Uj MBR-fereg.olvasd
http://sites.google.com/site/stellmajds ... in32zimuse

udv
ha nem segit valaki mas akor csinald eztet
1:Ugy nez ki hogy virusod van,ezert a virus ugyeket a Forumomon csinalom,
tehat menj att a forumora
http://squito-web.com/stell/forum/index.php
olvasd ell a tudnivalot es ted ba az utasitas szerint az RSIT logjat uj Temaba.

Sziasztok! Ugyanez lenne a gondom, mint Bencének...kikapcsoláskor kékhalál a következő szöveggel:

STOP: c000021a {Helyrehozhatatlan Rendszerhiba}
A rendszerfolyamat (Windows Logon Process) váratlanul félbeszakadt. Állapot: 0x00000000 (0x00000000 0x00000000).
A rendszer leállt.

Tudnátok nekem is segíteni? Gondolom nem pont ugyanezt kell csinálnom az elérési utak miatt...

Előre is köszi: Gréti

speedyke68
hm,ez igen keves amit irsz kekhalal,mit ir ki csak kikapcsolasnal??milyen rendszer,,?/

ok,bence nincsen mit

Sikerült feltelepíteni, működik minden! Köszi a sok segítséget!!!

Bence

oda van irva felkel raknod Hotfixet .es csak utana felrakni a ZoneAlarmot
it van a Hotfix rakd fel restart es mehet a tuzfal.
http://download.zonelabs.com/bin/free/beta/WindowsXP-KB943232-x86-ENU.exe

Letöltöttöem a ZoneAlarm-ot (origo Szoftverbázisról), és amikor telepíteni akarom ezt írja ki:

Your computer needs a Windows XP Service Pack hotfix befor you can install this version of ZoneAlarm. Please get hotfix KB943232 from the site shown below, install the hotfix, reboot, and then run ZoneAlarm installer.

Lehet hogy a CCleaner törölt valamit?

eztet je;lenti


ha te csinaltad hagyd meg ha akarod,de lefixeled a hijackal mar ugyse indul.

Mit jelent hogy fixáljam le a HiJack-et, mert a killprocess.bat-ot azt én csináltm, hogy amikor elindul a gép egy pár felesleges folyamatot bezár (mint pl.: google update). Ilyenek vannak benne:



A ZoneAlarm tűzfal? Azt tegyem fel?

ok,bence van ido,igem tudtam hogy nemlesz mert ot volt a vizilo virus

Hello! Suliban vagyok, otthon megcsinálom. De a kék halál eltünt!!!

ok,fixeld le a HiJackal
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Bence\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - Global Startup: killprocess.bat
leszeded a combofixet-start-futatas-masold be combofix /u ok
kipucolod a gepet CCleaneral

Idézet:

ostan toldsd le a -CCleanert-futatod-kinyilik a Windows Full-mindent bepipazol-klik-analyze-klik run cleaner-de a bongeszokett zard be.Adig nyomkodod a cleaner gombott meg nemtiszta a joboldalon az ablak.
http://www.ccleaner.com/download/downloadpage.aspx?f=2
Klik -Full-Aplikaciok-itt is bepipazni mindent-es ugyanugy csinalod.

Utana klik ISSUES-az a kocka=register->rendszer iro>itt is bepipazni mindent ugyanugy ha valamitt kerdez beleegyezel-klik fix problem.

Eztett megcsinalni kiprobalni es leirni ha van problem.

Felrakol tuzfalat-mehet a ZoneAlarm es ird le mi ujsag van

Még este elkészültem, csak nem tudtam bejelentkezni.
A ComboFix log-ja:

ComboFix 08-11-30.02 - Bence 2008-12-02 20:57:27.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1038.18.553 [GMT 1:00]
Running from: c:\documents and settings\Bence\Asztal\ComboFix.exe
Command switches used :: c:\documents and settings\Bence\Asztal\CFScript.txt
* Created a new restore point
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
c:\windows\system32\SET103F.tmp
c:\windows\system32\SET1043.tmp
c:\windows\system32\SET1045.tmp
c:\windows\system32\SET1046.tmp
c:\windows\system32\SET104C.tmp
c:\windows\system32\SET104F.tmp
c:\windows\system32\SET1055.tmp
c:\windows\system32\SET1A5.tmp
c:\windows\system32\SET221.tmp
c:\windows\system32\winzlo32.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\SET103F.tmp
c:\windows\system32\SET1043.tmp
c:\windows\system32\SET1045.tmp
c:\windows\system32\SET1046.tmp
c:\windows\system32\SET104C.tmp
c:\windows\system32\SET104F.tmp
c:\windows\system32\SET1055.tmp
c:\windows\system32\SET1A5.tmp
c:\windows\system32\SET221.tmp
c:\windows\system32\winzlo32.dll

.
((((((((((((((((((((((((( Files Created from 2008-11-02 to 2008-12-02 )))))))))))))))))))))))))))))))
.

