Nincsen mit.
Udv

ahhh,köszi stell.már azt hittem hogy megint órákig fogom irtani ezt is,mint az előzőt...köszöi még egyszer ))))

A suspicious hidden object (rootkit)=rootkit gyanus,rejtet
C:\WINDOWS\system32\drivers\sptd.sys

Igen az AVAST valahogy bolondul, ez is renben van, ez a driver az Alcohol Daemon drivere, es Rootkit taktikat hasznal, tehat figyelem kivul kel hagyni,

Hello! megint én vagyok.....
A suspicious hidden object (rootkit) has been detected on your system.This maybe a sign of a maleware infection.It is recommended to remove the object inmediately.
ezt dobja ki az avast pár percel a gép inditása után.
file name:C:\WINDOWS\system32\drivers\sptd.sys
+ még azt ajánlja h boot scan-nel próbáljam meg kiirtani....
Lécci segitsen valaki...köszi....

oks,kössz a tippet.bár ez a 9es nero csak vmi nagyon primitiv ingyenes változat.csak égetni másolni meg dvdt törölni lehet vele.pont azt ami nekem is kell én nem is foglal szerncsére sokat....

Kihasználod a 9-es által adott többletet? Azonkívül, hogy hatalamas a mérete, és tele van olyan opciókkal, amit 100-ból 99 User nem használ. Mert ha W7-ed lenne, akkor kellene csak az újabb.
Rakd fel a Nero 6.6.1.15c -t, az is tud mindent, ami neked kell. Ilyen gond sosem volt vele.

Nincsen mit.

kössz.ezt majd szép lassan áttanulmányozom.de szerencsére sikerült szereznem egy uj 9-es nerot,ami ráadásul még ingyenes is. megpróbálok párszor égetni vele RW-re,h több dvd ne menjen kárba....

http://translate.googleusercontent.com/ ... DZ2_MyNQqw
itt tanulmanyozd at es hasonlids ossze a hibat.

En ezzel nem-foglalkozom, de telepítsd újra a Nerot.

Azt hittem,h a dvd-vel van baj,vagy csak én rontottem el vmit.megpróbáltam ujra,de ugyanezt dobta ki...

hát ilyen nincs....egyik probléma megoldva,erre jön egy másik.
akartam égezni pár filmet,mert már nagyon tele van a gép.eliditom z égetést,alindul,de hirtelen kiirta h burning failed (vagy vmi hasonlót). Meg ezt a logot dobta ki:
Vmi ötlet h mi lehet a baj??????


xgybey

4A20-8217-0302-2549-3456-6989*

Windows XP 5.1
IA32
WinAspi: File 'Wnaspi32.dll': Ver=5, 0, 0, 1, size=22528 bytes, created 2001. 03. 17. 22:34:12
ahead WinASPI: File 'C:\Program Files\Ahead\nero\Wnaspi32.dll': Ver=2.0.1.74, size=164112 bytes, created 2004. 10. 26. 17:35:32
Nero Version: 6.6.0.14
Internal Version: 6, 6, 0, 14d
(Nero Express)
Recorder: <ASUS DRW-1608P2S> Version: 1.22 - HA 5 TA 0 - 6.6.0.14
Adapter driver: <atapi> HA 5
Drive buffer : 2000kB
Bus Type : via Inquiry data (1) -> ATAPI, detected: ATAPI
Connected to MMC as unknown drive with class-nr : 1
Drive is autodetected - recorder class: Std. MMC recorder
CD-ROM: <IVOPI YJ89YNOP6 >Version: 1.03 - HA 6 TA 0 - 6.6.0.14
Adapter driver: <a1q4av6y> HA 6

=== Scsi-Device-Map ===
DiskPeripheral : WDC WD800JD-00LSA0 atapi Port 2 ID 0 DMA: On
CdRomPeripheral : ASUS DRW-1608P2S atapi Port 5 ID 0 DMA: On
CdRomPeripheral : IVOPI YJ89YNOP6 1.03 a1q4av6y Port 6 ID 0 DMA: Off

=== CDRom-Device-Map ===
ASUS DRW-1608P2S E: CDRom0
IVOPI YJ89YNOP6 F: CDRom1
=======================

AutoRun : 1
Excluded drive IDs:
WriteBufferSize: 83886080 (0) Byte
ShowDrvBufStat : 0
BUFE : 0
Physical memory : 1534MB (1571312kB)
Free physical memory: 805MB (824428kB)
Memory in use : 47 %
Uncached PFiles: 0x0
Use Inquiry : 1
Global Bus Type: default (0)
Check supported media : Disabled (0)

2.11.2010
ISO compilation
13:30:40 #1 Text 0 File Isodoc.cpp, Line 6314
Iso document burn settings
------------------------------------------
Determine maximum speed : FALSE
Simulate : FALSE
Write : TRUE
Finalize CD : TRUE
Multisession : FALSE
Burning mode : DAO
Mode : 1
ISO Level : 1 (Max. of 11 = 8 + 3 char)
Character set : ISO 9660
Joliet : TRUE
Allow pathdepth more than 8 directories : TRUE
Allow more than 255 characters in path : TRUE
Write ISO9660 ;1 file extensions : TRUE

13:30:41 #2 Text 0 File Reader.cpp, Line 127
Reader running

13:30:41 #3 Text 0 File Writer.cpp, Line 122
Writer ASUS DRW-1608P2S running

13:30:41 #4 ISO9660GEN -11 File geniso.cpp, Line 3297
First writeable address = 0 (0x00000000)

13:30:41 #5 Text 0 File Burncd.cpp, Line 3230
Turn on Disc-At-Once, using DVD media

13:30:41 #6 Text 0 File DlgWaitCD.cpp, Line 267
Last possible write address on media: 2298495 (510:46.45, 4489MB)
Last address to be written: 2154367 (478:44.67, 4207MB)

13:30:41 #7 Text 0 File DlgWaitCD.cpp, Line 279
Write in overburning mode: NO (enabled: CD)

13:30:41 #8 Text 0 File DlgWaitCD.cpp, Line 2433
Recorder: ASUS DRW-1608P2S, Media type: DVD-R
Disc Manufacturer: SONY16 - D1
Disc Application Code: 64, Disc Physical Code: 193

13:30:41 #9 Text 0 File DlgWaitCD.cpp, Line 445
>>> Protocol of DlgWaitCD activities: <<<
=========================================

13:30:41 #10 Text 0 File ThreadedTransferInterface.cpp, Line 830
Setup items (after recorder preparation)
0: TRM_DATA_MODE1 ()
2 indices, index0 (150) not provided
original disc pos #0 + 2154368 (2154368) = #2154368/478:44.68
relocatable, disc pos for caching/writing not required/ required, no patch infos
-> TRM_DATA_MODE1, 2048, config 0, wanted index0 0 blocks, length 2154368 blocks [ASUS DRW-1608P2S]
--------------------------------------------------------------

13:30:41 #11 Text 0 File ThreadedTransferInterface.cpp, Line 1043
Prepare recorder [ASUS DRW-1608P2S] for write in CUE-sheet-DAO
DAO infos:
==========
MCN: ""
TOCType: 0x00; Session Closed, disc fixated
Tracks 1 to 1:
1: TRM_DATA_MODE1, 2048/0x00, FilePos 0 0 4412145664, ISRC ""
DAO layout:
===========
__Start_|____Track_|_Idx_|_CtrlAdr_|_RecDep__________
0 | lead-in | 0 | 0x41 | 0x00
0 | 1 | 0 | 0x41 | 0x00
0 | 1 | 1 | 0x41 | 0x00
2154368 | lead-out | 1 | 0x41 | 0x00

13:30:41 #12 Phase 24 File dlgbrnst.cpp, Line 1832
Caching of files started

13:30:42 #13 Text 0 File Burncd.cpp, Line 4114
Cache writing successful.

