Spomalene PC prosim o pomoc

[duch301]

Dobry den,
po dlhsiom pouzivani sa mi zacal spomalovat internet a neskor sa to prenieslo do hier v pc. Po zapnuti PC pracoval nejaky cas normalne a postupne sa tento cas zacal zkracovat az teraz, uz len 3 minuty pozapnuti je uplne spomaleny.

Log z ComboFixu:

Logfile of random's system information tool 1.08 (written by random/random)
Run by Duch at 2010-11-13 13:55:09
Microsoft Windows 7 Ultimate
System drive C: has 24 GB (30%) free of 80 GB
Total RAM: 1535 MB (57% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:55:38, on 13. 11. 2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16671)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Duch\Downloads\RSIT.exe
C:\Program Files\trend micro\Duch.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.sk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: McAfee Security Scan Plus.lnk = ?
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe

--
End of file - 2655 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2008-07-01 1447168]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-07-14 1173504]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
McAfee Security Scan Plus.lnk - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-11-13 13:55:10 ----D---- C:\Program Files\trend micro
2010-11-13 13:55:09 ----D---- C:\rsit
2010-11-13 13:34:03 ----D---- C:\Users\Duch\AppData\Roaming\ESET
2010-11-13 13:32:42 ----D---- C:\ProgramData\ESET
2010-11-13 13:32:42 ----D---- C:\Program Files\ESET
2010-11-06 16:15:11 ----D---- C:\Users\Duch\AppData\Roaming\WinRAR
2010-11-04 20:37:52 ----D---- C:\Windows\system32\Wat
2010-11-04 15:19:57 ----A---- C:\Windows\system32\msv1_0.dll
2010-11-04 15:15:06 ----A---- C:\Windows\system32\PresentationHostProxy.dll
2010-11-04 15:15:06 ----A---- C:\Windows\system32\PresentationHost.exe
2010-11-04 15:15:06 ----A---- C:\Windows\system32\netfxperf.dll
2010-11-04 15:15:06 ----A---- C:\Windows\system32\mscoree.dll
2010-11-04 15:15:06 ----A---- C:\Windows\system32\dfshim.dll
2010-11-04 15:04:09 ----A---- C:\Windows\system32\browserchoice.exe
2010-11-04 15:02:55 ----A---- C:\Windows\system32\drivers\ks.sys
2010-11-04 11:40:36 ----A---- C:\Windows\system32\ole32.dll
2010-11-04 11:40:33 ----A---- C:\Windows\system32\drivers\tcpip.sys
2010-11-04 11:40:05 ----A---- C:\Windows\system32\drivers\fvevol.sys
2010-11-04 11:40:01 ----A---- C:\Windows\system32\spoolsv.exe
2010-11-04 11:39:57 ----A---- C:\Windows\system32\mshtml.dll
2010-11-04 11:39:56 ----A---- C:\Windows\system32\ieframe.dll
2010-11-04 11:39:54 ----A---- C:\Windows\system32\urlmon.dll
2010-11-04 11:39:54 ----A---- C:\Windows\system32\mstime.dll
2010-11-04 11:39:54 ----A---- C:\Windows\system32\msfeeds.dll
2010-11-04 11:39:54 ----A---- C:\Windows\system32\iertutil.dll
2010-11-04 11:39:53 ----A---- C:\Windows\system32\wininet.dll
2010-11-04 11:39:53 ----A---- C:\Windows\system32\licmgr10.dll
2010-11-04 11:39:53 ----A---- C:\Windows\system32\iedkcs32.dll
2010-11-04 11:39:52 ----A---- C:\Windows\system32\mshtmled.dll
2010-11-04 11:39:52 ----A---- C:\Windows\system32\msfeedssync.exe
2010-11-04 11:39:52 ----A---- C:\Windows\system32\msfeedsbs.dll
2010-11-04 11:39:52 ----A---- C:\Windows\system32\jsproxy.dll
2010-11-04 11:39:52 ----A---- C:\Windows\system32\ieui.dll
2010-11-04 11:39:52 ----A---- C:\Windows\system32\iepeers.dll
2010-11-04 11:39:42 ----A---- C:\Windows\system32\ir32_32.dll
2010-11-04 11:39:42 ----A---- C:\Windows\system32\iccvid.dll
2010-11-04 11:39:40 ----A---- C:\Windows\system32\winlogon.exe
2010-11-04 11:39:40 ----A---- C:\Windows\explorer.exe
2010-11-04 11:39:37 ----A---- C:\Windows\system32\tzres.dll
2010-11-04 11:39:25 ----A---- C:\Windows\system32\t2embed.dll
2010-11-04 11:39:20 ----A---- C:\Windows\system32\CPFilters.dll
2010-11-04 11:39:19 ----A---- C:\Windows\system32\psisdecd.dll
2010-11-04 11:39:19 ----A---- C:\Windows\system32\msdri.dll
2010-11-04 11:39:11 ----A---- C:\Windows\system32\lsasrv.dll
2010-11-04 11:39:11 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2010-11-04 11:38:54 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2010-11-04 11:38:54 ----A---- C:\Windows\system32\CertEnroll.dll
2010-11-04 11:38:51 ----N---- C:\Windows\system32\winload.exe
2010-11-04 11:38:51 ----A---- C:\Windows\system32\winresume.exe
2010-11-04 11:38:33 ----A---- C:\Windows\system32\schannel.dll
2010-11-04 11:38:29 ----A---- C:\Windows\system32\msasn1.dll
2010-11-04 11:38:24 ----A---- C:\Windows\system32\inetcomm.dll
2010-11-04 11:38:18 ----A---- C:\Windows\system32\rtutils.dll
2010-11-04 11:38:12 ----A---- C:\Windows\system32\ntdll.dll
2010-11-04 11:38:07 ----A---- C:\Windows\system32\msxml3.dll
2010-11-04 11:38:00 ----A---- C:\Windows\system32\fontsub.dll
2010-11-04 11:38:00 ----A---- C:\Windows\system32\atmlib.dll
2010-11-04 11:38:00 ----A---- C:\Windows\system32\atmfd.dll
2010-11-04 11:37:52 ----A---- C:\Windows\system32\asycfilt.dll
