VIRY.CZ

Logfile of random's system information tool 1.08 (written by random/random)
Run by Adam at 2010-08-04 09:21:48
Microsoft Windows 7 Professional
System drive C: has 54 GB (47%) free of 114 GB
Total RAM: 2038 MB (49% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:21:52, on 4.8.2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\system32\igfxsrvc.exe
C:\Users\Adam\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Adam\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Adam\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Adam\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Adam\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Adam\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Adam\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Adam\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Adam\Downloads\HijackThis.exe
C:\Program Files\HJT\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Adam\Downloads\RSIT (1).exe
C:\Program Files\trend micro\Adam.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [snpstd3] C:\Windows\vsnpstd3.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKCU\..\Run: [Google Update] "C:\Users\Adam\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/f ... wflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: STI Simulator - Unknown owner - C:\Windows\System32\PAStiSvc.exe

--
End of file - 4973 bytes

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-684683860-1086771548-3266464040-1003Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-684683860-1086771548-3266464040-1003UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-06-19 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-06-20 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2010-04-07 2145000]
"snpstd3"=C:\Windows\vsnpstd3.exe [2005-09-05 339968]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2009-09-23 141848]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2009-09-23 173592]
"Persistence"=C:\Windows\system32\igfxpers.exe [2009-09-23 150552]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Google Update"=C:\Users\Adam\AppData\Local\Google\Update\GoogleUpdate.exe [2010-06-02 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2009-09-23 218112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-08-04 09:15:47 ----D---- C:\Program Files\HJT
2010-08-03 15:14:51 ----D---- C:\Program Files\trend micro
2010-08-03 15:14:49 ----D---- C:\rsit
2010-08-03 09:26:40 ----A---- C:\Windows\system32\shell32.dll
2010-07-14 12:51:50 ----A---- C:\Windows\system32\PAStiSvc.exe
2010-07-14 09:13:43 ----D---- C:\Windows\system32\x64
2010-07-14 09:13:43 ----A---- C:\Windows\system32\igxpun.exe
2010-07-14 09:11:55 ----A---- C:\Windows\system32\drivers\sffp_sd.sys
2010-07-13 15:53:01 ----D---- C:\Windows\PixArt
2010-07-13 12:28:09 ----D---- C:\ProgramData\Symantec
2010-07-13 12:28:09 ----D---- C:\ProgramData\Norton
2010-07-13 12:28:06 ----D---- C:\ProgramData\NortonInstaller
2010-07-13 12:25:41 ----A---- C:\Windows\system32\kernel32.dll
2010-07-13 12:25:40 ----A---- C:\Windows\system32\apphelp.dll
2010-07-12 12:27:52 ----D---- C:\Users\Adam\AppData\Roaming\OnifDesktop
2010-07-12 12:27:08 ----D---- C:\Program Files\OnifDesktop
2010-07-12 12:19:30 ----D---- C:\Windows\system32\Adobe
2010-07-12 11:39:17 ----D---- C:\ProgramData\FLEXnet
2010-07-12 11:28:25 ----D---- C:\Program Files\Common Files\Adobe AIR
2010-07-12 11:05:36 ----D---- C:\Users\Adam\AppData\Roaming\AdobeSupportAdvisor.E7BED6E5DDA59983786DD72EBFA46B1598278E07.1

