Nelze spustit žádný antivir

[Caroprd111]

Znáte složku c:\program files\e

[Bugsy2]

ne, vypadá to jak skladiště programů, ale všechno je to zip cca 1 - 1,5Mb. Každopádně jsem nic takového nestvořil.

[Caroprd111]

Tak ji smažte a napište, jak se chová PC.

[Bugsy2]

Adresář nejde smazat - Hlási mi to, že tyto soubory nebyly nalezeny:
Všechny ostatní soubory jsou smazány. PC se celkově zrychlylo a tváří se stabilně. Začali fungovat i aktualizace od Microsoftu. AVAST je zatím stále vypnutý, Spyboot ani Spyware jsem nezkoušel. Nouzový režim také ne.

[Caroprd111]

Ještě jednou aplikujte ComboFix s následujícím skriptem.

Kód: Vybrat vše

Folder::
c:\program files\e

Spybota odinstalujte a zkuste zapnout Avast.

[Bugsy2]

Avast jsem musel znova nainstalovat. Původní hlásil stále, že není platnou aplikací. Nová instalace už běží bez problémů.

Tady je poslední log.txt z Combofixu:

ComboFix 10-09-06.04 - Libor 07.09.2010 16:23:27.3.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3327.2618 [GMT 2:00]
Spuštěný z: c:\documents and settings\Libor\Plocha\cokoliv.com
Použité ovládací přepínače :: c:\docume~1\Libor\Plocha\CFScript.txt
AV: avast! antivirus 4.8.1368 [VPS 100613-2] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\e
c:\program files\e\3D Galaxy
c:\program files\e\404
c:\program files\e\A.M.L. - Full Edition
c:\program files\e\A.M.L. - Lite Edition
c:\program files\e\A.M.L. - Source Code
c:\program files\e\Perfect Day
c:\program files\e\Pompolic
c:\program files\e\xero

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-08-07 do 2010-09-07 )))))))))))))))))))))))))))))))
.

2010-09-07 06:24 . 2010-09-07 06:49 -------- d-----w- C:\cokoliv
2010-09-06 07:31 . 2010-06-14 14:31 744448 -c----w- c:\windows\system32\dllcache\helpsvc.exe
2010-09-06 07:31 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
2010-09-03 12:14 . 2010-09-03 12:14 -------- d-----w- C:\_OTL
2010-09-02 14:08 . 2010-09-02 14:08 -------- d-----w- c:\program files\trend micro
2010-09-02 14:08 . 2010-09-02 14:08 -------- d-----w- C:\rsit
2010-09-02 12:53 . 2010-09-02 12:53 -------- d-----w- C:\46c1a25689023fa07eea470afddf51
2010-09-02 11:24 . 2006-03-02 12:00 18944 -c--a-w- c:\windows\system32\dllcache\simptcp.dll
2010-09-02 11:24 . 2006-03-02 12:00 18944 ----a-w- c:\windows\system32\simptcp.dll
2010-09-02 10:22 . 2010-09-07 14:22 -------- d-----w- c:\windows\system32\CatRoot2