2010-11-04 11:37:45 ----A---- C:\Windows\system32\comctl32.dll
2010-11-04 11:37:39 ----A---- C:\Windows\system32\mfc40u.dll
2010-11-04 11:37:39 ----A---- C:\Windows\system32\mfc40.dll
2010-11-04 11:36:33 ----A---- C:\Windows\system32\wmp.dll
2010-11-04 11:36:30 ----A---- C:\Windows\system32\wmploc.DLL
2010-11-04 11:36:27 ----A---- C:\Windows\system32\drivers\Diskdump.sys
2010-11-04 11:36:26 ----A---- C:\Windows\system32\jscript.dll
2010-11-04 11:36:21 ----A---- C:\Windows\system32\win32k.sys
2010-11-04 11:36:18 ----A---- C:\Windows\system32\quartz.dll
2010-11-04 11:36:18 ----A---- C:\Windows\system32\msvidc32.dll
2010-11-04 11:36:18 ----A---- C:\Windows\system32\mciavi32.dll
2010-11-04 11:36:18 ----A---- C:\Windows\system32\iyuv_32.dll
2010-11-04 11:36:18 ----A---- C:\Windows\system32\avifil32.dll
2010-11-04 11:36:17 ----A---- C:\Windows\system32\tsbyuv.dll
2010-11-04 11:36:17 ----A---- C:\Windows\system32\msyuv.dll
2010-11-04 11:36:17 ----A---- C:\Windows\system32\msrle32.dll
2010-11-04 11:36:13 ----A---- C:\Windows\system32\kernel32.dll
2010-11-04 11:36:12 ----A---- C:\Windows\system32\apphelp.dll
2010-11-04 11:36:08 ----A---- C:\Windows\system32\shell32.dll
2010-11-04 11:36:05 ----A---- C:\Windows\system32\ntoskrnl.exe
2010-11-04 11:36:04 ----A---- C:\Windows\system32\ntkrnlpa.exe
2010-11-04 11:35:49 ----A---- C:\Windows\system32\srvsvc.dll
2010-11-04 11:35:49 ----A---- C:\Windows\system32\drivers\srv2.sys
2010-11-04 11:35:49 ----A---- C:\Windows\system32\drivers\srv.sys
2010-11-04 11:35:48 ----A---- C:\Windows\system32\drivers\srvnet.sys
2010-11-04 11:35:46 ----A---- C:\Windows\system32\wmpmde.dll
2010-11-04 11:35:41 ----A---- C:\Windows\system32\vbscript.dll
2010-11-04 11:35:39 ----D---- C:\Program Files\THQ
2010-11-04 11:35:12 ----A---- C:\Windows\system32\secproc_ssp_isv.dll
2010-11-04 11:35:12 ----A---- C:\Windows\system32\secproc_ssp.dll
2010-11-04 11:35:12 ----A---- C:\Windows\system32\secproc_isv.dll
2010-11-04 11:35:12 ----A---- C:\Windows\system32\secproc.dll
2010-11-04 11:35:12 ----A---- C:\Windows\system32\RMActivate_ssp_isv.exe
2010-11-04 11:35:12 ----A---- C:\Windows\system32\RMActivate_ssp.exe
2010-11-04 11:35:12 ----A---- C:\Windows\system32\RMActivate_isv.exe
2010-11-04 11:35:12 ----A---- C:\Windows\system32\RMActivate.exe
2010-11-04 11:34:40 ----A---- C:\Windows\system32\StructuredQuery.dll
2010-11-04 11:34:31 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2010-11-04 11:34:31 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2010-11-04 11:34:31 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2010-11-04 11:29:34 ----A---- C:\Windows\system32\wintrust.dll
2010-11-04 11:29:34 ----A---- C:\Windows\system32\cabview.dll
2010-11-03 22:29:13 ----D---- C:\Windows\Panther
2010-11-03 22:29:00 ----H---- C:\Boot.BAK
2010-11-03 22:28:42 ----D---- C:\Windows\system32\OEM
2010-11-03 22:19:32 ----D---- C:\Windows.old
2010-11-03 21:06:26 ----D---- C:\ProgramData\Enkord
2010-11-03 20:48:54 ----D---- C:\Users\Duch\AppData\Roaming\Ascaron Entertainment
2010-11-03 20:17:29 ----D---- C:\Windows\system32\appmgmt
2010-11-03 19:13:16 ----A---- C:\Windows\system32\xinput1_1.dll
2010-11-03 19:13:15 ----A---- C:\Windows\system32\xactengine2_1.dll
2010-11-03 19:13:15 ----A---- C:\Windows\system32\x3daudio1_0.dll
2010-11-03 19:13:15 ----A---- C:\Windows\system32\d3dx9_30.dll
2010-11-03 19:10:11 ----SHD---- C:\Windows\Installer
2010-11-03 15:17:34 ----D---- C:\Users\Duch\AppData\Roaming\BSplayer Pro
2010-11-03 15:17:34 ----D---- C:\Users\Duch\AppData\Roaming\BSplayer
2010-11-03 15:17:33 ----D---- C:\Program Files\Webteh
2010-11-03 14:15:50 ----D---- C:\Users\Duch\AppData\Roaming\Skype
2010-11-03 14:14:05 ----D---- C:\Users\Duch\AppData\Roaming\Macromedia
2010-11-03 14:14:04 ----D---- C:\Users\Duch\AppData\Roaming\Adobe
2010-11-03 14:13:21 ----N---- C:\Windows\system32\MpSigStub.exe
2010-11-03 14:08:14 ----D---- C:\Windows\system32\Macromed
2010-11-03 14:08:05 ----D---- C:\ProgramData\McAfee Security Scan
2010-11-03 14:08:05 ----D---- C:\ProgramData\McAfee
2010-11-03 14:08:04 ----D---- C:\Program Files\McAfee Security Scan
2010-11-03 14:04:22 ----D---- C:\Users\Duch\AppData\Roaming\Mozilla
2010-11-03 14:04:15 ----D---- C:\Program Files\Mozilla Firefox
2010-11-03 13:59:32 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-11-03 13:56:08 ----D---- C:\Users\Duch\AppData\Roaming\Identities
2010-11-03 13:55:50 ----SD---- C:\Users\Duch\AppData\Roaming\Microsoft
2010-11-03 13:55:50 ----D---- C:\Users\Duch\AppData\Roaming\Media Center Programs
2010-11-03 13:53:32 ----A---- C:\grldr.bak
2010-11-03 13:51:32 ----SHD---- C:\Recovery
2010-11-03 13:34:28 ----D---- C:\Windows\SoftwareDistribution
2010-11-03 13:31:00 ----D---- C:\Windows\Prefetch
2010-11-03 13:30:58 ----ASH---- C:\hiberfil.sys
2010-11-03 13:13:59 ----RASH---- C:\BOOTSECT.BAK
2010-11-03 13:13:53 ----SHD---- C:\Boot