2008-12-01 17:16 . 2004-08-18 13:00 504,320 --a------ c:\windows\system32\winlogon.exe
2008-12-01 17:16 . 2004-08-18 13:00 504,320 --a--c--- c:\windows\system32\dllcache\winlogon.exe
2008-11-30 19:50 . 2004-08-03 22:31 154,624 --a--c--- c:\windows\system32\dllcache\wlluc48.sys
2008-11-30 19:50 . 2004-08-17 16:47 116,736 --a--c--- c:\windows\system32\dllcache\xrxwiadr.dll
2008-11-30 19:50 . 2001-08-18 06:37 99,865 --a--c--- c:\windows\system32\dllcache\xlog.exe
2008-11-30 19:50 . 2001-10-26 21:25 27,648 --a--c--- c:\windows\system32\dllcache\xrxftplt.exe
2008-11-30 19:50 . 2001-10-26 21:25 23,040 --a--c--- c:\windows\system32\dllcache\xrxwbtmp.dll
2008-11-30 19:50 . 2004-08-03 22:29 19,455 --a--c--- c:\windows\system32\dllcache\wvchntxx.sys
2008-11-30 19:50 . 2001-10-26 21:25 17,408 --a--c--- c:\windows\system32\dllcache\xrxscnui.dll
2008-11-30 19:50 . 2001-08-17 20:11 16,970 --a--c--- c:\windows\system32\dllcache\xem336n5.sys
2008-11-30 19:50 . 2004-08-03 22:29 12,063 --a--c--- c:\windows\system32\dllcache\wsiintxx.sys
2008-11-30 19:50 . 2004-08-03 23:07 8,832 --a--c--- c:\windows\system32\dllcache\wmiacpi.sys
2008-11-30 19:50 . 2004-08-17 16:47 8,192 --a--c--- c:\windows\system32\dllcache\wshirda.dll
2008-11-30 19:50 . 2001-10-26 21:25 4,608 --a--c--- c:\windows\system32\dllcache\xrxflnch.exe
2008-11-30 19:48 . 2001-08-17 21:28 794,654 --a--c--- c:\windows\system32\dllcache\usr1801.sys
2008-11-30 19:47 . 2001-10-26 21:25 525,568 --a--c--- c:\windows\system32\dllcache\tridxp.dll
2008-11-30 19:46 . 2001-10-26 21:24 315,520 --a--c--- c:\windows\system32\dllcache\trid3d.dll
2008-11-30 19:45 . 2001-10-26 21:24 172,768 --a--c--- c:\windows\system32\dllcache\t2r4disp.dll
2008-11-30 19:44 . 2001-10-26 18:18 286,528 --a--c--- c:\windows\system32\dllcache\stlnata.sys
2008-11-30 19:43 . 2001-10-26 21:24 157,696 --a--c--- c:\windows\system32\dllcache\sisv256.dll
2008-11-30 19:42 . 2001-10-26 21:24 386,560 --a--c--- c:\windows\system32\dllcache\sgiul50.dll
2008-11-30 19:41 . 2001-10-26 21:23 495,616 --a--c--- c:\windows\system32\dllcache\sblfx.dll
2008-11-30 19:40 . 2001-10-26 20:25 899,402 --a--c--- c:\windows\system32\dllcache\r2mdkxga.sys
2008-11-30 19:39 . 2004-08-17 16:47 363,520 --a--c--- c:\windows\system32\dllcache\psisdecd.dll
2008-11-30 19:38 . 2004-08-17 16:44 259,328 --a--c--- c:\windows\system32\dllcache\perm3dd.dll
2008-11-30 19:37 . 2001-08-17 22:05 351,616 --a--c--- c:\windows\system32\dllcache\ovcodek2.sys
2008-11-30 19:36 . 2004-08-17 16:35 132,695 --a--c--- c:\windows\system32\dllcache\netwlan5.sys
2008-11-30 19:35 . 2001-10-26 19:28 131,072 --a--c--- c:\windows\system32\dllcache\n100325.sys
2008-11-30 19:34 . 2001-10-26 18:56 320,384 --a--c--- c:\windows\system32\dllcache\mgaum.sys
2008-11-30 19:33 . 2001-08-17 21:28 802,683 --a--c--- c:\windows\system32\dllcache\ltsm.sys
2008-11-30 19:32 . 2001-10-26 21:24 242,176 --a--c--- c:\windows\system32\dllcache\kdsusd.dll
2008-11-30 19:31 . 2001-10-26 21:24 372,824 --a--c--- c:\windows\system32\dllcache\iconf32.dll
2008-11-30 19:30 . 2004-08-17 16:46 702,845 --a--c--- c:\windows\system32\dllcache\i81xdnt5.dll
2008-11-30 19:29 . 2001-10-26 20:31 908,256 --a--c--- c:\windows\system32\dllcache\hcf_msft.sys
2008-11-30 19:28 . 2001-10-26 21:24 1,733,120 --a--c--- c:\windows\system32\dllcache\g400d.dll
2008-11-30 19:27 . 2001-10-26 20:11 629,984 --a--c--- c:\windows\system32\dllcache\eqn.sys
2008-11-30 19:26 . 2001-08-17 20:14 952,007 --a--c--- c:\windows\system32\dllcache\diwan.sys
2008-11-30 19:25 . 2001-10-26 21:25 618,525 --a--c--- c:\windows\system32\dllcache\digiview.exe
2008-11-30 19:24 . 2001-10-26 18:57 980,034 --a--c--- c:\windows\system32\dllcache\cicap.sys
2008-11-30 19:23 . 2001-08-17 21:28 871,388 --a--c--- c:\windows\system32\dllcache\bcmdm.sys
2008-11-30 19:22 . 2001-08-17 21:28 762,780 --a--c--- c:\windows\system32\dllcache\3cwmcru.sys
2008-11-30 19:21 . 2001-10-26 21:24 66,048 --a--c--- c:\windows\system32\dllcache\s3legacy.dll
2008-11-30 15:05 . 2008-11-30 15:05 <DIR> d-------- c:\program files\DAEMON Tools
2008-11-29 18:08 . 2008-11-29 18:08 <DIR> d-------- c:\program files\Common Files\Yahoo!
2008-11-29 18:08 . 2008-11-29 18:08 <DIR> d-------- c:\documents and settings\All Users\Application Data\Studio 12
2008-11-29 18:08 . 2008-11-29 18:08 <DIR> d-------- c:\documents and settings\All Users\Application Data\Pinnacle Studio Plus
2008-11-29 15:29 . 2008-04-14 09:01 3,066,880 --a------ c:\windows\system32\SET331.tmp
2008-11-29 15:28 . 2008-04-14 09:02 509,952 --a------ c:\windows\system32\SET1A3.tmp
2008-11-29 15:25 . 2006-12-28 12:01 19,569 --a------ c:\windows\003139_.tmp
2008-11-29 15:22 . 2004-08-18 13:00 1,896,400 --a------ c:\windows\system32\dllcache\nt5.cat
2008-11-29 15:21 . 2005-09-29 19:31 2,137,600 --a------ c:\windows\system32\ntoskrnl.exe
2008-11-29 15:15 . 2008-11-29 15:15 <DIR> d-------- c:\windows\system32\CatRoot_bak
2008-11-29 14:39 . 2008-11-29 14:39 <DIR> d-------- C:\VundoFix Backups
2008-11-29 13:52 . 2008-11-29 13:52 <DIR> d---s---- c:\documents and settings\Bence\UserData
2008-11-29 12:39 . 2004-08-18 13:00 13,463,552 --a--c--- c:\windows\system32\dllcache\hwxjpn.dll
2008-11-29 12:38 . 2004-08-18 13:00 10,096,640 --a--c--- c:\windows\system32\dllcache\hwxcht.dll
2008-11-29 12:37 . 2003-04-14 20:56 212,992 --a--c--- c:\windows\system32\dllcache\fpmmcsat.dll
2008-11-29 12:37 . 2003-04-14 20:56 16,384 --a--c--- c:\windows\system32\dllcache\tcptsat.dll
2008-11-29 12:37 . 2001-10-26 21:24 5,632 --a--c--- c:\windows\system32\dllcache\EXCH_adsiisex.dll
2008-11-29 12:32 . 2008-11-29 12:32 749 -rah----- c:\windows\WindowsShell.Manifest
2008-11-29 12:32 . 2008-11-29 12:32 749 -rah----- c:\windows\system32\wuaucpl.cpl.manifest
2008-11-29 12:32 . 2008-11-29 12:32 749 -rah----- c:\windows\system32\sapi.cpl.manifest
2008-11-29 12:32 . 2008-11-29 12:32 749 -rah----- c:\windows\system32\ncpa.cpl.manifest
2008-11-29 12:32 . 2008-11-29 12:32 488 -rah----- c:\windows\system32\logonui.exe.manifest
2008-11-29 12:31 . 2004-08-18 13:00 16,384 --a--c--- c:\windows\system32\dllcache\isignup.exe
2008-11-29 12:18 . 2001-08-17 20:13 27,165 --a------ c:\windows\system32\drivers\fetnd5.sys
2008-11-29 12:18 . 2001-08-17 20:13 27,165 --a--c--- c:\windows\system32\dllcache\fetnd5.sys
2008-11-23 00:03 . 2008-11-23 00:03 0 --a------ c:\windows\system32\EpfwUser.dat
2008-11-22 11:25 . 2008-11-22 11:25 39,686,818 --a------ c:\windows\winlogon836.dmp
2008-11-22 11:15 . 2008-11-22 11:15 39,633,508 --a------ c:\windows\winlogon2676.dmp
2008-11-22 11:13 . 2008-11-22 11:15 39,536,976 --a------ c:\windows\winlogon832.dmp
2008-11-22 11:09 . 2008-11-22 11:09 <DIR> d-------- c:\windows\system32\kktools
2008-11-22 11:09 . 2007-03-05 17:31 64,384 --a------ c:\windows\system32\drivers\userdump.sys
2008-11-22 11:08 . 2008-11-22 11:08 <DIR> d-------- C:\kktools
2008-11-21 16:38 . 1998-09-02 09:02 194,320 --a------ c:\windows\system32\qcut.dll
2008-11-21 16:38 . 1998-08-20 12:02 140,800 --a------ c:\windows\system32\tm20dec.ax
2008-11-21 16:38 . 1998-09-02 09:28 63,488 --a------ c:\windows\system32\unam4ie.exe
2008-11-21 16:38 . 1998-09-02 09:28 38,160 --a------ c:\windows\system32\LMRTREND.dll
2008-11-21 16:38 . 1998-08-17 10:21 11,776 --a------ c:\windows\system32\mciqtz.drv
2008-11-21 16:38 . 1998-08-17 10:21 10,240 --a------ c:\windows\system32\vidx16.dll
2008-11-21 16:38 . 1998-08-17 10:21 5,672 --a------ c:\windows\system32\quartz.vxd
2008-11-21 16:38 . 2008-11-21 16:38 4,608 --a------ c:\windows\system32\w95inf32.dll
2008-11-21 16:38 . 2008-11-21 16:38 2,272 --a------ c:\windows\system32\w95inf16.dll
2008-11-21 16:37 . 2008-11-21 16:37 <DIR> d-------- c:\program files\LEGO Media
2008-11-20 21:27 . 2008-11-20 21:27 <DIR> d-------- c:\documents and settings\Bence\Application Data\DivX
2008-11-20 21:25 . 2008-11-20 21:25 <DIR> d-------- c:\program files\Common Files\Pinnacle
2008-11-20 21:25 . 2008-11-20 21:25 <DIR> d-------- c:\documents and settings\All Users\Application Data\Pinnacle Studio Ultimate
2008-11-15 19:13 . 2008-11-15 19:13 <DIR> d-------- c:\program files\ESET
2008-11-03 21:26 . 2008-07-08 10:51 <DIR> d--h----- c:\documents and settings\Rendszergazda\Sablonok
2008-11-03 21:26 . 2008-07-08 12:44 <DIR> d-------- c:\documents and settings\Rendszergazda\Dokumentumok
2008-11-03 21:26 . 2008-07-08 10:59 <DIR> d-------- c:\documents and settings\Rendszergazda\Asztal
2008-11-03 21:26 . 2008-11-03 21:27 <DIR> d-------- c:\documents and settings\Rendszergazda
2008-11-03 20:15 . 2008-11-03 20:16 <DIR> d-------- c:\program files\Gepiras 2000

