,a6,a6,97,ec,8e,29,ba,a0,09,bd,\
"4"=hex:2f,ad,a2,e7,8a,bf,05,5e
"5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
"6"=hex:bf,e5,23,7b,b0,66,d6,fc,bc,64,22,fb,7e,d3,39,3e,a3,00,33,13,c0,21,f4,
51,6c,4e,0c,96,e2,dd,ad,8a,b6,c4,05,e8,5a,bd,9a,e9,d4,1a,3d,68,9d,00,32,20
"7"=hex:08,26,de,b9,bd,1e,cc,2a,55,96,fd,b8,7e,1b,23,82,71,bb,5a,5f,e0,12,25,
42,0c,3f,30,d4,d3,b8,cd,35,61,5a,c0,6c,22,7e,83,13,6e,44,91,28,69,cc,01,dd
"8"=hex:2d,c6,be,f8,45,f3,6d,88,e8,b2,bb,24,d5,05,ba,bb,f3,08,f0,77,63,5e,13,
24,e8,33,e5,0f,aa,7a,a7,a3,be,6f,db,12,46,ef,28,4d,f6,15,03,67,e8,fb,94,1d,\
"9"=hex:81,20,8f,ab,28,6a,52,9c
"18"=hex:70,56,26,33,e3,20,f8,ab
"10"=hex:9f,76,ea,b5,36,96,32,9b
"11"=hex:81,20,8f,ab,28,6a,52,9c
"12"=hex:81,20,8f,ab,28,6a,52,9c
"13"=hex:81,20,8f,ab,28,6a,52,9c
"14"=hex:81,20,8f,ab,28,6a,52,9c
"24"=hex:81,20,8f,ab,28,6a,52,9c
"26"=hex:81,20,8f,ab,28,6a,52,9c
"27"=hex:81,20,8f,ab,28,6a,52,9c
"19"=hex:81,20,8f,ab,28,6a,52,9c
"22"=hex:81,20,8f,ab,28,6a,52,9c
.
Celkový čas: 2010-05-23 22:01:26
ComboFix-quarantined-files.txt 2010-05-23 20:01

Před spuštěním: 6 122 176 512
Po spuštění: 6 141 476 864

WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
e:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

- - End Of File - - E10C08C95A1E15B9DBDB9D5F220BC7C8

Edit: Zkoušel jsem co se změnilo. A zatím je vše při starém.

Ještě dotaz, tohle :

Emsa Save My Work

tam máš schválně ?


Přes Start >> Spustit zkopíruj do okna:

ComboFix /Uninstall

a stiskni Enter

To odinstaluje ComboFix a smaže s ním související soubory a složky.


Pak použij Cure It z mého podpisu.

Ten keylogger jsem dřív používal. Teď mám v notebooku jeho zbytek kterého se nemůžu zbavit.
Jinak po vymazání toho ComboFixu se mi zcvoknul Norton. Píše mi to "1 item affecting your status" a že Windows Auto Updates mám vyplé. Ale jsou normálně zaplé. Jinak antivirou ochranu jsem měl vyplou když jsem používal ComboFix.

Edited:
Tak projel jsem to pomocí CureIt a tady je co mi to našlo. Co dál?

Na zbytky po tom keylogeru použij Unlocker podle TOHOTO návodu.

To co našel Cure It je převážně karanténa Nortonu to ale vidíš sám, tak že vše klidně smazat.

K Nortonu, máš legálně zakoupenou licenci ?

Na opravu aktualizací použij Dial-a-fix podle TOHOTO návodu (je to v dolní polovině - Reinstall Automatic Updates service)

Tak keylogger je snad pryč. Norton už neblázní. Jinak je to licencovaná verze na rok. Dostal jsem jí k notebooku, když jsem ho kupoval. Slyšel jsem, že cracklé verze jsou naprd. Že prý je lepší použít nějaký free, takže používám Aviru na druhém PC.
Jinak stále problém přetrvá. Tak přikládám log z rsit:


