nem minden amit a virus kereso talal virus,,a combofixnel ez hamis jelzes,,de letorolheted mindent,es szed le a geprol a combofixet,,a combofix most nem jon le sehonan mert javitasban van
udv

Minden összetevőjet megvizsgáltattam a drcs-nek és semmi hiba benne

Mi ez? Feladom!
Feltettem megint az Avirát, frissitettem és rázavartam a gépre
Ezeket adta ki






Már a Combofix is virusos???

by horex

vezereld az aszonyal,, ha megvan ez a progi teszteld le a virustotalon ,hogy mit mutat

Köszi. Ezek szerint most tiszta vagyok.
És mivel vezérlem a PC-m az ágybol ezek után?
Már egy ilyen kis progiban sem bizhat az ember, 100 éve töltöttem le

Nem kellene más csak lekapcsolni a PC-t, mert azon megy a TV is.

Majd jövök, ha engednek a csrcs.exe gonddal
by horex

ez PC távirányito progid a google nemigen ismeri es amit ismer az irja hogy Hack program,a log renben van,
http://www.spywareremove.com/removeDRCS.html

Lefutott. Reboot után itt a log
de áruld el,miért akarod mindig legyilkolni a drcs_xp progimat??
Az a PC távirányito progim, most elgyalultad
Persze visszarakom

ComboFix 09-12-11.05 - apple 009.12.13. 11:14:31.2.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1250.36.1038.18.511.326 [GMT 1:00]
Running from: c:\documents and settings\apple\Asztal\ComboFix.exe
Command switches used :: c:\documents and settings\apple\Asztal\cfscript.txt
FW: PC Tools Firewall Plus *disabled* {ABBD5028-5A95-4B6D-996E-98D64AE88D52}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
"c:\windows\system32\drivers\pxkbf.sys"
"c:\windows\system32\drivers\pxrts.sys"
"c:\windows\system32\drivers\pxscan.sys"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\drcs_xp
c:\program files\drcs_xp\DRCS.chm
c:\program files\drcs_xp\DRCS.dat
c:\program files\drcs_xp\DRCS.exe
c:\program files\drcs_xp\DRCS.ini
c:\program files\drcs_xp\DRCS20b.zip
c:\program files\drcs_xp\files.bbs
c:\program files\drcs_xp\Readme.txt

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ZPMODNTGS
-------\Service_tykgjkn
-------\Service_zpmodntgs


((((((((((((((((((((((((( Files Created from 2009-11-13 to 2009-12-13 )))))))))))))))))))))))))))))))
.

2009-12-13 09:42 . 2009-12-13 09:42 8694721 ----a-w- C:\Hull_kez_2_3EA_Hulladékok_elhelyezése.zip
2009-12-13 07:56 . 2009-12-13 07:56 -------- d-----w- c:\windows\system32\wbem\Repository
2009-12-13 07:55 . 2009-12-13 07:55 -------- d-----w- c:\program files\Ahead
2009-12-12 22:58 . 2009-12-12 22:58 -------- d-----w- c:\documents and settings\apple\Application Data\Uniblue
2009-12-12 21:01 . 2009-12-12 21:01 -------- d-----w- c:\documents and settings\All Users\Application Data\SITEguard
2009-12-12 21:00 . 2009-12-12 21:00 -------- d-----w- c:\program files\Common Files\iS3
2009-12-12 21:00 . 2009-12-12 21:00 -------- d-----w- c:\documents and settings\All Users\Application Data\STOPzilla!
2009-12-12 16:22 . 2009-12-12 16:22 -------- d-----w- c:\documents and settings\All Users\Application Data\{62EEA430-850F-46ED-B661-7C79D0D6D490}
2009-12-12 16:15 . 2009-12-12 16:15 -------- d-----w- c:\documents and settings\All Users\Application Data\VateraPst
2009-12-12 07:01 . 2009-12-12 07:01 -------- d-----w- c:\windows\$hf_mig$
2009-12-06 12:53 . 2009-12-06 12:53 -------- d-----w- c:\documents and settings\apple\Local Settings\Application Data\Ahead
2009-12-06 12:04 . 2009-12-06 12:04 -------- d-----w- c:\program files\Ahead(2)
2009-12-05 12:45 . 2009-12-05 12:45 -------- d-----w- c:\documents and settings\All Users\Application Data\PrevxCSI
2009-12-04 15:46 . 2009-12-04 15:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-12-04 14:24 . 2009-12-04 14:24 -------- d-----w- c:\program files\Microsoft Diagnostics and Recovery Toolset
2009-12-04 13:01 . 2009-12-04 13:01 -------- d-----w- c:\program files\Common Files\Ahead
2009-12-03 23:34 . 2009-12-03 23:34 -------- d-----w- c:\program files\REGSHAVE
2009-12-03 23:34 . 2002-06-25 09:06 45056 ------w- c:\windows\system32\FINFCOPY.dll
2009-12-03 23:34 . 2001-11-25 11:11 81924 ------w- c:\windows\system32\drivers\VC4CB104.SYS
2009-12-03 23:34 . 2002-02-27 11:27 65536 ------w- c:\windows\system32\FINFCHECK.dll
2009-12-03 23:34 . 2002-02-13 10:00 45056 ------w- c:\windows\system32\FCLKBTN.DLL
2009-12-03 23:34 . 2002-02-05 16:33 69632 ------w- c:\windows\system32\FREGSHEX.DLL
2009-12-03 21:45 . 2009-12-03 21:45 -------- d-----w- c:\program files\Datapol
2009-12-03 20:04 . 2009-12-03 20:04 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-12-03 20:04 . 2009-12-03 20:04 -------- d-----w- c:\program files\Common Files\InstallShield
2009-12-01 11:30 . 2009-12-01 11:30 -------- d-----w- c:\documents and settings\apple\Local Settings\Application Data\Innovative Solutions
2009-12-01 11:30 . 2009-12-01 11:30 -------- d-----w- c:\program files\Innovative Solutions
2009-11-28 19:34 . 2009-11-28 19:34 -------- d-----w- c:\documents and settings\apple\Application Data\Tenebril
2009-11-28 15:48 . 2009-11-28 15:48 -------- d-----w- c:\windows\system32\tenarchlib
2009-11-20 16:23 . 2009-11-20 16:23 -------- d-----w- c:\windows\url.dll
2009-11-13 10:54 . 2004-08-17 16:47 221184 ----a-w- c:\windows\system32\wmpns.dll
2009-11-13 10:41 . 2009-11-13 10:41 -------- d-----w- c:\documents and settings\apple\Application Data\Moyea
2009-11-13 10:41 . 2009-11-13 10:41 -------- d-----w- c:\program files\Moyea

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-12 15:44 . 2009-07-31 12:59 12328 ----a-w- c:\documents and settings\apple\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-15 10:54 . 2009-07-31 12:10 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-11-12 23:51 . 2009-07-31 14:43 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-11-12 22:48 . 2009-11-12 22:48 -------- d-----w- c:\program files\foxit
2009-11-12 22:16 . 2009-11-12 22:16 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-11-12 22:16 . 2009-11-12 22:16 -------- d-----w- c:\program files\Java
2009-11-12 22:16 . 2009-11-12 22:16 152576 ----a-w- c:\documents and settings\apple\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-11-12 20:21 . 2009-11-12 20:21 -------- d-----w- c:\documents and settings\apple\Application Data\XnView
2009-11-12 18:51 . 2009-11-12 18:51 -------- d-----w- c:\program files\Unlocker
2009-11-12 11:23 . 2009-11-12 11:23 -------- d-----w- c:\program files\XnView
2009-11-12 11:20 . 2009-11-12 11:20 -------- d-----w- c:\program files\FLV Player
2009-11-12 10:32 . 2009-11-12 10:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Hagel Technologies
.

((((((((((((((((((((((((((((( SnapShot@2009-12-13_09.14.57 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-12-13 10:18 . 2009-12-13 10:18 16384 c:\windows\temp\Perflib_Perfdata_4d8.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"00PCTFW"="c:\program files\PC Tools Firewall Plus\FirewallGUI.exe" [2009-02-23 2652056]
"DU Meter"="c:\program files\DU Meter\DUMeter.exe" [2004-08-25 1465856]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872]
"REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2002-02-04 53248]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-17 15360]

c:\documents and settings\All Users\Start Menu\Programs\Indˇt˘pult\
PC-TV FM Remote Control.lnk - c:\program files\KWorld\PC-TV FM\RemoteCtl.exe [2009-7-31 143360]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Indítópult^GhostSurf.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Indítópult\GhostSurf.lnk
backup=c:\windows\pss\GhostSurf.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-11-12 22:16 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [2009.07.31. 14:20 159600]
R2 BT848;BtCap, WDM Video Capture;c:\windows\system32\drivers\BT848.sys [2009.07.31. 13:37 265512]
R2 BTTUNER;BtTuner, WDM TvTuner;c:\windows\system32\drivers\bttuner.sys [2009.07.31. 13:37 18944]
R2 BTXBAR;BtXBar, WDM Crossbar;c:\windows\system32\drivers\btxbar.sys [2009.07.31. 13:37 13308]
R2 PCTAppEvent;PCTAppEvent Driver;c:\windows\system32\drivers\PCTAppEvent.sys [2009.07.31. 14:20 73840]
R3 EdgeSer;Inside Out Networks Edgeport Driver;c:\windows\system32\drivers\edgeser.sys [2009.11.12. 11:34 183534]
R3 Ionenum;Inside Out Networks Filter Driver;c:\windows\system32\drivers\ionenum.sys [2009.11.12. 11:34 27110]
R3 pctplfw;pctplfw;c:\windows\system32\drivers\pctplfw.sys [2009.07.31. 14:20 95640]
R3 wdm_au8830;Aureal Vortex 8830 audio-illesztőprogram (WDM);c:\windows\system32\drivers\adm8830.sys [2009.07.31. 12:12 747392]
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uInternet Settings,ProxyServer = <local>
uInternet Settings,ProxyOverride = <local>
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-13 11:18
Windows 5.1.2600 Szervizcsomag 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\PC Tools Firewall Plus\FWService.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Completion time: 2009-12-13 11:19:13 - machine was rebooted
ComboFix-quarantined-files.txt 2009-12-13 10:19
ComboFix2.txt 2009-12-13 09:15

Pre-Run: 2 758 160 384 bájt szabad
Post-Run: 2 701 418 496 bájt szabad

- - End Of File - - 1C060832BB6FEFC77350668F2F55A7E4

by horex

Üdv. stell
itt egy Combo log

"ComboFix 09-12-11.05 - apple 009.12.13. 10:12:28.1.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1250.36.1038.18.511.322 [GMT 1:00]
Running from: c:\documents and settings\apple\Asztal\ComboFix.exe
FW: PC Tools Firewall Plus *disabled* {ABBD5028-5A95-4B6D-996E-98D64AE88D52}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\ieuinit.inf

.
((((((((((((((((((((((((( Files Created from 2009-11-13 to 2009-12-13 )))))))))))))))))))))))))))))))
.