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-29 17:18 --------- d-----w c:\documents and settings\Bence\Application Data\Any Video Converter
2008-11-29 17:15 --------- d-----w c:\documents and settings\Bence\Application Data\LimeWire
2008-11-29 17:08 --------- d-----w c:\program files\Pinnacle
2008-11-29 13:34 685,816 ----a-w c:\windows\system32\drivers\sptd.sys
2008-11-29 11:12 9,388 ----a-w c:\windows\system32\drivers\iaStor.PNF
2008-11-29 11:12 7,280 ----a-w c:\windows\system32\drivers\viamraid.PNF
2008-11-29 11:12 63,240 ----a-w c:\windows\system32\drivers\Si3112r.PNF
2008-11-29 11:12 6,984 ----a-w c:\windows\system32\drivers\SiSRaid.PNF
2008-11-29 11:12 20,152 ----a-w c:\windows\system32\drivers\INFCACHE.1
2008-11-29 11:12 12,432 ----a-w c:\windows\system32\drivers\adpu320.PNF
2008-11-29 11:12 12,204 ----a-w c:\windows\system32\drivers\nvraid.PNF
2008-11-29 11:12 10,828 ----a-w c:\windows\system32\drivers\iaAHCI.PNF
2008-11-26 20:53 --------- d-----w c:\documents and settings\Bence\Application Data\uTorrent
2008-11-26 14:32 --------- d-----w c:\program files\Opera
2008-10-28 15:41 --------- d-----w c:\program files\WMR11
2008-10-26 22:41 --------- d-----w c:\program files\Safari
2008-10-26 22:41 --------- d-----w c:\documents and settings\Bence\Application Data\Apple Computer
2008-10-26 22:40 --------- d-----w c:\program files\Apple Software Update
2008-10-26 22:40 --------- d-----w c:\documents and settings\All Users\Application Data\Apple
2008-10-26 21:25 --------- d-----w c:\program files\Unlocker
2008-10-25 21:55 --------- d-----w c:\program files\Netscape
2008-10-25 21:55 --------- d-----w c:\documents and settings\Bence\Application Data\Netscape
2008-10-22 14:53 --------- d--h--w c:\program files\InstallShield Installation Information
2008-10-22 12:48 --------- d-----w c:\program files\Totalcmd
2008-10-18 15:42 --------- d-----w c:\program files\Messenger Plus! Live
2008-10-12 06:18 --------- d-----w c:\documents and settings\Mami\Application Data\AdobeUM
2008-10-04 14:04 --------- d-----w c:\program files\Program Produkt
2008-10-04 13:58 --------- d-----w c:\program files\VirtualDJ
2008-10-04 09:20 --------- d-----w c:\program files\BeamYourScreen Free Version
.