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-07 13:41 . 2008-04-14 06:50 -------- d-----w- c:\program files\Microsoft Silverlight
2010-09-07 06:37 . 2010-09-07 06:37 0 --sh--w- c:\windows\S16442130.tmp
2010-09-07 06:20 . 2008-09-01 12:22 -------- d-----w- c:\program files\Common Files\Java
2010-09-07 06:20 . 2008-09-01 12:22 -------- d-----w- c:\program files\Java
2010-09-02 13:16 . 2005-06-21 15:16 542280 ----a-w- c:\windows\system32\perfh005.dat
2010-09-02 13:16 . 2005-06-21 15:16 121342 ----a-w- c:\windows\system32\perfc005.dat
2010-09-02 11:28 . 2009-11-11 18:06 -------- d-----w- c:\program files\Windows Desktop Search
2010-09-02 11:16 . 2010-04-15 11:03 -------- d-----w- c:\program files\Common Files\DVDVideoSoft
2010-09-02 11:14 . 2005-12-25 10:20 -------- d-----w- c:\program files\AviSynth 2.5
2010-08-18 11:31 . 2006-06-26 11:30 -------- d-----w- c:\program files\Cherrysoft
2010-08-18 11:27 . 2005-12-25 10:19 -------- d-----w- c:\program files\Gabest
2010-08-18 11:26 . 2006-02-26 13:57 -------- d-----w- c:\program files\Yahoo!
2010-08-18 11:18 . 2007-01-17 11:06 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-08-18 11:15 . 2005-06-21 13:45 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-08-18 11:09 . 2007-08-13 14:13 -------- d-----w- c:\program files\ICQToolbar
2010-08-18 11:06 . 2006-09-26 11:04 -------- d-----w- c:\program files\Hewlett-Packard
2010-08-18 11:04 . 2006-04-13 14:52 -------- d-----w- c:\program files\Microsoft ActiveSync
2010-08-16 06:41 . 2008-09-01 12:44 -------- d-----w- c:\program files\Opera
2010-07-20 08:28 . 2010-05-18 07:11 -------- d-----w- c:\program files\FormStudio
2010-07-17 03:00 . 2010-05-25 06:24 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-06-30 12:33 . 2005-06-21 15:16 149504 ----a-w- c:\windows\system32\schannel.dll
2010-06-24 12:27 . 2005-06-21 15:16 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-24 09:02 . 2005-06-21 15:16 1851904 ----a-w- c:\windows\system32\win32k.sys
2010-06-21 15:27 . 2005-06-21 15:16 354304 ----a-w- c:\windows\system32\drivers\srv.sys
2010-06-17 14:03 . 2005-06-21 15:15 80384 ----a-w- c:\windows\system32\iccvid.dll
2010-06-14 14:31 . 2005-06-21 13:28 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-14 07:43 . 2005-06-21 15:15 1172480 ----a-w- c:\windows\system32\msxml3.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DBISQL9"="c:\program files\Sybase\SQL Anywhere 9\win32\dbisqlg.exe" [2006-01-11 135168]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-11-11 1451520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ASUS Probe"="c:\program files\ASUS\Probe\AsusProb.exe" [2002-12-06 617984]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\point32.exe" [2004-06-02 204800]
"type32"="c:\program files\Microsoft IntelliType Pro\type32.exe" [2004-06-02 172032]
"CloneCDTray"="c:\program files\SlySoft\CloneCD\CloneCDTray.exe" [2004-09-02 57344]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2010-09-06 866584]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2006-10-22 620152]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-04-01 5562368]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-000000000003}\_SC_Acrobat.exe [2008-4-21 295606]
Adobe Acrobat Synchronizer.lnk - c:\program files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe [2006-10-23 734872]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-12-6 576104]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\RACServerLogon]
2009-02-22 07:56 62736 ----a-w- c:\windows\system32\RACServerLogon2.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Action Manager 32.lnk]
backup=c:\windows\pss\Action Manager 32.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
2006-11-10 15:19 1051648 ----a-w- c:\program files\Nero\Nero 7\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\REGSHAVE]
2002-02-04 20:32 53248 ------w- c:\program files\REGSHAVE\REGSHAVE.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"InCDsrv"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\Adobe\\GoLive CS_ENG\\GoLive.exe"=
"c:\\Program Files\\Sybase\\SQL Anywhere 9\\win32\\dbeng9.exe"=
"c:\\Program Files\\Sybase\\SQL Anywhere 9\\win32\\dbisqlg.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
"c:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"=
"c:\\Program Files\\Nero\\Nero 7\\Nero ShowTime\\ShowTime.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"d:\\Strong DC++ 2.22\\StrongDC.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\abf3\\FTP.EXE"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\frd.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server
"50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server
"50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"8605:TCP"= 8605:TCP:Remote Administrator Control Server, TCP port 8605
"3499:TCP"= 3499:TCP:strong
"8600:TCP"= 8600:TCP:Remote Administrator Control Server, TCP port 8600

R2 Iprip;Naslouchání RIP;c:\windows\System32\svchost.exe -k netsvcs [21.6.2005 17:16 14336]
R2 MSSQL$SPZSQL2006;MSSQL$SPZSQL2006;c:\program files\Microsoft SQL Server\MSSQL$SPZSQL2006\Binn\sqlservr.exe -sSPZSQL2006 --> c:\program files\Microsoft SQL Server\MSSQL$SPZSQL2006\Binn\sqlservr.exe -sSPZSQL2006 [?]
R2 PCNetSoftware RAC Server;PCNetSoftware RAC Server;c:\program files\PCNetSoftware\RAC Server\RACs.exe [18.3.2009 14:55 3814720]
R2 RACDriver;RAC driver;c:\program files\PCNetSoftware\RAC Server\RACDriver.sys [18.3.2009 14:55 8208]
R2 SCPDFReadSpool;SolidConverterPDFReadSpool;c:\windows\Installer\MSID9.tmp [13.5.2010 9:27 189760]
R3 cmudax;C-Media High Definition Audio Interface;c:\windows\system32\drivers\cmudax.sys [22.6.2005 9:57 1275584]
R3 racmirror;racmirror;c:\windows\system32\drivers\racmirror.sys [18.3.2009 14:55 32784]
S1 aswSP;avast! Self Protection; [x]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [19.2.2010 9:52 135664]
S3 SliceDisk5;SliceDisk5;\??\c:\docume~1\Libor\LOCALS~1\Temp\FindAndMount\slicedisk.sys --> c:\docume~1\Libor\LOCALS~1\Temp\FindAndMount\slicedisk.sys [?]
S3 SQLAgent$SPZSQL2006;SQLAgent$SPZSQL2006;c:\program files\Microsoft SQL Server\MSSQL$SPZSQL2006\Binn\sqlagent.EXE -i SPZSQL2006 --> c:\program files\Microsoft SQL Server\MSSQL$SPZSQL2006\Binn\sqlagent.EXE -i SPZSQL2006 [?]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [6.8.2008 11:33 716272]
S4 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [3.11.2006 20:19 13592]
.
Obsah adresáře 'Naplánované úlohy'

