igen van ilyen, mert az a mm.vbe egy Trojai.Script,amely csinalhat ilyen csodakat, nem kel megijedni mert ez a viselkedes a rendszernek nem ritka.

Az hogy te nemtudod hogy miert ez a script.mm.vbe ez engemet nem erdekel, ez a .vbe script be van kodolva es enszerintem ez rakta a pendrivre a masik Top secret.vbe scriptet.

A Virustotal analysisa
https://www.virustotal.com/file/8d7b37d ... /analysis/

Nyisd ki a c:\meghajtot es nezd meg van e ott egy _OTL moved files mappa, ha van nyisd ki es ott kene lenie a naplojanak.
tedd ide

Szia!
A link: http://leteckaposta.cz/484504475

Letöltöttem azt a programot amit írtál, és a leírt módon elindítottam.
Abban a pillanatban, befagyott akkor még csak az a program, ki írta hogy nem válaszol.
Gondoltam hagyom, lehet csak dolgozik...
Eltelt 2 óra azóta és ránéztem a gépre. Totál be volt fagyva csak a háttérkép volt tisztán.
Semmit nem tudtam előhozni, így kényszer re-startot alkalmaztam. Ezután megpróbáltam újra indítani, de a Windows logó után hirtelen kikapcsolt (még a jelszó kérés előtt) Ezt megcsinálta velem 3x!
Harmadszorra kihúztam a tápot, levettem az akksit és így nyomva tartva a bekapcsoló gombot 20mp-ig tartottam. Ezek után elindítottam normál módban és elindult hála istennek a gép.
Nem tudom mi az a program amit letöltettél velem, és mire jó, de ne haragudj nem próbálom meg még 1x elindítani mert most örülök hogy egyáltalán megy a gépem.

Azt sem értem miért azt a mm.vbe filet töltetted fel velem mikor, a TOP_SICRET.vbe az a file ami folyton előjön magától, de csak és kizárólag a pendrive-omon, vagy az SD kártyámon.

köszi

1:Talald meg ezt a fajlt es tedd fel idde
http://leteckaposta.cz/
Klik >.prochazet>>megtalalod es klik Poslat>.a linked tedd ide.
C:\Windows\System32\mm.vbe

2:Tolds le az asztalra:Az OTL programot.jobb klik es ,Futtasd mint admin.
http://oldtimer.geekstogo.com/OTL.exe
A bealitasokat hagyd ugy ahogy van,
Az also ablakjaba masold be a KODOT es klik RunFix, >.a restart utan a naplojat tedd ide.

Szia!
Kész!

Logfile of random's system information tool 1.09 (written by random/random)
Run by Zsolti at 2012-08-11 14:55:54
Microsoft Windows 7 Ultimate Service Pack 1
System drive C: has 9 GB (30%) free of 30 GB
Total RAM: 3069 MB (59% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 14:56:13, on 2012.08.11.
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16447)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\System32\rundll32.exe
C:\Windows\Explorer.EXE
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Windows\System32\WScript.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Hewlett-Packard\Media\Webcam\YCMMirage.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\totalcmd\TOTALCMD.EXE
D:\Downloads\RSIT.exe
C:\Program Files\trend micro\Zsolti.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.hu/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O2 - BHO: BHO_TIMELINEREMOVE.Bho - {e7b9b609-19ad-40a4-a288-b300a3087465} - mscoree.dll (file missing)
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O3 - Toolbar: Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [AMD AVT] Cmd.exe /c start "AMD Accelerated Video Transcoding device initialization" /min "C:\Program Files\AMD AVT\bin\kdbsync.exe" aml
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [mm.vbe] C:\Windows\System32\mm.vbe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'HELYI SZOLGÁLTATÁS')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'HELYI SZOLGÁLTATÁS')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'HÁLÓZATI SZOLGÁLTATÁS')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'HÁLÓZATI SZOLGÁLTATÁS')
O8 - Extra context menu item: E&xportálás a Microsoft Excel programba - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Free YouTube Download - C:\Users\Zsolti\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Zsolti\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll
O9 - Extra button: Küldés a OneNote programba - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Kül&dés a OneNote programba - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: Garmin Communicator Plug-In - https://static.garmincdn.com/gcp/ie/4.0 ... rol_32.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\aelupsvc.dll,-1 (AeLookupSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_8e7d5b9d3a91d8c5\aestsrv.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: @%systemroot%\system32\appidsvc.dll,-100 (AppIDSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\appinfo.dll,-100 (Appinfo) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @appmgmts.dll,-3250 (AppMgmt) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\audiosrv.dll,-204 (AudioEndpointBuilder) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\audiosrv.dll,-200 (Audiosrv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: @%SystemRoot%\system32\AxInstSV.dll,-103 (AxInstSV) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\bdesvc.dll,-100 (BDESVC) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\bfe.dll,-1001 (BFE) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\qmgr.dll,-1000 (BITS) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\browser.dll,-100 (Browser) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\bthserv.dll,-101 (bthserv) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
O23 - Service: @%SystemRoot%\System32\certprop.dll,-11 (CertPropSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\cryptsvc.dll,-1001 (CryptSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\cscsvc.dll,-200 (CscService) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @oleres.dll,-5012 (DcomLaunch) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\defragsvc.dll,-101 (defragsvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\dhcpcore.dll,-100 (Dhcp) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\dnsapi.dll,-101 (Dnscache) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\dot3svc.dll,-1102 (dot3svc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\dps.dll,-500 (DPS) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\eapsvc.dll,-1 (EapHost) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\ehome\ehrecvr.exe,-101 (ehRecvr) - Unknown owner - C:\Windows\ehome\ehRecvr.exe
O23 - Service: @%SystemRoot%\ehome\ehsched.exe,-101 (ehSched) - Unknown owner - C:\Windows\ehome\ehsched.exe
O23 - Service: @%SystemRoot%\system32\wevtsvc.dll,-200 (eventlog) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @comres.dll,-2450 (EventSystem) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\fdPHost.dll,-100 (fdPHost) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\fdrespub.dll,-100 (FDResPub) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\FntCache.dll,-100 (FontCache) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @gpapi.dll,-112 (gpsvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\hidserv.dll,-101 (hidserv) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\kmsvc.dll,-6 (hkmsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\ListSvc.dll,-100 (HomeGroupListener) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\provsvc.dll,-100 (HomeGroupProvider) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: HP Support Assistant Service - Hewlett-Packard Company - C:\Program Files\Hewlett-Packard\HP Support Framework\hpsa_service.exe
O23 - Service: HP Quick Synchronization Service (HPDrvMntSvc.exe) - Hewlett-Packard Company - C:\Program Files\Hewlett-Packard\Shared\HPDrvMntSvc.exe
O23 - Service: HP Software Framework Service (hpqwmiex) - Hewlett-Packard Company - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: @%SystemRoot%\system32\ikeext.dll,-501 (IKEEXT) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\IPBusEnum.dll,-102 (IPBusEnum) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\iphlpsvc.dll,-500 (iphlpsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @comres.dll,-2946 (KtmRm) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\srvsvc.dll,-100 (LanmanServer) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\wkssvc.dll,-100 (LanmanWorkstation) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: @%SystemRoot%\system32\lltdres.dll,-1 (lltdsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\lmhsvc.dll,-101 (lmhosts) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\mmcss.dll,-100 (MMCSS) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\FirewallAPI.dll,-23090 (MpsSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe
O23 - Service: @%SystemRoot%\system32\iscsidsc.dll,-5000 (MSiSCSI) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\msimsg.dll,-27 (msiserver) - Unknown owner - C:\Windows\system32\msiexec.exe
O23 - Service: @%SystemRoot%\system32\qagentrt.dll,-6 (napagent) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\netman.dll,-109 (Netman) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\netprofm.dll,-202 (netprofm) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\nlasvc.dll,-1 (NlaSvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\nsisvc.dll,-200 (nsi) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\pnrpsvc.dll,-8004 (p2pimsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\p2psvc.dll,-8006 (p2psvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\pcasvc.dll,-1 (PcaSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\peerdistsvc.dll,-9000 (PeerDistSvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\pla.dll,-500 (pla) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\umpnpmgr.dll,-100 (PlugPlay) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\pnrpauto.dll,-8002 (PNRPAutoReg) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\pnrpsvc.dll,-8000 (PNRPsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\polstore.dll,-5010 (PolicyAgent) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\umpo.dll,-100 (Power) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\profsvc.dll,-300 (ProfSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32\rasauto.dll,-200 (RasAuto) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%Systemroot%\system32\rasmans.dll,-200 (RasMan) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @regsvc.dll,-1 (RemoteRegistry) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%windir%\system32\RpcEpMap.dll,-1001 (RpcEptMapper) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe
O23 - Service: @oleres.dll,-5010 (RpcSs) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\SCardSvr.dll,-1 (SCardSvr) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\schedsvc.dll,-100 (Schedule) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\certprop.dll,-13 (SCPolicySvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\sdrsvc.dll,-107 (SDRSVC) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\Sens.dll,-200 (SENS) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\sensrsvc.dll,-1000 (SensrSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\SessEnv.dll,-1026 (SessionEnv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\ipnathlp.dll,-106 (SharedAccess) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\shsvcs.dll,-12288 (ShellHWDetection) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe
O23 - Service: @%SystemRoot%\system32\sppuinotify.dll,-103 (sppuinotify) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\ssdpsrv.dll,-100 (SSDPSRV) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\sstpsvc.dll,-200 (SstpSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_8e7d5b9d3a91d8c5\STacSV.exe
O23 - Service: @%SystemRoot%\system32\wiaservc.dll,-9 (StiSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\swprv.dll,-103 (swprv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\sysmain.dll,-1000 (SysMain) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\TabSvc.dll,-100 (TabletInputService) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\tapisrv.dll,-10100 (TapiSrv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\tbssvc.dll,-100 (TBS) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\termsrv.dll,-268 (TermService) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\themeservice.dll,-8192 (Themes) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\mmcss.dll,-102 (THREADORDER) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\trkwks.dll,-1 (TrkWks) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\servicing\TrustedInstaller.exe,-100 (TrustedInstaller) - Unknown owner - C:\Windows\servicing\TrustedInstaller.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe
O23 - Service: @%SystemRoot%\system32\umrdp.dll,-1000 (UmRdpService) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\upnphost.dll,-213 (upnphost) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\dwm.exe,-2000 (UxSms) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe
O23 - Service: @%SystemRoot%\system32\w32time.dll,-200 (W32Time) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe
O23 - Service: @%systemroot%\system32\wbiosrvc.dll,-100 (WbioSrvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wcncsvc.dll,-3 (wcncsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\WcsPlugInService.dll,-200 (WcsPlugInService) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\wdi.dll,-502 (WdiServiceHost) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\wdi.dll,-500 (WdiSystemHost) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\webclnt.dll,-100 (WebClient) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wecsvc.dll,-200 (Wecsvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wercplsupport.dll,-101 (wercplsupport) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wersvc.dll,-100 (WerSvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%ProgramFiles%\Windows Defender\MsMpRes.dll,-103 (WinDefend) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\winhttp.dll,-100 (WinHttpAutoProxySvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32\wbem\wmisvc.dll,-205 (Winmgmt) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32\wsmsvc.dll,-101 (WinRM) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wlansvc.dll,-257 (Wlansvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\wmpnetwk.exe
O23 - Service: @%SystemRoot%\system32\wpcsvc.dll,-100 (WPCSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wpdbusenum.dll,-100 (WPDBusEnum) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wscsvc.dll,-200 (wscsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\SearchIndexer.exe,-103 (WSearch) - Unknown owner - C:\Windows\system32\SearchIndexer.exe
O23 - Service: @%systemroot%\system32\wuaueng.dll,-105 (wuauserv) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wudfsvc.dll,-1000 (wudfsvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wwansvc.dll,-257 (WwanSvc) - Unknown owner - C:\Windows\system32\svchost.exe

--
End of file - 23779 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Zsolti\AppData\Roaming\Mozilla\Firefox\Profiles\kvrrlqxx.default

prefs.js - "browser.startup.homepage" - "www.google.hu"

"wrc@avast.com"=C:\Program Files\AVAST Software\Avast\WebRep\FF


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.3.300.270 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_270.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/ShockwavePlayer]
"Description"=Adobe Shockwave Player
"Path"=C:\Windows\system32\Adobe\Director\np32dsw.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0]
"Description"=DivX VOD Helper Plug-in
"Path"=C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