((((((((((((((((((((((((((((( snapshot@2008-12-02_15.29.34.25 )))))))))))))))))))))))))))))))))))))))))
.
- 2004-08-18 12:00:00 66,560 ----a-w c:\windows\system32\cdm.dll
+ 2008-07-18 21:10:48 94,920 ----a-w c:\windows\system32\cdm.dll
- 2004-08-18 12:00:00 66,560 -c--a-w c:\windows\system32\dllcache\cdm.dll
+ 2008-07-18 21:10:48 94,920 -c--a-w c:\windows\system32\dllcache\cdm.dll
- 2004-08-18 12:00:00 431,104 -c--a-w c:\windows\system32\dllcache\wuapi.dll
+ 2008-07-18 21:09:44 563,912 -c--a-w c:\windows\system32\dllcache\wuapi.dll
- 2004-08-18 12:00:00 112,128 -c--a-w c:\windows\system32\dllcache\wuauclt.exe
+ 2008-07-18 21:10:42 53,448 -c--a-w c:\windows\system32\dllcache\wuauclt.exe
- 2004-08-18 12:00:00 1,134,592 -c--a-w c:\windows\system32\dllcache\wuaueng.dll
+ 2008-07-18 21:09:42 1,811,656 -c--a-w c:\windows\system32\dllcache\wuaueng.dll
- 2004-08-18 12:00:00 113,152 -c--a-w c:\windows\system32\dllcache\wucltui.dll
+ 2008-07-18 21:09:46 325,832 -c--a-w c:\windows\system32\dllcache\wucltui.dll
- 2004-08-18 12:00:00 36,864 -c--a-w c:\windows\system32\dllcache\wups.dll
+ 2008-07-18 20:10:20 36,552 -c--a-w c:\windows\system32\dllcache\wups.dll
- 2007-07-30 18:19:46 203,096 -c--a-w c:\windows\system32\dllcache\wuweb.dll
+ 2008-07-18 21:09:44 205,000 -c--a-w c:\windows\system32\dllcache\wuweb.dll
- 2008-12-02 14:21:54 77,712 ----a-w c:\windows\system32\perfc009.dat
+ 2008-12-02 14:43:58 77,712 ----a-w c:\windows\system32\perfc009.dat
- 2008-12-02 14:21:54 105,046 ----a-w c:\windows\system32\perfc00E.dat
+ 2008-12-02 14:43:58 105,046 ----a-w c:\windows\system32\perfc00E.dat
- 2008-12-02 14:21:54 436,860 ----a-w c:\windows\system32\perfh009.dat
+ 2008-12-02 14:43:58 436,860 ----a-w c:\windows\system32\perfh009.dat
- 2008-12-02 14:21:54 441,672 ----a-w c:\windows\system32\perfh00E.dat
+ 2008-12-02 14:43:58 441,672 ----a-w c:\windows\system32\perfh00E.dat
- 2004-08-18 12:00:00 431,104 ----a-w c:\windows\system32\wuapi.dll
+ 2008-07-18 21:09:44 563,912 ----a-w c:\windows\system32\wuapi.dll
- 2004-08-18 12:00:00 112,128 ----a-w c:\windows\system32\wuauclt.exe
+ 2008-07-18 21:10:42 53,448 ----a-w c:\windows\system32\wuauclt.exe
- 2004-08-18 12:00:00 1,134,592 ----a-w c:\windows\system32\wuaueng.dll
+ 2008-07-18 21:09:42 1,811,656 ----a-w c:\windows\system32\wuaueng.dll
- 2004-08-18 12:00:00 113,152 ----a-w c:\windows\system32\wucltui.dll
+ 2008-07-18 21:09:46 325,832 ----a-w c:\windows\system32\wucltui.dll
- 2004-08-18 12:00:00 36,864 ----a-w c:\windows\system32\wups.dll
+ 2008-07-18 20:10:20 36,552 ----a-w c:\windows\system32\wups.dll
- 2007-07-30 18:19:46 203,096 ----a-w c:\windows\system32\wuweb.dll
+ 2008-07-18 21:09:44 205,000 ----a-w c:\windows\system32\wuweb.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-18 15360]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"Google Update"="c:\documents and settings\Bence\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-10-26 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-17 7573504]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2004-10-08 221184]
"PinnacleDriverCheck"="c:\windows\system32\\PSDrvCheck.exe" [2003-11-10 406016]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-07-01 1447168]
"SsAAD.exe"="c:\progra~1\Sony\SONICS~1\SsAAD.exe" [2007-02-05 476728]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-08-17 86016]
"nwiz"="nwiz.exe" [2006-08-17 c:\windows\system32\nwiz.exe]
"SkyTel"="SkyTel.EXE" [2006-11-02 c:\windows\SkyTel.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-11-02 c:\windows\RTHDCPL.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-18 15360]

c:\documents and settings\All Users\Start Menu\Programs\Indˇt˘pult\
killprocess.bat [2008-10-30 421]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.PIM1"= pclepim1.dll
"vidc.mjpg"= pvmjpg30.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\Studio.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\PMSRegisterFile.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\umi.exe"=
"c:\\WINDOWS\\system32\\spoolsv.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\MCS Electronics\\BASCOM-AVR2\\bascavr.exe"=
"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"c:\\Program Files\\webcamXP\\webcamXP.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\PY Software\\Active WebCam 11.0\\WebCam.exe"=
"c:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager\\MediaManager.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\WINDOWS\\system32\\winver.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\Studio.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\umi.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

R1 epfwtdir;epfwtdir;c:\windows\system32\DRIVERS\epfwtdir.sys [2008-07-01 34312]
R2 GtDetectSc;GtDetectSc;"c:\program files\T-Mobile\web'n'walk Manager\GtDetectSc.exe" [2007-11-05 204915]
R2 udmpsvc;User Mode Process Dumper;system32\kktools\userdump.exe -Service []
R3 GT72NDISIPXP;GT 72 IP NDIS;c:\windows\system32\DRIVERS\Gt51Ip.sys [2007-07-09 95744]
R3 GT72UBUS;GT 72 U BUS;c:\windows\system32\DRIVERS\gt72ubus.sys [2007-06-26 51968]
R3 GTPTSER;GT PT SER;c:\windows\system32\DRIVERS\gtptser.sys [2007-03-30 8064]
R3 SNXPCARD;Sunix PCI Multi I/O Card Driver;c:\windows\system32\DRIVERS\snxpcard.sys [2008-07-15 20864]
R3 SNXPPALX;Sunix PCI Parallel Port Driver;c:\windows\system32\DRIVERS\snxppalx.sys [2008-07-15 75264]
R3 udmpdrvr;User Mode Process Dumper Driver;c:\windows\system32\drivers\userdump.sys [2008-11-22 64384]
S3 DLPortIO;DriverLINX Port I/O Driver;\??\c:\windows\system32\DRIVERS\DLPortIO.SYS [2008-07-28 3584]
S3 SIS163u;SiS163 usb Wireless LAN Adapter Driver;c:\windows\system32\DRIVERS\sis163u.sys [2005-08-30 215040]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\L]
\Shell\AutoRun\command - L:\Welcome.exe
.
Contents of the 'Scheduled Tasks' folder

2008-12-02 c:\windows\Tasks\GoogleUpdateTaskUser.job
- c:\documents and settings\Bence\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-10-26 17:37]
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-02 21:02:20
Windows 5.1.2600 Szervizcsomag 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\program files\IVT Corporation\BlueSoleil\BTNtService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\HPZipm12.exe
c:\windows\system32\kktools\userdump.exe
.
**************************************************************************
.
Completion time: 2008-12-02 21:06:59 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-02 20:06:57
ComboFix2.txt 2008-12-02 14:29:56

Pre-Run: 107 978 162 176 bájt szabad
Post-Run: 107,965,116,416 bájt szabad

315 --- E O F --- 2008-11-12 21:49:35



És a HiJack log-ja:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:25:21, on 2008.12.02.
Platform: Windows XP Szervizcsomag 2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\T-Mobile\web'n'walk Manager\GtDetectSc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\kktools\userdump.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hivatkozások
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\\PSDrvCheck.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Bence\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: killprocess.bat
O8 - Extra context menu item: E&xportálás Microsoft Excel formátumba - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 7963178281
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GtDetectSc - Option - C:\Program Files\T-Mobile\web'n'walk Manager\GtDetectSc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: MSSQLServerADHelper - Unknown owner - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe

--
End of file - 6259 bytes

Köszi, megcsinálom. 10 perc és írom az eredményeket. Bocs a kódnézetért, nekem átláthatóbb volt úgy.

koszi Hannibal

Kinyitod a Notepadot>Start>futatas>beirod notepad
Es bemasolod a piros textet


Mostan>a notepadon elso full>ballfelsosarokban>4-sor>lementenni mint....
A txt-hejet beteszed eztett>CFScript.txt<alatta bealitod >minden mapak<
legfelull>asztall i<klik gomb letenni.Es mostan megcsinalod eztett:

A combofix maga elindul es lehet hogy restartol es befejezi a scent.Amit majd ad ted ide Es az uj HijackThis logjat ted ide OK

megkerlek ved ki a logot CODE-bol nekem ezt at kel neznem es igy igen zavar,kosz.

