sajnálom, de megint csak lenne gondom...
tényleg nem várok csodákat, tudom, hogy ez a gép lassan egy idős a világgal, de csak netezésre használom, nem játszom vele, de ha mondjuk elindítom az MSN Messengert, akkor eléggé gyakran beszaggat, a parancsokat is lassan hajtaná végre. Megy a gép, dolgozik, de percekbe telik, mire végrehajt mondjuk egy egyszerű ctrl-alt-del parancsot. Normális, hogy ilyen lassú? Lassan 6 éves, a legutóbbi formázás és legalább 2 éve lehetett, de azon gondolkodom, lehet megint nem ártana leformázni... kérdés, hogy hasonló lesz-e a helyzet, mert talán nem is a vírusokkal lehet a gond (elvégre azokat kiírtottuk), hanem tényleg csak egyszerűen régi.

A legjobb,semijet,mert osze visza futatni mindenfele viruskereso progamokat nemerdemes,mindegyik hagy valamit a rendszerben es aztan lelasul,sott van egy csomo hamis program amivel megfertozod a gepet,,a legjobb ha problemad lesz es en meg itt leszek akor leirni a problemat,,es beteni a RSIT logjat,,mert evell is ugy van hogy minden betegsegre mas orvosag kell,,
udv
es nincsen mitt koszonod,

rendben, megcsináltam, minden rendben ment, nincs semmi gond.
Nagyon nagy köszönet!
Még csak annyit, hogy a jövőben mely programokat futtassam le, milyen beállításokkal és milyen gyakran, ha takarítani akarom a gépet?

ok,futasd a otmoveitot-klik-cleanup-yes-yes,,,ha mar nincsen gond a gepel enyi az egesz,,,meg csinalhatsz torezedes mentest ,mert az otmoveitel majd egy gigat kitoroltunk,

Meg is van!




All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
C:\FOUND.040 moved successfully.
C:\FOUND.039 moved successfully.
C:\FOUND.038 moved successfully.
C:\WINDOWS\WIWSW.txt moved successfully.
C:\Program Files\Common Files\Symantec Shared\LiveReg moved successfully.
C:\Program Files\Common Files\Symantec Shared moved successfully.
File/Folder C:\WINDOWS\system32\*.tmp.dll not found.
C:\WINDOWS\system32\SETB.tmp moved successfully.
C:\WINDOWS\system32\SET95E.tmp moved successfully.
C:\WINDOWS\system32\SET973.tmp moved successfully.
C:\WINDOWS\system32\SET2B.tmp moved successfully.
C:\WINDOWS\system32\SET2E.tmp moved successfully.
C:\WINDOWS\system32\SET957.tmp moved successfully.
C:\WINDOWS\system32\SET3D.tmp moved successfully.
C:\WINDOWS\system32\SET959.tmp moved successfully.
C:\WINDOWS\system32\SET965.tmp moved successfully.
C:\WINDOWS\system32\SET96E.tmp moved successfully.
C:\WINDOWS\system32\SET970.tmp moved successfully.
C:\WINDOWS\system32\SET92.tmp moved successfully.
C:\WINDOWS\system32\SET5F.tmp moved successfully.
C:\WINDOWS\SET3.tmp moved successfully.
C:\WINDOWS\SETA.tmp moved successfully.
C:\WINDOWS\msdownld.tmp moved successfully.
C:\WINDOWS\002200_.tmp moved successfully.
C:\WINDOWS\DUMP9159.tmp moved successfully.
C:\WINDOWS\DUMP51b9.tmp moved successfully.
C:\WINDOWS\inf\HFX9B.tmp moved successfully.
C:\WINDOWS\Installer\MSI2.tmp moved successfully.
C:\WINDOWS\Installer\MSIA.tmp moved successfully.
C:\WINDOWS\Installer\MSI64.tmp moved successfully.
C:\WINDOWS\Installer\MSI6B.tmp moved successfully.
C:\WINDOWS\Installer\MSI3C.tmp moved successfully.
C:\WINDOWS\Installer\MSI8B.tmp moved successfully.
C:\WINDOWS\Installer\MSI61.tmp moved successfully.
C:\WINDOWS\Installer\MSI6A.tmp moved successfully.
C:\WINDOWS\Installer\MSI94.tmp moved successfully.
C:\WINDOWS\Installer\MSI44.tmp moved successfully.
C:\WINDOWS\Installer\MSI2D1.tmp moved successfully.
C:\WINDOWS\system32\OLDE.tmp moved successfully.
C:\WINDOWS\system32\CONFIG.TMP moved successfully.
C:\WINDOWS\system32\OLD7.tmp moved successfully.
C:\WINDOWS\system32\OLDA.tmp moved successfully.
C:\WINDOWS\system32\OLD3E.tmp moved successfully.
C:\WINDOWS\system32\OLD38.tmp moved successfully.
C:\WINDOWS\system32\OLD3B.tmp moved successfully.
C:\WINDOWS\temp\HTTB67.tmp moved successfully.
C:\WINDOWS\temp\HTTB69.tmp moved successfully.
========== SERVICES/DRIVERS ==========

Service\Driver rkhdrv40 deleted successfully.

Service\Driver SymWSC deleted successfully.
========== REGISTRY ==========
Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{694b1850-a629-11da-8cf6-000b6a1f918f}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{694b1850-a629-11da-8cf6-000b6a1f918f}\ not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: All Users

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 32902 bytes

User: demo
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 702479 bytes
->Java cache emptied: 24012292 bytes
->FireFox cache emptied: 51505754 bytes

User: Gabi
->Temp folder emptied: 553386912 bytes
->Temporary Internet Files folder emptied: 434890 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 60613558 bytes

User: Julcsi
->Temp folder emptied: 35681649 bytes
->Temporary Internet Files folder emptied: 116085 bytes
->Java cache emptied: 388871 bytes
->FireFox cache emptied: 45164083 bytes

User: Anya
->Temp folder emptied: 627167 bytes
->Temporary Internet Files folder emptied: 32969 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 77405244 bytes

User: Máté
->Temp folder emptied: 50350205 bytes
->Temporary Internet Files folder emptied: 4919204 bytes
->Java cache emptied: 3801458 bytes
->FireFox cache emptied: 110149637 bytes

User: Rendszergazda
->Temp folder emptied: 13242980 bytes
->Temporary Internet Files folder emptied: 2016916 bytes

User: M�

User: MßtÚ
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 32768 bytes
RecycleBin emptied: 1189461 bytes

Total Files Cleaned = 987,85 mb


OTM by OldTimer - Version 3.0.0.5 log created on 06302009_200519

Files moved on Reboot...

Registry entries deleted on Reboot...

tolds le az otmoveit programot-ted az asztalra-a ballablakba masold be a piros textet-es klik-Moveit-a restart utan a logot ted ide
http://oldtimer.geekstogo.com/OTM.exe

rendben van, valószínűleg valamit rosszul csinálhattam előzőleg, most gond nélkül leadta a logot.
Köszönöm az eddigieket is, eddig nincs gond vele, de majd látjuk még...

Logfile of random's system information tool 1.06 (written by random/random)
Run by Gabi at 2009-06-30 17:38:16
Microsoft Windows XP Professional Szervizcsomag 2
System drive C: has 2 GB (12%) free of 16 GB
Total RAM: 255 MB (21% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:39:19, on 2009.06.30.
Platform: Windows XP Szervizcsomag 2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
I:\ad-aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
G:\Nod\ekrn.exe
G:\EgyeniGyakorlo\Interbase\bin\ibserver.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\htpatch.exe
C:\Program Files\ATI Technologies\ATI vezérlőpult\atiptaxx.exe
C:\WINDOWS\vsnpstd2.exe
G:\Nod\egui.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
H:\Programok\DAEMON Tools Lite\daemon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Gabi\Asztal\RSIT.exe
C:\Program Files\trend micro\Gabi.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hivatkozások
R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - H:\BitComet\tools\BitCometBHO_1.3.3.2.dll
O2 - BHO: Windows Live bejelentkezési segítség - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [SNPSTD2] C:\WINDOWS\vsnpstd2.exe
O4 - HKLM\..\Run: [egui] "G:\Nod\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Biolka] "H:\Biolka.exe autostart"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "H:\Programok\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader gyorsindító.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &A&z összes videó letöltése BitComettel - res://H:\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &L&etöltés &BitComettel - res://H:\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &M&inden letöltése BitComettel - res://H:\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xportálás Microsoft Excel formátumba - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: Küldés blogba - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Küldés blogba a Windows Live Writer programmal - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\TV\EXPLBAR.DLL
O9 - Extra button: Kutatás - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://H:\BitComet\tools\BitCometBHO_1.3.3.2.dll/206 (file missing)
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - H:\Programok\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - H:\Programok\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://map2.index.hu/MGViewer/ActiveX/mgaxctrl.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/Mi ... b56986.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - I:\ad-aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - G:\Nod\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - G:\Nod\ekrn.exe
O23 - Service: InterBase Server (InterBaseServer) - Inprise Corporation - G:\EgyeniGyakorlo\Interbase\bin\ibserver.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - Unknown owner - D:\Máté\x86\RaMaint.exe (file missing)
O23 - Service: LogMeIn - Unknown owner - D:\Máté\x86\LogMeIn.exe (file missing)
O23 - Service: SymWMI Service (SymWSC) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe (file missing)
O24 - Desktop Component 0: (no name) - http://www.sarok.org/pics/szilveszter.jpg
O24 - Desktop Component 2: (no name) - http://www.berlin.de/imperia/bde/wm-countdown.php

--
End of file - 6663 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2005-09-24 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}]
BitComet Helper - H:\BitComet\tools\BitCometBHO_1.3.3.2.dll [2009-03-02 636216]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live bejelentkezési segítség - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2007-09-20 328752]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-06-30 41368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-06-30 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"HTpatch"=C:\WINDOWS\htpatch.exe [2002-10-30 28672]
"SiSUSBRG"=C:\WINDOWS\SiSUSBrg.exe [2002-07-12 106496]
"ATIPTA"=C:\Program Files\ATI Technologies\ATI vezérlőpult\atiptaxx.exe [2002-05-17 286720]
"SNPSTD2"=C:\WINDOWS\vsnpstd2.exe [2004-06-10 286720]
"egui"=G:\Nod\egui.exe [2008-08-18 1447168]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-06-30 148888]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2004-10-13 1694208]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-17 15360]
"Biolka"=H:\Biolka.exe [2009-04-09 1690112]
"DAEMON Tools Lite"=H:\Programok\DAEMON Tools Lite\daemon.exe [2008-08-08 490952]

C:\Documents and Settings\All Users\Start Menu\Programs\Indítópult
Adobe Reader gyorsindító.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\LMIinit]
C:\WINDOWS\system32\LMIinit.dll [2008-10-16 87352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2007-03-15 183808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDrives"=0
"NoDriveAutoRun"=67108863