Logfile of random's system information tool 1.07 (written by random/random)
Run by Owner at 2010-05-25 22:13:03
Microsoft Windows XP Home Edition Service Pack 3
System drive E: has 7 GB (16%) free of 45 GB
Total RAM: 2038 MB (64% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:13:13, on 25.5.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
E:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
E:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
E:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Acer\Empowering Technology\admServ.exe
E:\WINDOWS\system32\bgsvcgen.exe
E:\Program Files\Bonjour\mDNSResponder.exe
E:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
E:\Program Files\LogMeIn Hamachi\hamachi-2.exe
E:\Program Files\Java\jre6\bin\jqs.exe
E:\WINDOWS\runservice.exe
C:\Acer\Mobility Center\MobilityService.exe
E:\Program Files\Norton AntiVirus\navapsvc.exe
E:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
E:\WINDOWS\system32\PnkBstrA.exe
E:\WINDOWS\Explorer.EXE
E:\Program Files\Google\Update\GoogleUpdate.exe
E:\WINDOWS\system32\PnkBstrB.exe
E:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
E:\Program Files\Google\Update\1.2.183.23\GoogleCrashHandler.exe
E:\PROGRA~1\LAUNCH~1\LManager.exe
E:\Program Files\RealVNC\VNC4\WinVNC4.exe
E:\WINDOWS\RTHDCPL.EXE
E:\WINDOWS\system32\igfxtray.exe
E:\WINDOWS\system32\hkcmd.exe
E:\WINDOWS\system32\igfxpers.exe
E:\Program Files\Common Files\Symantec Shared\ccApp.exe
E:\Program Files\Unlocker\UnlockerAssistant.exe
E:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
E:\WINDOWS\system32\igfxsrvc.exe
E:\Program Files\Synaptics\SynTP\SynTPEnh.exe
E:\Acer\Empowering Technology\ePower\ePowerSvc.exe
E:\WINDOWS\system32\igfxext.exe
E:\WINDOWS\System32\wbem\wmiapsrv.exe
E:\DOCUME~1\Owner\LOCALS~1\Temp\RtkBtMnt.exe
E:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
E:\Documents and Settings\Owner\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
E:\Documents and Settings\Owner\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
E:\Documents and Settings\Owner\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
E:\Documents and Settings\Owner\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
E:\WINDOWS\system32\wuauclt.exe
E:\Program Files\Skype\Phone\Skype.exe
E:\Program Files\Skype\Plugin Manager\skypePM.exe
E:\Program Files\Messenger\msmsgs.exe
E:\Program Files\Messenger\msmsgs.exe
E:\rsit\RSIT.exe
E:\Program Files\trend micro\Owner.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/av ... x_homepage
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Folder Castle - {783840E6-0A18-4087-9EC7-A1CC131DF0D4} - E:\PROGRA~1\MAGNET~1\FOLDER~1\FCTOOL~1.DLL
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - E:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - E:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - E:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - E:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: Folder Castle - {783840E6-0A18-4087-9EC7-A1CC131DF0D4} - E:\PROGRA~1\MAGNET~1\FOLDER~1\FCTOOL~1.DLL
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - E:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [LManager] E:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [AzMixerSel] E:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [ADMTray.exe] "C:\Acer\Empowering Technology\admtray.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [IgfxTray] E:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] E:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] E:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [ccApp] "E:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "E:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - Startup: Zástupce - SynTPEnh.exe.lnk = E:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - E:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: e:\windows\system32\nwprovau.dll
O16 - DPF: {210D0CBC-8B17-48D1-B294-1A338DD2EB3A} (VatCtrl Class) - http://85.193.52.237/VatDec.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - E:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - E:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - E:\WINDOWS\System32\browseui.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - E:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - E:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - E:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - E:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - E:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - E:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Software Updater (gusvc) - Google - E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - E:\Program Files\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - E:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - E:\WINDOWS\runservice.exe
O23 - Service: LiveUpdate - Symantec Corporation - E:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - E:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - E:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: PnkBstrA - Unknown owner - E:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - E:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - E:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ServiceLayer - Nokia. - E:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - E:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Symantec Core LC - Unknown owner - E:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - E:\Program Files\RealVNC\VNC4\WinVNC4.exe
O23 - Service: ePower Service (WMIService) - acer - E:\Acer\Empowering Technology\ePower\ePowerSvc.exe

--
End of file - 10786 bytes

Prosím tě log z Rsit není celý, tak to naprav.

Ten Dial-a-fix jsi použil ?

Je vidět ve Správci úloh co procesor zatěžuje ?


Jinak pokud nepoužíváš Windows Messenger tak přes Start >> Spustit do okénka nakopíruj tohle :

RunDll32 advpack.dll,LaunchINFSection %windir%/INF/msmsgs.inf,BLC.Remove

stiskni Enter.

Tím ho odstraníš ze systému.


Přes Start >> Spustit >> napiš - services.msc >> OK. Najdi službu :

Google Software Updater

klikni na ni pravým myšítkem, zvol vlastnosti, na další kartě nejprve službu zastav tlačítkem Zastavit a u položky Typ spouštění zvol Zakázáno.