Kék halál még meg van.

Na lefutattam a ComboFix-et. Itt a log-ja:


ComboFix 08-11-30.02 - Bence 2008-12-02 15:20:23.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1038.18.654 [GMT 1:00]
Running from: c:\documents and settings\Bence\Asztal\ComboFix.exe
* Created a new restore point
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\_004482_.tmp.dll
c:\windows\system32\_004620_.tmp.dll
c:\windows\system32\_004621_.tmp.dll
c:\windows\system32\_004622_.tmp.dll
c:\windows\system32\_004623_.tmp.dll
c:\windows\system32\_004629_.tmp.dll
c:\windows\system32\_004630_.tmp.dll
c:\windows\system32\_004631_.tmp.dll
c:\windows\system32\_004632_.tmp.dll
c:\windows\system32\_004633_.tmp.dll
c:\windows\system32\_004635_.tmp.dll
c:\windows\system32\_004636_.tmp.dll
c:\windows\system32\_004639_.tmp.dll
c:\windows\system32\_004640_.tmp.dll
c:\windows\system32\_004642_.tmp.dll
c:\windows\system32\_004643_.tmp.dll
c:\windows\system32\_004644_.tmp.dll
c:\windows\system32\_004646_.tmp.dll
c:\windows\system32\_004649_.tmp.dll
c:\windows\system32\_004650_.tmp.dll
c:\windows\system32\_004654_.tmp.dll
c:\windows\system32\_004655_.tmp.dll
c:\windows\system32\_004657_.tmp.dll
c:\windows\system32\_004659_.tmp.dll
c:\windows\system32\_004660_.tmp.dll
c:\windows\system32\_004662_.tmp.dll
c:\windows\system32\_004663_.tmp.dll
c:\windows\system32\_004664_.tmp.dll
c:\windows\system32\_004665_.tmp.dll
c:\windows\system32\_004666_.tmp.dll
c:\windows\system32\_004669_.tmp.dll
c:\windows\system32\_004670_.tmp.dll
c:\windows\system32\_004671_.tmp.dll
c:\windows\system32\_004672_.tmp.dll
c:\windows\system32\_004673_.tmp.dll
c:\windows\system32\_004678_.tmp.dll
c:\windows\system32\winlogon.exe.tmp

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_FILEMON
-------\Service_FILEMON


((((((((((((((((((((((((( Files Created from 2008-11-02 to 2008-12-02 )))))))))))))))))))))))))))))))
.