13:30:42 #14 Phase 25 File dlgbrnst.cpp, Line 1832
Caching of files completed

13:30:42 #15 Phase 36 File dlgbrnst.cpp, Line 1832
Burn process started at 8x (11 080 KB/s)

13:30:44 #16 Text 0 File ThreadedTransferInterface.cpp, Line 2643
Verifying disc position of item 0 (relocatable, disc pos, no patch infos, orig at #0): write at #0

13:30:44 #17 Text 0 File DVDR.cpp, Line 2316
Recording mode: Sequential Recording Mode

13:30:44 #18 Text 0 File Mmc.cpp, Line 21610
Set BUFE: Buffer underrun protection -> ON

13:30:45 #19 Text 0 File DVDR.cpp, Line 2470
Start write address at LBA 0
DVD high compatibility mode: Yes

13:30:45 #20 Text 0 File Cdrdrv.cpp, Line 8821
---- DVD Structure: Physical Format Information (00h) ----
Layer: 0, Address: 0 (0 h), AGID: 0; Length: 2050
Book Type: DVD-R (2), Part Version: 5
Disc Size: 120 mm, Maximum Rate: <not specified> (F h)
Number of Layers: 1, Track Path: Parallel Track Path (PTP), Layer Type: recordable
Linear Density: 0,267 um/bit, Track Density: 0,74 um/track
Starting Physical Sector Number of Data Area: 30000 h (DVD-ROM, DVD-R/-RW, DVD+R/+RW)
End Physical Sector Number of Data Area: 0 h
End Sector Number in Layer 0: 0 h (LBN: FFFD0000 h, 4193920 MB)
Data in Burst Cutting Area (BCA) does not exist
Start sector number of the current Border-Out: 0 h
Start sector number of the next Border-In: 0 h
Media Specific [16..63]:
00 60 00 10 20 30 40 50 - 00 00 00 21 00 00 00 00 .`...0@P...!....
00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................

13:30:47 #21 Text 0 File Cdrdrv.cpp, Line 1288
13:30:47.718 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:20 #22 Text 0 File Cdrdrv.cpp, Line 1288
13:31:20.125 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:20 #23 Text 0 File Cdrdrv.cpp, Line 1288
13:31:20.546 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:20 #24 Text 0 File Cdrdrv.cpp, Line 1288
13:31:20.593 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:20 #25 Text 0 File Cdrdrv.cpp, Line 1288
13:31:20.625 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:20 #26 Text 0 File Cdrdrv.cpp, Line 1288
13:31:20.671 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:20 #27 Text 0 File Cdrdrv.cpp, Line 1288
13:31:20.718 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:20 #28 Text 0 File Cdrdrv.cpp, Line 1288
13:31:20.765 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:20 #29 Text 0 File Cdrdrv.cpp, Line 1288
13:31:20.796 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:20 #30 Text 0 File Cdrdrv.cpp, Line 1288
13:31:20.875 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:20 #31 Text 0 File Cdrdrv.cpp, Line 1288
13:31:20.906 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:20 #32 Text 0 File Cdrdrv.cpp, Line 1288
13:31:20.953 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:21 #33 Text 0 File Cdrdrv.cpp, Line 1288
13:31:21.000 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:21 #34 Text 0 File Cdrdrv.cpp, Line 1288
13:31:21.031 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:21 #35 Text 0 File Cdrdrv.cpp, Line 1288
13:31:21.078 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:21 #36 Text 0 File Cdrdrv.cpp, Line 1288
13:31:21.125 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:21 #37 Text 0 File Cdrdrv.cpp, Line 1288
13:31:21.234 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:21 #38 Text 0 File Cdrdrv.cpp, Line 1288
13:31:21.265 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:21 #39 Text 0 File Cdrdrv.cpp, Line 1288
13:31:21.312 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:21 #40 Text 0 File Cdrdrv.cpp, Line 1288
13:31:21.343 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:21 #41 Text 0 File Cdrdrv.cpp, Line 1288
13:31:21.390 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:21 #42 Text 0 File Cdrdrv.cpp, Line 1288
13:31:21.437 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:21 #43 Text 0 File Cdrdrv.cpp, Line 1288
13:31:21.562 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:21 #44 Text 0 File Cdrdrv.cpp, Line 1288
13:31:21.609 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:21 #45 Text 0 File Cdrdrv.cpp, Line 1288
13:31:21.640 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:21 #46 Text 0 File Cdrdrv.cpp, Line 1288
13:31:21.687 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:21 #47 Text 0 File Cdrdrv.cpp, Line 1288
13:31:21.734 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:21 #48 Text 0 File Cdrdrv.cpp, Line 1288
13:31:21.765 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:21 #49 Text 0 File Cdrdrv.cpp, Line 1288
13:31:21.843 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:21 #50 Text 0 File Cdrdrv.cpp, Line 1288
13:31:21.875 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:21 #51 Text 0 File Cdrdrv.cpp, Line 1288
13:31:21.921 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:21 #52 Text 0 File Cdrdrv.cpp, Line 1288
13:31:21.968 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:22 #53 Text 0 File Cdrdrv.cpp, Line 1288
13:31:22.000 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:22 #54 Text 0 File Cdrdrv.cpp, Line 1288
13:31:22.046 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:22 #55 Text 0 File Cdrdrv.cpp, Line 1288
13:31:22.093 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:22 #56 Text 0 File Cdrdrv.cpp, Line 1288
13:31:22.203 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:22 #57 Text 0 File Cdrdrv.cpp, Line 1288
13:31:22.250 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:22 #58 Text 0 File Cdrdrv.cpp, Line 1288
13:31:22.281 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:22 #59 Text 0 File Cdrdrv.cpp, Line 1288
13:31:22.328 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:22 #60 Text 0 File Cdrdrv.cpp, Line 1288
13:31:22.375 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:22 #61 Text 0 File Cdrdrv.cpp, Line 1288
13:31:22.406 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:22 #62 Text 0 File Cdrdrv.cpp, Line 1288
13:31:22.468 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:22 #63 Text 0 File Cdrdrv.cpp, Line 1288
13:31:22.500 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:22 #64 Text 0 File Cdrdrv.cpp, Line 1288
13:31:22.546 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:22 #65 Text 0 File Cdrdrv.cpp, Line 1288
13:31:22.593 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:22 #66 Text 0 File Cdrdrv.cpp, Line 1288
13:31:22.625 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:22 #67 Text 0 File Cdrdrv.cpp, Line 1288
13:31:22.671 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:22 #68 Text 0 File Cdrdrv.cpp, Line 1288
13:31:22.718 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:22 #69 Text 0 File Cdrdrv.cpp, Line 1288
13:31:22.796 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:22 #70 Text 0 File Cdrdrv.cpp, Line 1288
13:31:22.843 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:22 #71 Text 0 File Cdrdrv.cpp, Line 1288
13:31:22.875 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:22 #72 Text 0 File Cdrdrv.cpp, Line 1288
13:31:22.921 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:22 #73 Text 0 File Cdrdrv.cpp, Line 1288
13:31:22.968 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:23 #74 Text 0 File Cdrdrv.cpp, Line 1288
13:31:23.000 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:23 #75 Text 0 File Cdrdrv.cpp, Line 1288
13:31:23.046 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:23 #76 Text 0 File Cdrdrv.cpp, Line 1288
13:31:23.125 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:23 #77 Text 0 File Cdrdrv.cpp, Line 1288
13:31:23.171 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:23 #78 Text 0 File Cdrdrv.cpp, Line 1288
13:31:23.203 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:23 #79 Text 0 File Cdrdrv.cpp, Line 1288
13:31:23.250 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:23 #80 Text 0 File Cdrdrv.cpp, Line 1288
13:31:23.296 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:23 #81 Text 0 File Cdrdrv.cpp, Line 1288
13:31:23.328 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:23 #82 Text 0 File Cdrdrv.cpp, Line 1288
13:31:23.375 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:23 #83 Text 0 File Cdrdrv.cpp, Line 1288
13:31:23.453 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:23 #84 Text 0 File Cdrdrv.cpp, Line 1288
13:31:23.500 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:23 #85 Text 0 File Cdrdrv.cpp, Line 1288
13:31:23.531 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:23 #86 Text 0 File Cdrdrv.cpp, Line 1288
13:31:23.578 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:23 #87 Text 0 File Cdrdrv.cpp, Line 1288
13:31:23.625 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:23 #88 Text 0 File Cdrdrv.cpp, Line 1288
13:31:23.656 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:23 #89 Text 0 File Cdrdrv.cpp, Line 1288
13:31:23.703 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:23 #90 Text 0 File Cdrdrv.cpp, Line 1288
13:31:23.812 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:23 #91 Text 0 File Cdrdrv.cpp, Line 1288
13:31:23.843 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:23 #92 Text 0 File Cdrdrv.cpp, Line 1288
13:31:23.890 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:23 #93 Text 0 File Cdrdrv.cpp, Line 1288
13:31:23.937 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:23 #94 Text 0 File Cdrdrv.cpp, Line 1288
13:31:23.968 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:24 #95 Text 0 File Cdrdrv.cpp, Line 1288
13:31:24.015 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:24 #96 Text 0 File Cdrdrv.cpp, Line 1288
13:31:24.109 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:24 #97 Text 0 File Cdrdrv.cpp, Line 1288
13:31:24.156 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:24 #98 Text 0 File Cdrdrv.cpp, Line 1288
13:31:24.187 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:24 #99 Text 0 File Cdrdrv.cpp, Line 1288
13:31:24.234 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:24 #100 Text 0 File Cdrdrv.cpp, Line 1288
13:31:24.281 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:24 #101 Text 0 File Cdrdrv.cpp, Line 1288
13:31:24.328 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:24 #102 Text 0 File Cdrdrv.cpp, Line 1288
13:31:24.437 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:24 #103 Text 0 File Cdrdrv.cpp, Line 1288
13:31:24.484 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:24 #104 Text 0 File Cdrdrv.cpp, Line 1288
13:31:24.515 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:24 #105 Text 0 File Cdrdrv.cpp, Line 1288
13:31:24.562 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:24 #106 Text 0 File Cdrdrv.cpp, Line 1288
13:31:24.609 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:24 #107 Text 0 File Cdrdrv.cpp, Line 1288
13:31:24.640 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:24 #108 Text 0 File Cdrdrv.cpp, Line 1288
13:31:24.718 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:24 #109 Text 0 File Cdrdrv.cpp, Line 1288
13:31:24.750 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:24 #110 Text 0 File Cdrdrv.cpp, Line 1288
13:31:24.796 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:24 #111 Text 0 File Cdrdrv.cpp, Line 1288
13:31:24.843 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:24 #112 Text 0 File Cdrdrv.cpp, Line 1288
13:31:24.875 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:24 #113 Text 0 File Cdrdrv.cpp, Line 1288
13:31:24.921 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:24 #114 Text 0 File Cdrdrv.cpp, Line 1288
13:31:24.968 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:25 #115 Text 0 File Cdrdrv.cpp, Line 1288
13:31:25.062 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:25 #116 Text 0 File Cdrdrv.cpp, Line 1288
13:31:25.093 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:25 #117 Text 0 File Cdrdrv.cpp, Line 1288
13:31:25.140 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:25 #118 Text 0 File Cdrdrv.cpp, Line 1288
13:31:25.187 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:25 #119 Text 0 File Cdrdrv.cpp, Line 1288
13:31:25.218 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:25 #120 Text 0 File Cdrdrv.cpp, Line 1288
13:31:25.265 - ASUS DRW-1608P2S\H5 T0 : Queue again later