======List of files/folders modified in the last 1 months======

2010-08-04 09:21:52 ----D---- C:\Windows\Prefetch
2010-08-04 09:21:50 ----D---- C:\Windows\Temp
2010-08-04 09:15:50 ----RD---- C:\Program Files
2010-08-04 07:27:38 ----D---- C:\Windows\system32\config
2010-08-04 03:02:02 ----SHD---- C:\System Volume Information
2010-08-03 14:58:21 ----D---- C:\Windows
2010-08-03 14:33:01 ----D---- C:\Windows\winsxs
2010-08-03 14:32:31 ----D---- C:\Windows\System32
2010-08-03 09:24:54 ----D---- C:\Windows\system32\catroot
2010-07-23 09:02:52 ----D---- C:\Windows\system32\catroot2
2010-07-19 09:17:39 ----HD---- C:\ProgramData
2010-07-19 09:17:38 ----D---- C:\Windows\Downloaded Program Files
2010-07-16 10:04:45 ----D---- C:\Windows\system32\Tasks
2010-07-15 10:39:14 ----SD---- C:\Users\Adam\AppData\Roaming\Microsoft
2010-07-15 09:56:51 ----D---- C:\Windows\debug
2010-07-14 13:01:47 ----SHD---- C:\Windows\Installer
2010-07-14 13:01:45 ----D---- C:\ProgramData\Microsoft Help
2010-07-14 12:50:15 ----D---- C:\Windows\system32\DriverStore
2010-07-14 12:50:15 ----D---- C:\Windows\system32\drivers
2010-07-14 09:13:58 ----D---- C:\Windows\inf
2010-07-13 15:53:01 ----D---- C:\Windows\twain_32
2010-07-13 14:25:08 ----D---- C:\Program Files\Adobe
2010-07-13 12:32:50 ----D---- C:\Windows\Tasks
2010-07-12 11:29:26 ----D---- C:\Program Files\Common Files\Adobe
2010-07-12 11:28:25 ----D---- C:\Program Files\Common Files
2010-07-08 12:32:44 ----D---- C:\Program Files\CCleaner
2010-07-08 11:54:42 ----RD---- C:\Users
2010-07-08 10:57:47 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-07-08 10:50:14 ----D---- C:\Windows\system32\wdi
2010-07-07 10:11:04 ----D---- C:\Windows\system32\wfp
2010-07-07 10:11:03 ----D---- C:\Windows\system32\wbem
2010-07-07 10:10:54 ----D---- C:\Windows\registration
2010-07-07 10:07:59 ----D---- C:\Windows\system32\LogFiles
2010-07-07 09:37:29 ----D---- C:\Windows\Microsoft.NET
2010-07-07 09:37:15 ----RSD---- C:\Windows\assembly

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2010-04-07 114984]
R2 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2010-04-07 133512]
R2 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2010-04-07 96896]
R2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
R3 e1express;Intel(R) PRO/1000 – ovladač PCI Express síťového připojení; C:\Windows\system32\DRIVERS\e1e6032.sys [2009-07-14 211456]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2009-09-23 4808192]
R3 PAC207;VideoCAM GF112; C:\Windows\system32\DRIVERS\pfc027.sys [2005-04-08 162176]
R3 USBPNPA;USB PnP Sound Device Interface; C:\Windows\system32\drivers\CM108.sys [2007-06-28 1310720]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
S3 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
S3 PID_0928;Logitech QuickCam Express(PID_0928); C:\Windows\system32\DRIVERS\LV561AV.SYS [2009-05-01 495768]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 133120]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 SNPSTD3;USB PC Camera (SNPSTD3); C:\Windows\system32\DRIVERS\snpstd3.sys [2005-10-13 8701824]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2010-04-07 810120]
R2 STI Simulator;STI Simulator; C:\Windows\System32\PAStiSvc.exe [2005-01-14 53248]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2010-04-07 33560]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2010-07-12 655624]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-06-09 1343400]

-----------------EOF-----------------

Dobrý večer
Máte s počítačem nějaké problémy?

Dobrý den, log jsem postoval proto, že mi počítač nesmyslně lagoval a připojení k internetu fungovalo naprosto zmateně, ale bylo to zřejmě špatnou instalací jednoho programu od Adobe v kombinaci s vybitou myší, už se zdá vše v pořádku.

adam.nykles píše:Dobrý den, log jsem postoval proto, že mi počítač nesmyslně lagoval a připojení k internetu fungovalo naprosto zmateně, ale bylo to zřejmě špatnou instalací jednoho programu od Adobe v kombinaci s vybitou myší, už se zdá vše v pořádku.