2008-12-01 17:16 . 2004-08-18 13:00 504,320 --a------ c:\windows\system32\winlogon.exe
2008-12-01 17:16 . 2004-08-18 13:00 504,320 --a--c--- c:\windows\system32\dllcache\winlogon.exe
2008-11-30 19:50 . 2004-08-03 22:31 154,624 --a--c--- c:\windows\system32\dllcache\wlluc48.sys
2008-11-30 19:50 . 2004-08-17 16:47 116,736 --a--c--- c:\windows\system32\dllcache\xrxwiadr.dll
2008-11-30 19:50 . 2001-08-18 06:37 99,865 --a--c--- c:\windows\system32\dllcache\xlog.exe
2008-11-30 19:50 . 2001-10-26 21:25 27,648 --a--c--- c:\windows\system32\dllcache\xrxftplt.exe
2008-11-30 19:50 . 2001-10-26 21:25 23,040 --a--c--- c:\windows\system32\dllcache\xrxwbtmp.dll
2008-11-30 19:50 . 2004-08-03 22:29 19,455 --a--c--- c:\windows\system32\dllcache\wvchntxx.sys
2008-11-30 19:50 . 2001-10-26 21:25 17,408 --a--c--- c:\windows\system32\dllcache\xrxscnui.dll
2008-11-30 19:50 . 2001-08-17 20:11 16,970 --a--c--- c:\windows\system32\dllcache\xem336n5.sys
2008-11-30 19:50 . 2004-08-03 22:29 12,063 --a--c--- c:\windows\system32\dllcache\wsiintxx.sys
2008-11-30 19:50 . 2004-08-03 23:07 8,832 --a--c--- c:\windows\system32\dllcache\wmiacpi.sys
2008-11-30 19:50 . 2004-08-17 16:47 8,192 --a--c--- c:\windows\system32\dllcache\wshirda.dll
2008-11-30 19:50 . 2001-10-26 21:25 4,608 --a--c--- c:\windows\system32\dllcache\xrxflnch.exe
2008-11-30 19:48 . 2001-08-17 21:28 794,654 --a--c--- c:\windows\system32\dllcache\usr1801.sys
2008-11-30 19:47 . 2001-10-26 21:25 525,568 --a--c--- c:\windows\system32\dllcache\tridxp.dll
2008-11-30 19:46 . 2001-10-26 21:24 315,520 --a--c--- c:\windows\system32\dllcache\trid3d.dll
2008-11-30 19:45 . 2001-10-26 21:24 172,768 --a--c--- c:\windows\system32\dllcache\t2r4disp.dll
2008-11-30 19:44 . 2001-10-26 18:18 286,528 --a--c--- c:\windows\system32\dllcache\stlnata.sys
2008-11-30 19:43 . 2001-10-26 21:24 157,696 --a--c--- c:\windows\system32\dllcache\sisv256.dll
2008-11-30 19:42 . 2001-10-26 21:24 386,560 --a--c--- c:\windows\system32\dllcache\sgiul50.dll
2008-11-30 19:41 . 2001-10-26 21:23 495,616 --a--c--- c:\windows\system32\dllcache\sblfx.dll
2008-11-30 19:40 . 2001-10-26 20:25 899,402 --a--c--- c:\windows\system32\dllcache\r2mdkxga.sys
2008-11-30 19:39 . 2004-08-17 16:47 363,520 --a--c--- c:\windows\system32\dllcache\psisdecd.dll
2008-11-30 19:38 . 2004-08-17 16:44 259,328 --a--c--- c:\windows\system32\dllcache\perm3dd.dll
2008-11-30 19:37 . 2001-08-17 22:05 351,616 --a--c--- c:\windows\system32\dllcache\ovcodek2.sys
2008-11-30 19:36 . 2004-08-17 16:35 132,695 --a--c--- c:\windows\system32\dllcache\netwlan5.sys
2008-11-30 19:35 . 2001-10-26 19:28 131,072 --a--c--- c:\windows\system32\dllcache\n100325.sys
2008-11-30 19:34 . 2001-10-26 18:56 320,384 --a--c--- c:\windows\system32\dllcache\mgaum.sys
2008-11-30 19:33 . 2001-08-17 21:28 802,683 --a--c--- c:\windows\system32\dllcache\ltsm.sys
2008-11-30 19:32 . 2001-10-26 21:24 242,176 --a--c--- c:\windows\system32\dllcache\kdsusd.dll
2008-11-30 19:31 . 2001-10-26 21:24 372,824 --a--c--- c:\windows\system32\dllcache\iconf32.dll
2008-11-30 19:30 . 2004-08-17 16:46 702,845 --a--c--- c:\windows\system32\dllcache\i81xdnt5.dll
2008-11-30 19:29 . 2001-10-26 20:31 908,256 --a--c--- c:\windows\system32\dllcache\hcf_msft.sys
2008-11-30 19:28 . 2001-10-26 21:24 1,733,120 --a--c--- c:\windows\system32\dllcache\g400d.dll
2008-11-30 19:27 . 2001-10-26 20:11 629,984 --a--c--- c:\windows\system32\dllcache\eqn.sys
2008-11-30 19:26 . 2001-08-17 20:14 952,007 --a--c--- c:\windows\system32\dllcache\diwan.sys
2008-11-30 19:25 . 2001-10-26 21:25 618,525 --a--c--- c:\windows\system32\dllcache\digiview.exe
2008-11-30 19:24 . 2001-10-26 18:57 980,034 --a--c--- c:\windows\system32\dllcache\cicap.sys
2008-11-30 19:23 . 2001-08-17 21:28 871,388 --a--c--- c:\windows\system32\dllcache\bcmdm.sys
2008-11-30 19:22 . 2001-08-17 21:28 762,780 --a--c--- c:\windows\system32\dllcache\3cwmcru.sys
2008-11-30 19:21 . 2001-10-26 21:24 66,048 --a--c--- c:\windows\system32\dllcache\s3legacy.dll
2008-11-30 15:05 . 2008-11-30 15:05 <DIR> d-------- c:\program files\DAEMON Tools
2008-11-29 18:08 . 2008-11-29 18:08 <DIR> d-------- c:\program files\Common Files\Yahoo!
2008-11-29 18:08 . 2008-11-29 18:08 <DIR> d-------- c:\documents and settings\All Users\Application Data\Studio 12
2008-11-29 18:08 . 2008-11-29 18:08 <DIR> d-------- c:\documents and settings\All Users\Application Data\Pinnacle Studio Plus
2008-11-29 15:35 . 2008-04-13 11:37 2,962,944 --a------ c:\windows\system32\SET1055.tmp
2008-11-29 15:35 . 2008-04-14 09:02 1,135,616 --a------ c:\windows\system32\SET1045.tmp
2008-11-29 15:35 . 2008-04-14 09:02 354,304 --a------ c:\windows\system32\SET104F.tmp
2008-11-29 15:35 . 2008-04-14 09:02 162,816 --a------ c:\windows\system32\SET1046.tmp
2008-11-29 15:35 . 2008-04-14 09:02 80,896 --a------ c:\windows\system32\SET104C.tmp
2008-11-29 15:35 . 2008-04-14 09:02 50,176 --a------ c:\windows\system32\SET103F.tmp
2008-11-29 15:35 . 2008-04-14 09:02 6,656 --a------ c:\windows\system32\SET1043.tmp
2008-11-29 15:29 . 2008-04-14 09:02 8,482,304 --a------ c:\windows\system32\SET221.tmp
2008-11-29 15:28 . 2008-04-14 09:02 666,624 --a------ c:\windows\system32\SET1A5.tmp
2008-11-29 15:25 . 2006-12-28 12:01 19,569 --a------ c:\windows\003139_.tmp
2008-11-29 15:22 . 2004-08-18 13:00 1,896,400 --a------ c:\windows\system32\dllcache\nt5.cat
2008-11-29 15:21 . 2005-09-29 19:31 2,137,600 --a------ c:\windows\system32\ntoskrnl.exe
2008-11-29 15:15 . 2008-11-29 15:15 <DIR> d-------- c:\windows\system32\CatRoot_bak
2008-11-29 14:39 . 2008-11-29 14:39 <DIR> d-------- C:\VundoFix Backups
2008-11-29 13:52 . 2008-11-29 13:52 <DIR> d---s---- c:\documents and settings\Bence\UserData
2008-11-29 12:39 . 2004-08-18 13:00 13,463,552 --a--c--- c:\windows\system32\dllcache\hwxjpn.dll
2008-11-29 12:38 . 2004-08-18 13:00 10,096,640 --a--c--- c:\windows\system32\dllcache\hwxcht.dll
2008-11-29 12:37 . 2003-04-14 20:56 212,992 --a--c--- c:\windows\system32\dllcache\fpmmcsat.dll
2008-11-29 12:37 . 2003-04-14 20:56 16,384 --a--c--- c:\windows\system32\dllcache\tcptsat.dll
2008-11-29 12:37 . 2001-10-26 21:24 5,632 --a--c--- c:\windows\system32\dllcache\EXCH_adsiisex.dll
2008-11-29 12:32 . 2008-11-29 12:32 749 -rah----- c:\windows\WindowsShell.Manifest
2008-11-29 12:32 . 2008-11-29 12:32 749 -rah----- c:\windows\system32\wuaucpl.cpl.manifest
2008-11-29 12:32 . 2008-11-29 12:32 749 -rah----- c:\windows\system32\sapi.cpl.manifest
2008-11-29 12:32 . 2008-11-29 12:32 749 -rah----- c:\windows\system32\ncpa.cpl.manifest
2008-11-29 12:32 . 2008-11-29 12:32 488 -rah----- c:\windows\system32\logonui.exe.manifest
2008-11-29 12:31 . 2004-08-18 13:00 16,384 --a--c--- c:\windows\system32\dllcache\isignup.exe
2008-11-29 12:18 . 2001-08-17 20:13 27,165 --a------ c:\windows\system32\drivers\fetnd5.sys
2008-11-29 12:18 . 2001-08-17 20:13 27,165 --a--c--- c:\windows\system32\dllcache\fetnd5.sys
2008-11-23 00:03 . 2008-11-23 00:03 0 --a------ c:\windows\system32\EpfwUser.dat
2008-11-22 11:25 . 2008-11-22 11:25 39,686,818 --a------ c:\windows\winlogon836.dmp
2008-11-22 11:15 . 2008-11-22 11:15 39,633,508 --a------ c:\windows\winlogon2676.dmp
2008-11-22 11:13 . 2008-11-22 11:15 39,536,976 --a------ c:\windows\winlogon832.dmp
2008-11-22 11:09 . 2008-11-22 11:09 <DIR> d-------- c:\windows\system32\kktools
2008-11-22 11:09 . 2007-03-05 17:31 64,384 --a------ c:\windows\system32\drivers\userdump.sys
2008-11-22 11:08 . 2008-11-22 11:08 <DIR> d-------- C:\kktools
2008-11-21 16:38 . 1998-09-02 09:02 194,320 --a------ c:\windows\system32\qcut.dll
2008-11-21 16:38 . 1998-08-20 12:02 140,800 --a------ c:\windows\system32\tm20dec.ax
2008-11-21 16:38 . 1998-09-02 09:28 63,488 --a------ c:\windows\system32\unam4ie.exe
2008-11-21 16:38 . 1998-09-02 09:28 38,160 --a------ c:\windows\system32\LMRTREND.dll
2008-11-21 16:38 . 1998-08-17 10:21 11,776 --a------ c:\windows\system32\mciqtz.drv
2008-11-21 16:38 . 1998-08-17 10:21 10,240 --a------ c:\windows\system32\vidx16.dll
2008-11-21 16:38 . 1998-08-17 10:21 5,672 --a------ c:\windows\system32\quartz.vxd
2008-11-21 16:38 . 2008-11-21 16:38 4,608 --a------ c:\windows\system32\w95inf32.dll
2008-11-21 16:38 . 2008-11-21 16:38 2,272 --a------ c:\windows\system32\w95inf16.dll
2008-11-21 16:37 . 2008-11-21 16:37 <DIR> d-------- c:\program files\LEGO Media
2008-11-20 21:27 . 2008-11-20 21:27 <DIR> d-------- c:\documents and settings\Bence\Application Data\DivX
2008-11-20 21:25 . 2008-11-20 21:25 <DIR> d-------- c:\program files\Common Files\Pinnacle
2008-11-20 21:25 . 2008-11-20 21:25 <DIR> d-------- c:\documents and settings\All Users\Application Data\Pinnacle Studio Ultimate
2008-11-20 21:16 . 2008-11-20 21:16 32,256 --a------ c:\windows\system32\winzlo32.dll
2008-11-15 19:13 . 2008-11-15 19:13 <DIR> d-------- c:\program files\ESET
2008-11-03 21:26 . 2008-07-08 10:51 <DIR> d--h----- c:\documents and settings\Rendszergazda\Sablonok
2008-11-03 21:26 . 2008-07-08 12:44 <DIR> d-------- c:\documents and settings\Rendszergazda\Dokumentumok
2008-11-03 21:26 . 2008-07-08 10:59 <DIR> d-------- c:\documents and settings\Rendszergazda\Asztal
2008-11-03 21:26 . 2008-11-03 21:27 <DIR> d-------- c:\documents and settings\Rendszergazda
2008-11-03 20:15 . 2008-11-03 20:16 <DIR> d-------- c:\program files\Gepiras 2000