13:31:34 #121 SCSI -1135 File Cdrdrv.cpp, Line 1436
SCSI Exec, HA 5, TA 0, LUN 0, buffer 0x0BC10000
Status: 0x04 (0x01, SCSI_ERR)
HA-Status 0x00 (0x00, OK)
TA-Status 0x02 (0x01, SCSI_TASTATUS_CHKCOND)
Sense Key: 0x03 (KEY_MEDIUM_ERROR)
Sense Code: 0x0C
Sense Qual: 0x00
CDB Data: 0x2A 0x00 0x00 0x01 0x03 0x80 0x00 0x00 0x20 0x00 0x00 0x00
Sense Data: 0x71 0x00 0x03 0x00 0x01 0x01 0x10 0x0E
0x00 0x00 0x00 0x00 0x0C 0x00

13:31:34 #122 CDR -1135 File Writer.cpp, Line 311
Write error

13:31:34 #123 Text 0 File ThreadedTransfer.cpp, Line 228
all writers idle, stopping conversion

13:31:35 #124 Text 0 File ThreadedTransfer.cpp, Line 222
conversion idle, stopping reader

13:31:35 #125 Text 0 File DVDR.cpp, Line 2708
EndDAO: Last written address was 66431

13:31:35 #126 Phase 38 File dlgbrnst.cpp, Line 1832
Burn process failed at 8x (11 080 KB/s)


Existing drivers:
File 'Drivers\ASPI32.SYS': Ver=4.71 (0002) built by: WinDDK, size=16512 bytes, created 2002. 07. 17. 9:05:10
File 'Drivers\atapi.sys': Ver=5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), size=95360 bytes, created 2004. 08. 03. 22:59:44 (Adapter driver for rec)

Registry Keys:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\AllocateCDROMs : 0 (Security Option)

akkor mar nem kell bántani, ha minden jól megy.

nagyszerűűűűűűűűűűűűűűűűűűűűűűűű.mostmár minden ok,nincs hibajelzés.

valami hiba tortent a telepitesnel
Avast javításra.
Vezerlo pult,[control pane] "Programok telepítése és törlése, válassza az" avast! Anti-Virus, "Módosítás / eltávolítás gombra" , javítás, [REPAIR]kattintson a Tovább [next]gombra, és kövesse az utasitasokkat.[restart]

oks.USB,stb... kitisztitva.Kössz még egyszer minden segitséget....THX....

ps.:még 1 legutolsó dolog.Avast-hoz nem nagyon értek,és az óra mellett egy kis ságra háromszög van fekete felkiáltójellel az avast logo mellett .nem vok biztos benne,de sztem azért van mert a Mail Shield nem megy.Próbáltam elinditani,de nem sikerült.Vmi tipp?

Nem, csak akkor fertőzöd meg a DVD-ha fertőzőt voltak, a filmek, zenek,STB.és te így kiírtad.
USB-igen ez a leggyakrabb oka a fertőzésnek, mivel Az adat hordozok, összevissza bekapcsolódnak minden idegen számítógépbe, főleg iskolaiba, és haza hurcolod a fertőzést.Erre a fertőzésre ezt kell használni, de prevenciónak is jo:
http://www.virus-stell.com/2010/04/auto ... itasa.html

oks.ezzel meg is volnánk.
előbb visszaolvastam kicsit ebben a fórumban,és volt ott szó USB-kről meg stb.Azokat is ki kell tisztitani valahogy??
Ez a virus terjed dvd-kre is,amiket én égettem nemrégen???