Tak ne, problém stále trvá. V nepravidelných intervalech se systém zasekne, aniž by vzrostla vytíženost procesoru nebo paměti a nic nereaguje, pokud kliknu na záložku v jakémkoliv prohlížeči, zavře se. Přiznám se, že už si nevím rady.

Koukneme se na to

Stáhněte na plochu, ukončete všechna aktivní okna a spusťte ComboFix - http://download.bleepingcomputer.com/sUBs/ComboFix.exe



- ComboFix je třeba spustit pod účtem s právy administrátora

- Před použitím vypněte všechny rezidentní bezpečnostní programy - antiviry, firewally, antispywary

- Po spuštění se zobrazí podmínky užití, potvrďte je stiskem tlačítka Ano

- Dále postupujte dle pokynů, během aplikování ComboFixu neklikejte do zobrazujícího se okna

- Po dokončení skenování, trvajícího maximálně 10 minut, by měl program vytvořit log - C:\ComboFix.txt, zkopírujte celý jeho obsah sem

ComboFix 10-08-08.02 - Adam 09.08.2010 13:22:11.1.2 - x86
Microsoft Windows 7 Professional 6.1.7600.0.1250.420.1029.18.2038.1266 [GMT 2:00]
Spuštěný z: c:\users\Adam\Desktop\ComboFix.exe
* Rezidentní štít AV je zapnutý

.

((((((((((((((((((((((((( Soubory vytvořené od 2010-07-09 do 2010-08-09 )))))))))))))))))))))))))))))))
.

2010-08-09 09:48 . 2010-08-09 09:48 -------- d-----w- c:\program files\Lavalys
2010-08-04 08:21 . 2010-07-28 15:42 13312 ----a-w- c:\users\Adam\AppData\Roaming\OnifDesktop\Local Store\OnifPipedSnaps\OnifPipedSnaps.exe
2010-08-04 08:21 . 2010-07-25 07:33 12155392 ----a-w- c:\users\Adam\AppData\Roaming\OnifDesktop\Local Store\OnifPipedSnaps\ffmpeg32\bin\ffprobe.exe
2010-08-04 08:21 . 2010-07-25 07:33 12688384 ----a-w- c:\users\Adam\AppData\Roaming\OnifDesktop\Local Store\OnifPipedSnaps\ffmpeg32\bin\ffplay.exe
2010-08-04 08:20 . 2010-07-25 07:33 12243968 ----a-w- c:\users\Adam\AppData\Roaming\OnifDesktop\Local Store\OnifPipedSnaps\ffmpeg32\bin\ffmpeg.exe
2010-08-04 08:19 . 2010-08-04 08:20 4879498 ----a-w- c:\users\Adam\AppData\Roaming\OnifDesktop\Local Store\OnifPipedSnaps1.exe
2010-08-04 08:18 . 2010-08-04 08:18 -------- d-----w- c:\program files\OnifDesktop
2010-08-04 07:15 . 2010-08-04 07:19 -------- d-----w- c:\program files\HJT
2010-08-03 13:14 . 2010-08-04 07:21 -------- d-----w- c:\program files\trend micro
2010-08-03 13:14 . 2010-08-03 13:50 -------- d-----w- C:\rsit
2010-07-14 10:51 . 2005-01-14 07:32 53248 ----a-w- c:\windows\system32\PAStiSvc.exe
2010-07-14 07:13 . 2010-07-14 07:13 -------- d-----w- c:\windows\system32\x64
2010-07-14 07:13 . 2009-09-23 17:30 1002008 ----a-w- c:\windows\system32\igxpun.exe
2010-07-14 07:11 . 2009-10-10 02:57 12800 ----a-w- c:\windows\system32\drivers\sffp_sd.sys
2010-07-13 13:53 . 2010-07-13 13:53 -------- d-----w- c:\windows\PixArt
2010-07-13 10:28 . 2010-07-13 10:32 -------- d-----w- c:\programdata\Norton
2010-07-13 10:28 . 2010-07-13 10:28 -------- d-----w- c:\programdata\Symantec
2010-07-13 10:28 . 2010-07-13 10:28 -------- d-----w- c:\programdata\NortonInstaller
2010-07-13 10:25 . 2009-12-08 11:32 292864 ----a-w- c:\windows\system32\apphelp.dll
2010-07-12 10:27 . 2010-07-12 10:27 -------- d-----w- c:\users\Adam\AppData\Roaming\OnifDesktop
2010-07-12 10:19 . 2010-07-12 10:19 -------- d-----w- c:\windows\system32\Adobe
2010-07-12 09:39 . 2010-07-13 10:42 -------- d-----w- c:\programdata\FLEXnet
2010-07-12 09:28 . 2010-07-12 09:41 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-07-12 09:05 . 2010-07-12 09:05 -------- d-----w- c:\users\Adam\AppData\Roaming\AdobeSupportAdvisor.E7BED6E5DDA59983786DD72EBFA46B1598278E07.1