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-29 17:18 --------- d-----w c:\documents and settings\Bence\Application Data\Any Video Converter
2008-11-29 17:15 --------- d-----w c:\documents and settings\Bence\Application Data\LimeWire
2008-11-29 17:08 --------- d-----w c:\program files\Pinnacle
2008-11-29 13:34 685,816 ----a-w c:\windows\system32\drivers\sptd.sys
2008-11-29 11:12 9,388 ----a-w c:\windows\system32\drivers\iaStor.PNF
2008-11-29 11:12 7,280 ----a-w c:\windows\system32\drivers\viamraid.PNF
2008-11-29 11:12 63,240 ----a-w c:\windows\system32\drivers\Si3112r.PNF
2008-11-29 11:12 6,984 ----a-w c:\windows\system32\drivers\SiSRaid.PNF
2008-11-29 11:12 20,152 ----a-w c:\windows\system32\drivers\INFCACHE.1
2008-11-29 11:12 12,432 ----a-w c:\windows\system32\drivers\adpu320.PNF
2008-11-29 11:12 12,204 ----a-w c:\windows\system32\drivers\nvraid.PNF
2008-11-29 11:12 10,828 ----a-w c:\windows\system32\drivers\iaAHCI.PNF
2008-11-26 20:53 --------- d-----w c:\documents and settings\Bence\Application Data\uTorrent
2008-11-26 14:32 --------- d-----w c:\program files\Opera
2008-10-28 15:41 --------- d-----w c:\program files\WMR11
2008-10-26 22:41 --------- d-----w c:\program files\Safari
2008-10-26 22:41 --------- d-----w c:\documents and settings\Bence\Application Data\Apple Computer
2008-10-26 22:40 --------- d-----w c:\program files\Apple Software Update
2008-10-26 22:40 --------- d-----w c:\documents and settings\All Users\Application Data\Apple
2008-10-26 21:25 --------- d-----w c:\program files\Unlocker
2008-10-25 21:55 --------- d-----w c:\program files\Netscape
2008-10-25 21:55 --------- d-----w c:\documents and settings\Bence\Application Data\Netscape
2008-10-22 14:53 --------- d--h--w c:\program files\InstallShield Installation Information
2008-10-22 12:48 --------- d-----w c:\program files\Totalcmd
2008-10-18 15:42 --------- d-----w c:\program files\Messenger Plus! Live
2008-10-12 06:18 --------- d-----w c:\documents and settings\Mami\Application Data\AdobeUM
2008-10-04 14:04 --------- d-----w c:\program files\Program Produkt
2008-10-04 13:58 --------- d-----w c:\program files\VirtualDJ
2008-10-04 09:20 --------- d-----w c:\program files\BeamYourScreen Free Version
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-18 15360]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"Google Update"="c:\documents and settings\Bence\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-10-26 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-17 7573504]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2004-10-08 221184]
"PinnacleDriverCheck"="c:\windows\system32\\PSDrvCheck.exe" [2003-11-10 406016]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-07-01 1447168]
"SsAAD.exe"="c:\progra~1\Sony\SONICS~1\SsAAD.exe" [2007-02-05 476728]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-08-17 86016]
"nwiz"="nwiz.exe" [2006-08-17 c:\windows\system32\nwiz.exe]
"SkyTel"="SkyTel.EXE" [2006-11-02 c:\windows\SkyTel.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-11-02 c:\windows\RTHDCPL.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-18 15360]

c:\documents and settings\All Users\Start Menu\Programs\Indˇt˘pult\
killprocess.bat [2008-10-30 421]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winzlo32]
2008-11-20 21:16 32256 c:\windows\system32\winzlo32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.PIM1"= pclepim1.dll
"vidc.mjpg"= pvmjpg30.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\Studio.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\PMSRegisterFile.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\umi.exe"=
"c:\\WINDOWS\\system32\\spoolsv.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\MCS Electronics\\BASCOM-AVR2\\bascavr.exe"=
"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"c:\\Program Files\\webcamXP\\webcamXP.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\PY Software\\Active WebCam 11.0\\WebCam.exe"=
"c:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager\\MediaManager.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\WINDOWS\\system32\\winver.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\Studio.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\umi.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