C:\Program Files\Mozilla Firefox\extensions\
{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files\Mozilla Firefox\plugins\
nppdf32.dll
npwachk.dll

C:\Program Files\Mozilla Firefox\searchplugins\
creativecommons.xml
eBay-hu.xml
google.xml
sztaki-en-hu.xml
vatera.xml
wikipedia-hu.xml

C:\Users\Zsolti\AppData\Roaming\Mozilla\Firefox\Profiles\kvrrlqxx.default\extensions\
{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-04-04 63912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3785D0AD-BFFF-47F6-BF5B-A587C162FED9}]
Canon Easy-WebPrint EX BHO - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll [2011-10-15 175744]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2012-07-03 1160792]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28 441216]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9FDDE16B-836F-4806-AB1F-1455CBEFF289}]
Windows Live Messenger Companion Helper - C:\Program Files\Windows Live\Companion\companioncore.dll [2012-03-08 393600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Browser Helper - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2012-01-17 3855520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-12-09 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E5A1691B-D188-4419-AD02-90002030B8EE}]
FlashFXP Helper for Internet Explorer - C:\PROGRA~1\FlashFXP\IEFlash.dll [2008-06-16 191096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e7b9b609-19ad-40a4-a288-b300a3087465}]
BHO_TIMELINEREMOVE.Bho - C:\Windows\system32\mscoree.dll [2010-11-20 297808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2012-07-03 1160792]
{759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - Canon Easy-WebPrint EX - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll [2011-10-15 4352120]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avast"=C:\Program Files\AVAST Software\Avast\avastUI.exe [2012-07-03 4273976]
"TaskTray"= []
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2010-02-19 1697064]
"SysTrayApp"=C:\Program Files\IDT\WDM\sttray.exe [2009-07-21 458844]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2012-03-09 636032]
"AMD AVT"=Cmd.exe /c start AMD Accelerated Video Transcoding device initialization /min C:\Program Files\AMD AVT\bin\kdbsync.exe aml []
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-01-03 843712]
"mm.vbe"=C:\Windows\System32\mm.vbe [2012-07-15 4431]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-20 1174016]
"msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2012-03-08 4280184]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2012-02-29 17148552]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-01-03 843712]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenu]
C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe [2009-09-04 767312]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
C:\Program Files\DivX\DivX Update\DivXUpdate.exe [2011-07-29 1259376]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2009-02-26 30040]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2011-03-04 2741616]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2012-03-09 636032]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Common Files\Java\Java Update\jusched.exe [2011-06-09 254696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SysTrayApp]
C:\Program Files\IDT\WDM\sttray.exe [2009-07-21 458844]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe [2011-10-26 74752]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Xvid]
C:\Program Files\Xvid\CheckUpdate.exe [2011-01-17 8192]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth.lnk]
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTTray.exe [2011-08-25 1008928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"notification packages"=scecli
C:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\FlashFXP\FlashFXP.exe"="C:\Program Files\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"C:\Program Files\FlashFXP\FlashFXP.exe"="C:\Program Files\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=l3codecp.acm
"vidc.cvid"=iccvid.dll
"MSVideo8"=VfWWDM32.dll
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"vidc.XVID"=xvidvfw.dll
"msacm.siren"=sirenacm.dll
"vidc.DIVX"=DivX.dll
"vidc.yv12"=DivX.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2012-08-11 14:55:54 ----D---- C:\rsit
2012-08-11 14:55:54 ----D---- C:\Program Files\trend micro
2012-07-18 21:40:12 ----D---- C:\Program Files\Common Files\Borland Shared
2012-07-18 21:39:45 ----D---- C:\Program Files\kresz_gyak
2012-07-12 09:46:34 ----A---- C:\Windows\system32\mshtmled.dll
2012-07-12 09:46:32 ----A---- C:\Windows\system32\iertutil.dll
2012-07-12 09:46:31 ----A---- C:\Windows\system32\ieui.dll
2012-07-12 09:46:30 ----A---- C:\Windows\system32\jsproxy.dll
2012-07-12 09:46:30 ----A---- C:\Windows\system32\ieUnatt.exe
2012-07-12 09:46:29 ----A---- C:\Windows\system32\wininet.dll
2012-07-12 09:46:28 ----A---- C:\Windows\system32\jscript.dll
2012-07-12 09:46:27 ----A---- C:\Windows\system32\jscript9.dll
2012-07-12 09:46:26 ----A---- C:\Windows\system32\url.dll
2012-07-12 09:46:24 ----A---- C:\Windows\system32\urlmon.dll
2012-07-12 09:46:21 ----A---- C:\Windows\system32\mshtml.dll
2012-07-12 09:46:19 ----A---- C:\Windows\system32\ieframe.dll
2012-07-12 09:41:21 ----A---- C:\Windows\system32\win32k.sys
2012-07-12 09:41:11 ----A---- C:\Windows\system32\browserchoice.exe

======List of files/folders modified in the last 1 month======

2012-08-11 14:56:05 ----D---- C:\Windows\Prefetch
2012-08-11 14:55:56 ----D---- C:\Windows\Temp
2012-08-11 14:55:54 ----RD---- C:\Program Files
2012-08-11 14:49:21 ----D---- C:\Program Files\Mozilla Firefox
2012-08-11 14:34:05 ----D---- C:\Windows\system32\config
2012-08-10 10:31:49 ----D---- C:\Windows\System32
2012-08-10 10:31:49 ----D---- C:\Windows\inf
2012-08-10 10:31:49 ----A---- C:\Windows\system32\PerfStringBackup.INI
2012-08-10 10:26:10 ----SHD---- C:\System Volume Information
2012-08-08 12:55:00 ----D---- C:\Users\Zsolti\AppData\Roaming\vlc
2012-08-07 19:56:15 ----D---- C:\Users\Zsolti\AppData\Roaming\Skype
2012-08-05 23:04:33 ----D---- C:\Users\Zsolti\AppData\Roaming\BitTorrent
2012-08-02 22:30:03 ----A---- C:\Windows\system32\FlashPlayerApp.exe
2012-07-24 11:25:11 ----D---- C:\Windows\system32\catroot2
2012-07-18 21:40:12 ----D---- C:\Program Files\Common Files
2012-07-18 21:01:14 ----D---- C:\Users\Zsolti\AppData\Roaming\DVDVideoSoft
2012-07-12 16:43:33 ----D---- C:\Windows\rescache
2012-07-12 14:29:43 ----D---- C:\Windows\system32\Tasks
2012-07-12 09:49:48 ----D---- C:\Windows\winsxs
2012-07-12 09:48:54 ----D---- C:\Windows
2012-07-12 09:47:52 ----D---- C:\Windows\system32\migration
2012-07-12 09:47:52 ----D---- C:\Program Files\Internet Explorer
2012-07-12 09:47:51 ----D---- C:\Windows\system32\drivers
2012-07-12 09:47:50 ----D---- C:\Windows\system32\hu-HU
2012-07-12 09:47:50 ----D---- C:\Windows\system32\en-US
2012-07-12 09:46:58 ----D---- C:\Windows\system32\catroot
2012-07-12 09:46:14 ----SHD---- C:\Windows\Installer
2012-07-12 09:46:12 ----D---- C:\ProgramData\Microsoft Help
2012-07-12 09:45:44 ----A---- C:\Windows\win.ini
2012-07-12 09:41:48 ----A---- C:\Windows\system32\MRT.exe
2012-07-12 09:41:03 ----RSD---- C:\Windows\assembly

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 giveio;giveio; C:\Windows\system32\giveio.sys [1996-04-03 5248]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R0 speedfan;speedfan; C:\Windows\system32\speedfan.sys [2011-03-18 25240]
R1 aswRdr;aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [2012-07-03 44784]
R1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2012-07-03 721000]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2012-07-03 353688]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2012-07-03 54232]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 388096]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2012-07-03 21256]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2012-07-03 57656]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2012-03-09 9183232]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2012-03-09 265216]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW73.sys [2012-02-23 86544]
R3 BCM43XX;Broadcom 802.11 hálózati adapter illesztőprogramja; C:\Windows\system32\DRIVERS\bcmwl6.sys [2011-10-25 4256320]
R3 BthEnum;Bluetooth kérési blokk illesztőprogramja; C:\Windows\system32\drivers\BthEnum.sys [2009-07-14 34816]
R3 BTHUSB;Bluetooth-rádió USB illesztőprogramja; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 60416]
R3 btwampfl;btwampfl Bluetooth filter driver; \??\C:\Windows\system32\drivers\btwampfl.sys [2011-08-25 525352]
R3 btwaudio;Bluetooth Audio Device Service; C:\Windows\system32\drivers\btwaudio.sys [2011-08-25 140328]
R3 btwavdt;Bluetooth AVDT; C:\Windows\system32\DRIVERS\btwavdt.sys [2011-08-25 148520]
R3 BTWDPAN;Bluetooth Personal Area Network; C:\Windows\system32\DRIVERS\btwdpan.sys [2011-08-25 76328]
R3 btwl2cap;Bluetooth L2CAP Service; C:\Windows\system32\DRIVERS\btwl2cap.sys [2011-08-25 33832]
R3 btwrchid;btwrchid; C:\Windows\system32\DRIVERS\btwrchid.sys [2011-08-25 18728]
R3 clwvd;HP Webcam Splitter; C:\Windows\system32\DRIVERS\clwvd.sys [2010-07-30 29168]
R3 enecir;ENE CIR Receiver; C:\Windows\system32\DRIVERS\enecir.sys [2009-06-29 59904]
R3 JMCR;JMCR; C:\Windows\system32\DRIVERS\jmcr.sys [2011-07-22 145496]
R3 johci;JMicron 1394 Filter Driver; C:\Windows\system32\DRIVERS\johci.sys [2011-07-25 23128]
R3 RFCOMM;Bluetooth-eszköz (RFCOMM protokoll TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 129536]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt86win7.sys [2009-03-02 139776]
R3 STHDA;IDT High Definition Audio CODEC; C:\Windows\system32\DRIVERS\stwrt.sys [2009-07-21 409088]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2010-02-19 242992]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 14336]
S2 Parvdm;Parvdm; C:\Windows\system32\drivers\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\Windows\system32\drivers\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 AtiHdmiService;ATI Service for HD Audio Codec; C:\Windows\system32\drivers\AtiHdmi.sys [2009-06-28 101392]
S3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2012-03-09 9183232]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
S3 BthPan;Bluetooth-eszköz (személyes hálózat); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 93696]
S3 BTHPORT;Bluetooth-portillesztőprogram; C:\Windows\System32\Drivers\BTHport.sys [2011-04-28 393728]
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-20 62464]
S3 Nokia USB Phone Parent;Nokia USB Phone Parent; C:\Windows\system32\drivers\nmwcd.sys [2005-10-13 124928]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 133632]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2010-11-20 15872]
S3 RTHDMIAzAudService;Service for HDMI; C:\Windows\system32\drivers\RtHDMIV.sys [2011-07-07 328552]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 5632]
S3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2010-11-20 84992]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 28032]
S3 Synth3dVsc;Synth3dVsc; C:\Windows\System32\drivers\synth3dvsc.sys [2010-11-20 77184]
S3 terminpt;Microsoft Remote Desktop Input Driver; C:\Windows\system32\drivers\terminpt.sys [2010-11-20 25600]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 52224]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
S3 tsusbhub;@%SystemRoot%\system32\drivers\tsusbhub.sys,-1; C:\Windows\system32\drivers\tsusbhub.sys [2010-11-20 112640]
S3 usbscan;USB képolvasó-illesztőprogram; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 35840]
S3 usbUDisc;usbUDisc; C:\Windows\system32\DRIVERS\USBDrv.sys [2010-09-27 7040]
S3 VGPU;VGPU; C:\Windows\System32\drivers\rdvgkmd.sys []
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\drivers\viac7.sys [2009-07-14 52736]
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 175360]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 17920]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
R2 AESTFilters;Andrea ST Filters Service; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_8e7d5b9d3a91d8c5\aestsrv.exe [2009-03-02 81920]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2012-03-09 163328]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2012-07-03 44808]
R2 btwdins;Bluetooth Service; C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe [2011-08-25 742688]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 HP Support Assistant Service;HP Support Assistant Service; C:\Program Files\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2011-09-09 86072]
R2 HPDrvMntSvc.exe;HP Quick Synchronization Service; C:\Program Files\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-03-28 94264]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2011-03-04 73728]
R2 STacSV;Audio Service; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_8e7d5b9d3a91d8c5\STacSV.exe [2009-07-21 221266]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2011-03-28 1713536]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2012-02-29 158856]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-02 250056]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 hpqwmiex;HP Software Framework Service; C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe [2011-03-28 799800]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2009-02-26 64856]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-11-02 1343400]

-----------------EOF-----------------

udv
.vbe ez VBScript kódolt parancsfájl.
Ezek a fájl típus is megfertőződhetnek, és gondosan meg kell vizsgálni.
Ugy kerul a pedrivre hogy a rendszerben van beirva es innen ra kerul.