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\WINDOWS\System32\dpvsetup.exe"="C:\WINDOWS\System32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"H:\StubInstaller.exe"="H:\StubInstaller.exe:*:Enabled:LimeWire swarmed installer"
"F:\utorrent-1.4.2-beta-build-432.exe"="F:\utorrent-1.4.2-beta-build-432.exe:*:Enabled:utorrent-1.4.2-beta-build-432"
"E:\bin\NPLocal.exe"="E:\bin\NPLocal.exe:*:Enabled:NXT Personal Edition HTTP Server"
"H:\utorrent-1.6.exe"="H:\utorrent-1.6.exe:*:Enabled:µTorrent"
"G:\LETÖLTÉS\DC\StrongDC.exe"="G:\LETÖLTÉS\DC\StrongDC.exe:*:Enabled:StrongDC++"
"H:\Programok\ICQ6\ICQ.exe"="H:\Programok\ICQ6\ICQ.exe:*:Enabled:ICQ6"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype. Take a deep breath "
"I:\Top Secret-Katonai hírszerzés\BIN\Game\Battlegrounds.exe"="I:\Top Secret-Katonai hírszerzés\BIN\Game\Battlegrounds.exe:*:Enabled:Star Wars Galactic Battlegrounds"
"F:\Jedi Outcast\GameData\jk2mp.exe"="F:\Jedi Outcast\GameData\jk2mp.exe:*:Enabled:jk2mp"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"D:\Máté\2008.11.24\limewire\LimeWire.exe"="D:\Máté\2008.11.24\limewire\LimeWire.exe:*:Enabled:LimeWire"
"E:\Máté metin2\metin2.bin"="E:\Máté metin2\metin2.bin:*:Enabled:metin2"
"H:\BitComet\BitComet.exe"="H:\BitComet\BitComet.exe:*:Enabled:BitComet.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{694b1850-a629-11da-8cf6-000b6a1f918f}]
shell\AutoRun\command - M:\setup\rsrc\Autorun.exe
shell\dinstall\command - M:\Directx\dxsetup.exe


======File associations======

.js - open -

======List of files/folders created in the last 1 months======

2009-06-30 14:53:10 ----D---- C:\Documents and Settings\Gabi\Application Data\Malwarebytes
2009-06-30 14:52:37 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-06-30 14:52:34 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-06-30 14:35:43 ----D---- C:\rsit
2009-06-30 14:23:59 ----A---- C:\WINDOWS\system32\javaws.exe
2009-06-30 14:23:59 ----A---- C:\WINDOWS\system32\javaw.exe
2009-06-30 14:23:59 ----A---- C:\WINDOWS\system32\deploytk.dll
2009-06-30 14:23:58 ----A---- C:\WINDOWS\system32\java.exe
2009-06-29 08:32:51 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-06-29 08:12:04 ----D---- C:\WINDOWS\CSC
2009-06-29 08:11:48 ----SHD---- C:\FOUND.040
2009-06-23 20:59:52 ----SHD---- C:\FOUND.039
2009-06-02 23:04:36 ----SHD---- C:\FOUND.038

======List of files/folders modified in the last 1 months======

2009-06-30 14:35:14 ----A---- C:\WINDOWS\WINCMD.INI
2009-06-29 08:17:48 ----A---- C:\WINDOWS\WIWSW.txt
2009-06-23 21:04:04 ----A---- C:\WINDOWS\NeroDigital.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdK7;AMD K7 processzor-illesztőprogram; C:\WINDOWS\System32\DRIVERS\amdk7.sys [2004-08-17 41600]
R1 easdrv;easdrv; C:\WINDOWS\system32\DRIVERS\easdrv.sys [2008-08-18 53256]
R1 epfwtdi;epfwtdi; C:\WINDOWS\system32\DRIVERS\epfwtdi.sys [2008-08-18 54280]
R2 eamon;EAMON; C:\WINDOWS\system32\DRIVERS\eamon.sys [2008-08-18 39944]
R2 epfw;epfw; C:\WINDOWS\system32\DRIVERS\epfw.sys [2008-08-18 71688]
R2 irda;IrDA protokoll; C:\WINDOWS\System32\DRIVERS\irda.sys [2004-08-03 87424]
R2 LMIRfsDriver;LogMeIn Remote File System Driver; \??\C:\WINDOWS\system32\drivers\LMIRfsDriver.sys []
R3 ati2mtag;ati2mtag; C:\WINDOWS\System32\DRIVERS\ati2mtag.sys [2002-06-21 472576]
R3 cmuda;C-Media WDM Audio Interface; C:\WINDOWS\system32\drivers\cmuda.sys [2002-11-01 451599]
R3 Epfwndis;Eset Personal Firewall; C:\WINDOWS\system32\DRIVERS\Epfwndis.sys [2008-08-18 30728]
R3 irsir;Microsoft soros infravörös illesztőprogram; C:\WINDOWS\System32\DRIVERS\irsir.sys [2001-08-17 18688]
R3 lmimirr;lmimirr; C:\WINDOWS\system32\DRIVERS\lmimirr.sys [2008-07-24 10144]
R3 ms_mpu401;Microsoft MPU-401 MIDI UART illesztőprogram; C:\WINDOWS\system32\drivers\msmpu401.sys [2001-08-17 2944]
R3 Rasirda;WAN miniport (IrDA); C:\WINDOWS\System32\DRIVERS\rasirda.sys [2001-08-17 19584]
R3 SISNIC;SiS PCI Fast Ethernet Adapter Driver; C:\WINDOWS\System32\DRIVERS\sisnic.sys [2002-07-10 32256]
R3 usbehci;Microsoft USB 2.0 bővített állomásvezérlő miniport illesztőprogramja; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2004-08-03 26624]
R3 usbhub;USB2-engedélyezett hub; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbohci;Microsoft USB nyílt állomásvezérlő miniport illesztőprogramja; C:\WINDOWS\System32\DRIVERS\usbohci.sys [2004-08-03 17024]
S2 LMIInfo;LogMeIn Kernel Information Provider; \??\D:\Máté\x86\RaInfo.sys []
S2 TinaKey;TinaKey; C:\WINDOWS\system32\drivers\TinaKey.sys []
S3 Ad-Watch Connect Filter;Ad-Watch Connect Kernel Filter; \??\C:\WINDOWS\system32\drivers\NSDriver.sys []
S3 aizqgmyh;aizqgmyh; C:\WINDOWS\system32\drivers\aizqgmyh.sys []
S3 catchme;catchme; \??\C:\DOCUME~1\Gabi\LOCALS~1\Temp\catchme.sys []
S3 CCDECODE;Feliratdekódoló; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024]
S3 dtscsi;dtscsi; C:\WINDOWS\System32\Drivers\dtscsi.sys []
S3 ENTECH;ENTECH; \??\C:\WINDOWS\system32\DRIVERS\ENTECH.SYS []
S3 MSTEE;Microsoft Streaming Tee/Sink - Sink átalakító; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;NABTS/FEC VBI kodek; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]
S3 NdisIP;Microsoft TV-/videokapcsolat; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880]
S3 rkhdrv40;Rootkit Unhooker Driver; C:\WINDOWS\system32\drivers\rkhdrv40.sys []
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136]
S3 snpstd2;VideoCAM Look; C:\WINDOWS\system32\DRIVERS\snpstd2.sys [2004-07-28 334080]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360]
S3 usbaudio;USB audio-illesztőprogram (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2004-08-03 59264]
S3 usbccgp;Microsoft USB általános szülő-illesztőprogram; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]
S3 usbprint;Microsoft USB PRINTER osztály; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
S3 USBSTOR;USB háttértár illesztőprogramja; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 WSTCODEC;World Standard Teletext kodek; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
S4 LMIRfsClientNP;LMIRfsClientNP; C:\WINDOWS\system32\drivers\LMIRfsClientNP.sys []
S4 WS2IFSL;Windows Socket 2.0 - nem IFS-t szolgáltató támogatási környezet; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-10-26 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aawservice;Ad-Aware 2007 Service; I:\ad-aware\aawservice.exe [2007-10-29 587096]
R2 ekrn;Eset Service; G:\Nod\ekrn.exe [2008-08-18 468224]
R2 InterBaseServer;InterBase Server; G:\EgyeniGyakorlo\Interbase\bin\ibserver -s []
R2 Irmon;Infravörös figyelő; C:\WINDOWS\System32\svchost.exe [2004-08-17 14336]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-06-30 152984]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
S2 LMIMaint;LogMeIn Maintenance Service; D:\Máté\x86\RaMaint.exe []
S2 LogMeIn;LogMeIn; D:\Máté\x86\LogMeIn.exe []
S2 SymWSC;SymWMI Service; C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe []
S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2007-12-23 72704]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 EhttpSrv;Eset HTTP Server; G:\Nod\EHttpSrv.exe [2008-08-18 19200]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 usnjsvc;Messenger megosztási mappák – USN-naplóolvasó szolgáltatás; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]
S3 WMPNetworkSvc;A Windows Media Player hálózatmegosztási szolgáltatása; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-10 919040]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2004-08-17 14336]

-----------------EOF-----------------

igen probald megegyszer az rsitet es ird ide van e javulas a gepel,,

Az RSIT nagyon lassan működik, normális ez? Kb. 5 perc után is Run Hijackthis-t írt ki... mindenesetre ma még megpróbálom egyszer, ha minden jól megy.

Megcsináltam mindent, amit mondtál, itt a Malware log ( a gép órája nem jó, most csináltam kb. 3 perce)

Malwarebytes' Anti-Malware 1.39
Adatbázis verzió: 2421
Windows 5.1.2600 Szervizcsomag 2

2009.06.30. 15:17:45
mbam-log-2009-06-30 (15-17-45).txt

Vizsgálat típusa: Gyorsvizsgálat
Átvizsgált objektumok: 123897
Eltelt idő: 7 minute(s), 41 second(s)

Fertőzött memóriafolyamatok: 0
Fertőzött memória modulok: 0
Fertőzött rendszerleíró kulcsok: 2
Fertőzött rendszerleíró értékek: 1
Fertőzött rednszerleíró elemek: 0
Fertőzött mappák: 0
Fertőzött fájlok: 0

Fertőzött memóriafolyamatok:
(Nem észleltem rosszindulatú elemeket)

Fertőzött memória modulok:
(Nem észleltem rosszindulatú elemeket)

Fertőzött rendszerleíró kulcsok:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{055fd26d-3a88-4e15-963d-dc8493744b1d} (Adware.BHO) -> Quarantined and deleted successfully.

Fertőzött rendszerleíró értékek:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Fertőzött rednszerleíró elemek:
(Nem észleltem rosszindulatú elemeket)

Fertőzött mappák:
(Nem észleltem rosszindulatú elemeket)

Fertőzött fájlok:
(Nem észleltem rosszindulatú elemeket)

udv
fixeld le a hijackal
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQToolbar\toolbaru.dll
O3 - Toolbar: PhotoPos Pro Toolbar - {A057A204-BACC-4D26-9F9D-3BEFCFBE6E86} - C:\PROGRA~1\PHOTOP~1\PHOTOP~1.DLL
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] D:\Máté\Winamp\winampa.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE

leszedni a geprol,letelepiteni a vezerlo pulton keresztul
Sigma Team Toolbar - C:\Program Files\Sigma_Team\
C:\Program Files\Common Files\Symantec Shared\Security Center
Toolbar: ICQ Toolbar- C:\Program Files\ICQToolbar
PhotoPos Pro Toolbar-C:\PROGRA~1\PHOTOP~1

letoltod ezt a programot es futatod-fel frisited a javat




,

Üdvözlet!
Gondban vagyok a géppel, eléggé lassú mostanában, bejelentkezés után 2 percet kell várni, hogy használható állapotba kerüljön, mert előtte hiába adok ki neki parancsot, nem hajtja végre, csak nagy késéssel. Van, amikor alig fél óra használat után kezd így szaggatni, és akkor már tényleg nem jó semmire.
Tudom, hogy le kéne formázni, de egyelőre valami egyszerűbb megoldásra lenne szükségem. Elnézést, ha pontatlanul fogalmaztam, nem vagyok nagy szakértő.
A segítséget előre is köszönöm!