Dial-a-fix jsem použil. Jak jsem psal Norton už neblázní. Ano zobrazuje mi to, který proces zatěžuje CPU. Vždy je to něco co využívá internet. např. Chrome, WoW. V chrome jsou to například online hry. Jakmile je něco z toho spuštěné tak nemůžu dělat nic jiného dokud to nevypnu. Ty Google updates už jsem jednou zakazoval .
Jinak díky za ten messeneger.
Tady je zbytek logu:

======Scheduled tasks folder======

E:\WINDOWS\tasks\Google Software Updater.job
E:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
E:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
E:\WINDOWS\tasks\Norton AntiVirus - Run Full System Scan - hry.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-04-04 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{783840E6-0A18-4087-9EC7-A1CC131DF0D4}]
Folder Castle - E:\PROGRA~1\MAGNET~1\FOLDER~1\FCTOOL~1.DLL [2009-03-04 558592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A8F38D8D-E480-4D52-B7A2-731BB6995FDD}]
CNavExtBho Class - E:\Program Files\Norton AntiVirus\NavShExt.dll [2007-05-23 140912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - E:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll [2009-07-20 668656]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - E:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-04-12 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - E:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-04-12 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - E:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2008-12-10 929224]
{783840E6-0A18-4087-9EC7-A1CC131DF0D4} - Folder Castle - E:\PROGRA~1\MAGNET~1\FOLDER~1\FCTOOL~1.DLL [2009-03-04 558592]
{C4069E3A-68F1-403E-B40E-20066696354B} - Norton AntiVirus - E:\Program Files\Norton AntiVirus\NavShExt.dll [2007-05-23 140912]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"LManager"=E:\PROGRA~1\LAUNCH~1\LManager.exe [2006-12-09 614400]
"AzMixerSel"=E:\Program Files\Realtek\InstallShield\AzMixerSel.exe [2006-07-17 53248]
"ADMTray.exe"=C:\Acer\Empowering Technology\admtray.exe [2005-10-24 2462208]
"RTHDCPL"=E:\WINDOWS\RTHDCPL.EXE [2007-05-28 16132608]
"IgfxTray"=E:\WINDOWS\system32\igfxtray.exe [2008-02-15 135168]
"HotKeysCmds"=E:\WINDOWS\system32\hkcmd.exe [2008-02-15 159744]
"Persistence"=E:\WINDOWS\system32\igfxpers.exe [2008-02-15 131072]
"ccApp"=E:\Program Files\Common Files\Symantec Shared\ccApp.exe [2005-09-17 52848]
"UnlockerAssistant"=E:\Program Files\Unlocker\UnlockerAssistant.exe [2008-05-02 15872]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
E:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-04-04 36272]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
E:\Program Files\DAEMON Tools Lite\daemon.exe [2008-12-29 687560]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
E:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe [2010-03-30 1820040]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
E:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe [2009-06-25 1414144]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
E:\Program Files\Skype\\Phone\Skype.exe [2010-03-09 26100520]

E:\Documents and Settings\Owner\Nabídka Start\Programy\Po spuštění
Zástupce - SynTPEnh.exe.lnk - E:\Program Files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
E:\WINDOWS\system32\igfxdev.dll [2008-02-15 208896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - E:\WINDOWS\system32\upnpui.dll [2008-04-14 239616]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Folder Castle Support]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Folder Castle Support]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"E:\Program Files\Skype\Plugin Manager\skypePM.exe"="E:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"E:\Program Files\QIP Infium\infium.exe"="E:\Program Files\QIP Infium\infium.exe:*:Enabled:QIP Infium"
"E:\Program Files\TmNationsForever\TmForever.exe"="E:\Program Files\TmNationsForever\TmForever.exe:*:Enabled:TmForever"
"E:\Program Files\uTorrent\utorrent.exe"="E:\Program Files\uTorrent\utorrent.exe:*:Enabled:µTorrent"
"E:\Program Files\RelevantKnowledge\rlvknlg.exe"="E:\Program Files\RelevantKnowledge\rlvknlg.exe:*:Enabled:rlvknlg.exe"
"E:\Program Files\Skype\Phone\Skype.exe"="E:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 1 months======