2009-12-13 07:56 . 2009-12-13 07:56 -------- d-----w- c:\windows\system32\wbem\Repository
2009-12-13 07:55 . 2009-12-13 07:55 -------- d-----w- c:\program files\Ahead
2009-12-12 22:58 . 2009-12-12 22:58 -------- d-----w- c:\documents and settings\apple\Application Data\Uniblue
2009-12-12 21:01 . 2009-12-12 21:01 -------- d-----w- c:\documents and settings\All Users\Application Data\SITEguard
2009-12-12 21:00 . 2009-12-12 21:00 -------- d-----w- c:\program files\Common Files\iS3
2009-12-12 21:00 . 2009-12-12 21:00 -------- d-----w- c:\documents and settings\All Users\Application Data\STOPzilla!
2009-12-12 16:22 . 2009-12-12 16:22 -------- d-----w- c:\documents and settings\All Users\Application Data\{62EEA430-850F-46ED-B661-7C79D0D6D490}
2009-12-12 16:15 . 2009-12-12 16:15 -------- d-----w- c:\documents and settings\All Users\Application Data\VateraPst
2009-12-12 07:01 . 2009-12-12 07:01 -------- d-----w- c:\windows\$hf_mig$
2009-12-06 12:53 . 2009-12-06 12:53 -------- d-----w- c:\documents and settings\apple\Local Settings\Application Data\Ahead
2009-12-06 12:04 . 2009-12-06 12:04 -------- d-----w- c:\program files\Ahead(2)
2009-12-05 12:45 . 2009-12-05 12:45 -------- d-----w- c:\documents and settings\All Users\Application Data\PrevxCSI
2009-12-04 15:46 . 2009-12-04 15:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-12-04 14:24 . 2009-12-04 14:24 -------- d-----w- c:\program files\Microsoft Diagnostics and Recovery Toolset
2009-12-04 13:01 . 2009-12-04 13:01 -------- d-----w- c:\program files\Common Files\Ahead
2009-12-03 23:34 . 2009-12-03 23:34 -------- d-----w- c:\program files\REGSHAVE
2009-12-03 23:34 . 2002-06-25 09:06 45056 ------w- c:\windows\system32\FINFCOPY.dll
2009-12-03 23:34 . 2001-11-25 11:11 81924 ------w- c:\windows\system32\drivers\VC4CB104.SYS
2009-12-03 23:34 . 2002-02-27 11:27 65536 ------w- c:\windows\system32\FINFCHECK.dll
2009-12-03 23:34 . 2002-02-13 10:00 45056 ------w- c:\windows\system32\FCLKBTN.DLL
2009-12-03 23:34 . 2002-02-05 16:33 69632 ------w- c:\windows\system32\FREGSHEX.DLL
2009-12-03 21:45 . 2009-12-03 21:45 -------- d-----w- c:\program files\Datapol
2009-12-03 20:04 . 2009-12-03 20:04 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-12-03 20:04 . 2009-12-03 20:04 -------- d-----w- c:\program files\Common Files\InstallShield
2009-12-01 11:30 . 2009-12-01 11:30 -------- d-----w- c:\documents and settings\apple\Local Settings\Application Data\Innovative Solutions
2009-12-01 11:30 . 2009-12-01 11:30 -------- d-----w- c:\program files\Innovative Solutions
2009-11-28 19:34 . 2009-11-28 19:34 -------- d-----w- c:\documents and settings\apple\Application Data\Tenebril
2009-11-28 15:48 . 2009-11-28 15:48 -------- d-----w- c:\windows\system32\tenarchlib
2009-11-20 16:23 . 2009-11-20 16:23 -------- d-----w- c:\windows\url.dll
2009-11-13 10:54 . 2004-08-17 16:47 221184 ----a-w- c:\windows\system32\wmpns.dll
2009-11-13 10:41 . 2009-11-13 10:41 -------- d-----w- c:\documents and settings\apple\Application Data\Moyea
2009-11-13 10:41 . 2009-11-13 10:41 -------- d-----w- c:\program files\Moyea

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-12 15:44 . 2009-07-31 12:59 12328 ----a-w- c:\documents and settings\apple\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-15 10:54 . 2009-07-31 12:10 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-11-12 23:51 . 2009-07-31 14:43 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-11-12 22:48 . 2009-11-12 22:48 -------- d-----w- c:\program files\foxit
2009-11-12 22:16 . 2009-11-12 22:16 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-11-12 22:16 . 2009-11-12 22:16 -------- d-----w- c:\program files\Java
2009-11-12 22:16 . 2009-11-12 22:16 152576 ----a-w- c:\documents and settings\apple\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-11-12 20:21 . 2009-11-12 20:21 -------- d-----w- c:\documents and settings\apple\Application Data\XnView
2009-11-12 18:51 . 2009-11-12 18:51 -------- d-----w- c:\program files\Unlocker
2009-11-12 11:23 . 2009-11-12 11:23 -------- d-----w- c:\program files\XnView
2009-11-12 11:20 . 2009-11-12 11:20 -------- d-----w- c:\program files\FLV Player
2009-11-12 10:32 . 2009-11-12 10:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Hagel Technologies
2009-11-12 10:32 . 2009-11-12 10:32 -------- d---a-w- c:\program files\drcs_xp
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"00PCTFW"="c:\program files\PC Tools Firewall Plus\FirewallGUI.exe" [2009-02-23 2652056]
"DU Meter"="c:\program files\DU Meter\DUMeter.exe" [2004-08-25 1465856]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872]
"DRCS"="c:\program files\drcs_xp\DRCS.exe" [2001-04-22 315392]
"REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2002-02-04 53248]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-17 15360]

c:\documents and settings\All Users\Start Menu\Programs\Indˇt˘pult\
PC-TV FM Remote Control.lnk - c:\program files\KWorld\PC-TV FM\RemoteCtl.exe [2009-7-31 143360]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Indítópult^GhostSurf.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Indítópult\GhostSurf.lnk
backup=c:\windows\pss\GhostSurf.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-11-12 22:16 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [2009.07.31. 14:20 159600]
R2 BT848;BtCap, WDM Video Capture;c:\windows\system32\drivers\BT848.sys [2009.07.31. 13:37 265512]
R2 BTTUNER;BtTuner, WDM TvTuner;c:\windows\system32\drivers\bttuner.sys [2009.07.31. 13:37 18944]
R2 BTXBAR;BtXBar, WDM Crossbar;c:\windows\system32\drivers\btxbar.sys [2009.07.31. 13:37 13308]
R2 PCTAppEvent;PCTAppEvent Driver;c:\windows\system32\drivers\PCTAppEvent.sys [2009.07.31. 14:20 73840]
R3 EdgeSer;Inside Out Networks Edgeport Driver;c:\windows\system32\drivers\edgeser.sys [2009.11.12. 11:34 183534]
R3 Ionenum;Inside Out Networks Filter Driver;c:\windows\system32\drivers\ionenum.sys [2009.11.12. 11:34 27110]
R3 pctplfw;pctplfw;c:\windows\system32\drivers\pctplfw.sys [2009.07.31. 14:20 95640]
R3 wdm_au8830;Aureal Vortex 8830 audio-illesztőprogram (WDM);c:\windows\system32\drivers\adm8830.sys [2009.07.31. 12:12 747392]
S2 zpmodntgs;Manager Shell;c:\windows\system32\svchost.exe -k netsvcs [2004.08.17. 15:48 14336]
S3 tykgjkn;tykgjkn;\??\c:\windows\system32\014.tmp --> c:\windows\system32\014.tmp [?]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
zpmodntgs
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uInternet Settings,ProxyServer = <local>
uInternet Settings,ProxyOverride = <local>
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-DriverMax - (no file)
MSConfigStartUp-MSMSGS - c:\program files\Messenger\msmsgs.exe
AddRemove-Commander - h:\ncom\Uninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-13 10:15
Windows 5.1.2600 Szervizcsomag 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DRCS = c:\program files\drcs_xp\DRCS.exe?????????^????????[????,?N??H9??9?[(H9?,?N??H9????[??????????i?,?N???????????^????????????w???????????????????w????????z6?[w??[??????????^????????wh??w(H9?H???$??w???w??????????i?????????????????O???<??????w???w???????w?u?w,?N

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\tykgjkn]
"ImagePath"="\??\c:\windows\system32\014.tmp"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\zpmodntgs]
"ServiceDll"="c:\windows\system32\vudtp.dll"
.
Completion time: 2009-12-13 10:15:49
ComboFix-quarantined-files.txt 2009-12-13 09:15

Pre-Run: 2 788 028 416 bájt szabad
Post-Run: 2 779 693 056 bájt szabad

- - End Of File - - 45DD4B678B172EADB2765399ED7F2DBD"

Addj egy scriptet rá, légyszi
by horex

aztán megint itt egy laptop csrcs.exe problémával, de arrol majd később

van ido,majd futasd a scriptet ha lesz idod,
udv

Kifagyott megint, aztán mégegyszer futtatva ment, de nem csinált log fájlt

Hagyjuk mára, mert hajtanak más ugyben
by horex

Csinálom, csak ma más is van
by horex

Kinyitod a Notepadot>Start>futatas>beirod notepad
Es bemasolod a piros textet


Mostan>a notepadon elso full-fajl>ballfelsosarokban>4-sor>lementenni mint....
A txt-hejetfajlnev beteszed eztett>CFScript.txt<alatta bealitod >minden fajl<
legfelull>asztall i<klik gomb letenni.Es mostan megcsinalod eztett:

A combofix maga elindul es lehet hogy restartol es befejezi a scent.Amit majd ad ted ide

Lefutott a Combo

ComboFix 09-12-11.05 - apple 009.12.12. 15:19:00.2.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1250.36.1038.18.511.310 [GMT 1:00]
Running from: c:\documents and settings\apple\Asztal\ComboFix.exe
AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
FW: PC Tools Firewall Plus *enabled* {ABBD5028-5A95-4B6D-996E-98D64AE88D52}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\LOG.TXT

.
((((((((((((((((((((((((( Files Created from 2009-11-12 to 2009-12-12 )))))))))))))))))))))))))))))))
.