Adok logot.

Logfile of HijackThis v1.99.1
Scan saved at 12:47:21, on 2009.06.30.
Platform: Windows XP Szervizcsomag 2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
I:\ad-aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
G:\Nod\ekrn.exe
G:\EgyeniGyakorlo\Interbase\bin\ibserver.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\htpatch.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\ATI Technologies\ATI vezérlőpult\atiptaxx.exe
C:\WINDOWS\vsnpstd2.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
G:\Nod\egui.exe
D:\Máté\Winamp\winampa.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
H:\Programok\DAEMON Tools Lite\daemon.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
H:\bilder\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hivatkozások
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQToolbar\toolbaru.dll
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\Program Files\ICQToolbar\toolbaru.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - H:\BitComet\tools\BitCometBHO_1.3.3.2.dll
O2 - BHO: Sigma Team Toolbar - {5a089bcd-c7f1-4064-8702-f58d8bd5d61f} - C:\Program Files\Sigma_Team\tbSig0.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live bejelentkezési segítség - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: PhotoPos Pro Toolbar - {A057A204-BACC-4D26-9F9D-3BEFCFBE6E86} - C:\PROGRA~1\PHOTOP~1\PHOTOP~1.DLL
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQToolbar\toolbaru.dll
O3 - Toolbar: PhotoPos Pro Toolbar - {A057A204-BACC-4D26-9F9D-3BEFCFBE6E86} - C:\PROGRA~1\PHOTOP~1\PHOTOP~1.DLL
O3 - Toolbar: Sigma Team Toolbar - {5a089bcd-c7f1-4064-8702-f58d8bd5d61f} - C:\Program Files\Sigma_Team\tbSig0.dll
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [SNPSTD2] C:\WINDOWS\vsnpstd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [egui] "G:\Nod\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [WinampAgent] D:\Máté\Winamp\winampa.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Biolka] "H:\Biolka.exe autostart"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "H:\Programok\DAEMON Tools Lite\daemon.exe" -autorun
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: Adobe Reader gyorsindító.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &A&z összes videó letöltése BitComettel - res://H:\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &L&etöltés &BitComettel - res://H:\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &M&inden letöltése BitComettel - res://H:\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xportálás Microsoft Excel formátumba - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Küldés blogba - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Küldés blogba a Windows Live Writer programmal - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\TV\EXPLBAR.DLL
O9 - Extra button: Kutatás - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://H:\BitComet\tools\BitCometBHO_1.3.3.2.dll/206 (file missing)
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - H:\Programok\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - H:\Programok\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://map2.index.hu/MGViewer/ActiveX/mgaxctrl.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/Mi ... b56986.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
O20 - Winlogon Notify: LMIinit - C:\WINDOWS\SYSTEM32\LMIinit.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - I:\ad-aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - G:\Nod\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - G:\Nod\ekrn.exe
O23 - Service: InterBase Server (InterBaseServer) - Inprise Corporation - G:\EgyeniGyakorlo\Interbase\bin\ibserver.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - Unknown owner - D:\Máté\x86\RaMaint.exe (file missing)
O23 - Service: LogMeIn - Unknown owner - D:\Máté\x86\LogMeIn.exe (file missing)
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Hááát.. ez csk részben igaz,az ilyen gépen csak az olyan duványokat (étd:USB,CD,DVD ami bele kerül) kellene ellenőriznie az gépnek.Köze nem lehetne a vírusírtónak a gyorsasághoz,mert "régen volt frissítve"..legfeljebb kiírja,hogy az adatbázis too old...az az írtó úgy sz. ahogy van,ha ezért fogja meg a gépet

Erre szokták mondani: aki hülye, az szenvedjen.

Azért ez furcsa némileg.
Mellesleg a Net tele van használható Serial-okkal. Pl:

http://www.for-ever.cn/nod32/
http://www.nod321.com/

Az egy hónapos próbaverzió alatt csinálta ezt
itt arol van szo hogy vagy lejart mar a verzio,hasznalata es mar nemmukszik,vagy nemjol van bealitva es a tuzfall blokolt mindent Futt fatt,vagy Trojak,
Mivell at vizsgalni?
Megjeleniteni a rejtet mapakat/fajlokat,
1:Malwarebytes
2:Combofix
3:G-Mer

Az egy hónapos próbaverzió alatt csinálta ezt...mivel nézzem meg a bujkáló trójait? Mit ajánlasz?

Az a fura, hogy nem a Eset Smart Security telepítése után csinálja, hanem jóval később.
lejart a licencio?/Trojak is szoktak ijet gyakran csinalni,nemhagya frisiteniaz AV-programokat-blokolja es nincsen net se,

Hello Dr. Stell!

Tapasztaltál már hasonlót? Több gépen találkoztam vele.
Ha leveszem az Eset Smart Security programot, akkor van net. Ellenkező eetben nincs. Az Eset sem tud tovább frissíteni (viszont a Skype működik). Az a fura, hogy nem a Eset Smart Security telepítése után csinálja, hanem jóval később.
Mi lehet az oka?

Remélem, mindent jól csináltam. Pénteken jövök legközelebb, addig is köszönök mindent!

ComboFix 09-05-08.03 - Gabi 009.05.07. 11:51.4 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1250.36.1038.18.255.80 [GMT 2:00]
Running from: c:\documents and settings\Gabi\Asztal\ComboFix.exe
AV: ESET Smart Security 3.0 *On-access scanning enabled* (Updated)
FW: ESET Személyi tűzfal *enabled*
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\install.exe

.
((((((((((((((((((((((((( Files Created from 2009-04-07 to 2009-05-07 )))))))))))))))))))))))))))))))
.

2009-04-18 12:08 . 2009-04-18 12:08 -------- d-----w c:\documents and settings\Gabi\Application Data\Winamp
2009-04-14 15:23 . 2009-04-14 15:23 -------- d-----w c:\documents and settings\demo\Local Settings\Application Data\Winamp Toolbar
2009-04-13 17:01 . 2009-04-13 17:01 -------- d-----w c:\documents and settings\Gabi\Local Settings\Application Data\Winamp Toolbar
2009-04-12 07:51 . 2009-04-12 07:51 -------- d-sh--w C:\FOUND.006
2009-04-10 08:05 . 2009-04-10 08:05 -------- d-----w c:\documents and settings\All Users\Application Data\Winamp Toolbar
2009-04-10 08:05 . 2009-04-10 08:05 -------- d-----w c:\program files\Winamp Toolbar
2009-04-10 08:04 . 2008-08-20 17:58 129520 ------w c:\windows\system32\pxafs.dll
2009-04-10 05:14 . 2009-04-10 05:14 -------- d-----w c:\documents and settings\Anya\Application Data\Biolka
2009-04-09 10:17 . 2009-04-09 10:17 -------- d-----w c:\documents and settings\Gabi\Application Data\Biolka

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-04 12:57 . 2005-05-22 13:10 89848 ----a-w c:\documents and settings\Julcsi\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-17 14:24 . 2005-05-10 16:45 89848 ----a-w c:\documents and settings\Gabi\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-03-16 15:13 . 2009-03-16 15:13 407129 ----a-w c:\windows\MarioForever_Toolbar_Uninstaller_546.exe
2009-03-16 15:12 . 2009-03-16 15:12 -------- d-----w c:\program files\Mario Forever Toolbar
2009-03-11 20:24 . 2009-03-11 20:24 -------- d-----w c:\program files\Windows Media Connect 2
2009-03-02 17:10 . 2008-07-04 12:13 67584 ----a-w c:\windows\system32\ff_vfw.dll
2009-03-01 19:00 . 2009-03-05 16:21 60273 ----a-w c:\windows\system32\pthreadGC2.dll
2005-09-24 07:40 . 2005-09-24 07:44 995090 ----a-w c:\program files\GazdanaploSetup.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5a089bcd-c7f1-4064-8702-f58d8bd5d61f}]
2007-12-10 11:46 1510424 ----a-w c:\program files\Sigma_Team\tbSig0.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-9F9D-3BEFCFBE6E86}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{5a089bcd-c7f1-4064-8702-f58d8bd5d61f}"= "c:\program files\Sigma_Team\tbSig0.dll" [2007-12-10 1510424]

[HKEY_CLASSES_ROOT\clsid\{5a089bcd-c7f1-4064-8702-f58d8bd5d61f}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-17 15360]
"Biolka"="H:\Biolka.exe" [2009-04-09 1690112]
"DAEMON Tools Lite"="h:\programok\DAEMON Tools Lite\daemon.exe" [2008-08-08 490952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HTpatch"="c:\windows\htpatch.exe" [2002-10-30 28672]
"SiSUSBRG"="c:\windows\SiSUSBrg.exe" [2002-07-12 106496]
"SNPSTD2"="c:\windows\vsnpstd2.exe" [2004-06-10 286720]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-05-30 77824]
"egui"="g:\nod\egui.exe" [2008-08-18 1447168]
"WinampAgent"="d:\máté\Winamp\winampa.exe" [2009-03-09 37888]
"ATIPTA"="atiptaxx.exe" - c:\program files\ATI Technologies\ATI vezérlőpult\atiptaxx.exe [2002-05-17 286720]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-17 15360]

c:\documents and settings\M t‚\Start Menu\Programs\Indˇt˘pult\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]

c:\documents and settings\All Users\Start Menu\Programs\Indˇt˘pult\
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2005-5-29 118784]
Adobe Reader gyorsindˇt˘.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-24 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2008-10-16 18:35 87352 ----a-w c:\windows\system32\LMIinit.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\System32\\dpvsetup.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"h:\\StubInstaller.exe"=
"f:\\utorrent-1.4.2-beta-build-432.exe"=
"e:\\bin\\NPLocal.exe"=
"h:\\utorrent-1.6.exe"=
"g:\\LETÖLTÉS\\DC\\StrongDC.exe"=
"h:\\Programok\\ICQ6\\ICQ.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"i:\\Top Secret-Katonai hírszerzés\\BIN\\Game\\Battlegrounds.exe"=
"f:\\Jedi Outcast\\GameData\\jk2mp.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"d:\\Máté\\2008.11.24\\limewire\\LimeWire.exe"=
"e:\\Máté metin2\\metin2.bin"=
"h:\\BitComet\\BitComet.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26252:TCP"= 26252:TCP:torrent
"8478:TCP"= 8478:TCP:BitComet 8478 TCP
"8478:UDP"= 8478:UDP:BitComet 8478 UDP
"16478:TCP"= 16478:TCP:comet

R2 ekrn;Eset Service;g:\nod\ekrn.exe [2008.08.18. 13:25 468224]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2008.11.23. 9:51 47640]
S2 LMIInfo;LogMeIn Kernel Information Provider;\??\d:\máté\x86\RaInfo.sys --> d:\máté\x86\RaInfo.sys [?]
S2 TinaKey;TinaKey; [x]
S3 rkhdrv40;Rootkit Unhooker Driver; [x]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{694b1850-a629-11da-8cf6-000b6a1f918f}]
\Shell\AutoRun\command - m:\setup\rsrc\Autorun.exe
\Shell\dinstall\command - m:\directx\dxsetup.exe
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &A&z összes videó letöltése BitComettel - h:\bitcomet\BitComet.exe/AddVideo.htm
IE: &L&etöltés &BitComettel - h:\bitcomet\BitComet.exe/AddLink.htm
IE: &M&inden letöltése BitComettel - h:\bitcomet\BitComet.exe/AddAllLink.htm
IE: E&xportálás Microsoft Excel formátumba - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Sothink SWF Catcher - c:\program files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Gabi\Application Data\Mozilla\Firefox\Profiles\hpxre1bs.default\
FF - prefs.js: browser.startup.homepage -
FF - component: c:\documents and settings\Gabi\Application Data\Mozilla\Firefox\Profiles\hpxre1bs.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\components\IBitCometExtension.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npOGAPlugin.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-07 11:55
Windows 5.1.2600 Szervizcsomag 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(832)
c:\windows\system32\LMIinit.dll
.
Completion time: 2009-05-07 11:57
ComboFix-quarantined-files.txt 2009-05-07 09:57
ComboFix2.txt 2008-08-04 07:46

Pre-Run: 1 269 817 344 bájt szabad
Post-Run: 2 606 055 424 bájt szabad

Current=6 Default=6 Failed=5 LastKnownGood=7 Sets=1,2,3,4,5,6,7
140 --- E O F --- 2008-12-07 09:30

udv
futasd a combofixet ,,DE csak holnap utan nezem meg,mert halaszveresenyek vannak es nekem ez elsobb,ok,,

Szia stell!