1: A combofix ikonjat torold.
2:Meghagyod az CCLEANERT es az TFC-Cleanert, es itt ott lefuttatni, a tobbit torolni.
3:Tuzfall-az xp-tuzfala-nem er semmit se, mert nemvizsgallya a kifele meno komunikaciot, tehat ha bejut a troja, Rootkit, vagy valami mas fertozes a gepre, akkor vidaman komunikalhat a neten.Nem, nem akad ossza a windows tuzfalaval, ez valodi tuzfall, tehat vedi a gepet a bejovo, es a kimeno komunikaciotol, tehat ha te futtatsz valami uj programot, akkor kiugrik a fegyelmeztetes ,es megengeded klik ALLOW, mert tudod hogy te futtatad, es erre az aplikaciora mar nem fog figyelmeztetni, ugyanaz van ha virus akkar bejutni vagy kimeni a netre, kiugrik az ablak, figyelmesen elolvasod mi van oda irva es letoltod, disabled, es ez mar nem fogg be, se kimeni a netre.
4:Igen, megvolt fertozve az ATAPI>sys, es kicsereltuk ujra, tisztara, mind minden troja, kemkedet, es lopta az adatokat.
5:a mai virusok-elen igen nehez vedekezni, ugy vannak megirva hogy igy, is ugy is bejutnak a gepbe, a tuzfal, es a az Anti-virus csokkenti az fertozes eselyet.
6:Tuzfal es Anti-virus nelkull csak a kisgyerekek neteznek, aki masat ir az nem ert a mai virusokhoz.Ha mar bejut a gepbe a Fertozes, akkor, nemkell hasznalni az antivirust a kiolesehez, mivel majd minden esetben megvanak fertozve a rendszer fajlok is, es mikkor te eztet karantenba teszed a rendszer ossze omlik.Igen sokkat olvasom a magyar bloggogban, forumokon, ilyen buta tanacsokat, futtasd, kasperskyt,Avastot, ezt azt amaszt, ezek nem jo tanacsok, ezert amit mar leirtam.
7:AZ SPDT-fuutasd es telepitsd vissza a DAEMONT ha kell, ha nem akkor torold le.
8:Ha tobbet akarsz tudni ,olvasd rendszeresen a bloggomat, most ezt:
http://www.virus-stell.com/2010/04/mier ... gepem.html
Talan enyit.

Na akk összegzés:
1.rendszervisszaálitás - megvan
2.átneveztem uninstallra,de nem tünt el az ikonja.akk most még benne van a gépben vagy nincs?Vagy csak töröljem ki az ikont?
3.TFC cleaner - letöltve,futtatva
4.CCleanre - letöltve,futtatva(csak annyit csinlátam,h katt. Elemzés,utána katt. A Tisztitás Futtatása-ra. Ez minden?)
5.AVAST telepitve
6. PCTOOLS telepitve.(ezt a programot semennyire nem ismerem.vmi fontos tudnivaló vele kapcsolatban?Esetleg nem fog bezavarni a sima Windows tűzfalnak?Vagy azt kapcsoljam ki?)


Am igy utólag belegondolva végülis fogalmam sincs h mit csináltunk egész este.Meg azt se tudom h mi volt ez,amit ki kellett irtani.Vmi virus?Ha virus volt,akk hogy veszélyeztette a PCt?Mit ronthat el benne?És most hogy ki lett irtva,hogy lehet elkerülni,h többet ne fertőzze meg a gépem?Van vmi jó módszer védekezésre?

Jah és még vmi: jópár program maradt emg a gépben (avenger, SystemLook, tdsskiller, SPTDinst-v174-x86 , TFC, CCleaner) ezekkel mit csináljak? Van értelme megtartani őket?

Nincsen mit
üdv
En is ma mar végzek,

asszem sikerült mindent megcsinálni....
nagyon szépen köszi a sok munkát és h ennyit segitettél

még van 1-2 kérdésem,de ma már nincs erőm leirni,xal majd holnap.
mégegyszer KÖSZI!

ingyenes, ott van a link allol, vagy klikelj ide
http://www.piriform.com/ccleaner/download/standard

ez a CCleaner fizetős???vagy le lehet ingyen is tölteni?

ok, keszek vagyunk, csak rendet csinalunk
1:Kapcsold ki a rendszervisszaalitasat, restart es kapcsold be ujra:
http://www.virus-stell.com/2010/04/win-rendszer.html

2:Nevezd at a combofix ikonjat uninstall
klik ok
a combofix letelepitodik a geprol
3:Futtasda TFC-cleanert
http://www.virus-stell.com/2010/05/temp ... itasa.html
4:CCleanert
http://virus-stell.blogspot.com/2010/04/ccleaner.html
5:Telepitsd fell a FREE AVIRAT, vagy az AVASTOT
http://www.virus-stell.com/2010/04/anti ... delem.html
6: Es a PCTOOLS-tuzfalat. a Spyware doctor nelkull.
http://translate.google.com/translate?h ... %23p868836

ComboFix 10-10-31.04 - Gyebnár 0. 11. 01. 20:32:26.3.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1534.1166 [GMT 1:00]
Running from: c:\documents and settings\Gyebnár\Desktop\stell.com.exe
.

((((((((((((((((((((((((( Files Created from 2010-10-01 to 2010-11-01 )))))))))))))))))))))))))))))))
.

2010-11-01 14:47 . 2010-11-01 14:48 -------- d-----w- c:\program files\trend micro
2010-11-01 14:47 . 2010-11-01 14:48 -------- d-----w- C:\rsit
2010-10-29 11:38 . 2010-10-29 11:38 -------- d-----w- c:\documents and settings\Gyebnár\Local Settings\Application Data\WMTools Downloaded Files
2010-10-29 11:36 . 2010-10-29 11:36 -------- d-----w- c:\program files\Pure Motion
2010-10-21 15:31 . 2010-10-26 16:24 -------- d-----w- c:\program files\PokerStars
2010-10-09 09:17 . 2010-10-09 09:17 -------- d-----w- c:\documents and settings\All Users\Application Data\nView_Profiles

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-09 15:25 . 2004-08-03 21:56 218624 ----a-w- c:\windows\system32\uxtheme.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-11-01_18.10.31 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-11-01 19:23 . 2010-11-01 19:23 16384 c:\windows\temp\Perflib_Perfdata_1cc.dat
+ 2004-08-03 19:59 . 2004-08-03 21:59 95360 c:\windows\system32\drivers\atapi.sys
- 2004-08-03 19:59 . 2004-08-03 19:59 95360 c:\windows\system32\drivers\atapi.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{0b876028-b388-4f6d-922f-f52faec8535f}"= "c:\program files\WeFiBar\tbWeF1.dll" [2010-03-22 2349080]

[HKEY_CLASSES_ROOT\clsid\{0b876028-b388-4f6d-922f-f52faec8535f}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0b876028-b388-4f6d-922f-f52faec8535f}]
2010-03-22 14:33 2349080 ----a-w- c:\program files\WeFiBar\tbWeF1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{0b876028-b388-4f6d-922f-f52faec8535f}"= "c:\program files\WeFiBar\tbWeF1.dll" [2010-03-22 2349080]

[HKEY_CLASSES_ROOT\clsid\{0b876028-b388-4f6d-922f-f52faec8535f}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{0B876028-B388-4F6D-922F-F52FAEC8535F}"= "c:\program files\WeFiBar\tbWeF1.dll" [2010-03-22 2349080]

[HKEY_CLASSES_ROOT\clsid\{0b876028-b388-4f6d-922f-f52faec8535f}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-09-02 13351304]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-12-22 39408]
"Google Update"="c:\documents and settings\Gyebnár\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-12-22 133104]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-09-25 328056]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883840]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-11-11 1451520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2009-12-10 18789920]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-12-09 7311360]
"nwiz"="nwiz.exe" [2005-12-09 1519616]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-12-09 86016]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"LXSUPMON"="c:\windows\system32\LXSUPMON.EXE" [2001-10-09 818176]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
InterVideo WinCinema Manager.lnk - c:\program files\InterVideo\Common\Bin\WinCinemaMgr.exe [2010-1-16 114688]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"d:\\Program Files\\Counter-Strike\\hl.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\EA Games\\Battlefield 2\\BF2.exe"=
"c:\\Program Files\\Free Music Zilla\\FMZilla.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8394:TCP"= 8394:TCP:League of Legends Launcher
"8394:UDP"= 8394:UDP:League of Legends Launcher
"6983:TCP"= 6983:TCP:League of Legends Launcher
"6983:UDP"= 6983:UDP:League of Legends Launcher

