Kad palim kompjuter otvara se explorer C:/windows. Gledano u start upu nema šorkata na explorer. Ima li netko rješenje.

Kucaj u run "msconfig" pa pogledaj startup, Nikako nemoj ukidati procese ukoliko nisi siguran da je to taj. Ja sam to resavao pomocu jednog proglamcica koji dolazi uz aAutoPatcher, Startup u Control Panelu, ako ga slucajno imas provjeri i tako.

Probat ću, ali mislim da imam brdo virusa na računaru! Evo log file pa ako se netko može pomoći:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:33:34, on 26.11.2008
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\PCI Audio Applications\Bin\EchoCtrl.exe
C:\WINDOWS\Mixer.exe
C:\WINDOWS\essspk.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Documents and Settings\gauss.ZVJER\Desktop\TG2\TG2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.hotinfolink.com
R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL (file missing)
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\
O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [C-Media Echo Control] "C:\Program Files\PCI Audio Applications\Bin\EchoCtrl.exe"
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [EssSpkPhone] essspk.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [service] dndrxut.exe
O4 - HKLM\..\Run: [Wlan Drier] WinUSB2.exe
O4 - HKLM\..\Run: [Windows Nets] WinNET.exe
O4 - HKLM\..\Run: [Win Comm] C:\Program Files\Win Comm\WinComm.exe
O4 - HKLM\..\Run: [qpoalombpbail] C:\WINDOWS\System32\ookpzbvo.exe
O4 - HKLM\..\Run: [mlcn] C:\WINDOWS\mlcn.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [kssiy] "c:\windows\system32\kssiy.exe" kssiy
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\RunServices: [service] dndrxut.exe
O4 - HKLM\..\RunServices: [Wlan Drier] WinUSB2.exe
O4 - HKLM\..\RunServices: [Windows Nets] WinNET.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Wlan Drier] WinUSB2.exe
O4 - HKCU\..\Run: [Network Security XP] C:\WINDOWS\System32\nvsvc86.exe
O4 - HKCU\..\Run: [Windows MSN2 XP] C:\WINDOWS\System32\swchost.exe
O4 - HKCU\..\Run: [Windows MSN Updates] C:\WINDOWS\System32\wnd32.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Network Security XP] C:\WINDOWS\System32\nvsvc86.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [Wlan Drier] WinUSB2.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunServices: [MSN Messanger] msnmsng.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [Wlan Drier] WinUSB2.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunServices: [MSN Messanger] msnmsng.exe (User 'Default user')
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Windows Smrss Service - Unknown owner - C:\WINDOWS\svchost.exe (file missing)

--
End of file - 6057 bytes

Pokreni Spybot S&D
Klikni na Mode pa na  Advance Mode \ Resident \ destikliraj Resident Tea-Timer
Zatvori Spybot S&D i restartuj komjuter

Zatim skini Reset tea timer na desktop
Pokreni ga i prati upustsva

-Iskljuci privremeno Nod AV

Skini  ComboFix  i stavi ga na desktop
Startuj ga i ne diraj prozor programa dok skenira.
Sledi uputstva na ekranu.
Kad zavrsi postavi log na forum (C:\ComboFix.txt)

Brdo zaraze 
Aj uradi sve sto ti je rekao @ivicaspas pa javi da li ima promena...

Probano da se odradi gore navedeno. Pri pokretanju reset tea timera javlja da nedostaje scrrun.dll. pokrenut i combofix, odradio je posao i poslije resetiranja isto je javljao da nema scrrun.dll ali je napravio log file i evo ga:
ComboFix 08-11-26.03 - gauss 2008-11-26 13:54:10.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.0.1250.1.1033.18.109 [GMT 1:00]
Running from: c:\documents and settings\gauss.ZVJER\Desktop\ComboFix.exe
 * Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
   /wow section - STAGE 3


(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\gauss.ZVJER\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
c:\documents and settings\gauss.ZVJER\Start Menu\crazy girls.lnk
c:\windows\system32\dnpeqit_navtmp.dat
c:\windows\system32\ftpupd.exe
c:\windows\system32\kssiy.dat
c:\windows\system32\kssiy.exe
c:\windows\system32\kssiy_nav.dat
c:\windows\system32\kssiy_navps.dat
c:\windows\system32\phqghu.exe
c:\windows\system32\winhelp32.exe
c:\windows\system32\wins\svchost.exe

.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_MSDIRECTX
-------\Legacy_WINDOWS_SMRSS_SERVICE
-------\Service_Windows Smrss Service


(((((((((((((((((((((((((   Files Created from 2008-10-26 to 2008-11-26  )))))))))))))))))))))))))))))))
.