2010-05-25 21:12:48 ----D---- E:\WINDOWS\LastGood
2010-05-25 20:53:31 ----D---- E:\Program Files\Unlocker
2010-05-24 23:24:45 ----A---- E:\WINDOWS\imsins.BAK
2010-05-24 23:10:24 ----D---- E:\Program Files\Auto Clicker Typer
2010-05-23 22:02:19 ----SHD---- E:\RECYCLER
2010-05-23 22:01:27 ----A---- E:\ComboFix.txt
2010-05-23 21:51:56 ----A---- E:\Boot.bak
2010-05-23 21:51:51 ----RASHD---- E:\cmdcons
2010-05-23 21:46:23 ----D---- E:\WINDOWS\ERDNT
2010-05-23 20:40:30 ----D---- E:\Documents and Settings\Owner\Data aplikací\Malwarebytes
2010-05-23 20:40:21 ----D---- E:\Program Files\Malwarebytes' Anti-Malware
2010-05-23 20:40:21 ----D---- E:\Documents and Settings\All Users\Data aplikací\Malwarebytes
2010-05-23 18:33:43 ----D---- E:\Program Files\trend micro
2010-05-23 18:33:42 ----D---- E:\rsit
2010-05-21 15:09:32 ----D---- E:\Documents and Settings\Owner\Data aplikací\Crayon Physics Deluxe
2010-05-21 15:06:31 ----D---- E:\Program Files\Crayon Physics Deluxe
2010-05-13 07:51:44 ----HDC---- E:\WINDOWS\$NtUninstallKB978542$
2010-05-05 10:09:47 ----D---- E:\Program Files\RealVNC
2010-05-05 01:28:35 ----A---- E:\WINDOWS\WinInit.ini
2010-04-28 18:48:28 ----A---- E:\WINDOWS\system32\javaws.exe
2010-04-28 18:48:28 ----A---- E:\WINDOWS\system32\deployJava1.dll
2010-04-28 18:48:27 ----A---- E:\WINDOWS\system32\javaw.exe
2010-04-28 18:48:27 ----A---- E:\WINDOWS\system32\java.exe
2010-04-28 18:47:13 ----D---- E:\Documents and Settings\All Users\Data aplikací\Sun

======List of files/folders modified in the last 1 months======

2010-05-25 22:00:44 ----D---- E:\Documents and Settings\Owner\Data aplikací\Skype
2010-05-25 21:18:19 ----D---- E:\WINDOWS\Temp
2010-05-25 21:13:37 ----D---- E:\WINDOWS\SoftwareDistribution
2010-05-25 21:13:19 ----D---- E:\WINDOWS\system32
2010-05-25 21:13:18 ----D---- E:\WINDOWS\Help
2010-05-25 21:13:05 ----RSHDC---- E:\WINDOWS\system32\dllcache
2010-05-25 21:13:05 ----HD---- E:\WINDOWS\inf
2010-05-25 21:12:48 ----D---- E:\WINDOWS
2010-05-25 21:12:47 ----D---- E:\WINDOWS\system32\CatRoot2
2010-05-25 21:10:36 ----SD---- E:\WINDOWS\Tasks
2010-05-25 21:08:26 ----A---- E:\WINDOWS\SchedLgU.Txt
2010-05-25 20:57:18 ----RD---- E:\Program Files
2010-05-25 20:53:32 ----D---- E:\Documents and Settings\Owner\Data aplikací\Desktopicon
2010-05-25 20:37:32 ----D---- E:\Documents and Settings\Owner\Data aplikací\vlc
2010-05-25 18:48:11 ----D---- E:\Documents and Settings\Owner\Data aplikací\skypePM
2010-05-25 13:05:05 ----D---- E:\WINDOWS\system32\drivers
2010-05-25 13:03:09 ----D---- E:\Program Files\uTorrent
2010-05-25 00:22:59 ----D---- E:\Program Files\Mozilla Firefox
2010-05-25 00:21:45 ----D---- E:\WINDOWS\Prefetch
2010-05-24 23:47:10 ----SHD---- E:\System Volume Information
2010-05-24 23:26:39 ----HDC---- E:\WINDOWS\$NtUninstallKB893756$
2010-05-23 21:59:15 ----A---- E:\WINDOWS\system.ini
2010-05-23 21:57:32 ----D---- E:\WINDOWS\AppPatch
2010-05-23 21:57:27 ----D---- E:\Program Files\Common Files
2010-05-23 21:51:56 ----RASH---- E:\boot.ini
2010-05-23 21:36:25 ----HDC---- E:\WINDOWS\$NtUninstallKB974571$
2010-05-23 20:45:41 ----D---- E:\WINDOWS\Minidump
2010-05-23 20:29:44 ----D---- E:\WINDOWS\Debug
2010-05-23 19:17:46 ----D---- E:\Documents and Settings\All Users\Data aplikací\TrackMania
2010-05-22 16:43:57 ----D---- E:\Documents and Settings\Owner\Data aplikací\Vso
2010-05-22 01:07:41 ----D---- E:\Documents and Settings\Owner\Data aplikací\uTorrent
2010-05-18 21:47:51 ----D---- E:\Documents and Settings\Owner\Data aplikací\dvdcss
2010-05-16 16:58:18 ----D---- E:\Program Files\Common Files\Symantec Shared
2010-05-16 12:07:35 ----SHD---- E:\WINDOWS\Installer
2010-05-16 12:06:29 ----D---- E:\Program Files\Google
2010-05-13 16:25:17 ----D---- E:\Program Files\Burn4Free
2010-05-13 07:51:48 ----D---- E:\Program Files\Outlook Express
2010-05-12 10:43:18 ----D---- E:\WINDOWS\system32\CatRoot
2010-05-12 10:41:19 ----HD---- E:\WINDOWS\$hf_mig$
2010-05-10 14:48:15 ----RSD---- E:\WINDOWS\Fonts
2010-05-09 01:53:48 ----D---- E:\Documents and Settings\All Users\Data aplikací\Blizzard Entertainment
2010-04-30 20:51:06 ----A---- E:\WINDOWS\system32\MRT.exe
2010-04-28 18:48:25 ----D---- E:\Program Files\Java
2010-04-28 18:47:12 ----D---- E:\Program Files\Common Files\Java