Tedd ide az RSIT naplojat,
http://virus-stell.blogspot.sk/2010/04/rsit.html

Sziasztok!
Egy ideje érdekes dolgot tapasztaltam a flash memóriáimon (SD kártya, Pendrive) használatakor.
Egy különös jelenségre lettem figyelmes, ami eddig nem volt. Pontosabban egy file-ra ami valahogy minden flash drive-omra rákerült. Kitörölni ki tudom, formázhatom is, de ahogy kihúzom és vissza dugom a gépbe megint rajta van ez a fálj! Fogalmam sincs, hogy került rá, mi célt szolgál, és miért jön vissza magátol! A file neve: TOP_SECRET.vbe
Meg tudnátok mondani mi ez és miért nem lehet kiirtani? Valami vírus lehet?
Az AVAST nem köpköd rá!

Köszi előre is!

Igen, pontosan igy.Akkor ez minden szia.

Köszi!
Minden megy mint a karikacsapás!
Tudtam én,hogy Te megoldod!!
Még egyszer köszönöm,és gondolom már csak a szokásos
eljárás van hátra: Combo fix átnevez uninstall és kész!

Akkor most hogy nez ki a geppel??

ComboFix 12-08-04.02 - user_11 012.08.04. 17:19:36.2.2 - x86
Microsoft® Windows Vista™ Business 6.0.6002.2.1250.36.1038.18.1023.496 [GMT 2:00]
Running from: c:\users\user_11\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
FW: PC Tools Firewall Plus *Disabled* {175D0B73-9F8F-2CA9-8BF1-62277A276DC9}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2012-07-04 to 2012-08-04 )))))))))))))))))))))))))))))))
.
.
2012-08-04 15:26 . 2012-08-04 15:26 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2012-08-04 15:26 . 2012-08-04 15:26 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-08-03 06:33 . 2012-06-29 08:44 6891424 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{A0A567AE-68FD-4780-AA8D-EEE9A250E3C9}\mpengine.dll
2012-08-02 08:51 . 2012-08-02 08:51 -------- d-----w- c:\users\user_11\AppData\Roaming\AlawarEntertainment
2012-08-01 18:04 . 2012-08-01 18:04 -------- d-----w- c:\program files\Common Files\Java
2012-08-01 18:03 . 2012-08-01 18:03 -------- d-----w- c:\program files\Oracle
2012-08-01 18:03 . 2012-07-05 20:06 772544 ----a-w- c:\windows\system32\npDeployJava1.dll
2012-07-30 20:53 . 2012-07-30 20:54 -------- d-----w- c:\users\user_11\AppData\Roaming\Bloom
2012-07-24 19:36 . 2012-07-24 19:36 -------- d-----w- c:\users\user_11\AppData\Roaming\ERS Game Studios
2012-07-21 21:31 . 2012-07-21 21:31 -------- d-----w- c:\users\user_11\AppData\Roaming\BlamGames
2012-07-21 14:52 . 2012-07-21 14:52 -------- d-----w- c:\users\user_11\AppData\Roaming\Funlinker
2012-07-20 11:18 . 2012-07-20 11:18 -------- d-----w- c:\users\user_11\AppData\Roaming\Boolat Games
2012-07-12 09:02 . 2012-07-12 09:04 -------- d-----w- c:\users\user_11\abevjava
2012-07-12 09:01 . 2012-07-12 09:01 -------- d-----w- c:\users\Public\abevjava
2012-07-11 11:54 . 2012-06-13 13:40 2047488 ----a-w- c:\windows\system32\win32k.sys
2012-07-11 06:53 . 2012-06-05 16:47 708608 ----a-w- c:\program files\Common Files\System\ado\msado15.dll
2012-07-11 06:53 . 2012-06-05 16:47 1401856 ----a-w- c:\windows\system32\msxml6.dll
2012-07-11 06:53 . 2012-06-05 16:47 1248768 ----a-w- c:\windows\system32\msxml3.dll
2012-07-11 06:53 . 2012-06-04 15:26 440704 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2012-07-11 06:53 . 2012-06-02 00:04 278528 ----a-w- c:\windows\system32\schannel.dll
2012-07-11 06:53 . 2012-06-02 00:03 204288 ----a-w- c:\windows\system32\ncrypt.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-05 20:06 . 2012-02-18 20:00 687544 ----a-w- c:\windows\system32\deployJava1.dll
2012-07-03 11:46 . 2011-07-13 11:04 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-06-02 22:19 . 2012-06-22 06:27 53784 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-02 22:19 . 2012-06-22 06:27 45080 ----a-w- c:\windows\system32\wups2.dll
2012-06-02 22:19 . 2012-06-22 06:26 35864 ----a-w- c:\windows\system32\wups.dll
2012-06-02 22:19 . 2012-06-22 06:26 577048 ----a-w- c:\windows\system32\wuapi.dll
2012-06-02 22:19 . 2012-06-22 06:27 1933848 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-02 22:12 . 2012-06-22 06:27 2422272 ----a-w- c:\windows\system32\wucltux.dll
2012-06-02 22:12 . 2012-06-22 06:26 88576 ----a-w- c:\windows\system32\wudriver.dll
2012-06-02 13:19 . 2012-06-22 06:26 171904 ----a-w- c:\windows\system32\wuwebv.dll
2012-06-02 13:12 . 2012-06-22 06:26 33792 ----a-w- c:\windows\system32\wuapp.exe
2012-05-31 10:25 . 2010-12-06 12:38 237072 ------w- c:\windows\system32\MpSigStub.exe
2012-05-15 10:53 . 2012-05-14 10:48 83392 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2012-05-15 10:53 . 2012-05-14 10:48 137928 ----a-w- c:\windows\system32\drivers\avipbb.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"00PCTFW"="c:\program files\PC Tools Firewall Plus\FirewallGUI.exe" [2011-04-07 2672600]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-05-15 348624]
.
c:\users\user_11\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
TODOR.lnk - c:\program files\Todor\todor.exe [2012-4-13 4810752]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^VPN Client.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\VPN Client.lnk
backup=c:\windows\pss\VPN Client.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^user_11^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^RollerCoaster Tycoon 3 Registration.lnk]
path=c:\users\user_11\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RollerCoaster Tycoon 3 Registration.lnk
backup=c:\windows\pss\RollerCoaster Tycoon 3 Registration.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
2012-02-20 19:28 59240 ----a-w- c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FlashPlayerUpdate]
2011-11-10 07:03 247968 ----a-w- c:\windows\System32\Macromed\Flash\FlashUtil11c_ActiveX.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2010-12-07 11:36 136176 ----atw- c:\users\user_11\AppData\Local\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes Anti-Malware]
2012-07-03 11:46 462920 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2012-04-18 18:56 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2012-01-17 09:07 252296 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2008-01-21 02:23 1008184 ----a-w- c:\program files\Windows Defender\MSASCui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2008-01-21 02:25 202240 ----a-w- c:\program files\Windows Media Player\wmpnscfg.exe
.
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2012-08-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3660284441-3406738706-2838319646-1000Core.job
- c:\users\user_11\AppData\Local\Google\Update\GoogleUpdate.exe [2010-12-07 11:36]
.
2012-08-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3660284441-3406738706-2838319646-1000UA.job
- c:\users\user_11\AppData\Local\Google\Update\GoogleUpdate.exe [2010-12-07 11:36]
.
.
------- Supplementary Scan -------
.
uStart Page =
IE: E&xportálás a Microsoft Excel programba - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
IE: Free YouTube to MP3 Converter - c:\users\user_11\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
TCP: DhcpNameServer = 192.168.0.1
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-{687578b9-7132-4a7a-80e4-30ee31099e03} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
MSConfigStartUp-ApnUpdater - c:\program files\Ask.com\Updater\Updater.exe
MSConfigStartUp-Device Detection - c:\program files\FUJIFILM\MyFinePix Studio\dd.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-08-04 17:26
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Completion time: 2012-08-04 17:30:15
ComboFix-quarantined-files.txt 2012-08-04 15:30
.
Pre-Run: 217 331 593 216 bájt szabad
Post-Run: 217 288 982 528 bájt szabad
.
- - End Of File - - 4FA3AC035689878C5DF0B09812ED2ADF

Ok futtasd le meg a Combofixet
http://www.bleepingcomputer.com/download/combofix/

All processes killed
========== OTL ==========
Error: No service named catchme was found to stop!
Service\Driver key catchme not found.
File C:\Users\user_11\AppData\Local\Temp\catchme.sys not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{687578b9-7132-4a7a-80e4-30ee31099e03} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{687578b9-7132-4a7a-80e4-30ee31099e03}\ not found.
File C:\Program Files\uTorrentControl2\prxtbuTo0.dll not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKU\S-1-5-21-3660284441-3406738706-2838319646-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKU\S-1-5-21-3660284441-3406738706-2838319646-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\StartPageCache| /E : value set successfully!
Registry value HKEY_USERS\S-1-5-21-3660284441-3406738706-2838319646-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\{687578b9-7132-4a7a-80e4-30ee31099e03} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{687578b9-7132-4a7a-80e4-30ee31099e03}\ not found.
File C:\Program Files\uTorrentControl2\prxtbuTo0.dll not found.
HKEY_USERS\S-1-5-21-3660284441-3406738706-2838319646-1000\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_USERS\S-1-5-21-3660284441-3406738706-2838319646-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_USERS\S-1-5-21-3660284441-3406738706-2838319646-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.
Registry key HKEY_USERS\S-1-5-21-3660284441-3406738706-2838319646-1000\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}\ not found.
Registry key HKEY_USERS\S-1-5-21-3660284441-3406738706-2838319646-1000\Software\Microsoft\Internet Explorer\SearchScopes\{7260EF17-3527-42F4-BEE5-03BEADB9CEB0}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7260EF17-3527-42F4-BEE5-03BEADB9CEB0}\ not found.
Registry key HKEY_USERS\S-1-5-21-3660284441-3406738706-2838319646-1000\Software\Microsoft\Internet Explorer\SearchScopes\{8DE22D8F-2A61-41B1-83B2-1C58C6E6F932}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8DE22D8F-2A61-41B1-83B2-1C58C6E6F932}\ not found.
Registry key HKEY_USERS\S-1-5-21-3660284441-3406738706-2838319646-1000\Software\Microsoft\Internet Explorer\SearchScopes\{968D3C46-36BE-4668-ACFB-C6750E5D66A9}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{968D3C46-36BE-4668-ACFB-C6750E5D66A9}\ not found.
Folder C:\Users\user_11\AppData\Roaming\mozilla\Firefox\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}\ not found.
HKU\S-1-5-21-3660284441-3406738706-2838319646-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
Unable to fix default_search_provider items.
Unable to fix default_search_provider items.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{687578b9-7132-4a7a-80e4-30ee31099e03}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{687578b9-7132-4a7a-80e4-30ee31099e03}\ not found.
File C:\Program Files\uTorrentControl2\prxtbuTo0.dll not found.
Registry value HKEY_USERS\S-1-5-21-3660284441-3406738706-2838319646-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{687578B9-7132-4A7A-80E4-30EE31099E03} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{687578B9-7132-4A7A-80E4-30EE31099E03}\ not found.
File C:\Program Files\uTorrentControl2\prxtbuTo0.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ not found.
Unable to delete ADS C:\ProgramData\TEMP:E153075C .
Unable to delete ADS C:\ProgramData\TEMP:5E8C18F1 .
Unable to delete ADS C:\ProgramData\TEMP:E0888117 .
Unable to delete ADS C:\ProgramData\TEMP:D696AA12 .
ADS C:\ProgramData\TEMP:C31F31E6 deleted successfully.
========== FILES ==========
File\Folder C:\Program Files\Ask.com not found.
autorun.inf not found in C:\
autorun.exe not found in C:\
recycler not found in C:\
< ipconfig /flushdns /c >
Windows IP konfigur ci˘
A DNS-felold si gyorsˇt˘t r kirˇt‚se sikeresen megt”rt‚nt.
C:\Users\user_11\Desktop\cmd.bat deleted successfully.
C:\Users\user_11\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
Unable to start System Restore Service. Error code 1084

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public

User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: user_11
->Temp folder emptied: 649158 bytes
->Temporary Internet Files folder emptied: 578043 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 150042140 bytes
->Flash cache emptied: 492 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 3536 bytes
RecycleBin emptied: 4225304 bytes

Total Files Cleaned = 148,00 mb


OTL by OldTimer - Version 3.2.43.0 log created on 08042012_170142

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Ok, restart csokkentet modba a halozattal es ismeteld meg a scriptet az OTL programmal.