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-14 11:01 . 2010-05-14 11:01 -------- d-----w- c:\programdata\Microsoft Help
2010-07-12 09:40 . 2010-06-02 09:27 53632 ----a-w- c:\users\Default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-07-12 09:29 . 2010-05-14 11:32 -------- d-----w- c:\program files\Common Files\Adobe
2010-07-08 10:32 . 2010-06-25 10:35 -------- d-----w- c:\program files\CCleaner
2010-07-08 08:57 . 2009-07-14 08:37 622422 ----a-w- c:\windows\system32\perfh005.dat
2010-07-08 08:57 . 2009-07-14 08:37 118604 ----a-w- c:\windows\system32\perfc005.dat
2010-06-28 11:06 . 2010-06-28 11:06 -------- d-----w- c:\users\Adam\AppData\Roaming\adobe.captivate.swfcomment.AdobeCaptivateReviewer.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2010-06-28 11:02 . 2010-06-28 11:02 -------- d-----w- c:\program files\MSXML 4.0
2010-06-28 11:02 . 2010-06-28 11:02 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2010-06-21 07:06 . 2010-06-21 07:07 53632 ----a-w- c:\users\Adam\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-06-02 10:00 . 2010-06-02 10:00 108824 ----a-w- c:\users\Adam\AppData\Local\GDIPFONTCACHEV1.DAT
2010-06-02 08:53 . 2010-06-02 08:53 108824 ----a-w- c:\users\uzivatel\AppData\Local\GDIPFONTCACHEV1.DAT
2010-05-27 07:24 . 2010-06-09 09:43 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-05-27 03:49 . 2010-06-09 09:43 293888 ----a-w- c:\windows\system32\atmfd.dll
2010-05-21 12:14 . 2010-05-14 10:36 221568 ------w- c:\windows\system32\MpSigStub.exe
2010-05-21 05:18 . 2010-06-09 09:43 977920 ----a-w- c:\windows\system32\wininet.dll
2010-05-14 13:23 . 2010-05-14 13:23 108824 ----a-w- c:\users\ADMIN\AppData\Local\GDIPFONTCACHEV1.DAT
2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\users\Adam\AppData\Local\Google\Update\GoogleUpdate.exe" [2010-06-02 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-04-07 2145000]
"snpstd3"="c:\windows\vsnpstd3.exe" [2005-09-05 339968]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-23 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-23 150552]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)

R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-06-09 1343400]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2010-04-07 114984]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2010-04-07 133512]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2010-04-07 810120]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2010-04-07 96896]
S3 PAC207;VideoCAM GF112;c:\windows\system32\DRIVERS\pfc027.sys [2005-04-08 162176]
S3 USBPNPA;USB PnP Sound Device Interface;c:\windows\system32\drivers\CM108.sys [2007-06-28 1310720]