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Amfilter;A4Tech Mouse Filter Driver; E:\WINDOWS\System32\DRIVERS\Amfilter.sys [2006-12-15 8704]
R1 cdrbsdrv;cdrbsdrv; E:\WINDOWS\system32\drivers\cdrbsdrv.sys [2006-02-20 33408]
R1 eeCtrl;Symantec Eraser Control driver; \??\E:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys []
R1 fcmfdriver;fcmfdriver; E:\WINDOWS\System32\DRIVERS\fcmfdriver.sys [2009-03-04 22528]
R1 fcvdisk;fcvdisk; E:\WINDOWS\System32\DRIVERS\fcvdrive.sys [2008-04-08 79872]
R1 intelppm;Řadič procesoru Intel; E:\WINDOWS\System32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 OsaFsLoc;OsaFsLoc; \??\E:\WINDOWS\system32\drivers\OsaFsLoc.sys []
R1 SAVRT;SAVRT; \??\E:\Program Files\Norton AntiVirus\SAVRT.SYS []
R1 SAVRTPEL;SAVRTPEL; \??\E:\Program Files\Norton AntiVirus\SAVRTPEL.SYS []
R1 SPBBCDrv;SPBBCDrv; \??\E:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys []
R1 SYMTDI;SYMTDI; E:\WINDOWS\System32\Drivers\SYMTDI.SYS [2007-10-01 189320]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; E:\WINDOWS\System32\DRIVERS\wmiacpi.sys [2008-04-13 8832]
R2 ASIXIo;ASIXIo; \??\E:\WINDOWS\system32\Drivers\asixio.sys []
R2 BTSERIAL;Bluetooth Serial Driver; \??\E:\WINDOWS\system32\drivers\btserial.sys []
R2 BTSLBCSP;Bluetooth Port Client Driver; \??\E:\WINDOWS\system32\drivers\btslbcsp.sys []
R2 DritekPortIO;Dritek General Port I/O; \??\E:\PROGRA~1\LAUNCH~1\DPortIO.sys []
R2 int15;int15; \??\E:\WINDOWS\system32\drivers\int15.sys []
R2 mdmxsdk;mdmxsdk; E:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2006-06-19 12672]
R2 NwlnkIpx;Transportní protokol kompatibilní s NWLink IPX/SPX/NetBIOS; E:\WINDOWS\system32\DRIVERS\nwlnkipx.sys [2008-04-13 88320]
R2 NwlnkNb;Služba NWLink pro rozhraní NetBIOS; E:\WINDOWS\system32\DRIVERS\nwlnknb.sys [2003-04-16 63232]
R2 NwlnkSpx;Protokol NWLink SPX/SPXII; E:\WINDOWS\system32\DRIVERS\nwlnkspx.sys [2003-04-16 55936]
R2 osaio;osaio; \??\E:\WINDOWS\system32\drivers\osaio.sys []
R2 osanbm;osanbm; \??\E:\WINDOWS\system32\drivers\osanbm.sys []
R2 symlcbrd;symlcbrd; \??\E:\WINDOWS\system32\drivers\symlcbrd.sys []
R3 BTKRNL;Bluetooth Bus Enumerator; E:\WINDOWS\system32\DRIVERS\btkrnl.sys [2004-11-29 1337850]
R3 CmBatt;Microsoft ACPI Control Method Battery Driver; E:\WINDOWS\System32\DRIVERS\CmBatt.sys [2008-04-13 13952]
R3 DKbFltr;Dritek Keyboard Filter Driver; E:\WINDOWS\system32\DRIVERS\DKbFltr.sys [2004-12-08 16896]
R3 EMSCR;EMSCR; E:\WINDOWS\system32\DRIVERS\EMS7SK.sys [2005-11-17 60928]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\E:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys []
R3 ESDCR;ESDCR; E:\WINDOWS\system32\DRIVERS\ESD7SK.sys [2005-11-17 37888]
R3 ESMCR;ESMCR; E:\WINDOWS\system32\DRIVERS\ESM7SK.sys [2005-11-17 74624]
R3 hamachi;Hamachi Network Interface; E:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-09-23 26176]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; E:\WINDOWS\System32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 HSF_DPV;HSF_DPV; E:\WINDOWS\system32\DRIVERS\HSF_DPV.sys [2006-12-22 988800]
R3 HSFHWAZL;HSFHWAZL; E:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys [2006-12-22 209664]
R3 ialm;ialm; E:\WINDOWS\system32\DRIVERS\igxpmp32.sys [2008-02-15 5854752]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); E:\WINDOWS\system32\drivers\RtkHDAud.sys [2007-05-30 4424192]