Sajnos én voltam a pancser,mert az Avira ki rakott valamit
én rákattintotta az OK-ra ,és mivel úgy tűnt,hogy nem történik semmi
újraindítottam a gépet,pedig csak türelmesnek kellett volna lennem!
Abban a mappában is ez van amit küldtem.

Nem jol csinaltad, de...
Restartolt a gep??
Ha igen akkor itt nezd meg
c:\_OTL\moved files
_OTL mappanak kene lenie es ebben van a naploja.

Bocsi azt hiszem valamit elcsesztem!


Files\Folders moved on Reboot...
File move failed. C:\Windows\System32\drivers\etc\Hosts scheduled to be moved on reboot.

Registry entries deleted on Reboot...

ok,akkor meghagyom neked.

Futtasd az OTL programot, a bealitasokat hagyd ugy ahogy van.
az ablakjaba masold be a textet, de Most raklikelsz az RUNFIX gombra a naplojat tedd ide.

A munkámhoz alkalmazom,határidőnapló.

Ez a program mire van??
Program Files\Todor

SHA256: f478e6a0c52d419bc0223a8e2747faef40a45d422baf15e97fc50c3eeec57c1a
SHA1: 095bc98de3bc3e46a7a7473fbc7129c26038d1b3
MD5: 07451a804956c606473e782f78f5087b
File size: 4.6 MB (4810752 bytes)
File name: todor.exe
Fájltípus: Win32 EXE
Detection arány: 0/41
Elemzés időpontja: 2012/08/04 08:52:19 UTC (1 perc ezelőtt)
00
További részletek
Antivirus Eredményez Frissítés
AhnLab-V3 - 20120803
AntiVir - 20120803
Antiy AVL- - 20120803
Avast - 20120803
AVG - 20120803
BitDefender - 20120803
ByteHero - 20120723
CAT-QuickHeal - 20120803
ClamAV - 20120803
Commtouch - 20120803
Comodo - 20120803
DrWeb - 20120803
Emsisoft - 20120803
eSafe - 20120802
ESET NOD32- - 20120803
F-Prot - 20120803
F-Secure - 20120803
Fortinet - 20120803
GData - 20120803
Ikarus - 20120803
Jiangmin - 20120803
K7AntiVirus - 20120803
Kaspersky - 20120803
McAfee - 20120803
McAfee-GW-Edition - 20120803
Microsoft - 20120803
Normann - 20120803
nProtect - 20120803
Panda - 20120803
Rising - 20120803
Sophos - 20120803
SUPERAntiSpyware - 20120803
Symantec - 20120803
TheHacker - 20120801
TotalDefense - 20120802
TrendMicro - 20120803
TrendMicro-HouseCall - 20120803
VBA32 - 20120803
VIPRE - 20120803
ViRobot - 20120803
VirusBuster - 20120803
Hozzászólások
Szavazatok
További információk

Ezt a programot letelepiteni a geprol.
C:\Program Files\Ask.com

Ezt meg teszteld le az
www.virustotal.com
C:\Program Files\Todor\todor.exe


az eredmenyt tedd ide.

Szia!
OTL logfile created on: 2012.08.04. 9:50:34 - Run 2
OTL by OldTimer - Version 3.2.43.0 Folder = C:\Users\user_11\Desktop
Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 0000040e | Country: Magyarország | Language: HUN | Date Format: yyyy.MM.dd.

1022,58 Mb Total Physical Memory | 233,75 Mb Available Physical Memory | 22,86% Memory free
2,25 Gb Paging File | 1,21 Gb Available in Paging File | 53,64% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 232,88 Gb Total Space | 202,81 Gb Free Space | 87,09% Space Free | Partition Type: NTFS

Computer Name: INTENSA-11 | User Name: user_11 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012.08.04 09:48:30 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Users\user_11\Desktop\OTL.exe
PRC - [2012.05.15 12:53:11 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.15 12:53:10 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
PRC - [2012.05.15 12:53:10 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.05.15 12:53:10 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.05.15 12:53:10 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.05.21 07:01:00 | 002,214,504 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
PRC - [2011.05.21 07:01:00 | 000,839,272 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
PRC - [2011.05.21 07:01:00 | 000,373,864 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
PRC - [2011.04.07 15:23:34 | 002,672,600 | ---- | M] (PC Tools) -- C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe
PRC - [2011.01.24 14:23:14 | 000,286,000 | ---- | M] (PC Tools) -- C:\Program Files\PC Tools Firewall Plus\FWService.exe
PRC - [2010.05.04 13:07:22 | 000,503,080 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Update\NASvc.exe
PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009.01.01 20:00:46 | 004,810,752 | ---- | M] () -- C:\Program Files\Todor\todor.exe
PRC - [2007.10.26 15:28:06 | 001,524,512 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe


========== Modules (No Company Name) ==========

MOD - [2009.01.01 20:00:46 | 004,810,752 | ---- | M] () -- C:\Program Files\Todor\todor.exe


========== Win32 Services (SafeList) ==========

SRV - [2012.05.15 12:53:11 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.15 12:53:10 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe -- (AntiVirWebService)
SRV - [2012.05.15 12:53:10 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.05.21 07:01:00 | 002,214,504 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)
SRV - [2011.01.24 14:23:14 | 000,286,000 | ---- | M] (PC Tools) [Auto | Running] -- C:\Program Files\PC Tools Firewall Plus\FWService.exe -- (PCToolsFirewallPlus)
SRV - [2010.05.04 13:07:22 | 000,503,080 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files\Nero\Update\NASvc.exe -- (NAUpdate)
SRV - [2008.01.21 04:23:59 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007.10.26 15:28:06 | 001,524,512 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\mcdbus.sys -- (mcdbus)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\user_11\AppData\Local\Temp\catchme.sys -- (catchme)
DRV - [2012.05.15 12:53:11 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.05.15 12:53:11 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2012.03.26 23:45:14 | 000,032,768 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\taphss.sys -- (taphss)
DRV - [2012.02.09 22:43:00 | 010,816,832 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2011.09.15 23:55:04 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2011.03.02 13:40:54 | 000,160,576 | ---- | M] (PC Tools) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\PCTAppEvent.sys -- (PCTAppEvent)
DRV - [2011.01.17 10:10:26 | 000,251,560 | ---- | M] (PC Tools) [Kernel | System | Running] -- C:\Windows\System32\drivers\pctgntdi.sys -- (pctgntdi)
DRV - [2011.01.17 09:11:12 | 000,125,248 | ---- | M] (PC Tools) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\pctplfw.sys -- (pctplfw)
DRV - [2011.01.12 11:36:22 | 000,089,472 | ---- | M] (PC Tools) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\pctNdis-PacketFilter.sys -- (PCTFW-PacketFilter)
DRV - [2010.07.08 09:49:10 | 000,057,536 | ---- | M] (PC Tools) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\pctNdis.sys -- (pctNdisMP)
DRV - [2010.07.08 09:49:10 | 000,057,536 | ---- | M] (PC Tools) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pctNdis.sys -- (pctNdis)
DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2007.10.26 15:27:00 | 000,306,300 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\CVPNDRVA.sys -- (CVPNDRVA)
DRV - [2007.01.31 14:45:06 | 000,127,376 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\dne2000.sys -- (DNE)
DRV - [2007.01.18 17:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CVirtA.sys -- (CVirtA)
DRV - [2006.11.02 09:30:56 | 000,044,544 | ---- | M] (Realtek Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\URLSearchHook: {687578b9-7132-4a7a-80e4-30ee31099e03} - C:\Program Files\uTorrentControl2\prxtbuTo0.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-3660284441-3406738706-2838319646-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource= ... =CT3072253
IE - HKU\S-1-5-21-3660284441-3406738706-2838319646-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-3660284441-3406738706-2838319646-1000\..\URLSearchHook: {687578b9-7132-4a7a-80e4-30ee31099e03} - C:\Program Files\uTorrentControl2\prxtbuTo0.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-3660284441-3406738706-2838319646-1000\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-3660284441-3406738706-2838319646-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-3660284441-3406738706-2838319646-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}&affID=112555&tt=230512_54x&babsrc=SP_ss&mntrId=c8d459070000000000000019dbf2c255
IE - HKU\S-1-5-21-3660284441-3406738706-2838319646-1000\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = http://websearch.ask.com/redirect?clien ... src=crm&q={searchTerms}&locale=en_EU&apn_ptnrs=NA&apn_dtid=YYYYYYYYHU&apn_uid=40DDA428-8A06-4358-9FF9-13B74D1433BB&apn_sauid=160D27DF-0BB6-4385-9201-2FB45BB6CFC6
IE - HKU\S-1-5-21-3660284441-3406738706-2838319646-1000\..\SearchScopes\{7260EF17-3527-42F4-BEE5-03BEADB9CEB0}: "URL" = http://www.bing.com/search?q={searchTerms}&src={referrer:source?}&MARKET=en-GB&FORM=M00UUK&Publ=BING&Crea=BAWL_SS1BING_1X1
IE - HKU\S-1-5-21-3660284441-3406738706-2838319646-1000\..\SearchScopes\{8DE22D8F-2A61-41B1-83B2-1C58C6E6F932}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3072253
IE - HKU\S-1-5-21-3660284441-3406738706-2838319646-1000\..\SearchScopes\{968D3C46-36BE-4668-ACFB-C6750E5D66A9}: "URL" = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
IE - HKU\S-1-5-21-3660284441-3406738706-2838319646-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\user_11\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\user_11\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\

[2012.06.21 13:09:10 | 000,000,000 | ---D | M] (No name found) -- C:\Users\user_11\AppData\Roaming\mozilla\Firefox\extensions
[2012.06.21 13:09:11 | 000,000,000 | ---D | M] (uTorrentControl2 Community Toolbar) -- C:\Users\user_11\AppData\Roaming\mozilla\Firefox\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}

========== Chrome ==========

CHR - default_search_provider: Conduit (Enabled)
CHR - default_search_provider: search_url = http://search.conduit.com/Results.aspx?q={searchTerms}&SearchSource=49&ctid=CT3072253
CHR - default_search_provider: suggest_url = http://search.conduit.com/
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\user_11\AppData\Local\Google\Chrome\Application\21.0.1180.60\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\user_11\AppData\Local\Google\Chrome\Application\21.0.1180.60\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\user_11\AppData\Local\Google\Chrome\Application\21.0.1180.60\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\user_11\AppData\Local\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: registryAccess (Enabled) = C:\Users\user_11\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaangmfdabjilefmognkgcebjgcojek\7.14.1.20932_0\background/registryAccess.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Java(TM) Platform SE 6 U31 (Enabled) = C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: Google Update (Enabled) = C:\Users\user_11\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: YouTube = C:\Users\user_11\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-keres\u00E9s = C:\Users\user_11\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: AdBlock = C:\Users\user_11\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.38_0\
CHR - Extension: Gmail = C:\Users\user_11\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2012.06.01 10:32:40 | 000,000,806 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (uTorrentControl2 Toolbar) - {687578b9-7132-4a7a-80e4-30ee31099e03} - C:\Program Files\uTorrentControl2\prxtbuTo0.dll (Conduit Ltd.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (uTorrentControl2 Toolbar) - {687578b9-7132-4a7a-80e4-30ee31099e03} - C:\Program Files\uTorrentControl2\prxtbuTo0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKU\S-1-5-21-3660284441-3406738706-2838319646-1000\..\Toolbar\WebBrowser: (uTorrentControl2 Toolbar) - {687578B9-7132-4A7A-80E4-30EE31099E03} - C:\Program Files\uTorrentControl2\prxtbuTo0.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-3660284441-3406738706-2838319646-1000\..\Toolbar\WebBrowser: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [00PCTFW] C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe (PC Tools)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKU\S-1-5-21-3660284441-3406738706-2838319646-1001..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - Startup: C:\Users\user_11\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TODOR.lnk = C:\Program Files\Todor\todor.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3660284441-3406738706-2838319646-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3660284441-3406738706-2838319646-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKU\S-1-5-21-3660284441-3406738706-2838319646-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-3660284441-3406738706-2838319646-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\user_11\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6A49D185-201E-4691-879E-01878F697AC6}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A90208A6-E414-46A0-9D68-D9B66DB71D2A}: DhcpNameServer = 10.91.88.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img16.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img16.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.ac3filter - C:\Windows\System32\ac3filter.acm ()
Drivers32: msacm.avis - C:\Windows\System32\ff_acm.acm ()
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FFDS - C:\Windows\System32\ff_vfw.dll ()
Drivers32: vidc.x264 - C:\Windows\System32\x264vfw.dll ()
Drivers32: vidc.XVID - C:\Windows\System32\xvidvfw.dll ()