R1 epfwtdir;epfwtdir;c:\windows\system32\DRIVERS\epfwtdir.sys [2008-07-01 34312]
R2 GtDetectSc;GtDetectSc;"c:\program files\T-Mobile\web'n'walk Manager\GtDetectSc.exe" [2007-11-05 204915]
R2 udmpsvc;User Mode Process Dumper;system32\kktools\userdump.exe -Service []
R3 SIS163u;SiS163 usb Wireless LAN Adapter Driver;c:\windows\system32\DRIVERS\sis163u.sys [2005-08-30 215040]
R3 SNXPCARD;Sunix PCI Multi I/O Card Driver;c:\windows\system32\DRIVERS\snxpcard.sys [2008-07-15 20864]
R3 SNXPPALX;Sunix PCI Parallel Port Driver;c:\windows\system32\DRIVERS\snxppalx.sys [2008-07-15 75264]
R3 udmpdrvr;User Mode Process Dumper Driver;c:\windows\system32\drivers\userdump.sys [2008-11-22 64384]
S3 DLPortIO;DriverLINX Port I/O Driver;\??\c:\windows\system32\DRIVERS\DLPortIO.SYS [2008-07-28 3584]
S3 GT72NDISIPXP;GT 72 IP NDIS;c:\windows\system32\DRIVERS\Gt51Ip.sys [2007-07-09 95744]
S3 GT72UBUS;GT 72 U BUS;c:\windows\system32\DRIVERS\gt72ubus.sys [2007-06-26 51968]
S3 GTPTSER;GT PT SER;c:\windows\system32\DRIVERS\gtptser.sys [2007-03-30 8064]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\L]
\Shell\AutoRun\command - L:\Welcome.exe
.
Contents of the 'Scheduled Tasks' folder

2008-12-01 c:\windows\Tasks\GoogleUpdateTaskUser.job
- c:\documents and settings\Bence\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-10-26 17:37]
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\Bence\Application Data\Mozilla\Firefox\Profiles\tb5cku25.default\
FF -: plugin - c:\documents and settings\Bence\Local Settings\Application Data\Google\Update\1.2.131.25\npGoogleOneClick6.dll
FF -: plugin - c:\program files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - c:\program files\Java\jre1.5.0_06\bin\NPJava11.dll
FF -: plugin - c:\program files\Java\jre1.5.0_06\bin\NPJava12.dll
FF -: plugin - c:\program files\Java\jre1.5.0_06\bin\NPJava13.dll
FF -: plugin - c:\program files\Java\jre1.5.0_06\bin\NPJava14.dll
FF -: plugin - c:\program files\Java\jre1.5.0_06\bin\NPJava32.dll
FF -: plugin - c:\program files\Java\jre1.5.0_06\bin\NPJPI150_06.dll
FF -: plugin - c:\program files\Java\jre1.5.0_06\bin\NPOJI610.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-02 15:27:04
Windows 5.1.2600 Szervizcsomag 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(844)
c:\windows\system32\winzlo32.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\IVT Corporation\BlueSoleil\BTNtService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\HPZipm12.exe
c:\windows\system32\kktools\userdump.exe
.
**************************************************************************
.
Completion time: 2008-12-02 15:29:55 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-02 14:29:53

Pre-Run: 107 593 703 424 bájt szabad
Post-Run: 108,515,225,600 bájt szabad

320 --- E O F --- 2008-11-12 21:49:35


CODE stell kérésére kivéve.

Moderálva: Hannibal

Először hallgasd(olvasd el Stell-mester gondolatait..mert én főként más OS-ban utazom-de pályán kívülről egy paracssoros konzolban amikor rákérdez,hogy melyik progi mehet v. nem miket lőnék ki(itt még nincs runnig process!)-mert te indítod az igen-nem vers-el:
A bluesolei biztosan kettyós,tehát nem indít főleg 5.0 felett(bluetoth adapterrel együtt települő szemét,amiből kifolyólag mindenki rajtad lóghat te leszel a közszolgálat-szolgáltató!)
A bonjure a az Apple lejátszóval terjedő (QuickTime)hsonló brodcacting adatszolgáltató
A Gtdetect a T-mobilos hasonló jó szolgáltatás web'walk.
A kktools valami codekel települő igazi beépülő,
A Sony féle lokátor-ez a legősibb!-erről koppintotta az M$ is a másolásvédelmi nyilatkozatát...stb
Aztán arenszerinulás után már futó cuccal a Hijack már nem tud mit kezdeni..mert az már a memóriából futtatja a zsáknyi szaart...ezért kell a CombFix,mert nem engedi elindulni ezeket a rémeket.

meg ne koszond,de ha sok munkad van eleg holnap is

De, de akarom, csak kiváncsi voltam miért. Na lehet, hogy ma még nekifutok. Köszi a sok segítséget!

azert fontos mert azian at nezem a combofix logjat es csinalok KILL scriptet es kipucoljuk ,ha masut lesz akor az nem jo,meg a geprol is lekel szedni es igy a vegen letudjuk telepiteni,meg a combofix alkotoja igy javasalja.Ez a sken 15-percig tart ide teszed a logjat es csinalhatod a munkadat,aztan benezel ide hogyan tovab,de ha nemakarod nemuszaj nem az en Trojaim ha nem a tied

Egyébként miért fontos az asztalra tölteni? Ma nem biztos, hogy megcsinálom, van még angol házim holnapra. De holnap szerintem meg tudom csinálni.

Oké, de ha a netet kikapcsolom, közben nem jön le még több trójai? Vagy ennek már mindegy?

csinald azt amit irtam a netet nekapcsold ki,a combofix megjavitsa enszerintem nemlesz kekhalal.

Akkor a netet is kikapcsolom, ugye nem baj? A gép rendesen tud újraindulni a kék halál miatt, ez nem baj?
Nacorvus mit csináljak?

Sőt! az lehetne mazsolázni,hogy melyik nem az! innetől lefelé):
A helyileg felülbírált proxy és mindenki jön-megy ki-be..
...ezek telepítették a rendszerindítással a bonjurt,web'walk stb beépülőket (trójait)..birkózhat vele a comb-fix

tele van trojaval

Aki nem tudja pontosan miről van szó röviden leírom, (bővebben: http://forum.terminal.hu/viewtopic.php?p=900431#900431 ). Amikor kikapcsolom a gépet kék halál a következő szöveggel:

Az már kiderült, hogy vírus okozza. Ahogy Stell írta, ide teszem a HiJack logját:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:26:01, on 2008.12.01.
Platform: Windows XP Szervizcsomag 2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\T-Mobile\web'n'walk Manager\GtDetectSc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\kktools\userdump.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Documents and Settings\Bence\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sony\SonicStage\Omgjbox.exe
C:\Program Files\Common Files\Sony Shared\AVLib\SsDbConnection.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hivatkozások
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\\PSDrvCheck.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Somefox] C:\DOCUME~1\Bence\LOCALS~1\Temp\6E7.tmp.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Bence\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'HELYI SZOLGÁLTATÁS')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'HÁLÓZATI SZOLGÁLTATÁS')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: killprocess.bat
O8 - Extra context menu item: E&xportálás Microsoft Excel formátumba - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 7963178281
O20 - Winlogon Notify: winzlo32 - C:\WINDOWS\SYSTEM32\winzlo32.dll
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GtDetectSc - Option - C:\Program Files\T-Mobile\web'n'walk Manager\GtDetectSc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: MSSQLServerADHelper - Unknown owner - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe

--
End of file - 6779 bytes