2009-12-12 07:01 . 2009-12-12 07:01 -------- d--h--w- c:\windows\$hf_mig$
2009-12-11 10:41 . 2009-12-11 10:41 -------- d-----w- c:\program files\SystemRequirementsLab
2009-12-06 12:53 . 2009-12-06 12:53 -------- d-----w- c:\documents and settings\apple\Local Settings\Application Data\Ahead
2009-12-06 12:04 . 2000-06-26 10:45 106496 ----a-w- c:\windows\system32\TwnLib20.dll
2009-12-06 12:04 . 2004-07-20 16:24 471040 ------w- c:\windows\system32\ImagXRA7.dll
2009-12-06 12:04 . 2004-07-09 08:43 364544 ------w- c:\windows\system32\TwnLib4.dll
2009-12-06 12:04 . 2004-07-20 16:24 476320 ------w- c:\windows\system32\ImagXpr7.dll
2009-12-06 12:04 . 2004-07-20 16:24 262144 ------w- c:\windows\system32\ImagXR7.dll
2009-12-06 12:04 . 2004-07-20 16:24 1568768 ------w- c:\windows\system32\ImagX7.dll
2009-12-06 12:04 . 2001-06-26 07:15 38912 ------w- c:\windows\system32\picn20.dll
2009-12-06 12:04 . 2001-07-09 10:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe
2009-12-06 12:04 . 2009-12-06 12:04 -------- d-----w- c:\program files\Ahead
2009-12-06 12:00 . 2009-12-06 12:00 63488 ----a-w- c:\windows\xobglu16.dll
2009-12-06 12:00 . 2009-12-06 12:00 23552 ----a-w- c:\windows\xobglu32.dll
2009-12-05 12:45 . 2009-12-05 12:45 53136 ----a-w- c:\windows\system32\PxSecure.dll
2009-12-05 12:45 . 2009-12-05 12:45 47152 ----a-w- c:\windows\system32\drivers\pxrts.sys
2009-12-05 12:45 . 2009-12-05 12:45 30280 ----a-w- c:\windows\system32\drivers\pxscan.sys
2009-12-05 12:45 . 2009-12-05 12:45 24496 ----a-w- c:\windows\system32\drivers\pxkbf.sys
2009-12-05 12:45 . 2009-12-05 12:45 -------- d-----w- c:\documents and settings\All Users\Application Data\PrevxCSI
2009-12-04 15:46 . 2009-03-30 09:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-12-04 15:46 . 2009-02-13 11:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-12-04 15:46 . 2009-02-13 11:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-12-04 15:46 . 2009-12-04 15:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-12-04 14:24 . 2009-12-04 14:24 -------- d-----w- c:\program files\Microsoft Diagnostics and Recovery Toolset
2009-12-04 13:01 . 2009-12-04 13:01 -------- d-----w- c:\program files\Common Files\Ahead
2009-12-03 23:34 . 2009-12-03 23:34 -------- d-----w- c:\program files\REGSHAVE
2009-12-03 23:34 . 2002-06-25 09:06 45056 ------w- c:\windows\system32\FINFCOPY.dll
2009-12-03 23:34 . 2001-11-25 11:11 81924 ------w- c:\windows\system32\drivers\VC4CB104.SYS
2009-12-03 23:34 . 2002-02-27 11:27 65536 ------w- c:\windows\system32\FINFCHECK.dll
2009-12-03 23:34 . 2002-02-13 10:00 45056 ------w- c:\windows\system32\FCLKBTN.DLL
2009-12-03 23:34 . 2002-02-05 16:33 69632 ------w- c:\windows\system32\FREGSHEX.DLL
2009-12-03 21:45 . 2009-12-03 21:45 -------- d-----w- c:\program files\Datapol
2009-12-03 20:04 . 2009-12-03 20:04 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-12-03 20:04 . 2009-12-03 20:04 -------- d-----w- c:\program files\Common Files\InstallShield
2009-12-01 11:30 . 2009-12-01 11:30 -------- d-----w- c:\documents and settings\apple\Local Settings\Application Data\Innovative Solutions
2009-12-01 11:30 . 2009-12-01 11:30 -------- d-----w- c:\program files\Innovative Solutions
2009-11-28 19:34 . 2009-11-28 19:34 -------- d-----w- c:\documents and settings\apple\Application Data\Tenebril
2009-11-28 15:48 . 2009-11-28 15:48 -------- d-----w- c:\windows\system32\tenarchlib
2009-11-20 16:23 . 2009-11-20 16:23 -------- d-----w- c:\windows\url.dll
2009-11-13 10:54 . 2004-08-17 16:47 221184 ----a-w- c:\windows\system32\wmpns.dll
2009-11-13 10:41 . 2009-11-13 10:41 -------- d-----w- c:\documents and settings\apple\Application Data\Moyea
2009-11-13 10:41 . 2009-11-13 10:41 -------- d-----w- c:\program files\Moyea
2009-11-12 22:48 . 2009-11-12 22:48 -------- d-----w- c:\program files\foxit
2009-11-12 22:18 . 2009-11-12 22:18 -------- d-----w- c:\documents and settings\apple\.housecall6.6
2009-11-12 22:17 . 2009-11-12 22:17 -------- d-----w- c:\windows\Sun
2009-11-12 22:16 . 2009-11-12 22:16 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-11-12 22:16 . 2009-11-12 22:16 -------- d-----w- c:\program files\Java
2009-11-12 22:16 . 2009-11-12 22:16 152576 ----a-w- c:\documents and settings\apple\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-11-12 20:21 . 2009-11-12 20:21 -------- d-----w- c:\documents and settings\apple\Application Data\XnView
2009-11-12 19:42 . 2009-11-12 19:42 -------- d-----w- c:\windows\system32\wbem\Repository
2009-11-12 18:51 . 2009-11-12 18:51 -------- d-----w- c:\program files\Unlocker

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-08 22:40 . 2009-07-31 14:43 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-11-15 10:54 . 2009-07-31 12:10 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-11-12 11:23 . 2009-11-12 11:23 -------- d-----w- c:\program files\XnView
2009-11-12 11:20 . 2009-11-12 11:20 -------- d-----w- c:\program files\FLV Player
2009-11-12 10:32 . 2009-11-12 10:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Hagel Technologies
2009-11-12 10:32 . 2009-11-12 10:32 -------- d---a-w- c:\program files\drcs_xp
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DU Meter"="c:\program files\DU Meter\DUMeter.exe" [2004-08-25 1465856]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-11-12 149280]
"DRCS"="c:\program files\drcs_xp\DRCS.exe" [2001-04-22 315392]
"REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2002-02-04 53248]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-17 15360]

c:\documents and settings\All Users\Start Menu\Programs\Indˇt˘pult\
PC-TV FM Remote Control.lnk - c:\program files\KWorld\PC-TV FM\RemoteCtl.exe [2009-7-31 143360]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Indítópult^GhostSurf.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Indítópult\GhostSurf.lnk
backup=c:\windows\pss\GhostSurf.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\00PCTFW]
2009-02-23 08:49 2652056 ----a-w- c:\program files\PC Tools Firewall Plus\FirewallGUI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt]
2009-03-02 12:08 209153 ----a-w- d:\programok\Avira\AntiVir Desktop\avgnt.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

R0 pxscan;pxscan;c:\windows\system32\drivers\pxscan.sys [2009.12.05. 13:45 30280]
R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [2009.07.31. 14:20 159600]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;d:\programok\Avira\AntiVir Desktop\sched.exe [2009.12.04. 16:46 108289]
R2 BT848;BtCap, WDM Video Capture;c:\windows\system32\drivers\BT848.sys [2009.07.31. 13:37 265512]
R2 BTTUNER;BtTuner, WDM TvTuner;c:\windows\system32\drivers\bttuner.sys [2009.07.31. 13:37 18944]
R2 BTXBAR;BtXBar, WDM Crossbar;c:\windows\system32\drivers\btxbar.sys [2009.07.31. 13:37 13308]
R2 PCTAppEvent;PCTAppEvent Driver;c:\windows\system32\drivers\PCTAppEvent.sys [2009.07.31. 14:20 73840]
R2 pxrts;pxrts;c:\windows\system32\drivers\pxrts.sys [2009.12.05. 13:45 47152]
R3 EdgeSer;Inside Out Networks Edgeport Driver;c:\windows\system32\drivers\edgeser.sys [2009.11.12. 11:34 183534]
R3 Ionenum;Inside Out Networks Filter Driver;c:\windows\system32\drivers\ionenum.sys [2009.11.12. 11:34 27110]
R3 pctplfw;pctplfw;c:\windows\system32\drivers\pctplfw.sys [2009.07.31. 14:20 95640]
R3 pxkbf;pxkbf;c:\windows\system32\drivers\pxkbf.sys [2009.12.05. 13:45 24496]
R3 wdm_au8830;Aureal Vortex 8830 audio-illesztőprogram (WDM);c:\windows\system32\drivers\adm8830.sys [2009.07.31. 12:12 747392]
S2 CSIScanner;CSIScanner;"c:\program files\Prevx\prevx.exe" /service --> c:\program files\Prevx\prevx.exe [?]
S2 zpmodntgs;Manager Shell;c:\windows\system32\svchost.exe -k netsvcs [2004.08.17. 15:48 14336]
S3 tykgjkn;tykgjkn;\??\c:\windows\system32\014.tmp --> c:\windows\system32\014.tmp [?]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
zpmodntgs
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uInternet Settings,ProxyServer = <local>
uInternet Settings,ProxyOverride = <local>
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-12 15:25
Windows 5.1.2600 Szervizcsomag 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DRCS = c:\program files\drcs_xp\DRCS.exe?????????^????????[????,?N??H9??9?[(H9?,?N??H9????[??????????i?,?N???????????^????????????w???????????????????w????????z6?[w??[??????????^????????wh??w(H9?H???$??w???w??????????i?????????????????O???<??????w???w???????w?u?w,?N