Ha lehet, ismét segítséget kérnék ( tavaly voltam erre utoljára, továbbra is az őskorszaki gépről van szó)
A lényeg, hogy ma, amikor bekapcsoltam a gépet, rögtön le akarta ellenőrizni a C és a J meghajtót, de anélkül, hogy megszakítottam volna az ellenőrzést, kiírta, hogy ellenőrzés megszakítva, azután továbblépett. Ezután jött az üdvözlőablak, ráléptem a felhasználói fiókomra, automatikusan elkezdte írni a jelszavamat, aztán pedig sípolásokat hallottam. Tisztára, mint a Morse-jelek. Ja, és nem állok alkohol befolyása alatt

Adok egy Hijackthis logot ( a dátum és az idő rossz, a számítógép órája nem működik jól...)
A választ előre is köszönöm!


Logfile of HijackThis v1.99.1
Scan saved at 8:11:39, on 2009.05.04.
Platform: Windows XP Szervizcsomag 2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
I:\ad-aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
G:\Nod\ekrn.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\htpatch.exe
C:\Program Files\ATI Technologies\ATI vezérlőpult\atiptaxx.exe
C:\WINDOWS\vsnpstd2.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
G:\Nod\egui.exe
D:\Máté\Winamp\winampa.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
H:\Programok\DAEMON Tools Lite\daemon.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\system32\wuauclt.exe
H:\bilder\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hivatkozások
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQToolbar\toolbaru.dll
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\Program Files\ICQToolbar\toolbaru.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - H:\BitComet\tools\BitCometBHO_1.3.3.2.dll
O2 - BHO: Sigma Team Toolbar - {5a089bcd-c7f1-4064-8702-f58d8bd5d61f} - C:\Program Files\Sigma_Team\tbSig0.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live bejelentkezési segítség - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: PhotoPos Pro Toolbar - {A057A204-BACC-4D26-9F9D-3BEFCFBE6E86} - C:\PROGRA~1\PHOTOP~1\PHOTOP~1.DLL
O2 - BHO: Mario Forever Toolbar Helper - {A20854FD-DDB5-4931-8F76-D11EA2364D94} - C:\Program Files\Mario Forever Toolbar\v3.2.0.0\MarioForever_Toolbar.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQToolbar\toolbaru.dll
O3 - Toolbar: PhotoPos Pro Toolbar - {A057A204-BACC-4D26-9F9D-3BEFCFBE6E86} - C:\PROGRA~1\PHOTOP~1\PHOTOP~1.DLL
O3 - Toolbar: Sigma Team Toolbar - {5a089bcd-c7f1-4064-8702-f58d8bd5d61f} - C:\Program Files\Sigma_Team\tbSig0.dll
O3 - Toolbar: Mario Forever Toolbar - {71B6ACF7-4F0F-4FD8-BB69-6D1A4D271CB7} - C:\Program Files\Mario Forever Toolbar\v3.2.0.0\MarioForever_Toolbar.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [SNPSTD2] C:\WINDOWS\vsnpstd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [egui] "G:\Nod\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [WinampAgent] D:\Máté\Winamp\winampa.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Biolka] "H:\Biolka.exe autostart"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "H:\Programok\DAEMON Tools Lite\daemon.exe" -autorun
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: Adobe Reader gyorsindító.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &A&z összes videó letöltése BitComettel - res://H:\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &L&etöltés &BitComettel - res://H:\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &M&inden letöltése BitComettel - res://H:\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xportálás Microsoft Excel formátumba - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Küldés blogba - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Küldés blogba a Windows Live Writer programmal - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\TV\EXPLBAR.DLL
O9 - Extra button: Kutatás - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://H:\BitComet\tools\BitCometBHO_1.3.3.2.dll/206 (file missing)
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - H:\Programok\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - H:\Programok\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://map2.index.hu/MGViewer/ActiveX/mgaxctrl.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/Mi ... b56986.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
O20 - Winlogon Notify: LMIinit - C:\WINDOWS\SYSTEM32\LMIinit.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - I:\ad-aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - G:\Nod\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - G:\Nod\ekrn.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - Unknown owner - D:\Máté\x86\RaMaint.exe (file missing)
O23 - Service: LogMeIn - Unknown owner - D:\Máté\x86\LogMeIn.exe (file missing)
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Tárgytalan, megoldódott.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:21:32, on 2008.09.04.
Platform: Windows XP Szervizcsomag 2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe
E:\WINDOWS\system32\wuauclt.exe
E:\WINDOWS\explorer.exe
E:\Program Files\HJK\HijackThis.exe
E:\Program Files\ESET\ESET Smart Security\ekrn.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - E:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - E:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Vodafone Mobile Connect Service (VMCService) - Vodafone - E:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe

--
End of file - 1491 bytes

ComboFix 08-09-01.05 - Drum 2008-09-04 18:14:09.6 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1038.18.574 [GMT 2:00]
Running from: E:\Documents and Settings\Drum\Asztal\ComboFix.exe
Command switches used :: /RestoreRun
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

I:\autorun.inf

.
((((((((((((((((((((((((( Files Created from 2008-08-04 to 2008-09-04 )))))))))))))))))))))))))))))))
.

2008-09-04 16:01 . 2008-09-04 17:49 <DIR> d-------- E:\Program Files\HJK
2008-09-04 13:02 . 2008-09-04 13:02 <DIR> d-------- E:\Documents and Settings\Drum\Application Data\gtopala
2008-09-04 11:42 . 2008-09-04 11:42 <DIR> d-------- E:\Program Files\Guitar Pro 5
2008-09-04 01:42 . 2008-09-04 01:42 <DIR> d-------- E:\Documents and Settings\Drum\Application Data\HEXelon
2008-09-04 01:42 . 2006-01-13 14:00 15,872 --a------ E:\WINDOWS\system32\drivers\vd_filedisk.sys
2008-09-04 01:41 . 2008-09-04 12:47 <DIR> d-------- E:\Program Files\TC UP
2008-09-04 01:25 . 2008-09-04 01:25 <DIR> d-------- E:\Program Files\Vodafone
2008-09-04 01:25 . 2008-09-04 01:25 <DIR> d-------- E:\Program Files\Common Files\InstallShield
2008-09-04 01:25 . 2008-09-04 01:25 <DIR> d-------- E:\Documents and Settings\LocalService\Application Data\Vodafone
2008-09-04 01:25 . 2008-09-04 01:25 <DIR> d-------- E:\Documents and Settings\Drum\Application Data\Vodafone
2008-09-04 01:25 . 2008-09-04 01:25 <DIR> d-------- E:\Documents and Settings\All Users\Application Data\Vodafone
2008-09-04 01:25 . 2008-09-04 01:25 <DIR> d-------- E:\Documents and Settings\All Users\Application Data\InstallShield
2008-09-04 01:24 . 2008-09-04 01:24 <DIR> d-------- E:\Program Files\CCleaner
2008-09-04 01:19 . 2004-08-03 23:08 26,496 --a--c--- E:\WINDOWS\system32\dllcache\usbstor.sys
2008-09-04 01:17 . 2008-09-04 01:17 <DIR> d-------- E:\Documents and Settings\Drum\Application Data\ESET
2008-09-04 01:16 . 2008-09-04 01:16 <DIR> d-------- E:\Program Files\ESET
2008-09-04 01:16 . 2008-09-04 01:16 <DIR> d-------- E:\Documents and Settings\All Users\Application Data\ESET
2008-09-04 01:11 . 2008-09-04 01:11 <DIR> d---s---- E:\WINDOWS\system32\Microsoft
2008-09-04 01:05 . 2008-09-04 01:14 316,640 --a------ E:\WINDOWS\WMSysPr9.prx
2008-09-04 01:03 . 2008-09-04 01:03 <DIR> d-------- E:\WINDOWS\ServicePackFiles
2008-09-04 01:01 . 2004-07-17 11:40 19,528 --a------ E:\WINDOWS\002197_.tmp
2008-09-04 01:00 . 2004-08-03 22:43 15,872 --a------ E:\WINDOWS\system32\spupdsvc.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-03 22:52 558,142 ----a-w E:\WINDOWS\java\Packages\5JXFDR5Z.ZIP
2008-09-03 22:52 155,995 ----a-w E:\WINDOWS\java\Packages\DNZ7Z5VV.ZIP
2008-09-03 22:52 --------- d-----w E:\Program Files\microsoft frontpage
.