R3 CamSuiteVAC;CamSuite Virtual Audio;c:\windows\system32\drivers\CamSuiteVAC.sys [2010. 09. 29. 14:59 37560]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010. 01. 25. 15:59 135664]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2009. 12. 22. 19:18 1691480]
S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\ASPI32.SYS [2010. 01. 30. 18:29 16512]
S3 pccsmcfd;PCCS Mode Change Filter Driver;c:\windows\system32\drivers\pccsmcfd.sys [2010. 02. 07. 22:04 18816]
S4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys --> c:\windows\system32\Drivers\sptd.sys [?]
.
Contents of the 'Scheduled Tasks' folder

2010-11-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-25 14:59]

2010-11-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-25 14:59]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://search.freemusiczilla.com
IE: E&xportálás Microsoft Excel formátumba - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
FF - ProfilePath - c:\documents and settings\Gyebnár\Application Data\Mozilla\Firefox\Profiles\g2amj3ta.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.as ... ource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - DAEMON Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.hu/

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true); // Simplified
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-01 20:36
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1659004503-2000478354-682003330-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-1659004503-2000478354-682003330-1003\Software\SecuROM\License information*]
"datasecu"=hex:f2,28,ba,1b,37,93,96,e8,5d,2e,17,e1,8f,24,98,d8,be,66,39,b7,02,
77,7d,09,ec,6d,91,f6,99,04,2f,72,e5,bc,78,21,95,ca,bc,71,20,5a,08,b3,f5,aa,\
"rkeysecu"=hex:d4,86,b3,92,34,3d,43,02,bf,4a,51,76,c8,43,6c,52
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2152)
c:\windows\system32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2010-11-01 20:37:45
ComboFix-quarantined-files.txt 2010-11-01 19:37
ComboFix2.txt 2010-11-01 19:25
ComboFix3.txt 2010-11-01 18:12

Pre-Run: 5 256 511 488 bytes free
Post-Run: 5 245 988 864 bytes free

- - End Of File - - 21CC9BCB02B9ADE6B3CD5959EE32D035

ok, most csak simán meg-egyszer futtasd le a combofixet.

ComboFix 10-10-31.04 - Gyebnár 0. 11. 01. 20:17:58.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1534.1185 [GMT 1:00]
Running from: c:\documents and settings\Gyebnár\Desktop\stell.com.exe
Command switches used :: c:\documents and settings\Gyebnár\Desktop\CFScript.txt
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\atapi.sys . . . is infected!!

.
((((((((((((((((((((((((( Files Created from 2010-10-01 to 2010-11-01 )))))))))))))))))))))))))))))))
.

2010-11-01 14:47 . 2010-11-01 14:48 -------- d-----w- c:\program files\trend micro
2010-11-01 14:47 . 2010-11-01 14:48 -------- d-----w- C:\rsit
2010-10-29 11:38 . 2010-10-29 11:38 -------- d-----w- c:\documents and settings\Gyebnár\Local Settings\Application Data\WMTools Downloaded Files
2010-10-29 11:36 . 2010-10-29 11:36 -------- d-----w- c:\program files\Pure Motion
2010-10-21 15:31 . 2010-10-26 16:24 -------- d-----w- c:\program files\PokerStars
2010-10-09 09:17 . 2010-10-09 09:17 -------- d-----w- c:\documents and settings\All Users\Application Data\nView_Profiles

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-09 15:25 . 2004-08-03 21:56 218624 ----a-w- c:\windows\system32\uxtheme.dll
.

(((((((((((((((((((((((((((((((((((((((((( SR_Search ))))))))))))))))))))))))))))))))))))))))))))))))))))))))

c:\avenger\atapi.sys [x]
[-] 93657E7157F7F060342AC9602D56CDD3 95360 \RP142\A0046757.sys
.
((((((((((((((((((((((((((((( SnapShot@2010-11-01_18.10.31 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-11-01 19:23 . 2010-11-01 19:23 16384 c:\windows\temp\Perflib_Perfdata_1cc.dat
+ 2004-08-03 19:59 . 2004-08-03 21:59 95360 c:\windows\system32\drivers\atapi.sys
- 2004-08-03 19:59 . 2004-08-03 19:59 95360 c:\windows\system32\drivers\atapi.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{0b876028-b388-4f6d-922f-f52faec8535f}"= "c:\program files\WeFiBar\tbWeF1.dll" [2010-03-22 2349080]

[HKEY_CLASSES_ROOT\clsid\{0b876028-b388-4f6d-922f-f52faec8535f}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0b876028-b388-4f6d-922f-f52faec8535f}]
2010-03-22 14:33 2349080 ----a-w- c:\program files\WeFiBar\tbWeF1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{0b876028-b388-4f6d-922f-f52faec8535f}"= "c:\program files\WeFiBar\tbWeF1.dll" [2010-03-22 2349080]

[HKEY_CLASSES_ROOT\clsid\{0b876028-b388-4f6d-922f-f52faec8535f}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{0B876028-B388-4F6D-922F-F52FAEC8535F}"= "c:\program files\WeFiBar\tbWeF1.dll" [2010-03-22 2349080]

[HKEY_CLASSES_ROOT\clsid\{0b876028-b388-4f6d-922f-f52faec8535f}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-09-02 13351304]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-12-22 39408]
"Google Update"="c:\documents and settings\Gyebnár\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-12-22 133104]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-09-25 328056]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883840]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-11-11 1451520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2009-12-10 18789920]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-12-09 7311360]
"nwiz"="nwiz.exe" [2005-12-09 1519616]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-12-09 86016]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"LXSUPMON"="c:\windows\system32\LXSUPMON.EXE" [2001-10-09 818176]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
InterVideo WinCinema Manager.lnk - c:\program files\InterVideo\Common\Bin\WinCinemaMgr.exe [2010-1-16 114688]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"d:\\Program Files\\Counter-Strike\\hl.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\EA Games\\Battlefield 2\\BF2.exe"=
"c:\\Program Files\\Free Music Zilla\\FMZilla.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8394:TCP"= 8394:TCP:League of Legends Launcher
"8394:UDP"= 8394:UDP:League of Legends Launcher
"6983:TCP"= 6983:TCP:League of Legends Launcher
"6983:UDP"= 6983:UDP:League of Legends Launcher

R3 CamSuiteVAC;CamSuite Virtual Audio;c:\windows\system32\drivers\CamSuiteVAC.sys [2010. 09. 29. 14:59 37560]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010. 01. 25. 15:59 135664]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2009. 12. 22. 19:18 1691480]
S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\ASPI32.SYS [2010. 01. 30. 18:29 16512]
S3 pccsmcfd;PCCS Mode Change Filter Driver;c:\windows\system32\drivers\pccsmcfd.sys [2010. 02. 07. 22:04 18816]
S4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys --> c:\windows\system32\Drivers\sptd.sys [?]
.
Contents of the 'Scheduled Tasks' folder

2010-11-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-25 14:59]

2010-11-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-25 14:59]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://search.freemusiczilla.com
IE: E&xportálás Microsoft Excel formátumba - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
FF - ProfilePath - c:\documents and settings\Gyebnár\Application Data\Mozilla\Firefox\Profiles\g2amj3ta.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.as ... ource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - DAEMON Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.hu/