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\tykgjkn]
"ImagePath"="\??\c:\windows\system32\014.tmp"
.
Completion time: 2009-12-12 15:27:52
ComboFix-quarantined-files.txt 2009-12-12 14:27

Pre-Run: 3 104 514 048 bájt szabad
Post-Run: 3 109 437 440 bájt szabad

- - End Of File - - CDE093D03FDF50CA32BF8FECCF5ADB1B

Micsoda? Ezek az oldalak nem használnak víruskeresőt? Nem létezik.

kikel kapcsolnod a tuzfalat is
futasd megegszer csak ugy tisztan,script nelkul,

Megvolt
Viszont a Combfix leállt, vártam vagy 15percet és kilőttem

by horex
Hö, most látom, hogy az OTL meg eltunt a gépröl!
Mi ez???

szed le a combofixet a geprol,mert megvan serulve,,start_futatas,masold be
combofix /uninstall ok
aztan tolds le az OTL2-programot
OTL
futasd,klik>Cleanup,,yes,,yes,,ez kiviszi a maradekot,
aztan ujbol tolds le a combofixet,es csinald amit irtam
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

"A windows nem találja a "NIRCMD" fájlt"
"Hozzáférés megtagadva"

Ezek a Conflickerek meg nem porno és tarsai oldalokon nyomulnak, hanem index.hu, simson.hu és itt a terminal.hu oldalokon is

Ja, és a DRCS a távirányitó progija

ez egyszeu kerdes,,de igen nehez a valasz,,it nemarol van szo hogy miert,es az Avirarol,de arol hogy tudnod kene hogy terjednek a virusok es a trojak,,
A virus -ez egy kis kod a programhoz,
Troja-ez pontosan ugy ahogy Odysseus kialalta a faloval,hogy jutotak be a gorog katonak a trojaba??ugyanugy bejutnak a gepedbe ,mert minden gyanus,,vagy nem legalis szoftewerben ot van mint bonus valami kod,,ami aztan majd kimaszik a falobol es tamad ,,hoza a tobbi katonat,
It van a szurke internet zona,porno,,,satobi.sokaig nincsenek is az antivirokal felfedezve a virusok,mert ez olyan mintha tut keresnenek a szenaboglyaban,es eltelik egypar het meg az uj szemet bekerul a detekcojokba,,
tehat,
nemtoltunk le minden fele programokat amit nemismerunk,
crackokat
pornot
a te estetben a conficker az USB-kulcsokon terjed,bedugod a gepbe a szomszed usb kulcsat es rogton fut az autorun.info,,ami rogton futatja az exe fajlot,ami aztan betelepitje a kodokat
Tehat sokan azt hiszik hogy van virusvedelem,tuzfal,akor nemtottenhet semmi,,ez mind a felhasznalo hibaja,,es nem a antiviruse,,
na erol enyit,,
Kinyitod a Notepadot>Start>futatas>beirod notepad
Es bemasolod a piros textet


Mostan>a notepadon elso full-fajl>ballfelsosarokban>4-sor>lementenni mint....
A txt-hejetfajlnev beteszed eztett>CFScript.txt<alatta bealitod >minden fajl<
legfelull>asztall i<klik gomb letenni.Es mostan megcsinalod eztett:

A combofix maga elindul es lehet hogy restartol es befejezi a scent.Amit majd ad ted ide

Itt vagyok, megcsináltam
Az alapkérdésem persze az, hogy az Avira miért engedi ezeket a virusokat át?

"ComboFix 09-12-11.01 - apple 009.12.12. 8:18.1.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1250.36.1038.18.511.295 [GMT 1:00]
Running from: d:\downloads\confick\ComboFix.exe
AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
FW: PC Tools Firewall Plus *enabled* {ABBD5028-5A95-4B6D-996E-98D64AE88D52}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\ieuinit.inf

.
((((((((((((((((((((((((( Files Created from 2009-11-12 to 2009-12-12 )))))))))))))))))))))))))))))))
.

2009-12-12 07:01 . 2009-12-12 07:01 -------- d--h--w- c:\windows\$hf_mig$
2009-12-11 10:41 . 2009-12-11 10:41 -------- d-----w- c:\program files\SystemRequirementsLab
2009-12-06 12:53 . 2009-12-06 12:53 -------- d-----w- c:\documents and settings\apple\Local Settings\Application Data\Ahead
2009-12-06 12:04 . 2000-06-26 10:45 106496 ----a-w- c:\windows\system32\TwnLib20.dll
2009-12-06 12:04 . 2004-07-20 16:24 471040 ------w- c:\windows\system32\ImagXRA7.dll
2009-12-06 12:04 . 2004-07-09 08:43 364544 ------w- c:\windows\system32\TwnLib4.dll
2009-12-06 12:04 . 2004-07-20 16:24 476320 ------w- c:\windows\system32\ImagXpr7.dll
2009-12-06 12:04 . 2004-07-20 16:24 262144 ------w- c:\windows\system32\ImagXR7.dll
2009-12-06 12:04 . 2004-07-20 16:24 1568768 ------w- c:\windows\system32\ImagX7.dll
2009-12-06 12:04 . 2001-06-26 07:15 38912 ------w- c:\windows\system32\picn20.dll
2009-12-06 12:04 . 2001-07-09 10:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe
2009-12-06 12:04 . 2009-12-06 12:04 -------- d-----w- c:\program files\Ahead
2009-12-06 12:00 . 2009-12-06 12:00 63488 ----a-w- c:\windows\xobglu16.dll
2009-12-06 12:00 . 2009-12-06 12:00 23552 ----a-w- c:\windows\xobglu32.dll
2009-12-05 12:45 . 2009-12-05 12:45 53136 ----a-w- c:\windows\system32\PxSecure.dll
2009-12-05 12:45 . 2009-12-05 12:45 47152 ----a-w- c:\windows\system32\drivers\pxrts.sys
2009-12-05 12:45 . 2009-12-05 12:45 30280 ----a-w- c:\windows\system32\drivers\pxscan.sys
2009-12-05 12:45 . 2009-12-05 12:45 24496 ----a-w- c:\windows\system32\drivers\pxkbf.sys
2009-12-05 12:45 . 2009-12-05 12:45 -------- d-----w- c:\documents and settings\All Users\Application Data\PrevxCSI
2009-12-04 15:46 . 2009-03-30 09:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-12-04 15:46 . 2009-02-13 11:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-12-04 15:46 . 2009-02-13 11:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-12-04 15:46 . 2009-12-04 15:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-12-04 14:24 . 2009-12-04 14:24 -------- d-----w- c:\program files\Microsoft Diagnostics and Recovery Toolset
2009-12-04 13:01 . 2009-12-04 13:01 -------- d-----w- c:\program files\Common Files\Ahead
2009-12-03 23:34 . 2009-12-03 23:34 -------- d-----w- c:\program files\REGSHAVE
2009-12-03 23:34 . 2002-06-25 09:06 45056 ------w- c:\windows\system32\FINFCOPY.dll
2009-12-03 23:34 . 2001-11-25 11:11 81924 ------w- c:\windows\system32\drivers\VC4CB104.SYS
2009-12-03 23:34 . 2002-02-27 11:27 65536 ------w- c:\windows\system32\FINFCHECK.dll
2009-12-03 23:34 . 2002-02-13 10:00 45056 ------w- c:\windows\system32\FCLKBTN.DLL
2009-12-03 23:34 . 2002-02-05 16:33 69632 ------w- c:\windows\system32\FREGSHEX.DLL
2009-12-03 21:45 . 2009-12-03 21:45 -------- d-----w- c:\program files\Datapol
2009-12-03 20:04 . 2009-12-03 20:04 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-12-03 20:04 . 2009-12-03 20:04 -------- d-----w- c:\program files\Common Files\InstallShield
2009-12-01 11:30 . 2009-12-01 11:30 -------- d-----w- c:\documents and settings\apple\Local Settings\Application Data\Innovative Solutions
2009-12-01 11:30 . 2009-12-01 11:30 -------- d-----w- c:\program files\Innovative Solutions
2009-11-28 19:34 . 2009-11-28 19:34 -------- d-----w- c:\documents and settings\apple\Application Data\Tenebril
2009-11-28 15:48 . 2009-11-28 15:48 -------- d-----w- c:\windows\system32\tenarchlib
2009-11-20 16:23 . 2009-11-20 16:23 -------- d-----w- c:\windows\url.dll
2009-11-13 10:54 . 2004-08-17 16:47 221184 ----a-w- c:\windows\system32\wmpns.dll
2009-11-13 10:41 . 2009-11-13 10:41 -------- d-----w- c:\documents and settings\apple\Application Data\Moyea
2009-11-13 10:41 . 2009-11-13 10:41 -------- d-----w- c:\program files\Moyea
2009-11-12 22:48 . 2009-11-12 22:48 -------- d-----w- c:\program files\foxit
2009-11-12 22:18 . 2009-11-12 22:18 -------- d-----w- c:\documents and settings\apple\.housecall6.6
2009-11-12 22:17 . 2009-11-12 22:17 -------- d-----w- c:\windows\Sun
2009-11-12 22:16 . 2009-11-12 22:16 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-11-12 22:16 . 2009-11-12 22:16 -------- d-----w- c:\program files\Java
2009-11-12 22:16 . 2009-11-12 22:16 152576 ----a-w- c:\documents and settings\apple\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-11-12 20:21 . 2009-11-12 20:21 -------- d-----w- c:\documents and settings\apple\Application Data\XnView
2009-11-12 19:42 . 2009-11-12 19:42 -------- d-----w- c:\windows\system32\wbem\Repository
2009-11-12 18:51 . 2009-11-12 18:51 -------- d-----w- c:\program files\Unlocker
2009-11-12 14:10 . 2009-11-12 14:10 -------- d-s---w- c:\documents and settings\apple\UserData
2009-11-12 11:23 . 2009-11-12 11:23 -------- d-----w- c:\program files\XnView
2009-11-12 11:20 . 2009-11-12 11:20 -------- d-----w- c:\program files\FLV Player
2009-11-12 10:34 . 2004-08-26 08:35 183534 ----a-w- c:\windows\system32\drivers\edgeser.sys
2009-11-12 10:34 . 2004-01-21 14:53 27110 ----a-w- c:\windows\system32\drivers\ionenum.sys
2009-11-12 10:34 . 2004-08-23 08:50 495616 ----a-w- c:\windows\system32\edgeport.exe
2009-11-12 10:34 . 2004-06-10 15:07 116628 ----a-w- c:\windows\system32\EdgeCoIn.dll
2009-11-12 10:32 . 2009-11-12 10:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Hagel Technologies
2009-11-12 10:32 . 2009-11-12 10:32 -------- d---a-w- c:\program files\drcs_xp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-08 22:40 . 2009-07-31 14:43 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-11-15 10:54 . 2009-07-31 12:10 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"00PCTFW"="c:\program files\PC Tools Firewall Plus\FirewallGUI.exe" [2009-02-23 2652056]
"DU Meter"="c:\program files\DU Meter\DUMeter.exe" [2004-08-25 1465856]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-11-12 149280]
"DRCS"="c:\program files\drcs_xp\DRCS.exe" [2001-04-22 315392]
"REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2002-02-04 53248]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-17 15360]