((((((((((((((((((((((((((((( snapshot@2008-09-04_13.27.59.15 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-09-04 14:09:57 26,624 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Accessibility\d1ccc7cbc4e442439a5673fa182ebe14\Accessibility.ni.dll
+ 2008-09-04 14:10:04 860,160 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\8af1e39c53e0114b8d8bee960865169c\AspNetMMCExt.ni.dll
+ 2008-09-04 14:10:05 237,568 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\44bb3517b6193b47b20d477ef3929b62\CustomMarshalers.ni.dll
+ 2008-09-04 14:10:05 15,360 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\dfsvc\4d364c9dbfc3684f8be8f22480a73438\dfsvc.ni.exe
+ 2008-09-04 14:10:11 880,640 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\6c6e8bec76ea6a4f81548cdd7696dc13\Microsoft.Build.Engine.ni.dll
+ 2008-09-04 14:10:12 81,920 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\ca1c429664d53f42b2af00c42a80030b\Microsoft.Build.Framework.ni.dll
+ 2008-09-04 14:23:01 1,691,648 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\ae8c1cd441de144394649370c69115b7\Microsoft.Build.Tasks.ni.dll
+ 2008-09-04 14:23:02 163,840 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\01a4126a0cbb5041b55ca1679498ec81\Microsoft.Build.Utilities.ni.dll
+ 2008-09-04 14:23:06 1,724,416 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\c57081acfcdfd34581c1f34bda759ee2\Microsoft.VisualBasic.ni.dll
+ 2008-09-04 14:23:08 962,560 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\69d6cd1455dbcc44a081d108e2798abb\System.Configuration.ni.dll
+ 2008-09-04 14:23:10 1,712,128 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Deployment\9a6d82fac4ff3742ae6b327ae77c31d4\System.Deployment.ni.dll
+ 2008-09-04 14:23:13 512,000 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\04edfcf86bf9a84c8f60cc0886f9f72b\System.DirectoryServices.Protocols.ni.dll
+ 2008-09-04 14:23:12 1,220,608 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\e73515ce7fd2ce438c014a89940e8a51\System.DirectoryServices.ni.dll
+ 2008-09-04 14:23:15 659,456 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\33550cf915c02c48a10d3a6521adf1f1\System.EnterpriseServices.ni.dll
+ 2008-09-04 14:23:15 294,912 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\33550cf915c02c48a10d3a6521adf1f1\System.EnterpriseServices.Wrapper.dll
+ 2008-09-04 14:23:16 729,088 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Security\cc4cda6f43cf624d867998c0c81e2a0a\System.Security.ni.dll
+ 2008-09-04 14:23:18 684,032 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Transactions\3c1e1627eb5b9f4fb5f89f45a3e41585\System.Transactions.ni.dll
+ 2008-09-04 14:23:46 2,310,144 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\454715277a3b364b9ddf36a6f7574b31\System.Web.Mobile.ni.dll
+ 2008-09-04 14:23:47 237,568 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\a4025d8657522f46b1e7cd6c917eeaa3\System.Web.RegularExpressions.ni.dll
+ 2008-09-04 14:23:50 1,945,600 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.Services\3a49f459ad60924da0bb70c73a5acde0\System.Web.Services.ni.dll
+ 2008-09-04 14:23:40 11,808,768 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\032f6c21f7ec4644b7593c95a46c3b71\System.Web.ni.dll
+ 2005-10-20 18:02:28 163,328 ----a-w E:\WINDOWS\erdnt\subs\ERDNT.EXE
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UacDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"F:\\ccsetup211.exe"=
"E:\\Program Files\\TC UP\\TOTALCMD.EXE"=
"E:\\Program Files\\TC UP\\Plugins\\Media\\Hasla\\hasla.exe"=
"E:\\Program Files\\HJK\\HijackThis.exe"=
"E:\\Documents and Settings\\Drum\\Asztal\\mbr.exe"=
"E:\\Documents and Settings\\Drum\\Asztal\\ComboFix.exe"=
"E:\\WINDOWS\\system32\\CF17415.exe"=

R1 VD_FileDisk;VD_FileDisk;E:\WINDOWS\system32\drivers\VD_FileDisk.sys [2006-01-13 15872]
R2 VMCService;Vodafone Mobile Connect Service;E:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [2008-05-28 14336]
S3 dac970nt;dac970nt;E:\WINDOWS\system32\drivers\rkghon.sys [ ]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5f91bba4-7a0e-11dd-a157-fe610eb61a35}]
\Shell\AutoRun\command - I:\setup_vmc_lite.exe /checkApplicationPresence
.
.
------- Supplementary Scan -------
.

O16 -: DirectAnimation Java Classes - file://E:\WINDOWS\Java\classes\dajava.cab
E:\WINDOWS\Downloaded Program Files\DirectAnimation Java Classes.osd

O16 -: Microsoft XML Parser for Java - file://E:\WINDOWS\Java\classes\xmldso.cab
E:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-04 18:18:05
Windows 5.1.2600 Szervizcsomag 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
E:\Program Files\ESET\ESET Smart Security\ekrn.exe
.
**************************************************************************
.
Completion time: 2008-09-04 18:19:54 - machine was rebooted [Drum]
ComboFix-quarantined-files.txt 2008-09-04 16:19:49
ComboFix2.txt 2008-09-04 15:33:49
ComboFix3.txt 2008-09-04 15:27:06
ComboFix4.txt 2008-09-04 14:37:54
ComboFix5.txt 2008-09-04 15:53:36

Pre-Run: 15,593,508,864 bájt szabad
Post-Run: 15,570,825,216 b jt szabad

135

Ok,
Start>futatas >masold be eztett:
"%userprofile%\Asztal\ComboFix.exe" /RestoreRun ok
Majd a logjat ted ide es uj hijackthis logot is.

nincs hálozati kapcsolat, a huawei modem nem jutott el odáig hogy csináljon kapcsolatot. nincsen hálókártya engedélyezve mert sem ADSL, sem egyéb kábel net nincs. usb-modem van, és betárcsázás....ha eljutott volna win odáig hogy megcsinalja. a combofix /f3m-töl meg le is fagyott a gépem. nemtudom más is ilyen értetlen mint én?

Fixeld le a HiJackal:
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1


1:Eztet miert nem csinaltad??

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:35:34, on 2008.09.04.
Platform: Windows XP Szervizcsomag 2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe
E:\WINDOWS\system32\wuauclt.exe
E:\WINDOWS\explorer.exe
E:\WINDOWS\system32\notepad.exe
E:\WINDOWS\system32\taskmgr.exe
E:\Program Files\TC UP\TOTALCMD.EXE
E:\Program Files\HJK\HijackThis.exe
E:\Program Files\ESET\ESET Smart Security\ekrn.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - E:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - E:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Vodafone Mobile Connect Service (VMCService) - Vodafone - E:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe

--
End of file - 1594 bytes

ComboFix 08-09-01.05 - Drum 2008-09-04 17:32:44.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1038.18.510 [GMT 2:00]
Running from: E:\Documents and Settings\Drum\Asztal\ComboFix.exe
Command switches used :: E:\Documents and Settings\Drum\Asztal\CFScript.txt
* Created a new restore point
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

I:\autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_DAC970NT
-------\Service_dac970nt


((((((((((((((((((((((((( Files Created from 2008-08-04 to 2008-09-04 )))))))))))))))))))))))))))))))
.

2008-09-04 16:01 . 2008-09-04 16:02 <DIR> d-------- E:\Program Files\HJK
2008-09-04 13:02 . 2008-09-04 13:02 <DIR> d-------- E:\Documents and Settings\Drum\Application Data\gtopala
2008-09-04 11:42 . 2008-09-04 11:42 <DIR> d-------- E:\Program Files\Guitar Pro 5
2008-09-04 01:42 . 2008-09-04 01:42 <DIR> d-------- E:\Documents and Settings\Drum\Application Data\HEXelon
2008-09-04 01:42 . 2006-01-13 14:00 15,872 --a------ E:\WINDOWS\system32\drivers\vd_filedisk.sys
2008-09-04 01:41 . 2008-09-04 12:47 <DIR> d-------- E:\Program Files\TC UP
2008-09-04 01:25 . 2008-09-04 01:25 <DIR> d-------- E:\Program Files\Vodafone
2008-09-04 01:25 . 2008-09-04 01:25 <DIR> d-------- E:\Program Files\Common Files\InstallShield
2008-09-04 01:25 . 2008-09-04 01:25 <DIR> d-------- E:\Documents and Settings\LocalService\Application Data\Vodafone
2008-09-04 01:25 . 2008-09-04 01:25 <DIR> d-------- E:\Documents and Settings\Drum\Application Data\Vodafone
2008-09-04 01:25 . 2008-09-04 01:25 <DIR> d-------- E:\Documents and Settings\All Users\Application Data\Vodafone
2008-09-04 01:25 . 2008-09-04 01:25 <DIR> d-------- E:\Documents and Settings\All Users\Application Data\InstallShield
2008-09-04 01:24 . 2008-09-04 01:24 <DIR> d-------- E:\Program Files\CCleaner
2008-09-04 01:19 . 2004-08-03 23:08 26,496 --a--c--- E:\WINDOWS\system32\dllcache\usbstor.sys
2008-09-04 01:17 . 2008-09-04 01:17 <DIR> d-------- E:\Documents and Settings\Drum\Application Data\ESET
2008-09-04 01:16 . 2008-09-04 01:16 <DIR> d-------- E:\Program Files\ESET
2008-09-04 01:16 . 2008-09-04 01:16 <DIR> d-------- E:\Documents and Settings\All Users\Application Data\ESET
2008-09-04 01:11 . 2008-09-04 01:11 <DIR> d---s---- E:\WINDOWS\system32\Microsoft
2008-09-04 01:05 . 2008-09-04 01:14 316,640 --a------ E:\WINDOWS\WMSysPr9.prx
2008-09-04 01:03 . 2008-09-04 01:03 <DIR> d-------- E:\WINDOWS\ServicePackFiles
2008-09-04 01:01 . 2004-07-17 11:40 19,528 --a------ E:\WINDOWS\002197_.tmp
2008-09-04 01:00 . 2004-08-03 22:43 15,872 --a------ E:\WINDOWS\system32\spupdsvc.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-03 22:52 558,142 ----a-w E:\WINDOWS\java\Packages\5JXFDR5Z.ZIP
2008-09-03 22:52 155,995 ----a-w E:\WINDOWS\java\Packages\DNZ7Z5VV.ZIP
2008-09-03 22:52 --------- d-----w E:\Program Files\microsoft frontpage
.

((((((((((((((((((((((((((((( snapshot@2008-09-04_13.27.59.15 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-09-04 14:09:57 26,624 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Accessibility\d1ccc7cbc4e442439a5673fa182ebe14\Accessibility.ni.dll
+ 2008-09-04 14:10:04 860,160 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\8af1e39c53e0114b8d8bee960865169c\AspNetMMCExt.ni.dll
+ 2008-09-04 14:10:05 237,568 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\44bb3517b6193b47b20d477ef3929b62\CustomMarshalers.ni.dll
+ 2008-09-04 14:10:05 15,360 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\dfsvc\4d364c9dbfc3684f8be8f22480a73438\dfsvc.ni.exe
+ 2008-09-04 14:10:11 880,640 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\6c6e8bec76ea6a4f81548cdd7696dc13\Microsoft.Build.Engine.ni.dll
+ 2008-09-04 14:10:12 81,920 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\ca1c429664d53f42b2af00c42a80030b\Microsoft.Build.Framework.ni.dll
+ 2008-09-04 14:23:01 1,691,648 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\ae8c1cd441de144394649370c69115b7\Microsoft.Build.Tasks.ni.dll
+ 2008-09-04 14:23:02 163,840 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\01a4126a0cbb5041b55ca1679498ec81\Microsoft.Build.Utilities.ni.dll
+ 2008-09-04 14:23:06 1,724,416 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\c57081acfcdfd34581c1f34bda759ee2\Microsoft.VisualBasic.ni.dll
+ 2008-09-04 14:23:08 962,560 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\69d6cd1455dbcc44a081d108e2798abb\System.Configuration.ni.dll
+ 2008-09-04 14:23:10 1,712,128 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Deployment\9a6d82fac4ff3742ae6b327ae77c31d4\System.Deployment.ni.dll
+ 2008-09-04 14:23:13 512,000 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\04edfcf86bf9a84c8f60cc0886f9f72b\System.DirectoryServices.Protocols.ni.dll
+ 2008-09-04 14:23:12 1,220,608 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\e73515ce7fd2ce438c014a89940e8a51\System.DirectoryServices.ni.dll
+ 2008-09-04 14:23:15 659,456 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\33550cf915c02c48a10d3a6521adf1f1\System.EnterpriseServices.ni.dll
+ 2008-09-04 14:23:15 294,912 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\33550cf915c02c48a10d3a6521adf1f1\System.EnterpriseServices.Wrapper.dll
+ 2008-09-04 14:23:16 729,088 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Security\cc4cda6f43cf624d867998c0c81e2a0a\System.Security.ni.dll
+ 2008-09-04 14:23:18 684,032 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Transactions\3c1e1627eb5b9f4fb5f89f45a3e41585\System.Transactions.ni.dll
+ 2008-09-04 14:23:46 2,310,144 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\454715277a3b364b9ddf36a6f7574b31\System.Web.Mobile.ni.dll
+ 2008-09-04 14:23:47 237,568 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\a4025d8657522f46b1e7cd6c917eeaa3\System.Web.RegularExpressions.ni.dll
+ 2008-09-04 14:23:50 1,945,600 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.Services\3a49f459ad60924da0bb70c73a5acde0\System.Web.Services.ni.dll
+ 2008-09-04 14:23:40 11,808,768 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\032f6c21f7ec4644b7593c95a46c3b71\System.Web.ni.dll
+ 2005-10-20 18:02:28 163,328 ----a-w E:\WINDOWS\erdnt\subs\ERDNT.EXE
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"F:\\ccsetup211.exe"=
"E:\\Program Files\\TC UP\\TOTALCMD.EXE"=
"E:\\Program Files\\TC UP\\Plugins\\Media\\Hasla\\hasla.exe"=
"E:\\Program Files\\HJK\\HijackThis.exe"=
"E:\\Documents and Settings\\Drum\\Asztal\\mbr.exe"=
"E:\\Documents and Settings\\Drum\\Asztal\\ComboFix.exe"=
"E:\\WINDOWS\\system32\\CF9150.exe"=