======List of files/folders modified in the last 1 months======

2010-11-13 13:55:33 ----D---- C:\Windows\Temp
2010-11-13 13:55:10 ----RD---- C:\Program Files
2010-11-13 13:40:00 ----D---- C:\Windows\System32
2010-11-13 13:39:59 ----D---- C:\Windows\inf
2010-11-13 13:38:51 ----D---- C:\Windows\system32\config
2010-11-13 13:34:12 ----D---- C:\Windows
2010-11-13 13:33:29 ----D---- C:\Windows\system32\drivers
2010-11-13 13:33:19 ----D---- C:\Windows\system32\DriverStore
2010-11-13 13:33:19 ----D---- C:\Windows\system32\catroot
2010-11-13 13:32:42 ----HD---- C:\ProgramData
2010-11-13 13:32:34 ----SHD---- C:\System Volume Information
2010-11-13 13:20:21 ----RD---- C:\Users
2010-11-13 13:13:04 ----SD---- C:\ProgramData\Microsoft
2010-11-13 13:13:01 ----D---- C:\Windows\system32\drivers\UMDF
2010-11-09 23:04:51 ----D---- C:\Windows\rescache
2010-11-06 21:22:16 ----D---- C:\Windows\Microsoft.NET
2010-11-06 16:27:48 ----D---- C:\Windows\debug
2010-11-06 14:31:33 ----RSD---- C:\Windows\assembly
2010-11-04 20:39:55 ----D---- C:\Windows\winsxs
2010-11-04 20:38:04 ----D---- C:\Windows\system32\migration
2010-11-04 20:38:04 ----D---- C:\Program Files\Internet Explorer
2010-11-04 20:38:03 ----D---- C:\Windows\system32\cs-CZ
2010-11-04 20:38:02 ----D---- C:\Windows\system32\sk-SK
2010-11-04 20:38:02 ----D---- C:\Windows\system32\en-US
2010-11-04 20:38:00 ----D---- C:\Windows\ehome
2010-11-04 20:37:58 ----D---- C:\Program Files\Windows Mail
2010-11-04 20:37:57 ----D---- C:\Windows\system32\Boot
2010-11-04 20:37:56 ----D---- C:\Windows\AppPatch
2010-11-04 20:37:56 ----D---- C:\Program Files\Windows Media Player
2010-11-04 15:20:17 ----D---- C:\Windows\system32\catroot2
2010-11-04 13:02:15 ----D---- C:\Windows\system32\LogFiles
2010-11-04 11:25:21 ----D---- C:\Windows\system32\wdi
2010-11-03 22:29:00 ----RASH---- C:\Boot.ini.saved
2010-11-03 21:10:30 ----D---- C:\Windows\system32\Tasks
2010-11-03 19:59:54 ----SHD---- C:\$Recycle.Bin
2010-11-03 14:46:06 ----D---- C:\Windows\Logs
2010-11-03 14:12:55 ----D---- C:\Windows\system32\restore
2010-11-03 13:53:32 ----D---- C:\Windows\Setup
2010-11-03 13:53:26 ----D---- C:\Windows\system32\wbem
2010-11-03 13:51:17 ----D---- C:\Windows\system32\CodeIntegrity
2010-11-03 13:35:36 ----D---- C:\Windows\system32\sysprep
2010-11-03 13:32:03 ----D---- C:\Windows\CSC
2010-10-22 13:35:08 ----D---- C:\Downloads

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R1 easdrv;easdrv; C:\Windows\system32\DRIVERS\easdrv.sys [2008-07-01 53256]
R1 epfwtdi;epfwtdi; C:\Windows\system32\DRIVERS\epfwtdi.sys [2008-07-01 54280]
R2 eamon;EAMON; C:\Windows\system32\DRIVERS\eamon.sys [2008-07-01 39944]
R2 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys [2008-07-01 71688]
R2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
R3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller; C:\Windows\system32\DRIVERS\l160x86.sys [2009-07-13 47104]
R3 Epfwndis;Eset Personal Firewall; C:\Windows\system32\DRIVERS\Epfwndis.sys [2008-07-01 30728]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 133120]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 ekrn;Eset Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2007-12-21 468224]
S2 NOD32FiXTemDono;Eset Nod32 Boot; C:\Windows\system32\regedt32.exe [2009-07-14 9216]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 EhttpSrv;Eset HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2008-07-01 19200]
S3 McComponentHostService;McAfee Security Scan Component Host Service; C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-11-04 1343400]

-----------------EOF-----------------

Prosim o kontrolu logu, pripadne rady.

[Roli]

Zdravím, za prvé tohle je log z Rsit.

Za druhé pokud chceš pomoct odinstaluj ten CRACKED NOD a pořiď si nějaký free antivir když za něj nechceš platit.

Do té doby

[duch301]

okey, crack som odinstaloval uz bezim na obicajnej trial verzii.
pre istotu prikladam dalsi log, z Rsitu, sry za preklep hadam sa tolko nestalo

chcem este dotat, problem je v tom ze mi procesor skoro stale vytazuje na 100% aj ked nemam nic zapnute.