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true); // Simplified
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-01 20:23
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1659004503-2000478354-682003330-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-1659004503-2000478354-682003330-1003\Software\SecuROM\License information*]
"datasecu"=hex:f2,28,ba,1b,37,93,96,e8,5d,2e,17,e1,8f,24,98,d8,be,66,39,b7,02,
77,7d,09,ec,6d,91,f6,99,04,2f,72,e5,bc,78,21,95,ca,bc,71,20,5a,08,b3,f5,aa,\
"rkeysecu"=hex:d4,86,b3,92,34,3d,43,02,bf,4a,51,76,c8,43,6c,52
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2344)
c:\windows\system32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_hun.nlr
c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\windows\RTHDCPL.EXE
c:\windows\system32\RUNDLL32.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\windows\system32\wscntfy.exe
c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe
.
**************************************************************************
.
Completion time: 2010-11-01 20:25:56 - machine was rebooted
ComboFix-quarantined-files.txt 2010-11-01 19:25
ComboFix2.txt 2010-11-01 18:12

Pre-Run: 5 261 406 208 bytes free
Post-Run: 5 250 166 784 bytes free

- - End Of File - - 54820573F2374E7EFE9E59B0ACD54897

csinald itt, es meglassuk.

am mostmár normál módban vagyok(nem csökkentett mód). maradhatok ebben vagy menjek vissza csökkentettbe???

Kinyitunk - Notepadot (Jegyzetfüzetet)igy: Start>futtatás>beírod: notepad
és bemásolod- a Kód: címszó alatt található zöld textet(Kód: szó nélkül), aztán a notepadba beillesztett textet elmentjük scriptnek az asztalra , úgy:- Fájl>Mentés Másként>Fájlnév>CFScript.txt>Fájl típusa>Minden fájl>Mentés.(Ásztálra),.Kész, az astalon lévő CFScript txt húzzunk rá a ComboFix ikonnyara. Es mostan megcsinalod eztett:

A combofix maga elindul es lehet hogy restartol es befejezi a scent.Amit majd ad ted ide.

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File move operation "C:\atapi.sys|C:\WINDOWS\system32\drivers\atapi.sys" completed successfully.

Completed script processing.

*******************

Finished! Terminate.

tolds lle az AVANGERT az asztalra:
http://swandog46.geekstogo.com/avenger2/download.php
Futtatod-az ablakjaba masold be a zold textet:


klik execute>>yes-yes- a gep restartol es be is mehet kekhalalba, a restart utan add logot tedd ide.

SystemLook 04.09.10 by jpshortstuff
Log created at 19:58 on 01/11/2010 by Gyebnár
Administrator - Elevation successful

No Context: Kód:

========== filefind ==========

Searching for "*atapi.sys*"
C:\atapi.sys --a---- 95360 bytes [18:35 01/11/2010] [21:59 03/08/2004] CDFE4411A69C224BD1D11B2DA92DAC51
C:\WINDOWS\system32\drivers\atapi.sys --a---- 95360 bytes [19:59 03/08/2004] [19:59 03/08/2004] 93657E7157F7F060342AC9602D56CDD3