.
Obsah adresáře 'Naplánované úlohy'

2010-08-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-684683860-1086771548-3266464040-1003Core.job
- c:\users\Adam\AppData\Local\Google\Update\GoogleUpdate.exe [2010-06-02 10:00]

2010-08-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-684683860-1086771548-3266464040-1003UA.job
- c:\users\Adam\AppData\Local\Google\Update\GoogleUpdate.exe [2010-06-02 10:00]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.cz/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Adam\AppData\Roaming\Mozilla\Firefox\Profiles\zodvodxg.default\
FF - prefs.js: browser.startup.homepage - www.google.cz
FF - plugin: c:\users\Adam\AppData\Local\Google\Update\1.2.183.29\npGoogleOneClick8.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2010-08-09 13:35:32
ComboFix-quarantined-files.txt 2010-08-09 11:35

Před spuštěním: Volných bajtů: 55 626 747 904
Po spuštění: Volných bajtů: 60 827 254 784

- - End Of File - - 76A47073FD3F5FBD53E0CBAED472E91D

Odzkoušejte počítač a dejte vědět, jak to vypadá.

Zatím to vypadá pořádku, snad to tak i zůstane. Děkuji mnohokrát.

Ještě neděkujte

Odinstalujte combofix přes Start - Spustit
- zkopírujte do okénka:

ComboFix /Uninstall

-stiskněte Enter
-To odinstaluje ComboFix a smaže s ním související soubory a složky.


***********


Stáhněte T-Cleaner
http://sweb.cz/Marinus/T-Cleaner.exe

-Spusťte,pro potvrzení volby mačkejte klávesu A, Enter
-po použití prográmek vymažte.Pozor,antiviry ho mohou falešně označit za vir



***********


Z mého podpisu stahněte Ccleaner
- nainstalujte, při výběru, co se má nainstalovat, dejte pryč fajfku u instalace yahoo toolbaru

záložka čistič
- nechejte v levém sloupečku zatrhnuté vše jak je, klikněte na analyzovat
- po analýze klikněte na Spustit Ccleaner

záložka Registry
- klikněte na hledej problémy
- pak klikněte na opravit vybrané problémy -- udělat zálohu registrů - nemusíte
- kliknete opravit všechny problémy ok zavřít

Záložka Nástroje
- zde můžete odinstalovat programy. Je to důkladnější odinstalace než u přidat/odebrat programy ve Windows.

Ccleaner - čistič doporučuji používat, krásně pročistí pc od dočasných souborů.
Registry pročistí třeba po odinstalaci nějakého programu.


***********



Stahněte OTC a použijte
http://oldtimer.geekstogo.com/OTC.exe
-vyčistí tempy a po použitých programech



***********

Vložte nový log ze RSIT a řekněte co počítač, jak se chová, už je vše v pořádku?

Počítač se zatím chová normálně, lagy přestaly, zdá se být vše v pořádku. Klesla i využívaná paměť, která se mi zdála příliš vysoká, najednou mi počítač využívá o cca 300 MB RAM méně při stejném zatížení.

Tady je log:

Logfile of random's system information tool 1.08 (written by random/random)
Run by Adam at 2010-08-09 15:03:38
Microsoft Windows 7 Professional
System drive C: has 58 GB (51%) free of 114 GB
Total RAM: 2038 MB (52% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:03:42, on 9.8.2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskhost.exe
C:\Windows\Explorer.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Adobe\Adobe Captivate 4\AdobeCaptivate.exe
C:\Users\Adam\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Adam\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Adam\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Adam\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32Info.exe
C:\Users\Adam\Downloads\RSIT (1).exe
C:\Program Files\trend micro\Adam.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [snpstd3] C:\Windows\vsnpstd3.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKCU\..\Run: [Google Update] "C:\Users\Adam\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/f ... wflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: STI Simulator - Unknown owner - C:\Windows\System32\PAStiSvc.exe