Logfile of random's system information tool 1.08 (written by random/random)
Run by Duch at 2010-11-23 14:43:41
Microsoft Windows 7 Ultimate
System drive C: has 18 GB (22%) free of 80 GB
Total RAM: 1535 MB (58% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 14:44:01, on 23. 11. 2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16671)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\wuauclt.exe
C:\Users\Duch\Downloads\RSIT.exe
C:\Program Files\trend micro\Duch.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.sk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: McAfee Security Scan Plus.lnk = ?
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe

--
End of file - 2613 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2008-07-01 1447168]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-07-14 1173504]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
McAfee Security Scan Plus.lnk - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-11-14 10:01:12 ----D---- C:\ProgramData\Media Center Programs
2010-11-14 09:44:13 ----A---- C:\Windows\system32\xinput1_3.dll
2010-11-14 09:44:12 ----A---- C:\Windows\system32\xactengine2_7.dll
2010-11-14 09:44:12 ----A---- C:\Windows\system32\x3daudio1_1.dll
2010-11-14 09:44:11 ----A---- C:\Windows\system32\d3dx10_33.dll
2010-11-14 09:44:11 ----A---- C:\Windows\system32\D3DCompiler_33.dll
2010-11-14 09:44:10 ----A---- C:\Windows\system32\d3dx9_33.dll
2010-11-13 13:55:10 ----D---- C:\Program Files\trend micro
2010-11-13 13:55:09 ----D---- C:\rsit
2010-11-13 13:34:03 ----D---- C:\Users\Duch\AppData\Roaming\ESET
2010-11-13 13:32:42 ----D---- C:\ProgramData\ESET
2010-11-13 13:32:42 ----D---- C:\Program Files\ESET
2010-11-06 16:15:11 ----D---- C:\Users\Duch\AppData\Roaming\WinRAR
2010-11-04 20:37:52 ----D---- C:\Windows\system32\Wat
2010-11-04 15:19:57 ----A---- C:\Windows\system32\msv1_0.dll
2010-11-04 15:15:06 ----A---- C:\Windows\system32\PresentationHostProxy.dll
2010-11-04 15:15:06 ----A---- C:\Windows\system32\PresentationHost.exe
2010-11-04 15:15:06 ----A---- C:\Windows\system32\netfxperf.dll
2010-11-04 15:15:06 ----A---- C:\Windows\system32\mscoree.dll
2010-11-04 15:15:06 ----A---- C:\Windows\system32\dfshim.dll
2010-11-04 15:04:09 ----A---- C:\Windows\system32\browserchoice.exe
2010-11-04 15:02:55 ----A---- C:\Windows\system32\drivers\ks.sys
2010-11-04 11:40:36 ----A---- C:\Windows\system32\ole32.dll
2010-11-04 11:40:33 ----A---- C:\Windows\system32\drivers\tcpip.sys
2010-11-04 11:40:05 ----A---- C:\Windows\system32\drivers\fvevol.sys
2010-11-04 11:40:01 ----A---- C:\Windows\system32\spoolsv.exe
2010-11-04 11:39:57 ----A---- C:\Windows\system32\mshtml.dll
2010-11-04 11:39:56 ----A---- C:\Windows\system32\ieframe.dll
2010-11-04 11:39:54 ----A---- C:\Windows\system32\urlmon.dll
2010-11-04 11:39:54 ----A---- C:\Windows\system32\mstime.dll
2010-11-04 11:39:54 ----A---- C:\Windows\system32\msfeeds.dll
2010-11-04 11:39:54 ----A---- C:\Windows\system32\iertutil.dll
2010-11-04 11:39:53 ----A---- C:\Windows\system32\wininet.dll
2010-11-04 11:39:53 ----A---- C:\Windows\system32\licmgr10.dll
2010-11-04 11:39:53 ----A---- C:\Windows\system32\iedkcs32.dll
2010-11-04 11:39:52 ----A---- C:\Windows\system32\mshtmled.dll
2010-11-04 11:39:52 ----A---- C:\Windows\system32\msfeedssync.exe
2010-11-04 11:39:52 ----A---- C:\Windows\system32\msfeedsbs.dll
2010-11-04 11:39:52 ----A---- C:\Windows\system32\jsproxy.dll
2010-11-04 11:39:52 ----A---- C:\Windows\system32\ieui.dll
2010-11-04 11:39:52 ----A---- C:\Windows\system32\iepeers.dll
2010-11-04 11:39:42 ----A---- C:\Windows\system32\ir32_32.dll
2010-11-04 11:39:42 ----A---- C:\Windows\system32\iccvid.dll
2010-11-04 11:39:40 ----A---- C:\Windows\system32\winlogon.exe
2010-11-04 11:39:40 ----A---- C:\Windows\explorer.exe
2010-11-04 11:39:37 ----A---- C:\Windows\system32\tzres.dll
2010-11-04 11:39:25 ----A---- C:\Windows\system32\t2embed.dll
2010-11-04 11:39:20 ----A---- C:\Windows\system32\CPFilters.dll
2010-11-04 11:39:19 ----A---- C:\Windows\system32\psisdecd.dll
2010-11-04 11:39:19 ----A---- C:\Windows\system32\msdri.dll
2010-11-04 11:39:11 ----A---- C:\Windows\system32\lsasrv.dll
2010-11-04 11:39:11 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2010-11-04 11:38:54 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2010-11-04 11:38:54 ----A---- C:\Windows\system32\CertEnroll.dll
2010-11-04 11:38:51 ----N---- C:\Windows\system32\winload.exe
2010-11-04 11:38:51 ----A---- C:\Windows\system32\winresume.exe
2010-11-04 11:38:33 ----A---- C:\Windows\system32\schannel.dll
2010-11-04 11:38:29 ----A---- C:\Windows\system32\msasn1.dll
2010-11-04 11:38:24 ----A---- C:\Windows\system32\inetcomm.dll
2010-11-04 11:38:18 ----A---- C:\Windows\system32\rtutils.dll
2010-11-04 11:38:12 ----A---- C:\Windows\system32\ntdll.dll
2010-11-04 11:38:07 ----A---- C:\Windows\system32\msxml3.dll
2010-11-04 11:38:00 ----A---- C:\Windows\system32\fontsub.dll
2010-11-04 11:38:00 ----A---- C:\Windows\system32\atmlib.dll