Searching for "*.sy_*"
C:\cmdcons\1394BUS.SY_ --a---- 29992 bytes [22:10 03/08/2004] [22:10 03/08/2004] 59BBC1E3CC66D499D26611BD763250D3
C:\cmdcons\1394VDBG.SY_ --a---- 6259 bytes [13:06 17/08/2001] [13:06 17/08/2001] EA4A9CB836284BAA3C245DC8618E514A
C:\cmdcons\ABP480N5.SY_ --a---- 13699 bytes [12:52 17/08/2001] [12:52 17/08/2001] DBCA0A1486D2F54738FD4CB4CE8587FC
C:\cmdcons\ACPI.SY_ --a---- 91947 bytes [22:07 03/08/2004] [22:07 03/08/2004] 7B34B41962ECE67A890DFF92954FB639
C:\cmdcons\ACPIEC.SY_ --a---- 6449 bytes [12:57 17/08/2001] [12:57 17/08/2001] 91B11D2080A9F4DBAB5715FB445A8218
C:\cmdcons\ADPU160M.SY_ --a---- 50331 bytes [13:07 17/08/2001] [13:07 17/08/2001] BE5645A90AD3711FE9C414FDFFC0FAAF
C:\cmdcons\AHA154X.SY_ --a---- 8038 bytes [12:52 17/08/2001] [12:52 17/08/2001] EC20A540BE1BC07AD165ECD8B99B1A64
C:\cmdcons\AIC78U2.SY_ --a---- 29912 bytes [13:07 17/08/2001] [13:07 17/08/2001] EE3342169D5A70E94998F47D489655FD
C:\cmdcons\AIC78XX.SY_ --a---- 30488 bytes [13:07 17/08/2001] [13:07 17/08/2001] E93DAA073543EE91144514726CBE13D5
C:\cmdcons\ALIIDE.SY_ --a---- 2839 bytes [12:51 17/08/2001] [12:51 17/08/2001] 64A33BA58E239DCE9F246FDFA64E158C
C:\cmdcons\AMSINT.SY_ --a---- 7277 bytes [12:52 17/08/2001] [12:52 17/08/2001] C40C0810BEA0BF3C80CF7413D65775CA
C:\cmdcons\ASC.SY_ --a---- 15258 bytes [12:52 17/08/2001] [12:52 17/08/2001] 76E604F206EEF107EA5AE6479F99FDA2
C:\cmdcons\ASC3350P.SY_ --a---- 13211 bytes [12:52 17/08/2001] [12:52 17/08/2001] 49A5F2AB86224B62B264E3880FA43FEC
C:\cmdcons\ASC3550.SY_ --a---- 8936 bytes [12:51 17/08/2001] [12:51 17/08/2001] 48AC322D9D1562C23703B4B6A7B492BA
C:\cmdcons\ATAPI.SY_ --a---- 49558 bytes [21:59 03/08/2004] [21:59 03/08/2004] 28541D14647BB58502D09D1CEAEE6684
C:\cmdcons\CBIDF2K.SY_ --a---- 7630 bytes [12:52 17/08/2001] [12:52 17/08/2001] F83A4725FA2DA34ADA266F2A6230C115
C:\cmdcons\CD20XRNT.SY_ --a---- 3975 bytes [12:52 17/08/2001] [12:52 17/08/2001] 87EBB46D7F449BAFC4B879E75A02F0D8
C:\cmdcons\CDFS.SY_ --a---- 33703 bytes [22:14 03/08/2004] [22:14 03/08/2004] D8F648CB22A6EBA0A44A1D35AB413757
C:\cmdcons\CDROM.SY_ --a---- 24812 bytes [21:59 03/08/2004] [21:59 03/08/2004] AC59EC774E0092BE96B6F012F391F002
C:\cmdcons\CLASSPNP.SY_ --a---- 27951 bytes [22:14 03/08/2004] [22:14 03/08/2004] 9181EE8368E37A566B0D41404B99C85F
C:\cmdcons\CMDIDE.SY_ --a---- 3671 bytes [12:51 17/08/2001] [12:51 17/08/2001] 7B334BE18DD14612B2B3A0B9D9396DF1
C:\cmdcons\CPQARRAY.SY_ --a---- 8537 bytes [12:52 17/08/2001] [12:52 17/08/2001] 3BF024FCD3202D6CC58BD9A32E1B880B
C:\cmdcons\DAC2W2K.SY_ --a---- 29302 bytes [12:52 17/08/2001] [12:52 17/08/2001] D577AC34D3FD17B5655F0D0B4044777E
C:\cmdcons\DAC960NT.SY_ --a---- 8001 bytes [12:52 17/08/2001] [12:52 17/08/2001] 3415C40F12D5CB9E754D741C6A8AA4C1
C:\cmdcons\DISK.SY_ --a---- 19989 bytes [21:59 03/08/2004] [21:59 03/08/2004] 749693D182E0697697C5943DA81DA0E0
C:\cmdcons\DMBOOT.SY_ --a---- 125135 bytes [22:07 03/08/2004] [22:07 03/08/2004] AC3649CE9D8B4F14B712AC7CD74ACD03
C:\cmdcons\DMIO.SY_ --a---- 70281 bytes [22:07 03/08/2004] [22:07 03/08/2004] 373F9B18052D70D6E813026C6571C39D
C:\cmdcons\DMLOAD.SY_ --a---- 2859 bytes [12:58 17/08/2001] [12:58 17/08/2001] 5ACB957591C3666670511D2607B665C3
C:\cmdcons\DPTI2O.SY_ --a---- 10997 bytes [13:07 17/08/2001] [13:07 17/08/2001] B0DC1D3EC2F597990B36B4D1D715848A
C:\cmdcons\FASTFAT.SY_ --a---- 72696 bytes [22:14 03/08/2004] [22:14 03/08/2004] C47638E3FAB63D26ED56D77BFECF676C
C:\cmdcons\FDC.SY_ --a---- 15204 bytes [21:59 03/08/2004] [21:59 03/08/2004] A4014A18C5457BAB6553D63B28702E5D
C:\cmdcons\FLPYDISK.SY_ --a---- 11325 bytes [21:59 03/08/2004] [21:59 03/08/2004] 857B4C3A8715397777A5DDF34C52EE3B
C:\cmdcons\FTDISK.SY_ --a---- 60791 bytes [12:52 17/08/2001] [12:52 17/08/2001] 345CA06DF0C008EA223F924391B4C205
C:\cmdcons\HIDCLASS.SY_ --a---- 20061 bytes [22:08 03/08/2004] [22:08 03/08/2004] 28208D22C6D5BFA65462E524F1F8AEDE
C:\cmdcons\HIDPARSE.SY_ --a---- 12727 bytes [22:08 03/08/2004] [22:08 03/08/2004] B139150FDB1CED4DBC69457E1B3CC674
C:\cmdcons\HIDUSB.SY_ --a---- 5265 bytes [13:02 17/08/2001] [13:02 17/08/2001] AC6C3BC09F942E59A2B3A32BFA6AFCE1
C:\cmdcons\HPN.SY_ --a---- 15648 bytes [13:07 17/08/2001] [13:07 17/08/2001] 70F8B39614D7F50E37D71F91ADC34740
C:\cmdcons\I2OMGMT.SY_ --a---- 4064 bytes [22:00 03/08/2004] [22:00 03/08/2004] FF7A90723715E3E6A928629961C6026C
C:\cmdcons\I2OMP.SY_ --a---- 10324 bytes [22:00 03/08/2004] [22:00 03/08/2004] 23B4348BE52D0E823BF783346FF9E53E
C:\cmdcons\I8042PRT.SY_ --a---- 26025 bytes [22:14 03/08/2004] [22:14 03/08/2004] 819D427AB9DBE6AC2960A585087CB766
C:\cmdcons\INI910U.SY_ --a---- 8560 bytes [12:52 17/08/2001] [12:52 17/08/2001] DBD5CC45D605F1EA9531FB6398E26C88
C:\cmdcons\INTELIDE.SY_ --a---- 2897 bytes [21:59 03/08/2004] [21:59 03/08/2004] E63A68BF0F4E8DE8FE4FB9B7469A6E5E
C:\cmdcons\ISAPNP.SY_ --a---- 20351 bytes [12:58 17/08/2001] [12:58 17/08/2001] BC5F55118ACD193140F8D0255731E07C
C:\cmdcons\KBDCLASS.SY_ --a---- 12223 bytes [21:58 03/08/2004] [21:58 03/08/2004] 9C0B5DF5E22E6F17A8D40CDFCDACACD8
C:\cmdcons\KBDHID.SY_ --a---- 7921 bytes [21:58 03/08/2004] [21:58 03/08/2004] 78EED0258A4173E317E098C024275CD2
C:\cmdcons\LBRTFDC.SY_ --a---- 14614 bytes [21:59 03/08/2004] [21:59 03/08/2004] 15B3D2284BFE35C7B011D669CDD9B0CD
C:\cmdcons\MOUNTMGR.SY_ --a---- 20981 bytes [21:58 03/08/2004] [21:58 03/08/2004] 987B2083AA3CDB84E6739573EEBFF92E
C:\cmdcons\MRAID35X.SY_ --a---- 9785 bytes [12:52 17/08/2001] [12:52 17/08/2001] BA8C3243114C110AD74F5FEB9B788EF3
C:\cmdcons\OHCI1394.SY_ --a---- 38047 bytes [22:10 03/08/2004] [22:10 03/08/2004] C315950B61E904291E8DC87D3989A5B9
C:\cmdcons\OPRGHDLR.SY_ --a---- 1629 bytes [12:57 17/08/2001] [12:57 17/08/2001] 7D9C6774FB1D0872835FF5A4631ACCE9
C:\cmdcons\PARTMGR.SY_ --a---- 10256 bytes [21:24 17/08/2001] [21:24 17/08/2001] 2762C1D2BE1BBCAB383FB233C1A9AB98
C:\cmdcons\PCI.SY_ --a---- 37184 bytes [22:07 03/08/2004] [22:07 03/08/2004] 0B305D746EB9DBD9DA13707187041B55
C:\cmdcons\PCIIDE.SY_ --a---- 1695 bytes [12:51 17/08/2001] [12:51 17/08/2001] DD70748EDC4DB912A6603D87760EE322
C:\cmdcons\PCIIDEX.SY_ --a---- 13610 bytes [21:59 03/08/2004] [21:59 03/08/2004] 074806F8AC6493BFD75FE120D0D895C2
C:\cmdcons\PCMCIA.SY_ --a---- 54681 bytes [22:07 03/08/2004] [22:07 03/08/2004] CD3A3DD15701249C39E995F9908B5573
C:\cmdcons\PERC2.SY_ --a---- 16328 bytes [13:07 17/08/2001] [13:07 17/08/2001] 361D8F2A102794A49D97A107A8B5B91D
C:\cmdcons\PERC2HIB.SY_ --a---- 3363 bytes [13:07 17/08/2001] [13:07 17/08/2001] BEB8C0DA4AC5BDEA7FC2DC1EE77433A6
C:\cmdcons\QL1080.SY_ --a---- 22761 bytes [12:52 17/08/2001] [12:52 17/08/2001] DD5E83F6B4E078C06815DB7FE60B2B65
C:\cmdcons\QL10WNT.SY_ --a---- 18888 bytes [12:52 17/08/2001] [12:52 17/08/2001] C09CD4436D2639F2ABE73D62B3B0D943
C:\cmdcons\QL12160.SY_ --a---- 25938 bytes [12:52 17/08/2001] [12:52 17/08/2001] 460DBA0C3B67EA5679297324B113E5F4
C:\cmdcons\QL1240.SY_ --a---- 22855 bytes [12:52 17/08/2001] [12:52 17/08/2001] 51AAC125FE4CBC678FB043134FF55D3B
C:\cmdcons\QL1280.SY_ --a---- 27359 bytes [12:52 17/08/2001] [12:52 17/08/2001] EDC14804054B29EF2B782E2D08D9596A
C:\cmdcons\RAMDISK.SY_ --a---- 12010 bytes [22:00 03/08/2004] [22:00 03/08/2004] 7AA4384913BCD86B7C3A31C1A5CB5D0C
C:\cmdcons\SBP2PORT.SY_ --a---- 23453 bytes [21:59 03/08/2004] [21:59 03/08/2004] 87EF6CEC43CCAB18FFB5178C3A45ECC9
C:\cmdcons\SCSIPORT.SY_ --a---- 52069 bytes [21:59 03/08/2004] [21:59 03/08/2004] 8C612E4BF114EBDDA944DE6CA4440112
C:\cmdcons\SERENUM.SY_ --a---- 8420 bytes [21:59 03/08/2004] [21:59 03/08/2004] B561A671D27694C570A80CA16B96AF1B
C:\cmdcons\SERIAL.SY_ --a---- 30067 bytes [22:15 03/08/2004] [22:15 03/08/2004] 56A1F7591D17ECD1C5F60DABD2FA6B61
C:\cmdcons\SETUPDD.SY_ --a---- 205502 bytes [22:05 03/08/2004] [22:05 03/08/2004] 19CA5093F6BFB45BB182AEC6A991E7CD
C:\cmdcons\SFLOPPY.SY_ --a---- 6310 bytes [21:59 03/08/2004] [21:59 03/08/2004] 92D5B5B3DDB37C4F399BF6F7A6C11630
C:\cmdcons\SLIP.SY_ --a---- 5597 bytes [22:10 03/08/2004] [22:10 03/08/2004] 771DA19E7945169E7CE8BA6AB495BCFD
C:\cmdcons\SPARROW.SY_ --a---- 11098 bytes [13:07 17/08/2001] [13:07 17/08/2001] 8087114BB6AD4E01013889819BBC0DFA
C:\cmdcons\SPDDLANG.SY_ --a---- 1599 bytes [12:56 17/08/2001] [12:56 17/08/2001] 10ADC2109ED27CA815C11D1B5EFF8D82
C:\cmdcons\STREAMIP.SY_ --a---- 6863 bytes [22:10 03/08/2004] [22:10 03/08/2004] 9F392810971C11EE32AFC5DD021D31D3
C:\cmdcons\SYMC810.SY_ --a---- 8352 bytes [13:07 17/08/2001] [13:07 17/08/2001] 3D5564AE73CC6C465FA2048D3A648E14
C:\cmdcons\SYMC8XX.SY_ --a---- 18304 bytes [13:07 17/08/2001] [13:07 17/08/2001] AADEB5BD1FF93811AAEC7811C086F61D
C:\cmdcons\SYM_HI.SY_ --a---- 16761 bytes [13:07 17/08/2001] [13:07 17/08/2001] C1B077602C416A96A7419E847CCE71C9
C:\cmdcons\SYM_U3.SY_ --a---- 17923 bytes [13:07 17/08/2001] [13:07 17/08/2001] ECB66F856B8F583E2855FC2B14E61F59
C:\cmdcons\TFFSPORT.SY_ --a---- 68787 bytes [22:00 03/08/2004] [22:00 03/08/2004] 9D78218A72C54E862AAF6AC9DC641446
C:\cmdcons\TOSIDE.SY_ --a---- 2629 bytes [12:51 17/08/2001] [12:51 17/08/2001] 1EB647B85FB7ECEEB2B2237C5001F397
C:\cmdcons\ULTRA.SY_ --a---- 15864 bytes [12:52 17/08/2001] [12:52 17/08/2001] 4B446205E32A30FA9D8FD45FD6F6DBC2
C:\cmdcons\USBCCGP.SY_ --a---- 14592 bytes [22:08 03/08/2004] [22:08 03/08/2004] 89CB9F495095267583ED0F216666844C
C:\cmdcons\USBD.SY_ --a---- 2495 bytes [13:03 17/08/2001] [13:03 17/08/2001] 3BC35ED537EFF128D7BA69B030BA6E9F
C:\cmdcons\USBEHCI.SY_ --a---- 15034 bytes [22:08 03/08/2004] [22:08 03/08/2004] 4622A7C6B2789441839796EDDDF180B0
C:\cmdcons\USBHUB.SY_ --a---- 30383 bytes [22:08 03/08/2004] [22:08 03/08/2004] 26A5D9F1573A87217941665719239E4A
C:\cmdcons\USBOHCI.SY_ --a---- 9350 bytes [22:08 03/08/2004] [22:08 03/08/2004] C098AB8F625DB00E818BB7398C505B63
C:\cmdcons\USBPORT.SY_ --a---- 61918 bytes [22:08 03/08/2004] [22:08 03/08/2004] 704F3CE96CDCFAC63D31BB380A221B62
C:\cmdcons\USBSTOR.SY_ --a---- 14618 bytes [22:08 03/08/2004] [22:08 03/08/2004] 4B14DF8D645E218F8BABBD35FAB63829
C:\cmdcons\USBUHCI.SY_ --a---- 11188 bytes [22:08 03/08/2004] [22:08 03/08/2004] 2BDD21615F3F15249AB0C4D740BEB131
C:\cmdcons\VGA.SY_ --a---- 10544 bytes [22:07 03/08/2004] [22:07 03/08/2004] 98BA75A8F550336D67155D6969863269
C:\cmdcons\VIAIDE.SY_ --a---- 2943 bytes [21:59 03/08/2004] [21:59 03/08/2004] 736EC3E9D49B30739119F7B81CF57050
C:\cmdcons\VIDEOPRT.SY_ --a---- 38449 bytes [22:07 03/08/2004] [22:07 03/08/2004] 11606059486F95DF311107AAA7A06E61
C:\cmdcons\WMILIB.SY_ --a---- 2509 bytes [13:07 17/08/2001] [13:07 17/08/2001] BE4D4123322CAE40637C84804C6903F7