2008-11-26 07:06 . 2008-11-26 07:06   <DIR>   d--------   c:\program files\Lavasoft
2008-11-26 07:05 . 2008-11-26 07:05   <DIR>   d--------   c:\program files\Common Files\Wise Installation Wizard
2008-11-24 14:24 . 2008-10-16 14:09   31,768   --a------   c:\windows\system32\wucltui.dll.mui
2008-11-24 14:24 . 2008-10-16 14:07   23,576   --a------   c:\windows\system32\wuaucpl.cpl.mui
2008-11-24 14:24 . 2008-10-16 14:07   23,576   --a------   c:\windows\system32\wuapi.dll.mui
2008-11-24 14:24 . 2008-10-16 14:07   18,456   --a------   c:\windows\system32\wuaueng.dll.mui
2008-11-24 10:52 . 2008-11-24 11:07   <DIR>   d--------   c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft
2008-11-24 10:43 . 2008-11-24 10:43   <DIR>   d--------   c:\documents and settings\gauss.ZVJER\Application Data\Malwarebytes
2008-11-24 10:43 . 2008-11-24 10:43   <DIR>   d--------   c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
2008-11-24 09:39 . 2008-11-26 13:39   <DIR>   d--------   c:\program files\Spybot - Search & Destroy
2008-11-24 09:39 . 2008-11-26 13:43   <DIR>   d--------   c:\documents and settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2008-11-24 08:50 . 2008-11-24 08:50   <DIR>   d--------   c:\program files\AskSBar
2008-11-24 08:24 . 2008-11-24 08:23   512,096   --a------   c:\windows\system32\drivers\amon.sys
2008-11-24 08:24 . 2008-11-24 08:23   298,104   --a------   c:\windows\system32\imon.dll
2008-11-24 08:24 . 2008-11-24 08:23   15,424   --a------   c:\windows\system32\drivers\nod32drv.sys
2008-11-24 08:24 . 2008-11-24 08:35   223   --a------   c:\windows\system32\windrocket
2008-11-24 08:08 . 2001-08-17 12:11   66,591   --a------   c:\windows\system32\drivers\el90xbc5.sys
2008-11-24 08:08 . 2001-08-17 12:11   66,591   --a--c---   c:\windows\system32\dllcache\el90xbc5.sys
2008-11-05 23:08 . 2008-11-05 23:08   <DIR>   d--------   C:\sv. niko_files
2008-11-05 23:08 . 2008-11-05 23:08   26,120   --a------   C:\sv. niko.htm
2008-11-05 23:05 . 2008-11-05 23:05   <DIR>   d--------   C:\igr._files
2008-11-05 23:05 . 2008-11-05 23:05   21,434   --a------   C:\igr..htm
2008-11-05 23:04 . 2008-11-05 23:04   <DIR>   d--------   C:\igrokaz_files
2008-11-05 23:04 . 2008-11-05 23:04   25,583   --a------   C:\igrokaz.htm

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-24 07:29   ---------   d-----w   c:\program files\ESET
2002-04-30 11:41   266   --sh--w   c:\program files\desktop.ini
2002-04-30 11:41   11,079   ---ha-w   c:\program files\folder.htt
2001-11-23 11:08   712,704   ----a-w   c:\windows\inf\OTHER\audio3d.dll
2001-08-23 10:00   1,388,544   --sh--r   c:\windows\system32\msvbvm60.dll
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\ctfmon.exe" [2001-08-23 13312]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"C-Media Echo Control"="c:\program files\PCI Audio Applications\Bin\EchoCtrl.exe" [2001-12-05 147456]
"WinampAgent"="c:\program files\Winamp\Winampa.exe" [2002-12-30 24576]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-11-17 3022848]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2008-11-24 949376]
"C-Media Mixer"="Mixer.exe" [2001-11-15 c:\windows\mixer.exe]
"EssSpkPhone"="essspk.exe" [2001-05-24 c:\windows\essspk.exe]
"nwiz"="nwiz.exe" [2003-11-17 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2001-08-23 13312]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.DIV3"= DivXc32.dll
"vidc.DIV4"= DivXc32f.dll
"msacm.divxa32"= DivXa32.acm
"vidc.xvid"= xvid.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001