c:\documents and settings\All Users\Start Menu\Programs\Indˇt˘pult\
PC-TV FM Remote Control.lnk - c:\program files\KWorld\PC-TV FM\RemoteCtl.exe [2009-7-31 143360]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Indítópult^GhostSurf.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Indítópult\GhostSurf.lnk
backup=c:\windows\pss\GhostSurf.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt]
2009-03-02 12:08 209153 ----a-w- d:\programok\Avira\AntiVir Desktop\avgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
2008-05-02 04:15 15872 ----a-w- c:\program files\Unlocker\UnlockerAssistant.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

R0 pxscan;pxscan;c:\windows\system32\drivers\pxscan.sys [2009.12.05. 13:45 30280]
R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [2009.07.31. 14:20 159600]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;d:\programok\Avira\AntiVir Desktop\sched.exe [2009.12.04. 16:46 108289]
R2 BT848;BtCap, WDM Video Capture;c:\windows\system32\drivers\BT848.sys [2009.07.31. 13:37 265512]
R2 BTTUNER;BtTuner, WDM TvTuner;c:\windows\system32\drivers\bttuner.sys [2009.07.31. 13:37 18944]
R2 BTXBAR;BtXBar, WDM Crossbar;c:\windows\system32\drivers\btxbar.sys [2009.07.31. 13:37 13308]
R2 PCTAppEvent;PCTAppEvent Driver;c:\windows\system32\drivers\PCTAppEvent.sys [2009.07.31. 14:20 73840]
R2 pxrts;pxrts;c:\windows\system32\drivers\pxrts.sys [2009.12.05. 13:45 47152]
R3 EdgeSer;Inside Out Networks Edgeport Driver;c:\windows\system32\drivers\edgeser.sys [2009.11.12. 11:34 183534]
R3 Ionenum;Inside Out Networks Filter Driver;c:\windows\system32\drivers\ionenum.sys [2009.11.12. 11:34 27110]
R3 pctplfw;pctplfw;c:\windows\system32\drivers\pctplfw.sys [2009.07.31. 14:20 95640]
R3 pxkbf;pxkbf;c:\windows\system32\drivers\pxkbf.sys [2009.12.05. 13:45 24496]
R3 wdm_au8830;Aureal Vortex 8830 audio-illesztőprogram (WDM);c:\windows\system32\drivers\adm8830.sys [2009.07.31. 12:12 747392]
S2 CSIScanner;CSIScanner;"c:\program files\Prevx\prevx.exe" /service --> c:\program files\Prevx\prevx.exe [?]
S2 zpmodntgs;Manager Shell;c:\windows\system32\svchost.exe -k netsvcs [2004.08.17. 15:48 14336]
S3 tykgjkn;tykgjkn;\??\c:\windows\system32\014.tmp --> c:\windows\system32\014.tmp [?]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
zpmodntgs
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uInternet Settings,ProxyServer = <local>
uInternet Settings,ProxyOverride = <local>
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-DriverMax - (no file)
MSConfigStartUp-MSMSGS - c:\program files\Messenger\msmsgs.exe
AddRemove-Commander - h:\ncom\Uninstall.exe
AddRemove-PCSI - c:\program files\Prevx\prevx.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-12 08:23
Windows 5.1.2600 Szervizcsomag 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DRCS = c:\program files\drcs_xp\DRCS.exe?????????^????????[????,?N??H9??9?[(H9?,?N??H9????[??????????i?,?N???????????^????????????w???????????????????w????????z6?[w??[??????????^????????wh??w(H9?H???$??w???w??????????i?????????????????O???<??????w???w???????w?u?w,?N

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\tykgjkn]
"ImagePath"="\??\c:\windows\system32\014.tmp"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\zpmodntgs]
"ServiceDll"="c:\windows\system32\vudtp.dll"
.
Completion time: 2009-12-12 08:25:13
ComboFix-quarantined-files.txt 2009-12-12 07:25

Pre-Run: 2 921 570 304 bájt szabad
Post-Run: 3 159 556 096 bájt szabad

- - End Of File - - B26C07D616DEE77037AC380A342909C7"

by horex

udv
csinald vegig eztet aztan>.a combofixet,logot ide,
http://forum.terminal.hu/viewtopic.php?t=37182

Üdv. Stell

Amint régen ajánlottad, az Avirát használom
Szinte folyamatosan felugro ablakok, hogy virus, mindig kattintok, hogy tegye karanténba

Ennek ellenére, gondolom a virus ráül a tárcsázóra, mert uj ablak nyitás esetén a kapcsolatra kell klikkelnem
Amikor meg lekapcsolódom a netröl, meginmt beugrik az ablak, hogy virus és mit akarok csinálni
Rendszer átvizsgáláskor jellemzően WormConficker-eket talál

HA virusvédelem, miért nem akadályozza meg a virus bejutását, pláne hogy karanténba rakatom?

Ennyi virus találna meg, pont engem, másoknál hogy van ez?

by horex

hm,hat meg ilyet nemlatam,menyi hozaszolas kel hogy at ugorjon az oldal??

Van egy ötletem, amíg a Fórumhiba (Nincs hozzászólás a témában) fennáll:

A Seurity Fórumon megkeresni a Topikot, és az utolsó előtti számra kattintani. Ott lesz a hozzászólás.

Az utolsó számra jön be ez a hibajelentés.

Ezt a hszt elküldtem a másik (VÍRUSOK,ROOTKIT ÉS MINDEN AMI ISSZA A VÉREMET:!: ) hibás topikba is.

Na most vigyaz nehogy restartolod a gepet mert meghal a rendszer,pedig irtam hogy nefutasd a combofixet mert hibas volt,,csinald eztet
1:talald meg>>c:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\pciide.sys.vir
torold le a .vir ugy hogy igy nezen ki
C\WINDOWS\system32\drivers\pciide.sys es masold visza a
C\WINDOWS\system32\drivers mapajaba

2:szed le a geprol a combofixet mert ez a mi most van hibas
start-futatas-beirod combofix /uninstall ok

3,igen vanak ot meg tojak,,letoltod az uj combofixet es futatod a loglyat ted ide
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Hello!

Ezt hozta ki a program:

ComboFix 09-11-20.02 - Telegdy 009.11.22. 11:02.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1250.36.1038.18.959.625 [GMT 1:00]
Running from: c:\documents and settings\Telegdy\Asztal\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\logfile32.txt
c:\windows\system32\AutoRun.inf
c:\windows\system32\drivers\pciide.sys
c:\windows\system32\ieuinit.inf

.
((((((((((((((((((((((((( Files Created from 2009-10-22 to 2009-11-22 )))))))))))))))))))))))))))))))
.