R1 VD_FileDisk;VD_FileDisk;E:\WINDOWS\system32\drivers\VD_FileDisk.sys [2006-01-13 15872]
R2 VMCService;Vodafone Mobile Connect Service;E:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [2008-05-28 14336]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5f91bba4-7a0e-11dd-a157-fe610eb61a35}]
\Shell\AutoRun\command - I:\setup_vmc_lite.exe /checkApplicationPresence
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-04 17:32:27
Windows 5.1.2600 Szervizcsomag 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
E:\Program Files\ESET\ESET Smart Security\ekrn.exe
.
**************************************************************************
.
Completion time: 2008-09-04 17:33:48 - machine was rebooted
ComboFix-quarantined-files.txt 2008-09-04 15:33:45
ComboFix2.txt 2008-09-04 15:27:06
ComboFix3.txt 2008-09-04 14:37:54
ComboFix4.txt 2008-09-04 11:28:57

Pre-Run: 15,688,155,136 bájt szabad
Post-Run: 15,628,939,264 b jt szabad

119

Tehat most csinald eztet:
1:
Megjavitsuk a NETET aztan adok tovabi utasitast:
Start>futatas>masold be eztet oda:

combofix /f3m ok futatod:>majd ide teszed a logot:

2:A combofix utan>jobklik a halozati kapcsoltodra>klik javitani>restart:
Dugjal be minden USB>eszkozot amit hasznalsz ,Kulcsot,FLASH...

3:Kinyitod a Notepadot>Start>futatas>beirod notepad
Es bekopirozod a piros textet






Mostan>a notepadon elso full>ballfelsosarokban>4-sor>lementenni mint....
A txt-hejet beteszed eztett>CFScript.txt<alatta bealitod >minden mapak<
legfelull>asztall i<klik gomb letenni.Es mostan megcsinalod eztett:

A combofix maga elindul es lehet hogy restartol es befejezi a scent.Amit majd ad ted ide Es az uj HijackThis logjat ted ide OK

pofámrol szakadjon le a bör amikor hugom hozzányult tegnap ezekszerint.
remelem azert nem baj. oké várok.

ok,en aztat latom a logbol hogy levan tiltva.
1:Varjal van egy kis munkam es aztan elkezdjuk a javitast
2:A combofixet mar futatad ez mar a masodik log>de mindegy

ComboFix 08-09-01.05 - Drum 2008-09-04 16:33:55.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1038.18.581 [GMT 2:00]
Running from: E:\Documents and Settings\Drum\Asztal\ComboFix.exe
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-08-04 to 2008-09-04 )))))))))))))))))))))))))))))))
.

2008-09-04 16:01 . 2008-09-04 16:02 <DIR> d-------- E:\Program Files\HJK
2008-09-04 13:02 . 2008-09-04 13:02 <DIR> d-------- E:\Documents and Settings\Drum\Application Data\gtopala
2008-09-04 11:42 . 2008-09-04 11:42 <DIR> d-------- E:\Program Files\Guitar Pro 5
2008-09-04 01:42 . 2008-09-04 01:42 <DIR> d-------- E:\Documents and Settings\Drum\Application Data\HEXelon
2008-09-04 01:42 . 2006-01-13 14:00 15,872 --a------ E:\WINDOWS\system32\drivers\vd_filedisk.sys
2008-09-04 01:41 . 2008-09-04 12:47 <DIR> d-------- E:\Program Files\TC UP
2008-09-04 01:25 . 2008-09-04 01:25 <DIR> d-------- E:\Program Files\Vodafone
2008-09-04 01:25 . 2008-09-04 01:25 <DIR> d-------- E:\Program Files\Common Files\InstallShield
2008-09-04 01:25 . 2008-09-04 01:25 <DIR> d-------- E:\Documents and Settings\LocalService\Application Data\Vodafone
2008-09-04 01:25 . 2008-09-04 01:25 <DIR> d-------- E:\Documents and Settings\Drum\Application Data\Vodafone
2008-09-04 01:25 . 2008-09-04 01:25 <DIR> d-------- E:\Documents and Settings\All Users\Application Data\Vodafone
2008-09-04 01:25 . 2008-09-04 01:25 <DIR> d-------- E:\Documents and Settings\All Users\Application Data\InstallShield
2008-09-04 01:24 . 2008-09-04 01:24 <DIR> d-------- E:\Program Files\CCleaner
2008-09-04 01:19 . 2004-08-03 23:08 26,496 --a--c--- E:\WINDOWS\system32\dllcache\usbstor.sys
2008-09-04 01:17 . 2008-09-04 01:17 <DIR> d-------- E:\Documents and Settings\Drum\Application Data\ESET
2008-09-04 01:16 . 2008-09-04 01:16 <DIR> d-------- E:\Program Files\ESET
2008-09-04 01:16 . 2008-09-04 01:16 <DIR> d-------- E:\Documents and Settings\All Users\Application Data\ESET
2008-09-04 01:11 . 2008-09-04 01:11 <DIR> d---s---- E:\WINDOWS\system32\Microsoft
2008-09-04 01:05 . 2008-09-04 01:14 316,640 --a------ E:\WINDOWS\WMSysPr9.prx
2008-09-04 01:03 . 2008-09-04 01:03 <DIR> d-------- E:\WINDOWS\ServicePackFiles
2008-09-04 01:01 . 2004-07-17 11:40 19,528 --a------ E:\WINDOWS\002197_.tmp
2008-09-04 01:00 . 2004-08-03 22:43 15,872 --a------ E:\WINDOWS\system32\spupdsvc.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-03 22:52 558,142 ----a-w E:\WINDOWS\java\Packages\5JXFDR5Z.ZIP
2008-09-03 22:52 155,995 ----a-w E:\WINDOWS\java\Packages\DNZ7Z5VV.ZIP
2008-09-03 22:52 --------- d-----w E:\Program Files\microsoft frontpage
.

((((((((((((((((((((((((((((( snapshot@2008-09-04_13.27.59.15 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-09-04 14:09:57 26,624 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Accessibility\d1ccc7cbc4e442439a5673fa182ebe14\Accessibility.ni.dll
+ 2008-09-04 14:10:04 860,160 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\8af1e39c53e0114b8d8bee960865169c\AspNetMMCExt.ni.dll
+ 2008-09-04 14:10:05 237,568 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\44bb3517b6193b47b20d477ef3929b62\CustomMarshalers.ni.dll
+ 2008-09-04 14:10:05 15,360 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\dfsvc\4d364c9dbfc3684f8be8f22480a73438\dfsvc.ni.exe
+ 2008-09-04 14:10:11 880,640 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\6c6e8bec76ea6a4f81548cdd7696dc13\Microsoft.Build.Engine.ni.dll
+ 2008-09-04 14:10:12 81,920 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\ca1c429664d53f42b2af00c42a80030b\Microsoft.Build.Framework.ni.dll
+ 2008-09-04 14:23:01 1,691,648 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\ae8c1cd441de144394649370c69115b7\Microsoft.Build.Tasks.ni.dll
+ 2008-09-04 14:23:02 163,840 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\01a4126a0cbb5041b55ca1679498ec81\Microsoft.Build.Utilities.ni.dll
+ 2008-09-04 14:23:06 1,724,416 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\c57081acfcdfd34581c1f34bda759ee2\Microsoft.VisualBasic.ni.dll
+ 2008-09-04 14:23:08 962,560 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\69d6cd1455dbcc44a081d108e2798abb\System.Configuration.ni.dll
+ 2008-09-04 14:23:10 1,712,128 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Deployment\9a6d82fac4ff3742ae6b327ae77c31d4\System.Deployment.ni.dll
+ 2008-09-04 14:23:13 512,000 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\04edfcf86bf9a84c8f60cc0886f9f72b\System.DirectoryServices.Protocols.ni.dll
+ 2008-09-04 14:23:12 1,220,608 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\e73515ce7fd2ce438c014a89940e8a51\System.DirectoryServices.ni.dll
+ 2008-09-04 14:23:15 659,456 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\33550cf915c02c48a10d3a6521adf1f1\System.EnterpriseServices.ni.dll
+ 2008-09-04 14:23:15 294,912 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\33550cf915c02c48a10d3a6521adf1f1\System.EnterpriseServices.Wrapper.dll
+ 2008-09-04 14:23:16 729,088 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Security\cc4cda6f43cf624d867998c0c81e2a0a\System.Security.ni.dll
+ 2008-09-04 14:23:18 684,032 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Transactions\3c1e1627eb5b9f4fb5f89f45a3e41585\System.Transactions.ni.dll
+ 2008-09-04 14:23:46 2,310,144 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\454715277a3b364b9ddf36a6f7574b31\System.Web.Mobile.ni.dll
+ 2008-09-04 14:23:47 237,568 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\a4025d8657522f46b1e7cd6c917eeaa3\System.Web.RegularExpressions.ni.dll
+ 2008-09-04 14:23:50 1,945,600 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.Services\3a49f459ad60924da0bb70c73a5acde0\System.Web.Services.ni.dll
+ 2008-09-04 14:23:40 11,808,768 ----a-w E:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\032f6c21f7ec4644b7593c95a46c3b71\System.Web.ni.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)
"DisableRegistryTools"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UacDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"F:\\ccsetup211.exe"=
"E:\\Program Files\\TC UP\\TOTALCMD.EXE"=
"E:\\Program Files\\TC UP\\Plugins\\Media\\Hasla\\hasla.exe"=
"E:\\Program Files\\HJK\\HijackThis.exe"=
"E:\\Documents and Settings\\Drum\\Asztal\\mbr.exe"=
"E:\\Documents and Settings\\Drum\\Asztal\\ComboFix.exe"=
"E:\\WINDOWS\\system32\\CF30463.exe"=

R1 VD_FileDisk;VD_FileDisk;E:\WINDOWS\system32\drivers\VD_FileDisk.sys [2006-01-13 15872]
R2 VMCService;Vodafone Mobile Connect Service;E:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [2008-05-28 14336]
R3 dac970nt;dac970nt;E:\WINDOWS\system32\drivers\rkghon.sys [ ]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5f91bba4-7a0e-11dd-a157-fe610eb61a35}]
\Shell\AutoRun\command - I:\setup_vmc_lite.exe /checkApplicationPresence
.
.
------- Supplementary Scan -------
.