2010-11-04 11:38:00 ----A---- C:\Windows\system32\atmfd.dll
2010-11-04 11:37:52 ----A---- C:\Windows\system32\asycfilt.dll
2010-11-04 11:37:45 ----A---- C:\Windows\system32\comctl32.dll
2010-11-04 11:37:39 ----A---- C:\Windows\system32\mfc40u.dll
2010-11-04 11:37:39 ----A---- C:\Windows\system32\mfc40.dll
2010-11-04 11:36:33 ----A---- C:\Windows\system32\wmp.dll
2010-11-04 11:36:30 ----A---- C:\Windows\system32\wmploc.DLL
2010-11-04 11:36:27 ----A---- C:\Windows\system32\drivers\Diskdump.sys
2010-11-04 11:36:26 ----A---- C:\Windows\system32\jscript.dll
2010-11-04 11:36:21 ----A---- C:\Windows\system32\win32k.sys
2010-11-04 11:36:18 ----A---- C:\Windows\system32\quartz.dll
2010-11-04 11:36:18 ----A---- C:\Windows\system32\msvidc32.dll
2010-11-04 11:36:18 ----A---- C:\Windows\system32\mciavi32.dll
2010-11-04 11:36:18 ----A---- C:\Windows\system32\iyuv_32.dll
2010-11-04 11:36:18 ----A---- C:\Windows\system32\avifil32.dll
2010-11-04 11:36:17 ----A---- C:\Windows\system32\tsbyuv.dll
2010-11-04 11:36:17 ----A---- C:\Windows\system32\msyuv.dll
2010-11-04 11:36:17 ----A---- C:\Windows\system32\msrle32.dll
2010-11-04 11:36:13 ----A---- C:\Windows\system32\kernel32.dll
2010-11-04 11:36:12 ----A---- C:\Windows\system32\apphelp.dll
2010-11-04 11:36:08 ----A---- C:\Windows\system32\shell32.dll
2010-11-04 11:36:05 ----A---- C:\Windows\system32\ntoskrnl.exe
2010-11-04 11:36:04 ----A---- C:\Windows\system32\ntkrnlpa.exe
2010-11-04 11:35:49 ----A---- C:\Windows\system32\srvsvc.dll
2010-11-04 11:35:49 ----A---- C:\Windows\system32\drivers\srv2.sys
2010-11-04 11:35:49 ----A---- C:\Windows\system32\drivers\srv.sys
2010-11-04 11:35:48 ----A---- C:\Windows\system32\drivers\srvnet.sys
2010-11-04 11:35:46 ----A---- C:\Windows\system32\wmpmde.dll
2010-11-04 11:35:41 ----A---- C:\Windows\system32\vbscript.dll
2010-11-04 11:35:39 ----D---- C:\Program Files\THQ
2010-11-04 11:35:12 ----A---- C:\Windows\system32\secproc_ssp_isv.dll
2010-11-04 11:35:12 ----A---- C:\Windows\system32\secproc_ssp.dll
2010-11-04 11:35:12 ----A---- C:\Windows\system32\secproc_isv.dll
2010-11-04 11:35:12 ----A---- C:\Windows\system32\secproc.dll
2010-11-04 11:35:12 ----A---- C:\Windows\system32\RMActivate_ssp_isv.exe
2010-11-04 11:35:12 ----A---- C:\Windows\system32\RMActivate_ssp.exe
2010-11-04 11:35:12 ----A---- C:\Windows\system32\RMActivate_isv.exe
2010-11-04 11:35:12 ----A---- C:\Windows\system32\RMActivate.exe
2010-11-04 11:34:40 ----A---- C:\Windows\system32\StructuredQuery.dll
2010-11-04 11:34:31 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2010-11-04 11:34:31 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2010-11-04 11:34:31 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2010-11-04 11:29:34 ----A---- C:\Windows\system32\wintrust.dll
2010-11-04 11:29:34 ----A---- C:\Windows\system32\cabview.dll
2010-11-03 22:29:13 ----D---- C:\Windows\Panther
2010-11-03 22:29:00 ----H---- C:\Boot.BAK
2010-11-03 22:28:42 ----D---- C:\Windows\system32\OEM
2010-11-03 22:19:32 ----D---- C:\Windows.old
2010-11-03 21:06:26 ----D---- C:\ProgramData\Enkord
2010-11-03 20:48:54 ----D---- C:\Users\Duch\AppData\Roaming\Ascaron Entertainment
2010-11-03 20:17:29 ----D---- C:\Windows\system32\appmgmt
2010-11-03 19:13:16 ----A---- C:\Windows\system32\xinput1_1.dll
2010-11-03 19:13:15 ----A---- C:\Windows\system32\xactengine2_1.dll
2010-11-03 19:13:15 ----A---- C:\Windows\system32\x3daudio1_0.dll
2010-11-03 19:13:15 ----A---- C:\Windows\system32\d3dx9_30.dll
2010-11-03 19:10:11 ----SHD---- C:\Windows\Installer
2010-11-03 15:17:34 ----D---- C:\Users\Duch\AppData\Roaming\BSplayer Pro
2010-11-03 15:17:34 ----D---- C:\Users\Duch\AppData\Roaming\BSplayer
2010-11-03 15:17:33 ----D---- C:\Program Files\Webteh
2010-11-03 14:15:50 ----D---- C:\Users\Duch\AppData\Roaming\Skype
2010-11-03 14:14:05 ----D---- C:\Users\Duch\AppData\Roaming\Macromedia
2010-11-03 14:14:04 ----D---- C:\Users\Duch\AppData\Roaming\Adobe
2010-11-03 14:13:21 ----N---- C:\Windows\system32\MpSigStub.exe
2010-11-03 14:08:14 ----D---- C:\Windows\system32\Macromed
2010-11-03 14:08:05 ----D---- C:\ProgramData\McAfee Security Scan
2010-11-03 14:08:05 ----D---- C:\ProgramData\McAfee
2010-11-03 14:08:04 ----D---- C:\Program Files\McAfee Security Scan
2010-11-03 14:04:22 ----D---- C:\Users\Duch\AppData\Roaming\Mozilla
2010-11-03 14:04:15 ----D---- C:\Program Files\Mozilla Firefox
2010-11-03 13:59:32 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-11-03 13:56:08 ----D---- C:\Users\Duch\AppData\Roaming\Identities
2010-11-03 13:55:50 ----SD---- C:\Users\Duch\AppData\Roaming\Microsoft
2010-11-03 13:55:50 ----D---- C:\Users\Duch\AppData\Roaming\Media Center Programs
2010-11-03 13:53:32 ----A---- C:\grldr.bak
2010-11-03 13:51:32 ----SHD---- C:\Recovery
2010-11-03 13:34:28 ----D---- C:\Windows\SoftwareDistribution
2010-11-03 13:31:00 ----D---- C:\Windows\Prefetch
2010-11-03 13:30:58 ----ASH---- C:\hiberfil.sys
2010-11-03 13:13:59 ----RASH---- C:\BOOTSECT.BAK
2010-11-03 13:13:53 ----SHD---- C:\Boot

