To nie winchost.exe, tylko svchost.exe, ale nie ma związku z procesem systemowym.
Wykonaj skrypt w OTL:
:OTL
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.)
O4:64bit: - HKLM..\Run: [CIS_{81EFDD93-DBBE-415B-BE6E-49B9664E3E82}] "C:\ProgramData\cis5328.exe" --PostUninstall {81EFDD93-DBBE-415B-BE6E-49B9664E3E82} File not found
O4:64bit: - HKLM..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdc.exe File not found
O4 - HKLM..\Run: [Max_Delete] C:\WINDOWS\max_delete.exe ()
O4 - HKCU..\Run: [AdobeUpdate] C:\Users\arentek\AppData\Roaming\AdobeX2\invis.vbs ()
[2013-12-08 14:42:52 | 000,000,000 | ---D | C] -- C:\AdwCleaner
[2013-12-07 23:29:21 | 000,000,000 | ---D | C] -- C:\Users\arentek\AppData\Roaming\AdobeX2
[2013-12-08 00:34:17 | 000,176,640 | ---- | C] () -- C:\WINDOWS\Max_delete.exe
@Alternate Data Stream - 40 bytes -> C:\ProgramData\MTA San Andreas All:NT
@Alternate Data Stream - 40 bytes -> C:\ProgramData:NT
:Files
C:\Windows\Temp\svchost.exe
:Commands
[emptytemp]