O16 -: DirectAnimation Java Classes - file://E:\WINDOWS\Java\classes\dajava.cab
E:\WINDOWS\Downloaded Program Files\DirectAnimation Java Classes.osd

O16 -: Microsoft XML Parser for Java - file://E:\WINDOWS\Java\classes\xmldso.cab
E:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-04 16:35:37
Windows 5.1.2600 Szervizcsomag 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\.NET CLR Data]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\.NET CLR Networking]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\.NET Data Provider for Oracle]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\.NET Data Provider for SqlServer]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\.NETFramework]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Abiosdsk]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\abp480n5]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\ACPI]
"ImagePath"="System32\DRIVERS\ACPI.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\ACPIEC]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\adpu160m]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\aec]
"ImagePath"="system32\drivers\aec.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\AFD]
"ImagePath"="\SystemRoot\System32\drivers\afd.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Aha154x]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\aic78u2]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\aic78xx]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Alerter]
"ServiceDll"="%SystemRoot%\system32\alrsvc.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\ALG]
"ImagePath"="%SystemRoot%\System32\alg.exe"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\AliIde]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\AmdK7]
"ImagePath"="System32\DRIVERS\amdk7.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\amsint]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\AppMgmt]
"ServiceDll"="%SystemRoot%\System32\appmgmts.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\asc]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\asc3350p]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\asc3550]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\ASP.NET]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\ASP.NET_2.0.50727]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\aspnet_state]
"ImagePath"="%SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\AsyncMac]
"ImagePath"="system32\DRIVERS\asyncmac.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\atapi]
"ImagePath"="System32\DRIVERS\atapi.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Atdisk]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Atmarpc]
"ImagePath"="System32\DRIVERS\atmarpc.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\AudioSrv]
"ServiceDll"="%SystemRoot%\System32\audiosrv.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\audstub]
"ImagePath"="System32\DRIVERS\audstub.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\BattC]
"MofImagePath"="System32\Drivers\battc.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Beep]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\BITS]
"ServiceDll"="%systemroot%\system32\qmgr.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Browser]
"ServiceDll"="%SystemRoot%\System32\browser.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\catchme]
"ImagePath"="\??\E:\ComboFix\catchme.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\cbidf2k]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\cd20xrnt]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Cdaudio]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Cdfs]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Cdrom]
"ImagePath"="System32\DRIVERS\cdrom.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Changer]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\CiSvc]
"ImagePath"="%SystemRoot%\system32\cisvc.exe"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\ClipSrv]
"ImagePath"="%SystemRoot%\system32\clipsrv.exe"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\clr_optimization_v2.0.50727_32]
"ImagePath"="E:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\CmdIde]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\COMSysApp]
"ImagePath"="E:\WINDOWS\System32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\ContentFilter]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\ContentIndex]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Cpqarray]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\CryptSvc]
"ServiceDll"="%SystemRoot%\System32\cryptsvc.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\dac2w2k]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\dac960nt]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\dac970nt]
"ImagePath"="\??\E:\WINDOWS\system32\drivers\rkghon.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\DcomLaunch]
"ServiceDll"="%SystemRoot%\system32\rpcss.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Dhcp]
"ServiceDll"="%SystemRoot%\System32\dhcpcsvc.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Disk]
"ImagePath"="System32\DRIVERS\disk.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\dmadmin]
"ImagePath"="%SystemRoot%\System32\dmadmin.exe /com"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\dmboot]
"ImagePath"="System32\drivers\dmboot.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\dmio]
"ImagePath"="System32\drivers\dmio.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\dmload]
"ImagePath"="System32\drivers\dmload.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\dmserver]
"ServiceDll"="%SystemRoot%\System32\dmserver.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\DMusic]
"ImagePath"="system32\drivers\DMusic.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Dnscache]
"ServiceDll"="%SystemRoot%\System32\dnsrslvr.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\dpti2o]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\drmkaud]
"ImagePath"="system32\drivers\drmkaud.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\eamon]
"ImagePath"="system32\DRIVERS\eamon.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\easdrv]
"ImagePath"="system32\DRIVERS\easdrv.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\EhttpSrv]
"ImagePath"="\"E:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe\""

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\ekrn]
"ImagePath"="\"E:\Program Files\ESET\ESET Smart Security\ekrn.exe\""

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\epfw]
"ImagePath"="system32\DRIVERS\epfw.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Epfwndis]
"ImagePath"="system32\DRIVERS\Epfwndis.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\epfwtdi]
"ImagePath"="system32\DRIVERS\epfwtdi.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\ERSvc]
"ServiceDll"="%SystemRoot%\System32\ersvc.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Eventlog]
"ImagePath"="%SystemRoot%\system32\services.exe"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\EventSystem]
"ServiceDll"="E:\WINDOWS\System32\es.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Fastfat]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\FastUserSwitchingCompatibility]
"ServiceDll"="%SystemRoot%\System32\shsvcs.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Fdc]
"ImagePath"="System32\DRIVERS\fdc.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Fips]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Flpydisk]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\FltMgr]
"ImagePath"="system32\drivers\fltmgr.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Fs_Rec]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Ftdisk]
"ImagePath"="System32\DRIVERS\ftdisk.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\gameenum]
"ImagePath"="System32\DRIVERS\gameenum.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Gpc]
"ImagePath"="System32\DRIVERS\msgpc.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\helpsvc]
"ServiceDll"="%WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\HidServ]
"ServiceDll"="%SystemRoot%\System32\hidserv.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\hidusb]
"ImagePath"="System32\DRIVERS\hidusb.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\hpn]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\HTTP]
"ImagePath"="System32\Drivers\HTTP.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\HTTPFilter]
"ServiceDll"="%SystemRoot%\System32\w3ssl.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\i2omgmt]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\i2omp]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\i8042prt]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Imapi]
"ImagePath"="System32\DRIVERS\imapi.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\ImapiService]
"ImagePath"="%systemroot%\system32\imapi.exe"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\inetaccs]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\ini910u]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Inport]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\IntelIde]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\ip6fw]
"ImagePath"="system32\drivers\ip6fw.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\IpFilterDriver]
"ImagePath"="System32\DRIVERS\ipfltdrv.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\IpInIp]
"ImagePath"="System32\DRIVERS\ipinip.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\IpNat]
"ImagePath"="System32\DRIVERS\ipnat.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\IPSec]
"ImagePath"="System32\DRIVERS\ipsec.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\IRENUM]
"ImagePath"="System32\DRIVERS\irenum.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\ISAPISearch]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\isapnp]
"ImagePath"="System32\DRIVERS\isapnp.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Kbdclass]
"ImagePath"="System32\DRIVERS\kbdclass.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\kbdhid]
"ImagePath"="System32\DRIVERS\kbdhid.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\kmixer]
"ImagePath"="system32\drivers\kmixer.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\KSecDD]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\lanmanserver]
"ServiceDll"="%SystemRoot%\System32\srvsvc.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\lanmanworkstation]
"ServiceDll"="%SystemRoot%\System32\wkssvc.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\lbrtfdc]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\ldap]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\LicenseService]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\LmHosts]
"ServiceDll"="%SystemRoot%\System32\lmhsvc.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\mbr]
"ImagePath"="\??\E:\DOCUME~1\Drum\LOCALS~1\Temp\mbr.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Messenger]
"ServiceDll"="%SystemRoot%\System32\msgsvc.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\mnmdd]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\mnmsrvc]
"ImagePath"="E:\WINDOWS\System32\mnmsrvc.exe"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Modem]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Mouclass]
"ImagePath"="System32\DRIVERS\mouclass.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\mouhid]
"ImagePath"="System32\DRIVERS\mouhid.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\MountMgr]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\mraid35x]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\MRxDAV]
"ImagePath"="System32\DRIVERS\mrxdav.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\MRxSmb]
"ImagePath"="System32\DRIVERS\mrxsmb.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\MSDTC]
"ImagePath"="E:\WINDOWS\System32\msdtc.exe"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Msfs]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\MSIServer]
"ImagePath"="%systemroot%\system32\msiexec.exe /V"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\MSKSSRV]
"ImagePath"="system32\drivers\MSKSSRV.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\MSPCLOCK]
"ImagePath"="system32\drivers\MSPCLOCK.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\MSPQM]
"ImagePath"="system32\drivers\MSPQM.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\mssmbios]
"ImagePath"="System32\DRIVERS\mssmbios.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\ms_mpu401]
"ImagePath"="system32\drivers\msmpu401.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Mup]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\NDIS]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\NdisTapi]
"ImagePath"="System32\DRIVERS\ndistapi.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Ndisuio]
"ImagePath"="System32\DRIVERS\ndisuio.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\NdisWan]
"ImagePath"="System32\DRIVERS\ndiswan.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\NDProxy]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\NetBIOS]
"ImagePath"="System32\DRIVERS\netbios.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\NetBT]
"ImagePath"="System32\DRIVERS\netbt.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\NetDDE]
"ImagePath"="%SystemRoot%\system32\netdde.exe"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\NetDDEdsdm]
"ImagePath"="%SystemRoot%\system32\netdde.exe"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Netlogon]
"ImagePath"="%SystemRoot%\system32\lsass.exe"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Netman]
"ServiceDll"="%SystemRoot%\System32\netman.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Nla]
"ServiceDll"="%SystemRoot%\System32\mswsock.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Npfs]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Ntfs]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\NtLmSsp]
"ImagePath"="%SystemRoot%\System32\lsass.exe"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\NtmsSvc]
"ServiceDll"="%SystemRoot%\system32\ntmssvc.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Null]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\nv]
"ImagePath"="System32\DRIVERS\nv4_mini.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\NwlnkFlt]
"ImagePath"="System32\DRIVERS\nwlnkflt.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\NwlnkFwd]
"ImagePath"="System32\DRIVERS\nwlnkfwd.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Parport]
"ImagePath"="System32\DRIVERS\parport.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\PartMgr]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\ParVdm]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\PCI]
"ImagePath"="System32\DRIVERS\pci.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\PCIDump]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\PCIIde]
"ImagePath"="System32\DRIVERS\pciide.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Pcmcia]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\PDCOMP]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\PDFRAME]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\PDRELI]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\PDRFRAME]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\perc2]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\perc2hib]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\PerfDisk]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\PerfNet]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\PerfOS]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\PerfProc]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\PlugPlay]
"ImagePath"="%SystemRoot%\system32\services.exe"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\PolicyAgent]
"ImagePath"="%SystemRoot%\system32\lsass.exe"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\PptpMiniport]
"ImagePath"="System32\DRIVERS\raspptp.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Processor]
"ImagePath"="System32\DRIVERS\processr.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\ProtectedStorage]
"ImagePath"="%SystemRoot%\system32\lsass.exe"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\PSched]
"ImagePath"="System32\DRIVERS\psched.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Ptilink]
"ImagePath"="System32\DRIVERS\ptilink.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\ql1080]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Ql10wnt]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\ql12160]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\ql1240]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\ql1280]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\RasAcd]
"ImagePath"="System32\DRIVERS\rasacd.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\RasAuto]
"ServiceDll"="%SystemRoot%\System32\rasauto.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Rasl2tp]
"ImagePath"="System32\DRIVERS\rasl2tp.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\RasMan]
"ServiceDll"="%SystemRoot%\System32\rasmans.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\RasPppoe]
"ImagePath"="System32\DRIVERS\raspppoe.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Raspti]
"ImagePath"="System32\DRIVERS\raspti.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Rdbss]
"ImagePath"="System32\DRIVERS\rdbss.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\RDPCDD]
"ImagePath"="System32\DRIVERS\RDPCDD.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\RDPDD]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\rdpdr]
"ImagePath"="System32\DRIVERS\rdpdr.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\RDPNP]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\RDPWD]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\RDSessMgr]
"ImagePath"="E:\WINDOWS\system32\sessmgr.exe"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\redbook]
"ImagePath"="System32\DRIVERS\redbook.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\RemoteAccess]
"ServiceDll"="%SystemRoot%\System32\mprdim.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\RemoteRegistry]
"ServiceDll"="%SystemRoot%\system32\regsvc.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\RpcLocator]
"ImagePath"="%SystemRoot%\System32\locator.exe"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\RpcSs]
"ServiceDll"="%SystemRoot%\System32\rpcss.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\RSVP]
"ImagePath"="%SystemRoot%\System32\rsvp.exe"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\SamSs]
"ImagePath"="%SystemRoot%\system32\lsass.exe"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\SCardSvr]
"ImagePath"="%SystemRoot%\System32\SCardSvr.exe"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Schedule]
"ServiceDll"="%SystemRoot%\system32\schedsvc.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\ScsiPort]
"ImagePath"="%SystemRoot%\system32\drivers\scsiport.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Secdrv]
"ImagePath"="System32\DRIVERS\secdrv.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\seclogon]
"ServiceDll"="%SystemRoot%\System32\seclogon.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\SENS]
"ServiceDll"="%SystemRoot%\system32\sens.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\serenum]
"ImagePath"="System32\DRIVERS\serenum.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Serial]
"ImagePath"="System32\DRIVERS\serial.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Sfloppy]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\SharedAccess]
"ServiceDll"="%SystemRoot%\System32\ipnathlp.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\ShellHWDetection]
"ServiceDll"="%SystemRoot%\System32\shsvcs.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Simbad]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Sparrow]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\splitter]
"ImagePath"="system32\drivers\splitter.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Spooler]
"ImagePath"="%SystemRoot%\system32\spoolsv.exe"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\sr]
"ImagePath"="system32\DRIVERS\sr.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\srservice]
"ServiceDll"="E:\WINDOWS\System32\srsvc.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Srv]
"ImagePath"="System32\DRIVERS\srv.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\SSDPSRV]
"ServiceDll"="%SystemRoot%\System32\ssdpsrv.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\stisvc]
"ServiceDll"="%SystemRoot%\system32\wiaservc.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\swenum]
"ImagePath"="System32\DRIVERS\swenum.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\swmidi]
"ImagePath"="system32\drivers\swmidi.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\SwPrv]
"ImagePath"="E:\WINDOWS\System32\dllhost.exe /Processid:{5DFC26F6-83FC-42F3-8FA7-64439BEDDCC9}"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\swwd]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\symc810]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\symc8xx]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\sym_hi]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\sym_u3]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\sysaudio]
"ImagePath"="system32\drivers\sysaudio.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\SysmonLog]
"ImagePath"="%SystemRoot%\system32\smlogsvc.exe"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\TapiSrv]
"ServiceDll"="%SystemRoot%\System32\tapisrv.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Tcpip]
"ImagePath"="System32\DRIVERS\tcpip.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\TDPIPE]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\TDTCP]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\TermDD]
"ImagePath"="System32\DRIVERS\termdd.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\TermService]
"ServiceDll"="%SystemRoot%\System32\termsrv.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Themes]
"ServiceDll"="%SystemRoot%\System32\shsvcs.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\TlntSvr]
"ImagePath"="E:\WINDOWS\System32\tlntsvr.exe"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\TosIde]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\TrkWks]
"ServiceDll"="%SystemRoot%\system32\trkwks.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\TSDDD]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Udfs]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\ultra]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Update]
"ImagePath"="System32\DRIVERS\update.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\upnphost]
"ServiceDll"="%SystemRoot%\System32\upnphost.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\UPS]
"ImagePath"="%SystemRoot%\System32\ups.exe"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\usbccgp]
"ImagePath"="System32\DRIVERS\usbccgp.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\usbehci]
"ImagePath"="System32\DRIVERS\usbehci.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\usbhub]
"ImagePath"="System32\DRIVERS\usbhub.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\usbohci]
"ImagePath"="System32\DRIVERS\usbohci.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\USBSTOR]
"ImagePath"="system32\DRIVERS\USBSTOR.SYS"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\VD_FileDisk]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\VgaSave]
"ImagePath"="\SystemRoot\System32\drivers\vga.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\ViaIde]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\VMCService]
"ImagePath"="\"E:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe\""