======List of files/folders modified in the last 1 months======

2010-11-23 14:43:54 ----D---- C:\Windows\Temp
2010-11-23 14:41:28 ----D---- C:\Windows\System32
2010-11-23 14:41:27 ----D---- C:\Windows\inf
2010-11-23 14:40:10 ----D---- C:\Windows\system32\config
2010-11-23 14:35:59 ----D---- C:\Windows
2010-11-18 19:54:57 ----D---- C:\Windows\system32\catroot2
2010-11-14 14:10:38 ----D---- C:\Windows\system32\wdi
2010-11-14 10:01:12 ----HD---- C:\ProgramData
2010-11-14 09:58:54 ----SHD---- C:\System Volume Information
2010-11-14 09:52:07 ----D---- C:\Windows\winsxs
2010-11-14 09:51:49 ----D---- C:\Program Files\Common Files\microsoft shared
2010-11-13 13:55:10 ----RD---- C:\Program Files
2010-11-13 13:33:29 ----D---- C:\Windows\system32\drivers
2010-11-13 13:33:19 ----D---- C:\Windows\system32\DriverStore
2010-11-13 13:33:19 ----D---- C:\Windows\system32\catroot
2010-11-13 13:20:21 ----RD---- C:\Users
2010-11-13 13:13:04 ----SD---- C:\ProgramData\Microsoft
2010-11-13 13:13:01 ----D---- C:\Windows\system32\drivers\UMDF
2010-11-09 23:04:51 ----D---- C:\Windows\rescache
2010-11-06 21:22:16 ----D---- C:\Windows\Microsoft.NET
2010-11-06 16:27:48 ----D---- C:\Windows\debug
2010-11-06 14:31:33 ----RSD---- C:\Windows\assembly
2010-11-04 20:38:04 ----D---- C:\Windows\system32\migration
2010-11-04 20:38:04 ----D---- C:\Program Files\Internet Explorer
2010-11-04 20:38:03 ----D---- C:\Windows\system32\cs-CZ
2010-11-04 20:38:02 ----D---- C:\Windows\system32\sk-SK
2010-11-04 20:38:02 ----D---- C:\Windows\system32\en-US
2010-11-04 20:38:00 ----D---- C:\Windows\ehome
2010-11-04 20:37:58 ----D---- C:\Program Files\Windows Mail
2010-11-04 20:37:57 ----D---- C:\Windows\system32\Boot
2010-11-04 20:37:56 ----D---- C:\Windows\AppPatch
2010-11-04 20:37:56 ----D---- C:\Program Files\Windows Media Player
2010-11-04 13:02:15 ----D---- C:\Windows\system32\LogFiles
2010-11-03 22:29:00 ----RASH---- C:\Boot.ini.saved
2010-11-03 21:10:30 ----D---- C:\Windows\system32\Tasks
2010-11-03 19:59:54 ----SHD---- C:\$Recycle.Bin
2010-11-03 14:46:06 ----D---- C:\Windows\Logs
2010-11-03 14:12:55 ----D---- C:\Windows\system32\restore
2010-11-03 13:53:32 ----D---- C:\Windows\Setup
2010-11-03 13:53:26 ----D---- C:\Windows\system32\wbem
2010-11-03 13:51:17 ----D---- C:\Windows\system32\CodeIntegrity
2010-11-03 13:35:36 ----D---- C:\Windows\system32\sysprep
2010-11-03 13:32:03 ----D---- C:\Windows\CSC

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R1 easdrv;easdrv; C:\Windows\system32\DRIVERS\easdrv.sys [2008-07-01 53256]
R1 epfwtdi;epfwtdi; C:\Windows\system32\DRIVERS\epfwtdi.sys [2008-07-01 54280]
R2 eamon;EAMON; C:\Windows\system32\DRIVERS\eamon.sys [2008-07-01 39944]
R2 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys [2008-07-01 71688]
R2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
R3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller; C:\Windows\system32\DRIVERS\l160x86.sys [2009-07-13 47104]
R3 Epfwndis;Eset Personal Firewall; C:\Windows\system32\DRIVERS\Epfwndis.sys [2008-07-01 30728]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 133120]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 ekrn;Eset Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2007-12-21 468224]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 EhttpSrv;Eset HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2008-07-01 19200]
S3 McComponentHostService;McAfee Security Scan Component Host Service; C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-11-04 1343400]

-----------------EOF-----------------

[Roli]

Tohle fixni v HJT :

O4 - Global Startup: McAfee Security Scan Plus.lnk = ?

HJT najdeš zde :

C:\Program Files\trend micro\Duch.exe

Fix znamená že spustíš HJT jako admin

v okně které se ti otevře klikneš na Do a system scan only

v dalším okně najdeš řádky které jsem ti vypsal,

vedle nich je čtvereček do kterého uděláš zatržítko,

pak klikneš na Fix checked které je vlevo dole,

program se ti zeptá zda opravdu ANO s tím samozřejmě souhlasíš a je hotovo.


Přes Start >> Všechny programy >> Příslušenství >> Spustit >> napiš - services.msc >> Enter. Najdi službu :

McAfee Security Scan

klikni na ni pravým myšítkem, zvol vlastnosti, na další kartě nejprve službu zastav tlačítkem Zastavit a u položky Typ spouštění zvol Zakázáno.


Dále použij Mbam z mého podpisu a dej mi sem z něj log dříve než něco smažeš.