2009-11-17 12:37 . 2009-11-17 12:37 -------- d-----w- c:\program files\Automex Kft
2009-11-14 14:59 . 2009-11-14 15:02 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-11-12 19:28 . 2009-11-12 19:28 94208 ----a-w- c:\windows\system32\05.scr
2009-11-11 17:10 . 2009-11-22 07:28 -------- d-----w- c:\documents and settings\Telegdy\Application Data\skypePM
2009-11-11 17:10 . 2009-11-11 17:10 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-11-11 15:44 . 2009-11-11 15:44 94208 --sh--r- c:\windows\system32\drivers\CztF.exe
2009-11-10 19:36 . 2009-11-22 09:29 -------- d-----w- c:\documents and settings\Telegdy\Application Data\Skype
2009-11-10 19:35 . 2009-11-10 19:35 -------- d-----w- c:\program files\Common Files\Skype
2009-11-10 19:35 . 2009-11-10 19:35 -------- d-----r- c:\program files\Skype
2009-11-10 19:35 . 2009-11-10 19:35 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2009-11-10 15:43 . 2008-04-23 13:05 47616 ----a-w- c:\windows\system32\Remove.exe
2009-11-10 15:43 . 2008-02-13 12:17 618112 ----a-w- c:\windows\system32\drivers\PFC027.SYS
2009-11-10 15:43 . 2007-11-02 10:07 6656 ----a-w- c:\windows\system32\CoInst_080213.dll
2009-11-10 15:43 . 2009-11-10 15:43 -------- d-----w- c:\program files\Common Files\i-Look 110
2009-11-10 15:43 . 2009-11-10 15:43 -------- d-----w- c:\windows\PixArt
2009-10-29 14:37 . 2009-10-15 21:32 85504 ----a-w- c:\windows\system32\ff_vfw.dll
2009-10-29 14:37 . 2009-10-29 14:37 -------- d-----w- c:\program files\ffdshow
2009-10-29 14:27 . 2007-02-26 12:30 36864 ----a-r- c:\windows\system32\cmudax3.DLL
2009-10-29 14:27 . 2008-12-03 06:32 1519424 ----a-r- c:\windows\system32\drivers\cmudax3.sys
2009-10-24 15:17 . 1999-01-11 15:26 59392 ----a-r- c:\windows\system\a3d.dll
2009-10-24 15:17 . 2009-10-24 15:17 -------- d-----w- c:\windows\SBAP
2009-10-24 15:17 . 2009-10-24 15:43 -------- d-----w- c:\program files\CREATIVE
2009-10-24 15:10 . 2004-08-03 21:08 10624 -c--a-w- c:\windows\system32\dllcache\gameenum.sys
2009-10-24 15:10 . 2004-08-03 21:08 10624 ----a-w- c:\windows\system32\drivers\gameenum.sys
2009-10-24 15:09 . 2001-08-17 18:19 40704 -c--a-w- c:\windows\system32\dllcache\es1371mp.sys
2009-10-24 15:09 . 2001-08-17 18:19 40704 ----a-w- c:\windows\system32\drivers\es1371mp.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-22 09:40 . 2009-08-04 14:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Avg8
2009-11-17 12:37 . 2009-08-04 13:58 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-11-14 16:48 . 2009-08-14 16:58 -------- d-----w- c:\documents and settings\Telegdy\Application Data\MSN6
2009-11-14 15:02 . 2009-08-05 16:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-11-09 19:33 . 2009-08-16 06:42 -------- d-----w- c:\program files\CyberLink
2009-11-08 18:59 . 2009-09-12 10:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton
2009-11-08 18:59 . 2009-09-12 10:51 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-10-25 08:19 . 2001-10-26 12:00 57716 ----a-w- c:\windows\system32\perfc00E.dat
2009-10-25 08:19 . 2001-10-26 12:00 303356 ----a-w- c:\windows\system32\perfh00E.dat
2009-10-18 06:18 . 2009-10-18 06:18 -------- d-----w- c:\documents and settings\Telegdy\Application Data\ArcSoft
2009-10-18 06:17 . 2009-10-18 06:17 -------- d-----w- c:\program files\Common Files\ArcSoft
2009-10-18 06:16 . 2009-10-18 06:16 -------- d-----w- c:\program files\ArcSoft
2009-10-10 19:30 . 2009-08-04 15:05 -------- d-----w- c:\program files\Google
2009-10-08 15:50 . 2009-10-08 15:50 -------- d-----w- c:\program files\totalcmd
2009-09-23 16:02 . 2009-08-04 13:54 28112 ----a-w- c:\documents and settings\Telegdy\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-23 15:27 . 2009-09-23 15:27 -------- d-----w- c:\program files\SmartSound Software
2009-09-23 15:27 . 2009-09-23 15:27 -------- d-----w- c:\documents and settings\All Users\Application Data\SmartSound Software Inc
2009-09-23 13:15 . 2009-09-23 13:15 0 ----a-w- c:\windows\nsreg.dat
2009-09-06 14:10 . 2009-09-06 14:10 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-09-06 14:10 . 2009-09-06 14:10 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-09-06 14:10 . 2009-09-06 14:10 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-09-06 14:10 . 2009-09-06 14:10 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2006-10-31 7634944]
"NvMediaCenter"="c:\windows\System32\NvMcTray.dll" [2006-10-31 86016]
"PAC207_Monitor"="c:\windows\PixArt\i-Look110\Monitor.exe" [2007-12-10 323584]
"Monitor"="c:\windows\PixArt\i-Look110\Monitor.exe" [2007-12-10 323584]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-11-03 2028312]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-17 15360]

c:\documents and settings\All Users\Start Menu\Programs\Ind·t¢pult\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-09-06 14:10 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Indítópult^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Indítópult\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\WINDOWS\\System32\\05.scr"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3970:TCP"= 3970:TCP:ssrzt

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009.09.06. 15:10 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009.09.06. 15:10 108552]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009.09.06. 15:09 297752]
R2 BT848;WinFast VC100 WDM Video Capture;c:\windows\system32\drivers\wf2kvcap.sys [2009.08.02. 12:31 76325]
R2 Tv2kXbar;WinFast VC100 WDM Crossbar;c:\windows\system32\drivers\wf2kXbar.sys [2009.08.02. 12:31 10005]
R3 PAC207;i-Look 110;c:\windows\system32\drivers\PFC027.SYS [2009.11.10. 16:43 618112]
S2 ajeknuorz;Boot Task;c:\windows\system32\svchost.exe -k netsvcs [2001.10.26. 13:00 14336]
S2 vffqg;Driver Helper;c:\windows\system32\svchost.exe -k netsvcs [2001.10.26. 13:00 14336]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys --> c:\windows\system32\drivers\Ambfilt.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ajeknuorz
vffqg
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.startlap.hu/
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
FF - ProfilePath - c:\documents and settings\Telegdy\Application Data\Mozilla\Firefox\Profiles\44gt2ok3.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.startlap.hu/
FF - plugin: d:\programok\Adobe\Acrobat 5.0\Reader\browser\nppdf32.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-22 11:06
Windows 5.1.2600 Szervizcsomag 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\RUNDLL32.EXE
c:\program files\Microsoft Office\Office\1038\msoffice.exe
c:\windows\System32\nvsvc32.exe
c:\progra~1\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-11-22 11:07 - machine was rebooted
ComboFix-quarantined-files.txt 2009-11-22 10:07

Pre-Run: 19 266 281 472 bájt szabad
Post-Run: 19 368 964 096 bájt szabad

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional - magyar" /fastdetect /NoExecute=OptIn

- - End Of File - - 0E512DFA778EEC5598C57BAA41AF8577

Egy félórával ezelőtt már írtam:
http://forum.terminal.hu/viewtopic.php?p=945331#945331

Remélem csinálnak is valamit. Basszus.

Azért írhatsz egy pü-t Sy-nak.
http://forum.terminal.hu/privmsg.php?mode=post&u=241496

ihkab azt mond hogy miert nemlyavitjak mar ki azt a hibat hogy nincsen hoza szolas es miert nemegy at mar a PHpBB3 ra,meg mindig ez a regi van,

Akkor megnyugodtam.

igen
mert ez program es nemvolt a whitelisteben ez a driver,,es ha a driver megfertozodot akor torolte,,de mar renben van,,kivan javitva,,

Ilyen is létezik?

Elõre is köszi!

Csak holnap délelõtt tudok átmenni hozzájuk, és lefuttatni a progit!
Szóval holnap másolom csak be a reportot....

Köszi!

udv

Szia!

Egy rokonom gépén találtam valami nem oda illõt, amit nem tudtam a géprõl kiírtani, mert mindig visszajön.
A "C" meghajtóra felír egy .exe file-t : t7v6u8m3j2y8.exe
Nem tudom , hogy ettõl lehet-e, de könnyen szed a gép mindenféle vírust, meg a net kapcsolat megszakad állandóan....
A gépen az AVGfree van fent, meg a Spybot
Segítség!!!

Köszi!

nincsen mit,
udv,

Hát akkor megnyugodtam
És köszönöm hogy ilyen sok időt pazaroltál a problémámra.
Tehát:Köszönöm szépen

ez a fontos

azt jelenti hogy nincsen ot semmi,tiszta a bootsectorok,,ez valami bugly a Mbr.exenek,,ha nincsen problem a gepel akor mar nempiszkallyuk ok,

Lefuttattam a norman-t:

Norman SinowalMBR Cleaner
Copyright © 1990 - 2008, Norman ASA. Built 2008/05/13 16:21:18

Norman Scanner Engine Version: 5.92.04
Nvcbin.def Version: 5.92.00, Date: 2008/05/13 16:21:18, Variants: 0

Running pre-scan cleanup routine:
Operating System: Microsoft Windows XP Professional 5.1.2600 Szervizcsomag 2
Logged on user: PRIVE-7E8CFBBA2\Rendszergazda

Set registry value: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLS = "00 00 00 00 20 25 2A 00 " -> ""
Removed registry value: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -> DisableRegistryTools = 0x00000000
Removed registry value: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -> DisableRegistryTools = 0x00000000

Scan started: 23/10/2009 19:30:18

Scanning bootsectors...

No SinowalMBR hooks found

Number of sectors found: 2
Number of sectors scanned: 2
Number of sectors not scanned: 0
Number of infections found: 0
Number of infections removed: 0
Total scanning time: 1s 265ms


Scanning running processes and process memory...

Number of processes/threads found: 1475
Number of processes/threads scanned: 1475
Number of processes/threads not scanned: 0
Number of infected processes/threads terminated: 0
Total scanning time: 26s


Scanning file system...