R0 hpt3xx;hpt3xx;c:\windows\System32\DRIVERS\hpt3xx.sys [2006-09-19 38144]
R2 eusk2par;EUTRON SmartKey Parallel Driver;\??\c:\windows\System32\Drivers\eusk2par.sys [2004-01-26 16695]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{39D3835D-F3E6-37C6-0605-070802010607}]
c:\windows\System32\windrocket.exe
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-{0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - c:\program files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
BHO-{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - c:\program files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
HKCU-Run-Wlan Drier - WinUSB2.exe
HKLM-Run-Win Comm - c:\program files\Win Comm\WinComm.exe
HKLM-Run-qpoalombpbail - c:\windows\System32\ookpzbvo.exe
HKLM-Run-mlcn - c:\windows\mlcn.exe
HKLM-Run-kssiy - c:\windows\system32\kssiy.exe
HKLM-Run-Malwarebytes Anti-Malware (reboot) - c:\program files\Malwarebytes' Anti-Malware\mbam.exe
HKLM-Run-Wlan Drier - WinUSB2.exe
HKLM-Run-Windows Nets - WinNET.exe
HKLM-RunServices-service - dndrxut.exe
HKLM-RunServices-Wlan Drier - WinUSB2.exe
HKLM-RunServices-Windows Nets - WinNET.exe
HKU-Default-Run-Network Security XP - c:\windows\System32\nvsvc86.exe
HKU-Default-Run-MSN Messanger - msnmsng.exe
HKU-Default-Run-Wlan Drier - WinUSB2.exe
HKU-Default-RunOnce-Wlan Drier - WinUSB2.exe
HKU-Default-RunServices-MSN Messanger - msnmsng.exe


.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\gauss.ZVJER\Application Data\Mozilla\Firefox\Profiles\6anv9b35.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - www.google.hr
FF -: plugin - c:\program files\Adobe\Acrobat 5.0\Acrobat\browser\nppdf32.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\NPAskSBr.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-26 13:59:40
Windows 5.1.2600  NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(532)
c:\windows\system32\ODBC32.dll

- - - - - - - > 'lsass.exe'(588)
c:\windows\System32\imon.dll
c:\windows\System32\dssenh.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\ESET\nod32krn.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\HPZipm12.exe
c:\windows\system32\wdfmgr.exe
.
**************************************************************************
.
Completion time: 2008-11-26 14:04:34 - machine was rebooted
ComboFix-quarantined-files.txt  2008-11-26 13:04:30

Pre-Run: 11.586.123.776 bytes free
Post-Run: 11,782,534,656 bytes free

151

@goga69  kakva je sada situacija, molim te postavi novi HJT log

Situacija mi se čini mnogo bolja. Pri startanju kompjutea ne pale se više stvari koje su se prije palile. Evo novi log file:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:59:39, on 27.11.2008
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\PCI Audio Applications\Bin\EchoCtrl.exe
C:\WINDOWS\Mixer.exe
C:\WINDOWS\essspk.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\gauss.ZVJER\Desktop\TP2\TP2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.hotinfolink.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [C-Media Echo Control] "C:\Program Files\PCI Audio Applications\Bin\EchoCtrl.exe"
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [EssSpkPhone] essspk.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [LiveUpdate] "C:\Program Files\Samsung\Samsung PC Studio 3\\Update\Copyer.exe" -R
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

--
End of file - 4404 bytes

Log je ok, uradi jos sledece
Start\run\ kucaj Combofix /u  pa ok i sacekaj da se deinstalacija zavrsi
Ovo ce da  resetuje system restore i sat i da deinstalira CF.

Pozdrav.

ps:
Ukljuci AV i Tea Timer
Ova win platforma ti je losa za izlaz na net.

OK, hvala na pomoći