[duch301]

tu je log z mbam

Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org

Verzia databázy: 5224

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

1. 12. 2010 13:23:57
mbam-log-2010-12-01 (13-23-56).txt

Typ kontroly: Rýchla kontrola
Objektov kontrolovaných: 123227
Uplynutý čas: 2 min, 59 sek

Infikované služby pamäte: 0
Infikované moduly pamäte: 0
Infikované registračné kľúče: 0
Infikované registračné hodnoty: 0
Infikované položky registračných dát: 0
Infikované priečinky: 0
Infikované súbory: 0

Infikované služby pamäte:
(Škodlivé položky neboli zistené)

Infikované moduly pamäte:
(Škodlivé položky neboli zistené)

Infikované registračné kľúče:
(Škodlivé položky neboli zistené)

Infikované registračné hodnoty:
(Škodlivé položky neboli zistené)

Infikované položky registračných dát:
(Škodlivé položky neboli zistené)

Infikované priečinky:
(Škodlivé položky neboli zistené)

Infikované súbory:
(Škodlivé položky neboli zistené)

nič to nenašlo...

cez hjt som to fixol
a mcafee som odstavil

[Roli]

Stáhni a ulož na plochu ComboFix,

spusť aplikaci jako Administrátor a povol instalaci Konzole pro zotavení - Recovery Console.

Poté se zobrazí okno s licenčními podmínkami které potvrdíš kliknutím na ANO,

pak ještě jednou klik na ANO a už to jede.

Celá akce trvá okolo 10 minut ale může i déle, během skenu se nepokoušej spouštět nic jiného.

Při skenovaní může být PC i restartováno nelekat se.

Upozornění: po dobu skenu vypni rezidentní štít Antiviru a AntiSpy programu,

protože Combofix se pokouší napadené soubory smazat a tyto programy mu můžou bránit.

Po dokončení skenu nebo následném restartu aplikace vytvoří log, uložený na C:/Combofix.txt

(při opakovaném použití jsou logy číslovány Combofix2.txt atd.), jeho obsah zkopíruj sem.

[duch301]

tu je log

ComboFix 10-12-06.03 - Duch . 12. 2010 13:22:59.1.1 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.421.1051.18.1535.910 [GMT 1:00]
Running from: c:\users\Duch\Downloads\ComboFix.exe
AV: ESET Smart Security 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET Personal firewall *disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
SP: ESET Smart Security 3.0 *disabled* (Updated) {E5E70D32-0101-4B98-A4D6-D1D15C3BB448}
.

((((((((((((((((((((((((( Files Created from 2010-11-07 to 2010-12-07 )))))))))))))))))))))))))))))))
.

2010-12-07 12:29 . 2010-12-07 12:29 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-12-07 12:21 . 2010-12-07 12:21 -------- d-----w- C:\32788R22FWJFW
2010-12-01 12:20 . 2010-12-01 12:20 -------- d-----w- c:\users\Duch\AppData\Roaming\Malwarebytes
2010-12-01 12:20 . 2010-11-29 16:42 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-01 12:20 . 2010-12-01 12:20 -------- d-----w- c:\programdata\Malwarebytes
2010-12-01 12:20 . 2010-11-29 16:42 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-12-01 12:20 . 2010-12-01 12:20 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-11-14 09:01 . 2010-11-14 09:01 -------- d-----w- c:\programdata\Media Center Programs
2010-11-14 08:44 . 2007-04-04 17:53 81768 ----a-w- c:\windows\system32\xinput1_3.dll
2010-11-14 08:44 . 2007-04-04 17:55 261480 ----a-w- c:\windows\system32\xactengine2_7.dll
2010-11-14 08:44 . 2007-03-05 11:42 15128 ----a-w- c:\windows\system32\x3daudio1_1.dll
2010-11-14 08:44 . 2007-03-15 15:57 443752 ----a-w- c:\windows\system32\d3dx10_33.dll
2010-11-14 08:44 . 2007-03-12 15:42 1123696 ----a-w- c:\windows\system32\D3DCompiler_33.dll
2010-11-14 08:44 . 2007-03-12 15:42 3495784 ----a-w- c:\windows\system32\d3dx9_33.dll
2010-11-13 12:55 . 2010-11-23 13:43 -------- d-----w- c:\program files\trend micro
2010-11-13 12:55 . 2010-11-13 12:55 -------- d-----w- C:\rsit
2010-11-13 12:34 . 2008-03-03 13:25 5702 ---ha-w- c:\windows\nod32restoretemdono.reg
2010-11-13 12:32 . 2010-11-13 12:32 -------- d-----w- c:\program files\ESET

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-19 10:41 . 2010-11-03 13:13 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-10-18 08:41 . 2010-11-05 13:50 6146896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{D53C1470-0FA1-45C9-A609-37317DA3B5B1}\mpengine.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-07-01 1447168]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)

R3 WatAdminSvc;Služba Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2010-11-04 1343400]
R4 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
S2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2007-12-21 468224]
S3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;c:\windows\system32\DRIVERS\l160x86.sys [2009-07-13 47104]

.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.sk/
FF - ProfilePath - c:\users\Duch\AppData\Roaming\Mozilla\Firefox\Profiles\7dgyn1vw.default\
FF - component: c:\users\Duch\AppData\Roaming\Mozilla\Firefox\Profiles\7dgyn1vw.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
FF - plugin: c:\users\Duch\AppData\Roaming\Mozilla\Firefox\Profiles\7dgyn1vw.default\extensions\piclens@cooliris.com\plugins\npcoolirisplugin.dll
FF - Extension: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Extension: Cooliris: piclens@cooliris.com - c:\users\Duch\AppData\Roaming\Mozilla\Firefox\Profiles\7dgyn1vw.default\extensions\piclens@cooliris.com
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2010-12-07 13:33:00
ComboFix-quarantined-files.txt 2010-12-07 12:32

Pre-Run: 21 868 359 680 bytes free
Post-Run: 21 836 824 576 bytes free

- - End Of File - - 4A8696A335129EF71DC2B6707CF29DA4

[Roli]

Pokud jsi tak ještě neučinil, přesuň Combofix na plochu

otevři si Poznámkový blok

do něj zkopíruj skript z následujícího okna:

Kód: Vybrat vše

File::  
c:\windows\nod32restoretemdono.reg

ulož Tebou vytvořený TXT soubor jako CFScript.txt na plochu,

po uložení uchop vytvořený skript levým myšítkem a přesuň ho nad ikonu Combofixu, kde ho upustíš:



Po aplikaci na Tebe vypadne další log, zkopíruj ho sem

Upozornění : může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou,

v tom případě znovu restartuj a přitom mačkej F8 poté zvol Poslední známou funkční konfiguraci

[duch301]

log:

ComboFix 10-12-07.04 - Duch . 12. 2010 13:06:44.2.1 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.421.1051.18.1535.1023 [GMT 1:00]
Running from: c:\users\Duch\Downloads\ComboFix.exe
Command switches used :: c:\users\Duch\Desktop\CFScript.txt
.