Scanning: C:\*.*

Scanning: D:\*.*

D:\Lacko\N95\Valamik\Navigon_Mobile_Navigator_7.1.004_Final.rar/CMT (Error whilst scanning file: I/O Error)

D:\Lacko\N95\Valamik\power-mp3-upfone-hu.rar/CMT (Error whilst scanning file: I/O Error)

Scanning: I:\*.*

I:\Install\Titan.Quest.EMUDVD-Unleashed\Titan.Quest.Crash.Fix\Titan_Quest_Update_v1.08_to_v1.11_Multi-WFE\wfe.tq.1.11.rar/CMT (Error whilst scanning file: I/O Error)


Running post-scan cleanup routine:

Number of files found: 146117
Number of archives unpacked: 1390
Number of files scanned: 146084
Number of files not scanned: 33
Number of files skipped due to exclude list: 0
Number of infected files found: 0
Number of infected files repaired/deleted: 0
Number of infections removed: 0
Total scanning time: 39m 38s


Az mbr.exe log fájl ugyan az maradt

na figyelly ide mar nemegy gepen at irtuk a sectorokat en nemtudom hogy a tied miert nemlyo,,vagy csak a mbr.exe buglya,,,mert a G-Mer nemutatot semmit,,meg futasd le a normanrt,az tan a vegen restartolni a gepet
http://download.softpedia.com/dl/4d0a8c ... leaner.exe

Hát ez még mindig ugyanaz

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK
copy of MBR has been found in sector 0x04A817F0
malicious code @ sector 0x04A817F3 !
PE file found in sector at 0x04A81809 !

ok,nemlatok it semmi veszelyes dolgot
start-futats masold be combofix /u ok
a combofix letelepitodig a geprol
start futats masold be
"%userprofile%\Asztal\mbr" -f ok restart
es uly mbr.exe logot ide,

Itt a txt fájl:

ComboFix 09-10-22.01 - Rendszergazda 2009/10/23 17:52.1.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1038.18.503.203 [GMT 2:00]
Running from: c:\documents and settings\Rendszergazda\Asztal\ComboFix.exe
AV: ESET NOD32 Antivirus System 2.70 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2009-09-23 to 2009-10-23 )))))))))))))))))))))))))))))))
.

2009-10-22 20:25 . 2009-10-22 20:25 -------- d-----w- c:\documents and settings\Rendszergazda\Application Data\Registry Mechanic
2009-10-22 20:17 . 2009-10-22 20:17 -------- d-----w- c:\program files\Common Files\PC Tools
2009-10-22 19:13 . 2009-10-22 19:13 -------- d-----w- c:\documents and settings\Rendszergazda\Application Data\Mael
2009-10-22 19:08 . 2009-10-22 19:08 -------- d-----w- c:\program files\HxD
2009-10-17 21:11 . 2009-10-17 21:10 737280 ----a-w- c:\windows\iun6002.exe
2009-10-17 21:11 . 2009-10-17 21:11 -------- d-----w- c:\program files\FireTune
2009-10-17 10:22 . 2009-10-17 10:22 -------- d-----w- c:\documents and settings\Rendszergazda\Local Settings\Application Data\Downloaded Installations
2009-10-16 23:38 . 2003-11-15 20:27 118872 ----a-w- c:\windows\system32\PXC25uis.dll
2009-10-16 23:38 . 2003-02-05 19:06 45142 ----a-w- c:\windows\system32\PXC25s.dll
2009-10-16 23:38 . 2002-12-27 17:33 20569 ----a-w- c:\windows\system32\PXC25pm.dll
2009-10-16 23:38 . 2003-09-15 01:36 390656 ----a-w- c:\windows\system32\pdfxclib.dll
2009-10-16 23:38 . 2003-08-15 22:15 109568 ----a-w- c:\windows\system32\pdfxcpro.dll
2009-10-16 23:38 . 2003-08-15 22:12 144896 ----a-w- c:\windows\system32\xc_parse.dll
2009-10-16 23:38 . 2003-07-31 17:02 8704 ----a-w- c:\windows\system32\pdfxcds.dll
2009-10-16 23:38 . 2003-05-18 17:37 157184 ----a-w- c:\windows\system32\img_xchg.dll
2009-10-16 23:38 . 2003-04-13 23:08 185344 ----a-w- c:\windows\system32\Img_cdx.dll
2009-10-16 23:38 . 2002-01-05 05:37 344064 ----a-w- c:\windows\system32\msvcr70.dll
2009-10-16 23:38 . 2009-10-16 23:38 -------- d-----w- c:\program files\TTMessenger
2009-10-09 16:56 . 2009-10-10 11:45 -------- d-----w- c:\program files\Luxor Mahjong
2009-10-09 16:56 . 2009-10-09 16:56 -------- d-----w- c:\program files\BFG
2009-10-04 07:07 . 2009-10-17 10:44 -------- d-----w- c:\documents and settings\Rendszergazda\Local Settings\Application Data\Adobe
2009-10-04 07:04 . 2009-10-17 10:42 -------- d-----w- c:\program files\Common Files\Adobe
2009-10-04 00:45 . 2009-10-04 00:45 -------- d-----w- c:\windows\ServicePackFiles
2009-10-04 00:36 . 2009-10-04 04:49 -------- d-----w- c:\windows\SxsCaPendDel
2009-10-04 00:30 . 2009-10-04 00:30 -------- d-----w- c:\program files\MSXML 6.0
2009-10-04 00:23 . 2009-10-04 00:23 -------- d-----w- c:\program files\MSXML 4.0
2009-10-03 18:27 . 2009-10-03 22:03 -------- d-----w- c:\windows\system32\CatRoot_bak
2009-10-03 15:46 . 2008-06-14 18:00 272512 -c----w- c:\windows\system32\dllcache\bthport.sys
2009-10-03 15:46 . 2008-06-14 18:00 272512 ------w- c:\windows\system32\drivers\bthport.sys
2009-10-03 15:32 . 2009-06-09 14:56 53248 -c----w- c:\windows\system32\dllcache\tsgqec.dll
2009-10-03 15:32 . 2009-06-09 14:56 290816 -c----w- c:\windows\system32\dllcache\rhttpaa.dll
2009-10-03 15:32 . 2009-06-09 14:56 136192 -c----w- c:\windows\system32\dllcache\aaclient.dll
2009-10-03 15:32 . 2009-02-09 11:45 2064384 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe
2009-10-03 15:32 . 2009-02-09 11:45 2022400 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2009-10-03 15:31 . 2009-02-09 11:45 2187520 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe
2009-10-03 15:31 . 2009-02-09 11:45 2144256 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2009-10-03 15:24 . 2008-10-24 11:25 455936 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2009-10-03 15:02 . 2009-10-04 20:33 -------- d--h--w- c:\windows\$hf_mig$
2009-10-03 14:42 . 2008-10-16 12:06 268648 ----a-w- c:\windows\system32\mucltui.dll
2009-10-03 08:57 . 2009-10-03 08:57 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-10-03 07:17 . 2009-10-03 07:17 -------- d-----w- c:\documents and settings\All Users\Application Data\WindowsLiveInstaller
2009-10-03 07:17 . 2009-10-03 07:19 -------- d-----w- c:\program files\Windows Live
2009-10-03 07:17 . 2009-10-03 07:17 -------- d-----w- c:\documents and settings\All Users\Application Data\WLInstaller
2009-09-30 19:48 . 2001-03-28 14:38 69632 ----a-w- c:\windows\system32\GkSui18.EXE
2009-09-24 07:33 . 2009-09-24 07:34 -------- d-----w- c:\windows\ShellNew