R3 MouseCap;MouseCapture Driver; E:\WINDOWS\System32\Drivers\MouseCap.sys [2005-08-08 6640]
R3 NAVENG;NAVENG; \??\E:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20100525.003\NAVENG.Sys []
R3 NAVEX15;NAVEX15; \??\E:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20100525.003\NavEx15.Sys []
R3 pcouffin;VSO Software pcouffin; E:\WINDOWS\System32\Drivers\pcouffin.sys [2008-12-21 47360]
R3 sdbus;sdbus; E:\WINDOWS\System32\DRIVERS\sdbus.sys [2008-04-13 79232]
R3 SYMDNS;SYMDNS; E:\WINDOWS\System32\Drivers\SYMDNS.SYS [2007-10-01 12680]
R3 SymEvent;SymEvent; \??\E:\Program Files\Symantec\SYMEVENT.SYS []
R3 SYMFW;SYMFW; E:\WINDOWS\System32\Drivers\SYMFW.SYS [2007-10-01 98184]
R3 SYMIDS;SYMIDS; E:\WINDOWS\System32\Drivers\SYMIDS.SYS [2007-10-01 31624]
R3 SYMIDSCO;SYMIDSCO; \??\E:\PROGRA~1\COMMON~1\SYMANT~1\SymcData\IDS-DI~1\20100513.001\symidsco.sys []
R3 SYMNDIS;SYMNDIS; E:\WINDOWS\System32\Drivers\SYMNDIS.SYS [2007-10-01 28040]
R3 SYMREDRV;SYMREDRV; E:\WINDOWS\System32\Drivers\SYMREDRV.SYS [2007-10-01 23944]
R3 SynTP;Synaptics TouchPad Driver; E:\WINDOWS\System32\DRIVERS\SynTP.sys [2006-10-22 199776]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; E:\WINDOWS\System32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Rozbočovač umožnující USB2; E:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; E:\WINDOWS\System32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 w39n51;Intel(R) PRO/Wireless 3945ABG Adapter Driver; E:\WINDOWS\System32\DRIVERS\w39n51.sys [2006-04-04 1429632]
R3 winachsf;winachsf; E:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2006-12-22 730112]
S1 kbdhid;Ovladač klávesnice standardu HID; E:\WINDOWS\System32\DRIVERS\kbdhid.sys [2008-04-14 14592]
S3 Amusbprt;A4Tech HID-compliant Mouse Driver; E:\WINDOWS\System32\DRIVERS\Amusbprt.sys [2006-12-15 13824]
S3 b57w2k;Broadcom NetXtreme Gigabit Ethernet; E:\WINDOWS\system32\DRIVERS\b57xp32.sys [2001-10-24 97120]
S3 btaudio;Bluetooth Audio Device; E:\WINDOWS\system32\drivers\btaudio.sys [2004-11-29 399616]
S3 BTDriver;Bluetooth Virtual Communications Driver; E:\WINDOWS\system32\DRIVERS\btport.sys [2004-11-29 30299]
S3 BthEnum;Ovladač pro Bluetooth Request Block; E:\WINDOWS\system32\DRIVERS\BthEnum.sys [2008-04-13 17024]
S3 BTHMODEM;Ovladač pro sériovou komunikaci protokolem Bluetooth; E:\WINDOWS\system32\DRIVERS\bthmodem.sys [2008-04-13 37888]
S3 BthPan;Bluetooth Device (Personal Area Network); E:\WINDOWS\system32\DRIVERS\bthpan.sys [2008-04-13 101120]
S3 BTHPORT;Ovladač portu Bluetooth; E:\WINDOWS\System32\Drivers\BTHport.sys [2008-06-14 272128]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; E:\WINDOWS\System32\Drivers\BTHUSB.sys [2008-04-13 18944]
S3 BTWDNDIS;Bluetooth LAN Access Server; E:\WINDOWS\system32\DRIVERS\btwdndis.sys [2004-11-29 148040]
S3 BTWUSB;WIDCOMM USB Bluetooth Driver; E:\WINDOWS\System32\Drivers\btwusb.sys [2004-11-29 55320]
S3 catchme;catchme; \??\E:\DOCUME~1\Owner\LOCALS~1\Temp\catchme.sys []
S3 cpudrv;cpudrv; \??\E:\Program Files\SystemRequirementsLab\cpudrv.sys []
S3 EverestDriver;Lavalys EVEREST Kernel Driver; \??\E:\Program Files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt []
S3 genmcmnUSB;Genius USB Mouse Driver; E:\WINDOWS\system32\DRIVERS\gflmouhid.sys []
S3 hidusb;Ovladač třídy standardu HID; E:\WINDOWS\System32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 mouhid;Ovladač myši standardu HID; E:\WINDOWS\System32\DRIVERS\mouhid.sys [2003-04-16 12160]