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\VolSnap]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\VSS]
"ImagePath"="%SystemRoot%\System32\vssvc.exe"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\W32Time]
"ServiceDll"="%systemroot%\system32\w32time.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\W3SVC]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Wanarp]
"ImagePath"="System32\DRIVERS\wanarp.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\WDICA]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\wdmaud]
"ImagePath"="system32\drivers\wdmaud.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\WebClient]
"ServiceDll"="%SystemRoot%\System32\webclnt.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\winmgmt]
"ServiceDll"="%SystemRoot%\system32\wbem\WMIsvc.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Winsock]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\WinSock2]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\WinTrust]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\WmdmPmSN]
"ServiceDll"="E:\WINDOWS\System32\mspmsnsv.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Wmi]
"ServiceDll"="%SystemRoot%\System32\advapi32.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\WmiApRpl]

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\WmiApSrv]
"ImagePath"="E:\WINDOWS\System32\wbem\wmiapsrv.exe"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\wscsvc]
"ServiceDll"="%SYSTEMROOT%\system32\wscsvc.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\wuauserv]
"ServiceDll"="E:\WINDOWS\System32\wuauserv.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\WZCSVC]
"ServiceDll"="%SystemRoot%\System32\wzcsvc.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\xmlprov]
"ServiceDll"="%SystemRoot%\System32\xmlprov.dll"
.
Completion time: 2008-09-04 16:37:49
ComboFix-quarantined-files.txt 2008-09-04 14:37:44
ComboFix2.txt 2008-09-04 11:28:57

Pre-Run: 15,741,431,808 bájt szabad
Post-Run: 15,744,516,096 bájt szabad

589

keresés közben hibaüzenet vagy 15-szer: "az adatbázis szerkesztését a rendszergazda letiltotta"

ok,az Autorun.info az Virus egyelore ne torodj vele majd el banunk vele.
Ha feltudod teni a gepre az ASZTALRA a Combofixet akor ird ide,ha nem akor is.

rendes modba, héozat net nincs

az autorun.inf tartalma:

;RYlfSBBcWkG
[AutoRun]
;heOCogsleijbSSr yWJML

;inqYr
shelL\OPEn\DeFAULT=1

;EBAlfG
open=dpni.cmd
shELL\eXPLoRe\CoMmAND =dpni.cmd

;
sHell\opeN\cOmmanD =dpni.cmd

;utpv KRCHHAMmki PrgE BdtcDQCbowHLSdimhGH dbkPjCjoBE
sHEll\aUtOPLAy\CommAnd =dpni.cmd

Tehat:
1:Van kapcsolatod a netre??
2:Hol vagy most csokentet modban vagy a rendes windowsban.??

csökkentett modban mindig ujraindul a gép.

Meg valamit segitek neked de csak azt csinald amit irok es felelj ha kerdezek,mert ha osze visza kezdel futatni mindenfele programokat akor soha sem csinaljuk meg a gepet igen a leirasod szerint es a HiJackban is latok problemat,Az autorun.info>ez virus az autorun.exe az nem virus,

irtam, semmi muveletet nem hajtottam végre még, tegnap egy win install volt, azért tünik ilyen kevésnek, de ha gondolod összevirusozom megint...=) igen a mbr.exe-re olvastam hamis risztast, de nekem azelött is volt a gépen Sality.NAT de érdekes mindig sikerül letörölni.

hm,ez a Hijack logja csak enyi az egesz??Bootvirusod nincsen.
Vagy oszevisza lefixeltel mindent,vagy csokentet modban Vagy??
a mbr.exe nem virus hamis riasztas.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:02:14, on 2008.09.04.
Platform: Windows XP Szervizcsomag 2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
E:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe
E:\WINDOWS\system32\wuauclt.exe
E:\Program Files\TC UP\TOTALCMD.EXE
E:\Program Files\HJK\HijackThis.exe
E:\Program Files\ESET\ESET Smart Security\ekrn.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - E:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - E:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Vodafone Mobile Connect Service (VMCService) - Vodafone - E:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe

--
End of file - 1588 bytes
********************************************************************
Stealth MBR rootkit detector 0.2.4 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK


az érdekes hogy a két gépem kozul ez még mukodik, de máris risztott itt a nod32 mbr.exe-re win32/sality.NAT

OK,
Ted ide a HiJack progi logjat>+ ezt a programot ted az asztalra >futasd>par masodperc mulva ad logot ted szinten ide.
http://www2.gmer.net/mbr/mbr.exe

na még anyit elfelejtettem hogy az összes flash memorian volt ilyen rejtett fájlom: autorun.inf, autorun.exe, késöbbiekben az autorun.exe helyett már csak egy kreált *****.cmd fájl jelentkezett. ezektöl megszabadultam, akkor még ment a csökkentett módom.

sir prof.dr stell! (vagy ne nyaljak?=))

segitsegre lenne szuksegem. se elore se hátra. van valami a gépen ami mindig ott van a meghajtókon. a tünetek: a beegyzett vindows xp-m,tuzfala és hálózati beállitásai NOD32 szerint módosultak, ezt szovátette a win security center is. a taskmanager nem működik: "a rendszergazda letiltotta" szöveggel, a regedit ugyancsak: "az adatbázis szerkesztését a redszergazda letiltott" szöveggel. a csökkentett módok a betöltödö fájlok felsorolása után ujrainditja a gépet. én egy 24éves srác vagyok, de tegnap hajnalban már majdnem szoszerint sirógörcsöt kaptam emiatt, de hála istennek bele sikerült folytani egy doboz sörbe. nem probálkoztam semmi hijackthis-el meg combofixel mert vegignezve a forumot mindenkinek más az eljárás az ügyben, lehet nekem is ilyen bootsectoros dolgom van. memoriába "beleéghet"? milyen gyilkoló programokra van szuksegem a hijackthis, combofix, és CCleaner mellett? ja és VODA HSDPA netem van egy usb huawei modemmel ami nem indul el a virus miatt, nod smart sem indul, ccleaner sem, mint mondtam csökkentett mód esélytelen. elöre is köszi!

Tolds le inen a Windows Washert>kipucolni vele mindent MSN....
Ha netudod hogy kel hasznalni akor majd leirom>de elote mends le a kontaktokat MSN....mert ha 0 ra kipucolod tobszor akor lehet hogy elveszlik.OK.
http://www.eusing.com/Window_Washer/Window_Washer.htm

Szia Stell, az igazi seven vagyok, tesómék azt mondták, h gyorsabb lett a gép, meg még a net is a pucolás után.
De sajnos az msn továbbra is küldözgeti a linkeket.
Változtattunk jelszót is Msn-be.

Nem tudom számít-e, h most tesóm munkahelyén levő gépről küldözget az msn, nem tudom ilyenkor a géppel vagy msn-el van-e gond, majd Te megmondod.

üdv