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-23 15:52 . 2009-09-03 10:55 447052 ----a-w- c:\windows\system32\perfh00E.dat
2009-10-23 15:52 . 2009-09-03 10:55 99920 ----a-w- c:\windows\system32\perfc00E.dat
2009-10-23 15:49 . 2009-09-03 12:31 -------- d-----w- c:\documents and settings\Rendszergazda\Application Data\uTorrent
2009-10-23 15:09 . 2009-09-19 08:37 -------- d-----w- c:\documents and settings\Rendszergazda\Application Data\XnView
2009-10-22 20:32 . 2009-09-08 08:16 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-10-17 22:01 . 2009-09-05 15:00 -------- d-----w- c:\program files\Webteh
2009-10-17 22:01 . 2009-09-05 15:00 -------- d-----w- c:\documents and settings\Rendszergazda\Application Data\BSplayer PRO
2009-10-04 04:50 . 2009-09-03 12:00 16368 ----a-w- c:\documents and settings\Rendszergazda\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-03 11:02 . 2009-09-19 08:36 -------- d-----w- c:\program files\XnView
2009-09-29 18:41 . 2009-09-23 06:35 -------- d-----w- c:\documents and settings\Rendszergazda\Application Data\gtk-2.0
2009-09-23 06:23 . 2009-09-23 06:23 -------- d-----w- c:\program files\Gimp-2.0
2009-09-22 18:18 . 2009-09-22 18:16 -------- d-----w- c:\documents and settings\Rendszergazda\Application Data\Super-Cow
2009-09-21 16:01 . 2009-09-21 16:01 -------- d-----w- c:\documents and settings\Rendszergazda\Application Data\ArGoSoft
2009-09-17 22:26 . 2009-09-17 20:48 -------- d-----w- c:\documents and settings\Rendszergazda\Application Data\EditPlus 3
2009-09-17 20:49 . 2009-09-17 20:48 -------- d-----w- c:\program files\EditPlus 3
2009-09-17 19:31 . 2009-09-09 23:20 -------- d-----w- c:\program files\Hide My IP 2009
2009-09-17 16:33 . 2009-09-17 16:33 581632 ----a-w- c:\documents and settings\Rendszergazda\plugin.dat
2009-09-11 09:32 . 2009-09-03 13:40 -------- d-----w- c:\program files\ESET
2009-09-11 06:47 . 2009-09-03 20:26 -------- d-----w- c:\documents and settings\Rendszergazda\Application Data\PC Suite
2009-09-11 06:47 . 2009-09-03 20:26 -------- d-----w- c:\documents and settings\Rendszergazda\Application Data\Nokia
2009-09-09 22:36 . 2009-09-06 15:18 -------- d-----w- c:\program files\Virgin Interactive
2009-09-08 18:05 . 2009-09-08 18:05 -------- d-----w- c:\program files\Google Hacks
2009-09-08 08:17 . 2009-09-08 08:16 -------- d-----w- c:\program files\Smarty Uninstaller Pro
2009-09-07 20:14 . 2009-09-07 18:27 -------- d-----w- c:\program files\Game_Maker7
2009-09-07 18:37 . 2009-09-07 18:37 -------- d-----w- c:\program files\Game_Maker4
2009-09-07 18:37 . 2009-09-07 18:37 798720 ----a-w- c:\windows\GPInstall.exe
2009-09-06 10:49 . 2009-09-03 12:11 -------- d-----w- c:\program files\totalcmd
2009-09-05 12:03 . 2009-09-05 12:03 -------- d-----w- c:\program files\MSBuild
2009-09-05 12:03 . 2009-09-05 12:03 -------- d-----w- c:\program files\Reference Assemblies
2009-09-04 21:43 . 2009-09-04 21:43 0 ---ha-w- c:\windows\system32\drivers\Msft_User_PCCSWpdDriver_01_07_00.Wdf
2009-09-04 21:43 . 2009-09-04 21:43 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_user_01_07_00.Wdf
2009-09-04 21:42 . 2009-09-03 20:26 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Suite
2009-09-04 21:34 . 2009-09-04 21:34 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
2009-09-04 21:34 . 2009-09-04 21:34 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2009-09-04 20:26 . 2009-09-03 10:41 -------- d-----w- c:\program files\Windows Media Connect 2
2009-09-04 16:29 . 2009-09-04 16:29 -------- d-----w- c:\program files\Common Files\EZB Systems
2009-09-04 16:29 . 2009-09-04 16:29 -------- d-----w- c:\program files\UltraISO
2009-09-04 15:58 . 2009-09-04 15:58 -------- d-----w- c:\program files\PowerISO
2009-09-04 11:08 . 2009-09-04 08:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-09-03 21:58 . 2009-09-03 21:58 -------- d-----w- c:\program files\CCleaner
2009-09-03 19:53 . 2009-09-03 19:51 -------- d-----w- c:\program files\DIFX
2009-09-03 19:52 . 2009-09-03 19:52 -------- d-----w- c:\program files\Common Files\PCSuite
2009-09-03 19:52 . 2009-09-03 19:52 -------- d-----w- c:\program files\Common Files\Nokia
2009-09-03 19:52 . 2009-09-03 19:50 -------- d-----w- c:\program files\Nokia
2009-09-03 19:51 . 2009-09-03 19:51 -------- d-----w- c:\program files\PC Connectivity Solution
2009-09-03 19:50 . 2009-09-03 19:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Installations
2009-09-03 14:01 . 2009-09-03 14:01 -------- d-----w- c:\documents and settings\Rendszergazda\Application Data\Media Player Classic
2009-09-03 13:52 . 2009-09-03 13:52 -------- d-----w- c:\program files\Microsoft Games
2009-09-03 13:40 . 2009-09-03 13:41 298104 ----a-w- c:\windows\system32\imon.dll
2009-09-03 13:40 . 2009-09-03 13:41 512096 ----a-w- c:\windows\system32\drivers\amon.sys
2009-09-03 13:40 . 2009-09-03 13:41 15424 ----a-w- c:\windows\system32\drivers\nod32drv.sys
2009-09-03 13:28 . 2009-09-03 13:28 1174 ----a-w- c:\windows\mozver.dat
2009-09-03 13:24 . 2009-09-03 13:23 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-09-03 12:35 . 2009-09-03 12:35 -------- d-----w- c:\documents and settings\Rendszergazda\Application Data\Talkback
2009-09-03 12:35 . 2009-09-03 12:35 0 ----a-w- c:\windows\nsreg.dat
2009-09-03 12:32 . 2009-09-03 12:31 -------- d-----w- c:\program files\uTorrent
2009-09-03 12:28 . 2009-09-03 12:26 -------- d-----w- c:\documents and settings\Rendszergazda\Application Data\DAEMON Tools
2009-09-03 12:26 . 2009-09-03 12:26 -------- d-----w- c:\program files\DAEMON Tools Lite
2009-09-03 12:24 . 2009-09-03 12:24 715248 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-09-03 12:01 . 2009-09-03 11:20 -------- d-----w- c:\program files\Windows Media Connect
2009-09-03 12:00 . 2009-09-03 12:00 137 ----a-w- c:\documents and settings\NetworkService\Local Settings\Application Data\fusioncache.dat
2009-09-03 12:00 . 2009-09-03 11:08 -------- d-----w- c:\program files\HPQ
2009-09-03 11:38 . 2009-09-03 11:19 -------- d-----w- c:\documents and settings\Rendszergazda\Application Data\Sonic
2009-09-03 11:37 . 2009-09-03 11:37 -------- d-----w- c:\documents and settings\Rendszergazda\Application Data\Leadertech
2009-09-03 11:35 . 2009-09-03 11:35 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-09-03 11:35 . 2009-09-03 11:19 -------- d-----w- c:\program files\Java
2009-09-03 11:23 . 2009-09-03 11:23 -------- d-----w- c:\program files\Intel
2009-09-03 11:22 . 2009-09-03 11:06 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-09-03 11:22 . 2009-09-03 11:06 -------- d-----w- c:\program files\Common Files\InstallShield
2009-09-03 11:20 . 2009-09-03 11:20 136 ----a-w- c:\documents and settings\Rendszergazda\Local Settings\Application Data\fusioncache.dat
2009-09-03 11:19 . 2009-09-03 11:19 -------- d-----w- c:\program files\Common Files\Java
2009-09-03 11:18 . 2009-09-03 11:18 108544 ------w- c:\windows\system32\pxcpyi64.exe
2009-09-03 11:18 . 2009-09-03 11:18 104960 ------w- c:\windows\system32\pxinsi64.exe
2009-09-03 11:13 . 2009-09-03 11:13 1749 --sha-r- c:\windows\system32\drivers\103C_HP_NTBK_HP Compaq nx6110 (PY439ES#AKC)_YN_0U_QCNU5352DWZ_EU_46_I3088_SHP_VKBC Version 39.2A_B68DTD Ver. F.14_T060727_WXP2_L40E_M504_J40_7Intel_8Celeron M_91.4_#090903_N14E4170C_(PY439ES#AKC)_XMOBILE_CN10.MRK
2009-09-03 11:08 . 2009-09-03 11:08 -------- d-----w- c:\program files\Broadcom
2009-09-03 11:06 . 2009-09-03 11:06 -------- d-----w- c:\program files\Analog Devices
2009-09-03 10:47 . 2009-09-03 10:47 -------- d-----w- c:\program files\microsoft frontpage
2009-09-03 10:42 . 2009-09-03 10:42 21948 ----a-w- c:\windows\system32\emptyregdb.dat
2009-08-05 09:08 . 2009-09-03 10:53 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-29 04:30 . 2009-09-03 10:58 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-07-29 04:30 . 2009-09-03 10:47 81920 ----a-w- c:\windows\system32\fontsub.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2009-09-03 288048]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-06-25 1414144]
"TTMessengerPDF"="c:\program files\TTMessenger\spool\PDFSaver.exe" [2004-03-22 61440]
"TTMessenger"="c:\program files\TTMessenger\ttmessenger2.exe" [2008-01-22 585728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-12-21 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-12-21 126976]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2004-09-07 213054]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-09-03 149280]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2009-09-03 949376]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2004-08-24 88363]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"TSClientMSIUninstaller"="c:\windows\Installer\TSClientMsiTrans\tscuinst.vbs" [2008-01-30 12451]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Anti Trojan Elite
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cFosSpeed
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2009/9/3 15:41 15424]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\Common Files\PC Tools\sMonitor\StartManSvc.exe [2009/10/22 22:17 583640]
S2 ATE_PROCMON;ATE_PROCMON;\??\c:\program files\Anti Trojan Elite\ATEPMon.sys --> c:\program files\Anti Trojan Elite\ATEPMon.sys [?]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - DMADMIN
*Deregistered* - mbr
*Deregistered* - pweyifob

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{O650WNCI-24L7-0X3Y-HUA8-M7W002RUUFTJ}]
Restart
.
Contents of the 'Scheduled Tasks' folder
.
.
------- Supplementary Scan -------
.
IE: E&xportálás Microsoft Excel formátumba - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Rendszergazda\Application Data\Mozilla\Firefox\Profiles\iq0646oo.default\
FF - prefs.js: browser.startup.homepage - hxxp://startlap.hu
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

BHO-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
Toolbar-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-23 17:58
Windows 5.1.2600 Szervizcsomag 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????2?5?4?7??????? ???B???????????????B? ??????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(1240)
c:\windows\system32\WININET.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-10-23 18:00
ComboFix-quarantined-files.txt 2009-10-23 16:00

Pre-Run: 5 924 552 704 bájt szabad
Post-Run: 5 942 972 416 bájt szabad

- - End Of File - - 52CB7580C0132CE4F7B914306DDA8297

ez nemigaz es te kontrolalod minden sectort 1 tol egesz 62 ig??
1,2,3,4,5,6,7,8,9 es igy tovabb??ha igen futasd a combofixet

Azon minden nulla aminek annak kell lennie.

ok,akor ird at a merevlemez2 is mert nemtudom melyik a C:\meghalyto,,aztan restart es uly logot a mbr,exe programbol,

Bízz bennem mielött átírtam kivettem a pipát.
Azt minden inditásnál visszarakja.

ok,renben van de ahogy latom te nemirhatad at a fizikai meghajtot mivel a pipa mindig ot van megnyitas csak olvasasra,, ha a pipa ot van nemengedi at irni a merevlemezen a sectorokat,,it ved ki a pipat klikelsz mindig ok,ok,ok,
tehat klikely a merevlemez 1 re es kiveni a pipat,es azt se ertem mert mutat neked 3-darab logikus meghalytot ha csak egy van, a D:\