--
End of file - 4054 bytes

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-684683860-1086771548-3266464040-1003Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-684683860-1086771548-3266464040-1003UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-06-19 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-06-20 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2010-04-07 2145000]
"snpstd3"=C:\Windows\vsnpstd3.exe [2005-09-05 339968]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2009-09-23 141848]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2009-09-23 173592]
"Persistence"=C:\Windows\system32\igfxpers.exe [2009-09-23 150552]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Google Update"=C:\Users\Adam\AppData\Local\Google\Update\GoogleUpdate.exe [2010-06-02 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2009-09-23 218112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\system32\webcheck.dll [2009-07-14 229376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"= []

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 months======

2010-08-09 15:03:38 ----D---- C:\rsit
2010-08-09 13:34:58 ----SHD---- C:\$RECYCLE.BIN
2010-08-09 13:21:09 ----A---- C:\Windows\PEV.exe
2010-08-09 13:21:09 ----A---- C:\Windows\MBR.exe
2010-08-09 13:21:00 ----D---- C:\Windows\ERDNT
2010-08-09 11:48:41 ----D---- C:\Program Files\Lavalys
2010-08-04 10:18:32 ----D---- C:\Program Files\OnifDesktop
2010-08-04 09:15:47 ----D---- C:\Program Files\HJT
2010-08-03 15:14:51 ----D---- C:\Program Files\trend micro
2010-08-03 09:26:40 ----A---- C:\Windows\system32\shell32.dll
2010-07-14 12:51:50 ----A---- C:\Windows\system32\PAStiSvc.exe
2010-07-14 09:13:43 ----D---- C:\Windows\system32\x64
2010-07-14 09:13:43 ----A---- C:\Windows\system32\igxpun.exe
2010-07-14 09:11:55 ----A---- C:\Windows\system32\drivers\sffp_sd.sys
2010-07-13 15:53:01 ----D---- C:\Windows\PixArt
2010-07-13 12:28:09 ----D---- C:\ProgramData\Symantec
2010-07-13 12:28:09 ----D---- C:\ProgramData\Norton
2010-07-13 12:28:06 ----D---- C:\ProgramData\NortonInstaller
2010-07-13 12:25:41 ----A---- C:\Windows\system32\kernel32.dll
2010-07-13 12:25:40 ----A---- C:\Windows\system32\apphelp.dll
2010-07-12 12:27:52 ----D---- C:\Users\Adam\AppData\Roaming\OnifDesktop
2010-07-12 12:19:30 ----D---- C:\Windows\system32\Adobe
2010-07-12 11:39:17 ----D---- C:\ProgramData\FLEXnet
2010-07-12 11:28:25 ----D---- C:\Program Files\Common Files\Adobe AIR
2010-07-12 11:05:36 ----D---- C:\Users\Adam\AppData\Roaming\AdobeSupportAdvisor.E7BED6E5DDA59983786DD72EBFA46B1598278E07.1