========== Files/Folders - Created Within 30 Days ==========

[2012.08.04 09:48:37 | 000,595,456 | ---- | C] (OldTimer Tools) -- C:\Users\user_11\Desktop\OTL.exe
[2012.08.02 10:51:25 | 000,000,000 | ---D | C] -- C:\Users\user_11\AppData\Roaming\AlawarEntertainment
[2012.08.01 20:04:16 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2012.08.01 20:03:34 | 000,000,000 | ---D | C] -- C:\Program Files\Oracle
[2012.08.01 20:03:02 | 000,772,544 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\npDeployJava1.dll
[2012.08.01 20:03:02 | 000,227,760 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\javaws.exe
[2012.08.01 20:02:33 | 000,174,064 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\javaw.exe
[2012.08.01 20:02:33 | 000,174,064 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\java.exe
[2012.07.30 22:53:18 | 000,000,000 | ---D | C] -- C:\Users\user_11\AppData\Roaming\Bloom
[2012.07.24 21:36:50 | 000,000,000 | ---D | C] -- C:\Users\user_11\AppData\Roaming\ERS Game Studios
[2012.07.21 23:31:14 | 000,000,000 | ---D | C] -- C:\Users\user_11\AppData\Roaming\BlamGames
[2012.07.21 16:52:24 | 000,000,000 | ---D | C] -- C:\Users\user_11\AppData\Roaming\Funlinker
[2012.07.20 13:18:33 | 000,000,000 | ---D | C] -- C:\Users\user_11\AppData\Roaming\Boolat Games
[2012.07.17 15:46:11 | 000,000,000 | ---D | C] -- C:\Users\user_11\Desktop\Flotta Telefon
[2012.07.12 11:07:52 | 000,000,000 | ---D | C] -- C:\Users\user_11\Desktop\APEH
[2012.07.12 11:02:07 | 000,000,000 | ---D | C] -- C:\Users\user_11\abevjava
[2012.07.11 13:54:29 | 002,047,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2012.07.11 13:48:57 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2012.07.11 13:48:56 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2012.07.11 13:48:56 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2012.07.11 13:48:55 | 001,800,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2012.07.11 13:48:55 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2012.07.11 13:48:54 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2012.07.11 13:48:53 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2012.07.11 08:53:40 | 000,204,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ncrypt.dll

========== Files - Modified Within 30 Days ==========

[2012.08.04 09:48:30 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Users\user_11\Desktop\OTL.exe
[2012.08.04 09:45:07 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.04 09:45:07 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.04 09:45:02 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.08.03 22:15:02 | 000,001,046 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3660284441-3406738706-2838319646-1000UA.job
[2012.08.03 10:15:01 | 000,000,994 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3660284441-3406738706-2838319646-1000Core.job
[2012.08.01 20:01:51 | 000,174,064 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\javaw.exe
[2012.08.01 20:01:51 | 000,174,064 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\java.exe
[2012.08.01 12:39:14 | 000,002,014 | ---- | M] () -- C:\Users\user_11\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012.08.01 12:39:13 | 000,002,052 | ---- | M] () -- C:\Users\user_11\Desktop\Google Chrome.lnk
[2012.08.01 09:29:56 | 000,613,306 | ---- | M] () -- C:\Windows\System32\perfh00E.dat
[2012.08.01 09:29:56 | 000,595,798 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.08.01 09:29:56 | 000,144,850 | ---- | M] () -- C:\Windows\System32\perfc00E.dat
[2012.08.01 09:29:56 | 000,103,872 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.07.30 19:05:56 | 000,008,192 | ---- | M] () -- C:\Users\user_11\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.07.22 19:33:30 | 000,000,012 | ---- | M] () -- C:\Windows\dirsaver.ini
[2012.07.11 14:08:17 | 000,372,176 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.07.05 22:06:48 | 000,227,760 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\javaws.exe
[2012.07.05 22:06:30 | 000,772,544 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\npDeployJava1.dll
[2012.07.05 22:06:20 | 000,687,544 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\deployJava1.dll

========== Files Created - No Company Name ==========

[2012.06.01 10:20:03 | 000,000,012 | ---- | C] () -- C:\Windows\dirsaver.ini
[2011.11.11 10:33:30 | 000,024,206 | ---- | C] () -- C:\Users\user_11\AppData\Roaming\UserTile.png
[2011.07.30 12:57:46 | 003,999,744 | ---- | C] () -- C:\Windows\System32\x264vfw.dll
[2011.07.12 20:56:50 | 000,074,752 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2011.04.01 10:47:58 | 000,008,192 | ---- | C] () -- C:\Users\user_11\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.03.19 12:06:02 | 000,240,640 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2011.03.19 12:04:28 | 000,650,752 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2010.12.13 12:52:14 | 000,413,696 | ---- | C] () -- C:\Windows\System32\ZSM1120.exe
[2010.12.13 12:52:14 | 000,167,936 | ---- | C] () -- C:\Windows\System32\hpsfs.dll
[2010.12.11 12:36:25 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2010.12.11 12:36:24 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2010.12.11 12:35:46 | 000,062,976 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2010.12.06 16:57:26 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2010.12.03 16:27:19 | 000,001,356 | ---- | C] () -- C:\Users\user_11\AppData\Local\d3d9caps.dat

========== LOP Check ==========

[2012.05.03 12:50:18 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\Adore Games
[2012.02.21 13:24:13 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\Alawar
[2012.02.05 22:00:38 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\Alawar Entertainment
[2012.08.02 10:51:25 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\AlawarEntertainment
[2012.06.22 10:09:18 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\Atari
[2012.06.01 11:15:46 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\Babylon
[2012.02.07 15:42:59 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\Babylonia
[2012.07.21 23:31:14 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\BlamGames
[2012.07.30 22:54:44 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\Bloom
[2012.02.28 14:52:00 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\Blue Tea Games
[2012.07.20 13:18:33 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\Boolat Games
[2012.03.20 12:11:24 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\DVDVideoSoft
[2012.03.20 12:10:54 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.07.24 21:36:50 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\ERS Game Studios
[2012.05.23 09:33:04 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\flashInstall
[2012.07.21 16:52:24 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\Funlinker
[2012.05.10 11:24:41 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\Genimo
[2011.04.27 13:31:04 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\GHISLER
[2012.05.16 15:02:59 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\HipSoft
[2012.07.20 12:56:23 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\Islands2
[2012.06.18 08:56:52 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\Jewel Time Deluxe
[2012.02.19 13:48:13 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\JoyBits
[2012.06.22 09:17:20 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\Leadertech
[2012.06.22 12:05:16 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\Mahjong LoT
[2012.02.03 09:30:19 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\PCToolsFirewallPlus
[2011.11.11 10:33:30 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\PeerNetworking
[2012.03.16 20:43:38 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\PlayFirst
[2012.02.15 14:38:04 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\tabagames
[2012.05.03 12:10:16 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\TheMissingMonaLisa
[2012.07.29 19:06:37 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\uTorrent
[2012.02.15 09:38:28 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\VistaCodecs
[2012.04.13 15:18:07 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\XemiComputers
[2012.06.01 11:14:57 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\YourFileDownloader
[2012.08.03 22:52:15 | 000,032,512 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========

< %systemroot%\system32\drivers\*.sys /5 >

< %systemroot%\system32\drivers\*.sys /X >
[2006.09.18 23:26:46 | 003,440,660 | ---- | M] () -- C:\Windows\system32\drivers\gm.dls
[2006.09.18 23:26:46 | 000,000,646 | ---- | M] () -- C:\Windows\system32\drivers\gmreadme.txt
[2008.01.21 04:24:15 | 000,000,003 | ---- | M] () -- C:\Windows\system32\drivers\MsftWdf_Kernel_01007_Inbox_Critical.Wdf
[2011.04.01 10:39:33 | 000,000,000 | -H-- | M] () -- C:\Windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf
[2012.02.22 11:17:41 | 000,000,000 | -H-- | M] () -- C:\Windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
[2011.05.21 07:01:00 | 000,012,392 | ---- | M] (NVIDIA Corporation) -- C:\Windows\system32\drivers\nvBridge.kmd

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\system32\*.* /5 >
[2012.08.04 09:45:07 | 000,003,712 | -H-- | M] () -- C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.04 09:45:07 | 000,003,712 | -H-- | M] () -- C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.01 20:01:51 | 000,174,064 | ---- | M] (Oracle Corporation) -- C:\Windows\system32\java.exe
[2012.08.01 20:01:51 | 000,174,064 | ---- | M] (Oracle Corporation) -- C:\Windows\system32\javaw.exe
[2012.08.01 09:29:56 | 000,103,872 | ---- | M] () -- C:\Windows\system32\perfc009.dat
[2012.08.01 09:29:56 | 000,144,850 | ---- | M] () -- C:\Windows\system32\perfc00E.dat
[2012.08.01 09:29:56 | 000,595,798 | ---- | M] () -- C:\Windows\system32\perfh009.dat
[2012.08.01 09:29:56 | 000,613,306 | ---- | M] () -- C:\Windows\system32\perfh00E.dat
[2012.08.01 09:29:56 | 001,451,170 | ---- | M] () -- C:\Windows\system32\PerfStringBackup.INI

< %systemroot%\system32\*.dll /lockedfiles >

< %systemroot%\system32\config\*.sav >
[2008.01.21 05:20:25 | 017,223,680 | ---- | M] () -- C:\Windows\system32\config\COMPONENTS.SAV
[2008.01.21 05:20:08 | 000,106,496 | ---- | M] () -- C:\Windows\system32\config\DEFAULT.SAV
[2008.01.21 05:20:25 | 000,020,480 | ---- | M] () -- C:\Windows\system32\config\SECURITY.SAV
[2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\system32\config\SOFTWARE.SAV
[2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\system32\config\SYSTEM.SAV

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\*.* /U /s >
[13 C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\*.tmp files -> C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\*.tmp -> ]
[1 C:\Windows\SoftwareDistribution\Download\b96d50058973e3df62dac7c0e0c51b67\*.tmp files -> C:\Windows\SoftwareDistribution\Download\b96d50058973e3df62dac7c0e0c51b67\*.tmp -> ]

