VIRY.CZ

.text C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe[1832] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe[1832] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program ...

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-03-16 23:21:45
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\Tuaoid\LOCALS~1\Temp\kwkirkoc.sys


---- System - GMER 1.0.15 ----

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL ...

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit quick scan 2010-03-16 20:44:23
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\Tuaoid\LOCALS~1\Temp\kwkirkoc.sys


---- System - GMER 1.0.15 ----

SSDT spla.sys ZwEnumerateKey [0xB9ECDDA4]
SSDT spla.sys ZwEnumerateValueKey ...

lišta šlape akorát se vyskytl jiný nesmysl a to, že chrome který je hlavní prohlížeč hlásí chybu: s pamětí nelze provést operaci: written a mozilla se nerozběhne vůbec. pouze iexplorer se snaží ale bere si 60% CPU...

díky. zkusím restart

http://www.virustotal.com/cs/analisis/1 ... 1268754739
http://www.virustotal.com/cs/analisis/0 ... 1268754894

2010-03-05 17:44:37 ----HD---- C:\Program Files\Zero G Registry
2010-03-05 17:43:57 ----D---- C:\Program Files\112dB Redline Reverb
2010-03-05 17:43:27 ----D---- C:\Program Files\112dB Redline Monitor
2010-03-05 17:43:27 ----D---- C:\Program Files\112dB
2010-03-05 17:40:48 ----D---- C:\Program Files ...

Logfile of random's system information tool 1.06 (written by random/random)
Run by Tuaoid at 2010-03-16 16:12:59
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 104 GB (43%) free of 238 GB
Total RAM: 3582 MB (81% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved ...

All processes killed
========== FILES ==========
File/Folder C:\Program Files\VstPlugins\Vanguard\Presets\Soundbanks.Vanguard.Vsti.dxi.1001.Presets.H2O.rar not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary ...

Object "CoreGuardAntivirus2009 Corrupted Adware/Spyware" found in File System! Action Taken: No Action Taken.
Object "Spyware.NetScreenWatch Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "Backdoor (IRCBot) Trojans Spyware/Adware" found in File System! Action Taken: No ...

bohužel beze změny

+ 2010-03-09 16:46 . 2010-03-09 16:46 380928 c:\windows\assembly\NativeImages_v2.0.50727_32\WsatConfig\13f498f606b7cb97c086eea149b8c872\WsatConfig.ni.exe
+ 2010-03-09 16:48 . 2010-03-09 16:48 270336 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\b7c202147607f93463ead99e743c78b9 ...

+ 2007-10-11 08:55 . 2007-10-11 08:55 2560 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelEvents.dll
+ 2007-10-24 00:47 . 2007-10-24 00:47 7168 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft_VsaVb.dll
- 2005-09-23 06:28 . 2005-09-23 06:28 7168 c ...

ComboFix 10-03-08.02 - Tuaoid 09.03.2010 18:56:31.2.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3582.3060 [GMT 1:00]
Spuštěný z: c:\documents and settings\Tuaoid\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Tuaoid\Plocha\CFScript.txt
AV ...

zdravím..přikládám linky

http://www.virustotal.com/cs/analisis/24d602b7ddf7718a1f149d35b24c2345d0dde6e8b8a7fdf35062c24a6d13226d-1268136637
http://www.virustotal.com/cs/analisis/f241f37d423dd5c192b22ca1d4655dbf9e9b861487a6ac0f958b190e975934dc-1268136699
http://www.virustotal.com/cs/analisis ...