======List of files/folders modified in the last 1 months======

2010-08-09 15:03:40 ----D---- C:\Windows\Temp
2010-08-09 14:57:38 ----D---- C:\Windows\system32\config
2010-08-09 14:54:32 ----D---- C:\Windows
2010-08-09 14:49:35 ----D---- C:\Windows\Prefetch
2010-08-09 14:10:59 ----SHD---- C:\System Volume Information
2010-08-09 14:10:59 ----D---- C:\Windows\Logs
2010-08-09 13:31:53 ----A---- C:\Windows\system.ini
2010-08-09 13:27:58 ----D---- C:\Windows\system32\drivers
2010-08-09 13:27:58 ----D---- C:\Windows\System32
2010-08-09 13:27:58 ----D---- C:\Windows\AppPatch
2010-08-09 13:27:56 ----D---- C:\Program Files\Common Files
2010-08-09 11:48:51 ----SD---- C:\ProgramData\Microsoft
2010-08-09 11:48:41 ----RD---- C:\Program Files
2010-08-04 10:18:38 ----SHD---- C:\Windows\Installer
2010-08-03 14:33:01 ----D---- C:\Windows\winsxs
2010-08-03 09:24:54 ----D---- C:\Windows\system32\catroot
2010-07-23 09:02:52 ----D---- C:\Windows\system32\catroot2
2010-07-19 09:17:39 ----D---- C:\ProgramData
2010-07-19 09:17:38 ----D---- C:\Windows\Downloaded Program Files
2010-07-16 10:04:45 ----D---- C:\Windows\system32\Tasks
2010-07-15 10:39:14 ----SD---- C:\Users\Adam\AppData\Roaming\Microsoft
2010-07-15 09:56:51 ----D---- C:\Windows\debug
2010-07-14 13:01:45 ----D---- C:\ProgramData\Microsoft Help
2010-07-14 12:50:15 ----D---- C:\Windows\system32\DriverStore
2010-07-14 09:13:58 ----D---- C:\Windows\inf
2010-07-13 15:53:01 ----D---- C:\Windows\twain_32
2010-07-13 14:25:08 ----D---- C:\Program Files\Adobe
2010-07-13 12:32:50 ----D---- C:\Windows\Tasks
2010-07-12 11:29:26 ----D---- C:\Program Files\Common Files\Adobe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2010-04-07 114984]
R2 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2010-04-07 133512]
R2 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2010-04-07 96896]
R2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
R3 e1express;Intel(R) PRO/1000 – ovladač PCI Express síťového připojení; C:\Windows\system32\DRIVERS\e1e6032.sys [2009-07-14 211456]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2009-09-23 4808192]
R3 PAC207;VideoCAM GF112; C:\Windows\system32\DRIVERS\pfc027.sys [2005-04-08 162176]
R3 USBPNPA;USB PnP Sound Device Interface; C:\Windows\system32\drivers\CM108.sys [2007-06-28 1310720]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
S3 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
S3 PID_0928;Logitech QuickCam Express(PID_0928); C:\Windows\system32\DRIVERS\LV561AV.SYS [2009-05-01 495768]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 133120]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 SNPSTD3;USB PC Camera (SNPSTD3); C:\Windows\system32\DRIVERS\snpstd3.sys [2005-10-13 8701824]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2010-04-07 810120]
R2 STI Simulator;STI Simulator; C:\Windows\System32\PAStiSvc.exe [2005-01-14 53248]
R3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2010-07-12 655624]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2010-04-07 33560]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-06-09 1343400]

-----------------EOF-----------------

Otevřete si Poznámkový blok a zkopírujte do něj text

-uložte jako (typ: všechny soubory) kde za název souboru zadáte "smazani.reg" bez uvozovek,
klikněte na uložit, pak na soubor standardně 2X klikněte a potvrďte dialogové okno.



Pokud nejsou problémy, je to vše .

Problémy nejsou, takže moc děkuji za pomoc.

Tak jsem se radovali předčasně, lagy se vrátili. Netuším, jestli je to softwarového původu, ale zjevně se to vymýtit nepovedlo.

Můžete být trošku konkrétnější? Jaké jsou přesně problémy?

v nepravidelných intervalech (včera před řešením třeba 10 min, dnes zatím asi 1 za hodinu) se windows zaseknou, nereaguje nic, kromě kurzoru a nejnepochopitelnější efekt je, že když se pokouším překliknout na záložku v jakémkoliv prohlížeči, tak se zavře. Pomáhá když přes alt+ctrl+del otevřu správce úloh, pak se vše zase rozjede. Nikde nemůžu najít chybové hlášení, v centru akcí taky nic zvláštního, procesor se mi nepřehřívá, jen mám permanentně využitou prakticky celou RAMku, volná se pohybuje od 10 do 60 MB, ale netuším, jestli to s tím má souvislost...