< %systemroot%\*. /mp /s >

< %ALLUSERSPROFILE%\Data Aplikací\*.* >

< %ALLUSERSPROFILE%\Data Aplikací\*.exe /s >

< %ALLUSERSPROFILE%\Dáta aplikácií\*.* >

< %ALLUSERSPROFILE%\Dáta aplikácií\*.exe /s >

< %APPDATA%\*. >
[2011.06.03 12:11:36 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\Adobe
[2012.05.03 12:50:18 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\Adore Games
[2012.02.21 13:24:13 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\Alawar
[2012.02.05 22:00:38 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\Alawar Entertainment
[2012.08.02 10:51:25 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\AlawarEntertainment
[2012.02.14 20:39:25 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\Apple Computer
[2012.06.22 10:09:18 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\Atari
[2012.05.14 12:51:00 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\Avira
[2012.06.01 11:15:46 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\Babylon
[2012.02.07 15:42:59 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\Babylonia
[2012.07.21 23:31:14 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\BlamGames
[2012.07.30 22:54:44 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\Bloom
[2012.02.28 14:52:00 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\Blue Tea Games
[2012.07.20 13:18:33 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\Boolat Games
[2012.03.20 12:11:24 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\DVDVideoSoft
[2012.03.20 12:10:54 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.07.24 21:36:50 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\ERS Game Studios
[2012.05.23 09:33:04 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\flashInstall
[2012.07.21 16:52:24 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\Funlinker
[2012.05.10 11:24:41 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\Genimo
[2011.04.27 13:31:04 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\GHISLER
[2012.05.16 15:02:59 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\HipSoft
[2010.12.03 16:27:24 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\Identities
[2012.02.10 11:26:14 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\InstallShield
[2012.07.20 12:56:23 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\Islands2
[2012.06.18 08:56:52 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\Jewel Time Deluxe
[2012.02.19 13:48:13 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\JoyBits
[2012.06.22 09:17:20 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\Leadertech
[2010.12.11 12:24:56 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\Macromedia
[2012.06.22 12:05:16 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\Mahjong LoT
[2011.07.13 13:04:23 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\Malwarebytes
[2012.03.26 14:17:47 | 000,000,000 | --SD | M] -- C:\Users\user_11\AppData\Roaming\Microsoft
[2012.06.21 13:09:10 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\Mozilla
[2010.12.21 13:13:10 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\Nero
[2012.06.04 09:03:45 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\NVIDIA
[2012.02.03 09:30:19 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\PCToolsFirewallPlus
[2011.11.11 10:33:30 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\PeerNetworking
[2012.03.16 20:43:38 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\PlayFirst
[2012.02.15 14:38:04 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\tabagames
[2012.05.03 12:10:16 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\TheMissingMonaLisa
[2012.07.29 19:06:37 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\uTorrent
[2012.02.15 09:38:28 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\VistaCodecs
[2012.02.02 17:39:22 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\WinRAR
[2012.04.13 15:18:07 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\XemiComputers
[2012.06.01 11:14:57 | 000,000,000 | ---D | M] -- C:\Users\user_11\AppData\Roaming\YourFileDownloader

< %APPDATA%\*.* >
[2011.11.11 10:33:30 | 000,024,206 | ---- | M] () -- C:\Users\user_11\AppData\Roaming\UserTile.png

< %APPDATA%\*.exe /s >
[2012.03.26 14:17:13 | 006,060,352 | ---- | M] () -- C:\Users\user_11\AppData\Roaming\Microsoft\BingAroundTheWorld\baw-uninst.exe
[2012.03.26 14:17:47 | 000,181,568 | ---- | M] (Microsoft) -- C:\Users\user_11\AppData\Roaming\Microsoft\BingAroundTheWorld\BingAroundTheWorldScreensaver.exe

< %SYSTEMDRIVE%\*.exe >

========== Alternate Data Streams ==========

@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:E153075C
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:5E8C18F1
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:E0888117
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:D696AA12
@Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:C31F31E6

< End of report >

Szia
Nem voltam ithon.
Tolds le az asztalra
http://oldtimer.geekstogo.com/OTL.exe
Futtasd>> az also abkjabba masold be a textet
Pipazd be >.allusers>>LOP>>Purity.
es klika SCAN gombra a naplojat tedd ide.

Szia Stell!

Már rég jártam erre,de most van egy kis gond elég lassan tölt be a net,
és a frissítéseket az avirán is csak lassan tölti.
Lehet,hogy csak a szokásos "takarításos" valamit kellene megcsinálni,
mert vírust nemjelez.
Ja és már nem a régi gép,sikerült lecserélnem!:)

Előre is köszönöm,ha szakítasz rám időt!

Rendben.

Bocs stell közben új telepítés történt és nem a saját gépemről volt szó,csak segíteni akartam.
Elnézést
Üdv.

Udv
Tegy ide screenshotot.
Futtasd le az RSIT programot
http://www.virus-stell.com/2010/04/rsit.html

Köszi,de nem segitett az icon cache törlése,keresünk tovább, vagy újra lesz rakva.

Nem vagyok stell, de: http://smallvoid.com/article/windows-icon-cache.html

Vagy Google > icon cache rebuild xp
van találat bőven. Amit idéztem, az is onnan van.

Szia stell!

Tanácsot szeretnék kérni:

Ismerösőm notebook-ján az asztalon és tálcán lévő ikonok fehérek, kivéve a rendszer ikonokat, ezek jók. Az ikon neve olvasható, a nyíl látszik.
Ikon cache méret növelve lett/ Max Cached Icons: 2000/ , de nem oldotta meg a problémát.
Lehet, hogy kártevőt szedett össze?AVG-t le futatta, de nem talált.

Igen, ez is megoldás,
Nincsen mit
Udv

Üdv Stell!

Az a helyzet, hogy a párom összepakolta a gépét tegnap, és elvitte a rendszergazdájukhoz a munkahelyére. Azt mondta nem várhat, kell neki a gép mielőbb..
Azért köszönöm szépen a nevében is a segítséged!!

További jó munkát kívánok!

Virust nem talalt.

Letolteni az asztalra>OTListIt2>>
http://oldtimer.geekstogo.com/OTL.exe
-Futatni
-bepipazni
-Scan all users.
-Lop check.
-Purity check.
-v sekciobaExtra Registry>bepotyozni>Use SafeList
-az ablakjaba -customscan/fixes masold be a textet-es klik RUNSCAN
-5-10 perc mulva add logot tedd ide
-OTL.txt (az asztalon lesz).
-exras.txt-a talcan lesz.

Csökkentett módban indult csak el a program. A naplót itt találod: http://leteckaposta.cz/128235316 Ide nem fért volna be.

ok, meglássuk mit talál.
Jo ejt.

Ok, akkor futtatom amit írtál, és holnap jövök a naplóval. Köszönöm, hogy segítesz! Jó éjt!

Elírtam , még a Ccleaner is fent van. Ezzel a programmal töröltem az biztos, csak csökkentett módban, mert nem akart rendesen elindulni a gép. Eszközök-->programok eltávolítása.

neem, ejszaka futtasd le az AVPTOOL11 verziot, programot,, majd a naplojat tedd ide
http://www.virus-stell.com/2010/04/avptool.html


AVIRA

Tehat torolted, vagy le telepitetted??

Nem nem semmit. Az Avirát szedtem le, mert akkor még lassabb lett minden. Csökkentett módban töröltem azt hiszem. Semmi nincs is a Java-n kívül szerintem.
Éjszakára hagyjam szerinted, hátha lefut?

Kozben nem raktal fel valami Visrusirtokat??tuzfalakat??

Azt hiszem kezdem feladni..
Megint nem akart végezni, pedig letöröltem és újraletöltöttem a Combofixet. Mintha dolgozna, de nem csinál semmit sem. Mitévő legyek?

c:\documents and settings\Dugó\Asztal\ComboFix.exe
az Asztalon talald meg az combofix.exe ikont,, nevezd at uninstall.exe
es futtasd, a combofix letelepitodig a geprol,

Most ujbol tolds le az asztalra a combofixet,, es csak siman futtasd le,
http://www.virus-stell.com/2010/04/combofix.html

a naplojat tedd ide.

Itt a napló, remélem jót küldök, mert nem adott ki semmit, a Report feliratra klikkelve onnan másolam ki:

13:37:40.0463 1184 TDSS rootkit removing tool 2.7.0.0 Jan 10 2012 09:14:26
13:37:41.0064 1184 ============================================================
13:37:41.0064 1184 Current date / time: 2012/01/11 13:37:41.0064
13:37:41.0064 1184 SystemInfo:
13:37:41.0064 1184
13:37:41.0064 1184 OS Version: 5.1.2600 ServicePack: 2.0
13:37:41.0064 1184 Product type: Workstation
13:37:41.0064 1184 ComputerName: DUGO-3404485C25
13:37:41.0084 1184 UserName: Dugó
13:37:41.0084 1184 Windows directory: C:\WINDOWS
13:37:41.0084 1184 System windows directory: C:\WINDOWS
13:37:41.0084 1184 Processor architecture: Intel x86
13:37:41.0084 1184 Number of processors: 1
13:37:41.0084 1184 Page size: 0x1000
13:37:41.0084 1184 Boot type: Normal boot
13:37:41.0084 1184 ============================================================
13:37:46.0051 1184 Drive \Device\Harddisk0\DR0 - Size: 0x26257E000, SectorSize: 0x200, Cylinders: 0x4DC, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K', Flags 0x00000054
13:37:46.0121 1184 Initialize success
13:39:16.0741 1576 ============================================================
13:39:16.0741 1576 Scan started
13:39:16.0741 1576 Mode: Manual;
13:39:16.0741 1576 ============================================================
13:39:17.0753 1576 Abiosdsk - ok
13:39:17.0983 1576 abp480n5 - ok
13:39:19.0475 1576 ACPI (4b60d4e72648207eb98287464fe3489d) C:\WINDOWS\system32\DRIVERS\ACPI.sys
13:39:20.0517 1576 ACPI - ok
13:39:21.0478 1576 ACPIEC (582c901174a7f0733c6fe41c37c9a80b) C:\WINDOWS\system32\drivers\ACPIEC.sys
13:39:21.0478 1576 ACPIEC - ok
13:39:21.0889 1576 adpu160m - ok
13:39:22.0299 1576 aec (841f385c6cfaf66b58fbd898722bb4f0) C:\WINDOWS\system32\drivers\aec.sys
13:39:22.0439 1576 aec - ok
13:39:23.0361 1576 AFD (5ac495f4cb807b2b98ad2ad591e6d92e) C:\WINDOWS\System32\drivers\afd.sys
13:39:23.0431 1576 AFD - ok
13:39:23.0962 1576 Aha154x - ok
13:39:24.0612 1576 aic78u2 - ok
13:39:24.0953 1576 aic78xx - ok
13:39:25.0193 1576 AliIde - ok
13:39:25.0374 1576 amsint - ok
13:39:25.0664 1576 asc - ok
13:39:25.0944 1576 asc3350p - ok
13:39:26.0245 1576 asc3550 - ok
13:39:26.0846 1576 AsyncMac (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
13:39:26.0976 1576 AsyncMac - ok
13:39:27.0957 1576 atapi (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\DRIVERS\atapi.sys
13:39:28.0007 1576 atapi - ok
13:39:28.0488 1576 Atdisk - ok
13:39:29.0049 1576 Atmarpc (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
13:39:29.0069 1576 Atmarpc - ok
13:39:29.0710 1576 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
13:39:29.0710 1576 audstub - ok
13:39:31.0122 1576 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
13:39:31.0122 1576 Beep - ok
13:39:31.0853 1576 catchme - ok
13:39:33.0035 1576 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
13:39:33.0045 1576 cbidf2k - ok
13:39:33.0475 1576 cd20xrnt - ok
13:39:33.0846 1576 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
13:39:33.0856 1576 Cdaudio - ok
13:39:34.0927 1576 Cdfs (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys
13:39:35.0278 1576 Cdfs - ok
13:39:36.0169 1576 Cdrom (af9c19b3100fe010496b1a27181fbf72) C:\WINDOWS\system32\DRIVERS\cdrom.sys
13:39:36.0399 1576 Cdrom - ok
13:39:36.0860 1576 Changer - ok
13:39:37.0211 1576 CmdIde - ok
13:39:37.0421 1576 Cpqarray - ok
13:39:37.0721 1576 dac2w2k - ok
13:39:37.0872 1576 dac960nt - ok
13:39:38.0532 1576 Disk (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS\system32\DRIVERS\disk.sys
13:39:38.0703 1576 Disk - ok
13:39:39.0934 1576 dmboot (89e3734f8b92bc9322b0b4331e94bcb4) C:\WINDOWS\system32\drivers\dmboot.sys
13:39:40.0215 1576 dmboot - ok
13:39:42.0108 1576 dmio (1811ad47c0ac9a082f1761138e2f2022) C:\WINDOWS\system32\drivers\dmio.sys
13:39:42.0368 1576 dmio - ok
13:39:42.0879 1576 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
13:39:42.0919 1576 dmload - ok
13:39:43.0690 1576 DMusic (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys
13:39:44.0110 1576 DMusic - ok
13:39:44.0491 1576 dpti2o - ok
13:39:44.0962 1576 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys
13:39:44.0982 1576 drmkaud - ok
13:39:45.0733 1576 EL90XBC (6e883bf518296a40959131c2304af714) C:\WINDOWS\system32\DRIVERS\el90xbc5.sys
13:39:45.0863 1576 EL90XBC - ok
13:39:46.0975 1576 es1371 (a55dd7d8ced5d2624a9ee2dda7be0319) C:\WINDOWS\system32\drivers\es1371mp.sys
13:39:47.0225 1576 es1371 - ok
13:39:49.0338 1576 Fastfat (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS\system32\drivers\Fastfat.sys
13:39:50.0930 1576 Fastfat - ok
13:39:51.0491 1576 Fdc (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS\system32\DRIVERS\fdc.sys
13:39:51.0511 1576 Fdc - ok
13:39:51.0952 1576 Fips (3e16f14a26c5f2f663a14669a0e09544) C:\WINDOWS\system32\drivers\Fips.sys
13:39:51.0962 1576 Fips - ok
13:39:52.0432 1576 Flpydisk (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
13:39:52.0452 1576 Flpydisk - ok
13:39:53.0073 1576 FltMgr (157754f0df355a9e0a6f54721914f9c6) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
13:39:53.0164 1576 FltMgr - ok
13:39:53.0474 1576 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
13:39:53.0494 1576 Fs_Rec - ok
13:39:54.0115 1576 Ftdisk (44225407f69666099c4d4c6bc9cd804d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
13:39:54.0165 1576 Ftdisk - ok
13:39:54.0546 1576 gameenum (5f92fd09e5610a5995da7d775eadcd12) C:\WINDOWS\system32\DRIVERS\gameenum.sys
13:39:54.0606 1576 gameenum - ok
13:39:55.0347 1576 Gpc (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS\system32\DRIVERS\msgpc.sys
13:39:55.0397 1576 Gpc - ok
13:39:55.0917 1576 hidusb (1de6783b918f540149aa69943bdfeba8) C:\WINDOWS\system32\DRIVERS\hidusb.sys
13:39:55.0988 1576 hidusb - ok
13:39:56.0428 1576 hpn - ok
13:39:57.0189 1576 HTTP (c19b522a9ae0bbc3293397f3055e80a1) C:\WINDOWS\system32\Drivers\HTTP.sys
13:39:57.0510 1576 HTTP - ok
13:39:58.0010 1576 i2omgmt - ok
13:39:58.0111 1576 i2omp - ok
13:39:58.0381 1576 i8042prt (cced51afecf99e8d7b9e2ab45cf3ceb2) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
13:39:58.0461 1576 i8042prt - ok
13:39:59.0793 1576 i81x (06b7ef73ba5f302eecc294cdf7e19702) C:\WINDOWS\system32\DRIVERS\i81xnt5.sys
13:40:00.0554 1576 i81x - ok
13:40:01.0255 1576 iAimFP0 (7b5b44efe5eb9dadfb8ee29700885d23) C:\WINDOWS\system32\DRIVERS\wADV01nt.sys
13:40:01.0265 1576 iAimFP0 - ok
13:40:01.0516 1576 iAimFP1 (eb1f6bab6c22ede0ba551b527475f7e9) C:\WINDOWS\system32\DRIVERS\wADV02NT.sys
13:40:01.0516 1576 iAimFP1 - ok
13:40:01.0846 1576 iAimFP2 (03ce989d846c1aa81145cb22fcb86d06) C:\WINDOWS\system32\DRIVERS\wADV05NT.sys
13:40:01.0846 1576 iAimFP2 - ok
13:40:02.0527 1576 iAimFP3 (525849b4469de021d5d61b4db9be3a9d) C:\WINDOWS\system32\DRIVERS\wSiINTxx.sys
13:40:02.0567 1576 iAimFP3 - ok
13:40:03.0008 1576 iAimFP4 (589c2bcdb5bd602bf7b63d210407ef8c) C:\WINDOWS\system32\DRIVERS\wVchNTxx.sys
13:40:03.0018 1576 iAimFP4 - ok
13:40:03.0929 1576 iAimFP5 (0308aef61941e4af478fa1a0f83812f5) C:\WINDOWS\system32\DRIVERS\wADV07nt.sys
13:40:03.0939 1576 iAimFP5 - ok
13:40:05.0021 1576 iAimFP6 (714038a8aa5de08e12062202cd7eaeb5) C:\WINDOWS\system32\DRIVERS\wADV08nt.sys
13:40:05.0021 1576 iAimFP6 - ok
13:40:05.0371 1576 iAimFP7 (7bb3aa595e4507a788de1cdc63f4c8c4) C:\WINDOWS\system32\DRIVERS\wADV09nt.sys
13:40:05.0381 1576 iAimFP7 - ok
13:40:05.0832 1576 iAimTV0 (d83bdd5c059667a2f647a6be5703a4d2) C:\WINDOWS\system32\DRIVERS\wATV01nt.sys
13:40:05.0852 1576 iAimTV0 - ok
13:40:06.0222 1576 iAimTV1 (ed968d23354daa0d7c621580c012a1f6) C:\WINDOWS\system32\DRIVERS\wATV02NT.sys
13:40:06.0242 1576 iAimTV1 - ok
13:40:06.0743 1576 iAimTV3 (d738273f218a224c1ddac04203f27a84) C:\WINDOWS\system32\DRIVERS\wATV04nt.sys
13:40:06.0743 1576 iAimTV3 - ok
13:40:07.0464 1576 iAimTV4 (0052d118995cbab152daabe6106d1442) C:\WINDOWS\system32\DRIVERS\wCh7xxNT.sys
13:40:07.0484 1576 iAimTV4 - ok
13:40:08.0365 1576 iAimTV5 (791cc45de6e50445be72e8ad6401ff45) C:\WINDOWS\system32\DRIVERS\wATV10nt.sys
13:40:08.0486 1576 iAimTV5 - ok
13:40:08.0796 1576 iAimTV6 (352fa0e98bc461ce1ce5d41f64db558d) C:\WINDOWS\system32\DRIVERS\wATV06nt.sys
13:40:08.0826 1576 iAimTV6 - ok
13:40:09.0227 1576 Imapi (f8aa320c6a0409c0380e5d8a99d76ec6) C:\WINDOWS\system32\DRIVERS\imapi.sys
13:40:09.0247 1576 Imapi - ok
13:40:09.0437 1576 ini910u - ok
13:40:09.0908 1576 IntelIde (0d13a30de5dfdec8938801a8a2dfc792) C:\WINDOWS\system32\DRIVERS\intelide.sys
13:40:09.0908 1576 IntelIde - ok
13:40:10.0859 1576 Ip6Fw (4448006b6bc60e6c027932cfc38d6855) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
13:40:10.0879 1576 Ip6Fw - ok
13:40:11.0700 1576 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
13:40:12.0131 1576 IpFilterDriver - ok
13:40:13.0232 1576 IpInIp (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS\system32\DRIVERS\ipinip.sys
13:40:13.0232 1576 IpInIp - ok
13:40:13.0983 1576 IpNat (b5a8e215ac29d24d60b4d1250ef05ace) C:\WINDOWS\system32\DRIVERS\ipnat.sys
13:40:14.0044 1576 IpNat - ok
13:40:14.0965 1576 IPSec (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS\system32\DRIVERS\ipsec.sys
13:40:14.0975 1576 IPSec - ok
13:40:15.0896 1576 IRENUM (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINDOWS\system32\DRIVERS\irenum.sys
13:40:15.0916 1576 IRENUM - ok
13:40:16.0547 1576 isapnp (ae9857353a6d45f101c4496789585c25) C:\WINDOWS\system32\DRIVERS\isapnp.sys
13:40:16.0567 1576 isapnp - ok
13:40:17.0428 1576 Kbdclass (059b59b694dbb143a5b627187c9d8860) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
13:40:17.0428 1576 Kbdclass - ok
13:40:19.0101 1576 kmixer (d93cad07c5683db066b0b2d2d3790ead) C:\WINDOWS\system32\drivers\kmixer.sys
13:40:19.0722 1576 kmixer - ok
13:40:20.0893 1576 KSecDD (eb7ffe87fd367ea8fca0506f74a87fbb) C:\WINDOWS\system32\drivers\KSecDD.sys
13:40:21.0414 1576 KSecDD - ok
13:40:21.0945 1576 lbrtfdc - ok
13:40:22.0345 1576 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
13:40:22.0366 1576 mnmdd - ok
13:40:23.0207 1576 Modem (af00a5a5a613e165f3bdea187df796ec) C:\WINDOWS\system32\drivers\Modem.sys
13:40:23.0407 1576 Modem - ok
13:40:24.0388 1576 Mouclass (de28319707eb33dd721559110acd757d) C:\WINDOWS\system32\DRIVERS\mouclass.sys
13:40:24.0459 1576 Mouclass - ok
13:40:24.0759 1576 mouhid (6a79cb27d0e608a45638cd9468269a3e) C:\WINDOWS\system32\DRIVERS\mouhid.sys
13:40:24.0809 1576 mouhid - ok
13:40:25.0450 1576 MountMgr (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS\system32\drivers\MountMgr.sys
13:40:25.0570 1576 MountMgr - ok
13:40:26.0712 1576 mraid35x - ok
13:40:29.0155 1576 MRxDAV (46edcc8f2db2f322c24f48785cb46366) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
13:40:30.0137 1576 MRxDAV - ok
13:40:31.0749 1576 MRxSmb (1fd607fc67f7f7c633c3da65bfc53d18) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
13:40:32.0150 1576 MRxSmb - ok
13:40:33.0251 1576 Msfs (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS\system32\drivers\Msfs.sys
13:40:33.0431 1576 Msfs - ok
13:40:34.0012 1576 MSKSSRV (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS\system32\drivers\MSKSSRV.sys
13:40:34.0152 1576 MSKSSRV - ok
13:40:34.0944 1576 MSPCLOCK (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
13:40:35.0064 1576 MSPCLOCK - ok
13:40:35.0615 1576 MSPQM (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS\system32\drivers\MSPQM.sys
13:40:35.0705 1576 MSPQM - ok
13:40:36.0326 1576 mssmbios (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
13:40:36.0416 1576 mssmbios - ok
13:40:37.0557 1576 Mup (82035e0f41c2dd05ae41d27fe6cf7de1) C:\WINDOWS\system32\drivers\Mup.sys
13:40:38.0379 1576 Mup - ok
13:40:40.0071 1576 NDIS (558635d3af1c7546d26067d5d9b6959e) C:\WINDOWS\system32\drivers\NDIS.sys
13:40:40.0982 1576 NDIS - ok
13:40:41.0723 1576 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
13:40:41.0743 1576 NdisTapi - ok
13:40:42.0514 1576 Ndisuio (34d6cd56409da9a7ed573e1c90a308bf) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
13:40:42.0675 1576 Ndisuio - ok
13:40:43.0406 1576 NdisWan (0b90e255a9490166ab368cd55a529893) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
13:40:43.0416 1576 NdisWan - ok
13:40:44.0537 1576 NDProxy (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys
13:40:44.0678 1576 NDProxy - ok
13:40:46.0010 1576 NetBIOS (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS\system32\DRIVERS\netbios.sys
13:40:46.0210 1576 NetBIOS - ok
13:40:47.0822 1576 NetBT (0c80e410cd2f47134407ee7dd19cc86b) C:\WINDOWS\system32\DRIVERS\netbt.sys
13:40:48.0453 1576 NetBT - ok
13:40:49.0655 1576 Npfs (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS\system32\drivers\Npfs.sys
13:40:49.0765 1576 Npfs - ok
13:40:51.0678 1576 Ntfs (b78be402c3f63dd55521f73876951cdd) C:\WINDOWS\system32\drivers\Ntfs.sys
13:40:52.0529 1576 Ntfs - ok
13:40:53.0661 1576 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
13:40:53.0661 1576 Null - ok
13:40:54.0572 1576 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
13:40:54.0692 1576 NwlnkFlt - ok
13:40:55.0794 1576 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
13:40:56.0254 1576 NwlnkFwd - ok
13:40:57.0847 1576 P3 (4b9a660626c199b1f838f67635e3d402) C:\WINDOWS\system32\DRIVERS\p3.sys
13:40:58.0007 1576 P3 - ok
13:40:58.0588 1576 Parport (99d001d603b5c27c01fe9fc55b4bb181) C:\WINDOWS\system32\DRIVERS\parport.sys
13:40:58.0888 1576 Parport - ok
13:40:59.0399 1576 PartMgr (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys
13:40:59.0509 1576 PartMgr - ok
13:41:00.0240 1576 ParVdm (4df92a889e7fe15ed3834d288a0271f5) C:\WINDOWS\system32\drivers\ParVdm.sys
13:41:00.0300 1576 ParVdm - ok
13:41:01.0572 1576 PCI (0827cc4cb7c97ef6d94e97927db55df8) C:\WINDOWS\system32\DRIVERS\pci.sys
13:41:01.0852 1576 PCI - ok
13:41:02.0603 1576 PCIDump - ok
13:41:03.0825 1576 PCIIde - ok
13:41:04.0696 1576 Pcmcia (eca393902f8b2ca5233cbb325f0b4488) C:\WINDOWS\system32\drivers\Pcmcia.sys
13:41:05.0217 1576 Pcmcia - ok
13:41:05.0347 1576 PDCOMP - ok
13:41:05.0467 1576 PDFRAME - ok
13:41:05.0938 1576 PDRELI - ok
13:41:06.0499 1576 PDRFRAME - ok
13:41:07.0060 1576 perc2 - ok
13:41:08.0272 1576 perc2hib - ok
13:41:09.0223 1576 PptpMiniport (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS\system32\DRIVERS\raspptp.sys
13:41:09.0263 1576 PptpMiniport - ok
13:41:10.0505 1576 PSched (48671f327553dcf1d27f6197f622a668) C:\WINDOWS\system32\DRIVERS\psched.sys
13:41:10.0665 1576 PSched - ok
13:41:11.0366 1576 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
13:41:11.0366 1576 Ptilink - ok
13:41:11.0526 1576 ql1080 - ok
13:41:11.0666 1576 Ql10wnt - ok
13:41:12.0037 1576 ql12160 - ok
13:41:12.0528 1576 ql1240 - ok
13:41:12.0898 1576 ql1280 - ok
13:41:13.0900 1576 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
13:41:13.0900 1576 RasAcd - ok
13:41:15.0372 1576 Rasl2tp (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
13:41:15.0622 1576 Rasl2tp - ok
13:41:16.0654 1576 RasPppoe (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
13:41:16.0704 1576 RasPppoe - ok
13:41:18.0086 1576 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
13:41:18.0136 1576 Raspti - ok
13:41:21.0120 1576 Rdbss (29d66245adba878fff574cd66abd2884) C:\WINDOWS\system32\DRIVERS\rdbss.sys
13:41:22.0392 1576 Rdbss - ok
13:41:23.0824 1576 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
13:41:23.0824 1576 RDPCDD - ok
13:41:25.0957 1576 rdpdr (a2cae2c60bc37e0751ef9dda7ceaf4ad) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
13:41:26.0538 1576 rdpdr - ok
13:41:29.0332 1576 RDPWD (d4f5643d7714ef499ae9527fdcd50894) C:\WINDOWS\system32\drivers\RDPWD.sys
13:41:31.0104 1576 RDPWD - ok
13:41:32.0266 1576 redbook (de6e09ca3a6fa6fc2b0bac66ae617726) C:\WINDOWS\system32\DRIVERS\redbook.sys
13:41:32.0436 1576 redbook - ok
13:41:33.0217 1576 Secdrv (d26e26ea516450af9d072635c60387f4) C:\WINDOWS\system32\DRIVERS\secdrv.sys
13:41:33.0267 1576 Secdrv - ok
13:41:34.0810 1576 serenum (a2d868aeeff612e70e213c451a70cafb) C:\WINDOWS\system32\DRIVERS\serenum.sys
13:41:34.0980 1576 serenum - ok
13:41:35.0741 1576 Serial (eb35db11a54056f7ef2f2187b9a4f24a) C:\WINDOWS\system32\DRIVERS\serial.sys
13:41:36.0001 1576 Serial - ok
13:41:36.0532 1576 Sfloppy (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS\system32\drivers\Sfloppy.sys
13:41:36.0532 1576 Sfloppy - ok
13:41:37.0033 1576 Simbad - ok
13:41:37.0183 1576 Sparrow - ok
13:41:37.0283 1576 splitter (8e186b8f23295d1e42c573b82b80d548) C:\WINDOWS\system32\drivers\splitter.sys
13:41:37.0343 1576 splitter - ok
13:41:37.0974 1576 sr (d11ef3ba5bb0f718d5fefe761101782b) C:\WINDOWS\system32\DRIVERS\sr.sys
13:41:38.0625 1576 sr - ok
13:41:41.0279 1576 Srv (20b7e396720353e4117d64d9dcb926ca) C:\WINDOWS\system32\DRIVERS\srv.sys
13:41:42.0881 1576 Srv - ok
13:41:43.0743 1576 swenum (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS\system32\DRIVERS\swenum.sys
13:41:43.0793 1576 swenum - ok
13:41:44.0614 1576 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys
13:41:44.0654 1576 swmidi - ok
13:41:45.0054 1576 symc810 - ok
13:41:45.0345 1576 symc8xx - ok
13:41:45.0495 1576 sym_hi - ok
13:41:45.0715 1576 sym_u3 - ok
13:41:46.0426 1576 sysaudio (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys
13:41:46.0426 1576 sysaudio - ok
13:41:49.0581 1576 Tcpip (9f4b36614a0fc234525ba224957de55c) C:\WINDOWS\system32\DRIVERS\tcpip.sys
13:41:52.0125 1576 Tcpip - ok
13:41:53.0066 1576 TDPIPE (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS\system32\drivers\TDPIPE.sys
13:41:53.0236 1576 TDPIPE - ok
13:41:53.0477 1576 TDTCP (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS\system32\drivers\TDTCP.sys
13:41:53.0497 1576 TDTCP - ok
13:41:54.0808 1576 TermDD (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS\system32\DRIVERS\termdd.sys
13:41:54.0999 1576 TermDD - ok
13:41:55.0950 1576 TosIde - ok
13:41:56.0371 1576 Udfs (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS\system32\drivers\Udfs.sys
13:41:56.0651 1576 Udfs - ok
13:41:56.0941 1576 ultra - ok
13:41:57.0282 1576 Update (aff2e5045961bbc0a602bb6f95eb1345) C:\WINDOWS\system32\DRIVERS\update.sys
13:41:57.0422 1576 Update - ok
13:41:57.0622 1576 usbhub (c72f40947f92cea56a8fb532edf025f1) C:\WINDOWS\system32\DRIVERS\usbhub.sys
13:41:57.0632 1576 usbhub - ok
13:41:57.0903 1576 usbuhci (f8fd1400092e23c8f2f31406ef06167b) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
13:41:58.0083 1576 usbuhci - ok
13:41:58.0263 1576 VgaSave (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS\System32\drivers\vga.sys
13:41:58.0273 1576 VgaSave - ok
13:41:58.0444 1576 ViaIde - ok
13:41:58.0634 1576 VolSnap (1cafd39fec4cb1fe96f408983bb0c106) C:\WINDOWS\system32\drivers\VolSnap.sys
13:41:58.0634 1576 VolSnap - ok
13:41:58.0894 1576 Wanarp (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS\system32\DRIVERS\wanarp.sys
13:41:58.0904 1576 Wanarp - ok
13:41:59.0045 1576 WDICA - ok
13:41:59.0175 1576 wdmaud (2797f33ebf50466020c430ee4f037933) C:\WINDOWS\system32\drivers\wdmaud.sys
13:41:59.0175 1576 wdmaud - ok
13:41:59.0545 1576 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
13:41:59.0555 1576 WS2IFSL - ok
13:41:59.0705 1576 MBR (0x1B8) (186a4159d7661245314a7a933981403e) \Device\Harddisk0\DR0
13:41:59.0906 1576 \Device\Harddisk0\DR0 - ok
13:41:59.0946 1576 Boot (0x1200) (f86011c384175598b6841c86a47becb6) \Device\Harddisk0\DR0\Partition0
13:41:59.0946 1576 \Device\Harddisk0\DR0\Partition0 - ok
13:41:59.0966 1576 ============================================================
13:41:59.0966 1576 Scan finished
13:41:59.0966 1576 ============================================================
13:42:00.0036 1560 Detected object count: 0
13:42:00.0036 1560 Actual detected object count: 0