((((((((((((((((((((((((( Files Created from 2010-11-08 to 2010-12-08 )))))))))))))))))))))))))))))))
.

2010-12-08 12:15 . 2010-12-08 12:15 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-12-07 13:01 . 2010-12-07 13:03 -------- d-----w- c:\users\Duch\AppData\Local\Google
2010-12-07 13:01 . 2010-12-07 13:02 -------- d-----w- c:\program files\Google
2010-12-07 13:01 . 2010-09-07 15:52 165584 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-12-07 13:01 . 2010-09-07 15:47 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-12-07 13:01 . 2010-09-07 15:47 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-12-07 13:01 . 2010-09-07 15:52 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-12-07 13:01 . 2010-09-07 15:47 50768 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2010-12-07 13:00 . 2010-09-07 16:12 38848 ----a-w- c:\windows\avastSS.scr
2010-12-07 13:00 . 2010-09-07 16:11 167592 ----a-w- c:\windows\system32\aswBoot.exe
2010-12-07 13:00 . 2010-12-07 13:00 -------- d-----w- c:\programdata\Alwil Software
2010-12-07 13:00 . 2010-12-07 13:00 -------- d-----w- c:\program files\Alwil Software
2010-12-07 12:33 . 2010-12-08 12:15 -------- d-----w- c:\users\Duch\AppData\Local\temp
2010-12-01 12:20 . 2010-12-01 12:20 -------- d-----w- c:\users\Duch\AppData\Roaming\Malwarebytes
2010-12-01 12:20 . 2010-12-01 12:20 -------- d-----w- c:\programdata\Malwarebytes
2010-11-14 09:01 . 2010-11-14 09:01 -------- d-----w- c:\programdata\Media Center Programs
2010-11-14 08:44 . 2007-04-04 17:53 81768 ----a-w- c:\windows\system32\xinput1_3.dll
2010-11-14 08:44 . 2007-04-04 17:55 261480 ----a-w- c:\windows\system32\xactengine2_7.dll
2010-11-14 08:44 . 2007-03-05 11:42 15128 ----a-w- c:\windows\system32\x3daudio1_1.dll
2010-11-14 08:44 . 2007-03-15 15:57 443752 ----a-w- c:\windows\system32\d3dx10_33.dll
2010-11-14 08:44 . 2007-03-12 15:42 1123696 ----a-w- c:\windows\system32\D3DCompiler_33.dll
2010-11-14 08:44 . 2007-03-12 15:42 3495784 ----a-w- c:\windows\system32\d3dx9_33.dll
2010-11-13 12:55 . 2010-11-23 13:43 -------- d-----w- c:\program files\trend micro
2010-11-13 12:55 . 2010-11-13 12:55 -------- d-----w- C:\rsit
2010-11-13 12:34 . 2008-03-03 13:25 5702 ---ha-w- c:\windows\nod32restoretemdono.reg
2010-11-13 12:32 . 2010-11-13 12:32 -------- d-----w- c:\program files\ESET

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-19 10:41 . 2010-11-03 13:13 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-10-18 08:41 . 2010-11-05 13:50 6146896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{D53C1470-0FA1-45C9-A609-37317DA3B5B1}\mpengine.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-09-07 2838912]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)

R2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-12-07 136176]
R3 WatAdminSvc;Služba Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2010-11-04 1343400]
R4 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
S1 aswSP;aswSP; [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-09-07 50768]
S3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;c:\windows\system32\DRIVERS\l160x86.sys [2009-07-13 47104]

.
Contents of the 'Scheduled Tasks' folder

2010-12-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-12-07 13:01]

2010-12-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-12-07 13:01]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.sk/
FF - ProfilePath - c:\users\Duch\AppData\Roaming\Mozilla\Firefox\Profiles\7dgyn1vw.default\
FF - component: c:\users\Duch\AppData\Roaming\Mozilla\Firefox\Profiles\7dgyn1vw.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
FF - plugin: c:\program files\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\users\Duch\AppData\Roaming\Mozilla\Firefox\Profiles\7dgyn1vw.default\extensions\piclens@cooliris.com\plugins\npcoolirisplugin.dll
FF - Extension: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Extension: Cooliris: piclens@cooliris.com - c:\users\Duch\AppData\Roaming\Mozilla\Firefox\Profiles\7dgyn1vw.default\extensions\piclens@cooliris.com
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2010-12-08 13:22:58
ComboFix-quarantined-files.txt 2010-12-08 12:22
ComboFix2.txt 2010-12-07 12:33

Pre-Run: 20 854 562 816 bytes free
Post-Run: 20 814 409 728 bytes free

- - End Of File - - 5BCB2B008A00DEF7B992E7E817CC2B67

[Roli]

Přes Start >> Spustit zkopíruj do okna:

ComboFix /Uninstall

a stiskni Enter

To odinstaluje ComboFix a smaže s ním související soubory a složky.


Stáhni a spusť OTMoveIt

do levého okna aplikace pod Paste Instructions for Items to be Moved zkopíruj tento text:

Kód: Vybrat vše

:processes
explorer.exe       

:files 
C:\*.tmp
C:\WINDOWS\System32\*.tmp
C:\WINDOWS\*.tmp
c:\windows\nod32restoretemdono.reg

:commands
[purity]
[emptytemp]
[start explorer]

klikni na MoveIt! a v pravém zeleném okně aplikace se Ti objeví info o provedene akci, obsah okna zkopíruj sem,

pokud aplikace bude požadovat restart, klikni na YES

v tom případě sem chci zkopírovat obsah logu uloženého na C:\_OTMoveIt\MovedFiles\