2010-09-07 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2010-01-08 11:03]

2010-09-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-19 07:52]

2010-09-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-19 07:52]

2010-09-07 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]

2010-09-07 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 13:07]

2010-09-07 c:\windows\Tasks\User_Feed_Synchronization-{19855D51-09FF-4CC1-815C-34C0775FB6A5}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uInternet Settings,ProxyOverride = *.local
IE: &ICQ Toolbar Search - c:\program files\ICQToolbar\toolbaru.dll/SEARCH.HTML
IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: WikiKomentáře Google... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
TCP: {B10BA91D-FEC2-4B2E-A910-9BEC10461BD2} = 212.47.0.4,212.47.1.4
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-07 16:31
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SCPDFReadSpool]
"ImagePath"="c:\windows\Installer\MSID9.tmp"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-3315528086-514123159-2874609403-1004\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(868)
c:\windows\system32\RACServerLogon2.dll
.
Celkový čas: 2010-09-07 16:34:17
ComboFix-quarantined-files.txt 2010-09-07 14:34
ComboFix2.txt 2010-09-07 06:49
ComboFix3.txt 2010-09-06 07:26

Před spuštěním: Volných bajtů: 15 482 757 120
Po spuštění: Volných bajtů: 15 467 159 552

- - End Of File - - 964400DB03F123C341B7F7D9AD382515

[Bugsy2]

Ještě by mně zajímalo co je zač adresář C:\Program Files\Bonjoure\

[Caroprd111]

http://en.wikipedia.org/wiki/Bonjour_(software)


Odinstalujte všechny emulátory virtuálních mechanik.

Stáhněte SPTD http://www.duplexsecure.com/en/downloads

• Vyberte verzi podle svého operačního systému (64 & 32b). Uložte na plochu a spusťte.
• zvolte možnost Uninstall a restartujte PC.

Stáhněte a spusťte http://www.jpshortstuff.247fixes.com/Defogger.exe

• Klikněte na "Disable" a restartujte PC.

Stáhněte MBR na plochu http://www2.gmer.net/mbr/mbr.exe

Start > Spustit (Win + R)

• Vyskočí okénko, zkopírujte do něj:

Kód: Vybrat vše

"%userprofile%\plocha\mbr" -t

• Klikněte na OK

• Vytvoří se log s názvem mbr.log, vložte ho sem.

Dejte log z Gmer http://www.viry.cz/forum/viewtopic.php?f=29&t=62878

[Bugsy2]

Alcohol 12% nejde odinstalovat- hlásí: Setup is unable to validate instalation

SPTD hlásí No SPTD version wos detected

Defoger:

defogger_disable.log

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 18:11 on 07/09/2010 (Libor)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...
SPTD -> Already disabled


-=E.O.F=-

MBR:

mbr.log

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS
kernel: MBR read successfully
user & kernel MBR OK

[Caroprd111]

Ok, ještě Gmer.

[Bugsy2]

gmer1.log

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit quick scan 2010-09-07 18:19:07
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\Libor\LOCALS~1\Temp\pgtdapob.sys


---- System - GMER 1.0.15 ----

Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateProcessEx [0xB6F39B9C]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateSection [0xB6F399C0]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwLoadDriver [0xB6F39AFA]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) NtCreateSection
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ObInsertObject
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ObMakeTemporaryObject

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs aswSP.SYS (avast! self protection module/ALWIL Software)

AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

---- EOF - GMER 1.0.15 ----

[Caroprd111]

Ještě druhý log.

[Bugsy2]

Ještě si pořád chrochtá

[Caroprd111]

Gmer někdy trvá i 4 hodiny.

[Bugsy2]

Pořád chrochtá . Nechám ho běžet a jdu domů. Pokračování zítra