ok,
masold be kezzel az usbehci.sys
Az c:\windows\system32\drivers
Mappaba.

Utana futtasd le az TDSSKILLERT, a naplojat tedd ide.
http://www.virus-stell.com/2010/08/root ... -tdl3.html

Elindítottam csökkentett módban is, de úgyis tovább tart sajna. 2 órát hagytam kb.

Hat igen, ez az ügynevezet Svéd -Stockholmi szindrom.
Nincsen mit szia.

Jó rendben! Köszönöm és tudom,hogy néha idegesítő vagyok de szeretek mindennek a végére járni
Még egyszer kösz:Évi
U.i:Azért megjegyezném,hogy még egy pasi üzenetét sem vártam úgy mint a tiédet

Igen, Torold ki, ez a játékot, ez nem megbízható,ha tényleg akarod ezt a játékot, akkor megbízható helyről kel letölteni, és telepítés élőt át vizsgálni a VT.

setup.exe
Submission date:
2012-01-11 09:28:41 (UTC)
Current status:
finished
Result:
5/ 42 (11.9%)

VT Community

not reviewed
Safety score: -
Compact
Print results
Antivirus Version Last Update Result
AhnLab-V3 2012.01.08.00 2012.01.08 -
AntiVir 7.11.20.195 2012.01.08 -
Antiy-AVL 2.0.3.7 2012.01.08 -
Avast 6.0.1289.0 2012.01.08 -
AVG 10.0.0.1190 2012.01.08 -
BitDefender 7.2 2012.01.08 -
ByteHero 1.0.0.1 2011.12.31 Trojan.Win32.Heur.Gen
CAT-QuickHeal 12.00 None.. -
ClamAV 0.97.3.0 2012.01.07 PUA.Packed.Armadillo
Commtouch 5.3.2.6 2012.01.07 -
Comodo 11216 2012.01.08 -
DrWeb 5.0.2.03300 2012.01.08 Trojan.Inject.13951
Emsisoft 5.1.0.11 2012.01.08 -
eSafe 7.0.17.0 2012.01.08 -
eTrust-Vet 37.0.9668 2012.01.06 -
F-Prot 4.6.5.141 2012.01.07 -
F-Secure 9.0.16440.0 2012.01.08 -
Fortinet 4.3.388.0 2012.01.08 -
GData 22 2012.01.08 -
Ikarus T3.1.1.109.0 2012.01.08 -
Jiangmin 13.0.900 2012.01.08 Trojan/Buzus.twy
K7AntiVirus 9.123.5881 2012.01.06 -
Kaspersky 9.0.0.837 2012.01.08 -
McAfee 5.400.0.1158 2012.01.08 -
McAfee-GW-Edition 2010.1E 2012.01.08 Heuristic.LooksLike.Win32.SuspiciousPE.F
Microsoft 1.7903 2012.01.08 -
NOD32 6777 2012.01.08 -
nProtect 2012-01-08.01 2012.01.08 -
Panda 10.0.3.5 2012.01.08 -
PCTools 8.0.0.5 2012.01.08 -
Prevx 3.0 2012.01.11 -
Rising 23.91.04.02 None.. -
Sophos 4.73.0 2012.01.08 -
SUPERAntiSpyware 4.40.0.1006 2012.01.07 -
Symantec 20111.2.0.82 2012.01.08 -
TheHacker 6.7.0.1.373 2012.01.08 -
TrendMicro 9.500.0.1008 2012.01.08 -
TrendMicro-HouseCall 9.500.0.1008 2012.01.08 -
VBA32 3.12.16.4 2012.01.06 -
VIPRE 11370 2012.01.08 -
ViRobot 2012.1.7.4869 2012.01.08 -
VirusBuster 14.1.157.0 2012.01.08 -

Na jo,
Talald meg a karantenba ezt a SETUP.EXE fajlot
C:\Program Files\Oberon Media\Zoo Tycoon 2 - Dino Danger Pack Installer\setup.exe
Es teszteld le a
www.virustotal.com
es meglassuk

2:Az Common Files mappa, tartalmazza a programok bizonyos fajlóit, is,, tartalmazhat pldaul olyan fajlot, amit egy bizonyos program,használ, de ezt a fajlot hasznalhatja mas program is, ezert ez a mappa igen fontos, a rendszernek, tehat nagyjabbol igy..