S3 NdisFilt;OSA NdisFilter Protocol; E:\WINDOWS\System32\Drivers\NdisFilt.sys [2005-09-13 4392]
S3 NETMNT;Acer NetMonitor Protocol; E:\WINDOWS\system32\DRIVERS\NETMNT.sys [2005-05-02 9600]
S3 NCHSSVAD;SoundTap Recorder; E:\WINDOWS\system32\drivers\nchssvad.sys [2009-04-19 27136]
S3 nmwcd;Nokia USB Phone Parent; E:\WINDOWS\system32\drivers\ccdcmb.sys [2009-02-09 17664]
S3 nmwcdc;Nokia USB Generic; E:\WINDOWS\system32\drivers\ccdcmbo.sys [2009-02-09 22016]
S3 pccsmcfd;PCCS Mode Change Filter Driver; E:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); E:\WINDOWS\system32\DRIVERS\rfcomm.sys [2008-04-13 59136]
S3 SONYPVU1;Sony USB Filter Driver (SONYPVU1); E:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS [2001-08-17 7552]
S3 upperdev;upperdev; E:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2009-02-09 7808]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; E:\WINDOWS\System32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbser;USB Modem Driver; E:\WINDOWS\system32\drivers\usbser.sys [2008-04-13 26112]
S3 UsbserFilt;UsbserFilt; E:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys [2009-02-09 7808]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; E:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 Wdf01000;Wdf01000; E:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2008-03-27 503008]
S3 WpdUsb;WpdUsb; E:\WINDOWS\System32\Drivers\wpdusb.sys [2005-01-28 18944]
S4 dwshd;dwshd; E:\WINDOWS\System32\drivers\dwshd.sys []
S4 IntelIde;IntelIde; E:\WINDOWS\system32\drivers\IntelIde.sys []
S4 s24trans;WLAN Transport; E:\WINDOWS\system32\DRIVERS\s24trans.sys []
S4 sptd;sptd; E:\WINDOWS\System32\Drivers\sptd.sys [2009-12-07 721904]
S4 sr;Ovladač filtru Obnovy systému; E:\WINDOWS\System32\DRIVERS\sr.sys [2008-04-14 73344]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Automatic LiveUpdate Scheduler;Automatic LiveUpdate Scheduler; E:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2010-03-04 99720]
R2 AWService;AdminWorks Agent X6; C:\Acer\Empowering Technology\admServ.exe [2005-10-24 1314816]
R2 bgsvcgen;B's Recorder GOLD Library General Service; E:\WINDOWS\system32\bgsvcgen.exe [2007-06-15 145504]
R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; E:\Program Files\Bonjour\mDNSResponder.exe [2006-02-28 229376]
R2 BthServ;Bluetooth Support Service; E:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 btwdins;Bluetooth Service; E:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe [2004-11-29 254007]
R2 ccEvtMgr;Symantec Event Manager; E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe [2005-09-17 192112]
R2 ccSetMgr;Symantec Settings Manager; E:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe [2005-09-17 169584]
R2 eSettingsService;eSettings Service; E:\Acer\Empowering Technology\eSettings\Service\capuserv.exe [2007-01-02 24576]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine; E:\Program Files\LogMeIn Hamachi\hamachi-2.exe [2010-03-30 1107336]
R2 JavaQuickStarterService;Java Quick Starter; E:\Program Files\Java\jre6\bin\jqs.exe [2010-04-12 153376]
R2 LicCtrlService;LicCtrl Service; E:\WINDOWS\runservice.exe [2009-11-12 2560]
R2 MobilityService;MobilityService; C:\Acer\Mobility Center\MobilityService.exe [2006-11-24 107008]
R2 navapsvc;Norton AntiVirus Auto-Protect Service; E:\Program Files\Norton AntiVirus\navapsvc.exe [2007-05-23 139888]
R2 NPFMntor;Norton AntiVirus Firewall Monitor Service; E:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe [2007-05-23 46704]
R2 NwSapAgent;Agent SAP; E:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 PnkBstrA;PnkBstrA; E:\WINDOWS\system32\PnkBstrA.exe [2009-06-16 75064]
R2 PnkBstrB;PnkBstrB; E:\WINDOWS\system32\PnkBstrB.exe [2009-11-12 202448]
R2 SNDSrvc;Symantec Network Drivers Service; E:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe [2007-10-01 214408]
R2 SPBBCSvc;SPBBCSvc; E:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe [2005-09-16 1160800]
R2 StarWindServiceAE;StarWind AE Service; E:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2007-05-28 275968]
R2 Symantec Core LC;Symantec Core LC; E:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe [2010-03-17 1251720]
R2 UMWdf;Windows User Mode Driver Framework; E:\WINDOWS\System32\wdfmgr.exe [2005-01-28 38912]
R2 WinVNC4;VNC Server Version 4; E:\Program Files\RealVNC\VNC4\WinVNC4.exe [2008-10-15 439632]
R2 WMIService;ePower Service; E:\Acer\Empowering Technology\ePower\ePowerSvc.exe [2007-01-02 135168]
R3 NSCService;Norton Protection Center Service; E:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE [2006-12-15 750720]
S2 gusvc;Google Software Updater; E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-07-20 190448]
S3 aspnet_state;Stavová služba ASP.NET; E:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; E:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; E:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2009-02-20 654848]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; E:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Služba Windows CardSpace; E:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 LiveUpdate;LiveUpdate; E:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2010-03-04 2106760]
S3 ose;Office Source Engine; E:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 SAVScan;Symantec AVScan; E:\Program Files\Norton AntiVirus\SAVScan.exe [2005-08-27 198368]
S3 ServiceLayer;ServiceLayer; E:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2009-06-02 637952]
S4 gupdate1ca096815e95a46;Služba Google Update (gupdate1ca096815e95a46); E:\Program Files\Google\Update\GoogleUpdate.exe [2009-07-20 133104]
S4 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; E:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe []
S4 NetTcpPortSharing;Služba sdílení portů Net.Tcp; E:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

R2 JavaQuickStarterService;Java Quick Starter; E:\Program Files\Java\jre6\bin\jqs.exe [2010-04-12 153376]

Tohle by mohlo být zakázáno ne? Občas mi to žere dost CPU, přitom je to v podstatě zbytečné když moc často Javu nepoužívám ne?

Ano v HJT můžeš fixnout :

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - E:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

a také :

O4 - HKLM\..\Run: [UnlockerAssistant] "E:\Program Files\Unlocker\UnlockerAssistant.exe"


Ve službách najít a zastavit :

Java Quick Starter

protože fixnout nelze.


Pak ještě použij Cure It z mého podpisu.

Jinak u toho CureIt je nějaký podprogram co používá internet 6a9ajxp.exe a ten žere 90% z cpu nejde nějak zastavit? Ten kompletní sken pak trvá asi 4 hodiny.
Tak jsem to projel a nic mi to nenašlo.

Všechny logy jsou v pořádku, zkus tedy na chvilku při serfování zastavit antivir.

Ještě se zeptám, ty jsi připojený k netu přes kabel nebo wifi ?