-= EOF =-

nem, ennek ip,top, nak mennie kell, biztosan nemtalaja a parancs, csináld a másikat, amit írtam,

kicsomagolás*

már lassan fél órája megy a kcsomagolás,de még semmit sem haladt előre...ez normális,hogy ilyen lassú?

aha ok, klik start-klik-RUN.

jah..ok...bocs de angol a windows,aztán nem mindig találok meg benne mindent elsőre...sry...

klikelj START-klikelly-FUTTATAS es az Ablakba.
extrac32 /L %systemdrive%\ "C:\WINDOWS\Driver Cache\i386\sp2.cab" atapi.sys

de hova másoljam be?

klik start-klik=futtatas-masold be ezt a parancsot,
extrac32 /L %systemdrive%\ "C:\WINDOWS\Driver Cache\i386\sp2.cab" atapi.sys

[enter]

Letoltod ezt a programot az asztalra-futtatod-masold be az ablakjaba a zold textet es klik LOOK, add logot tedd ide.
Download

tdsskiller - ugyaugy kék halál
a combofix szerencsére lefutott...:


ComboFix 10-10-31.04 - Gyebnár 0. 11. 01. 19:07:27.1.1 - x86 NETWORK
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1534.1283 [GMT 1:00]
Running from: c:\documents and settings\Gyebnár\Desktop\stell.com.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((( Files Created from 2010-10-01 to 2010-11-01 )))))))))))))))))))))))))))))))
.

2010-11-01 14:47 . 2010-11-01 14:48 -------- d-----w- c:\program files\trend micro
2010-11-01 14:47 . 2010-11-01 14:48 -------- d-----w- C:\rsit
2010-10-29 11:38 . 2010-10-29 11:38 -------- d-----w- c:\documents and settings\Gyebnár\Local Settings\Application Data\WMTools Downloaded Files
2010-10-29 11:36 . 2010-10-29 11:36 -------- d-----w- c:\program files\Pure Motion
2010-10-21 15:31 . 2010-10-26 16:24 -------- d-----w- c:\program files\PokerStars
2010-10-09 09:17 . 2010-10-09 09:17 -------- d-----w- c:\documents and settings\All Users\Application Data\nView_Profiles

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-09 15:25 . 2004-08-03 21:56 218624 ----a-w- c:\windows\system32\uxtheme.dll
.

------- Sigcheck -------

[-] 2004-08-03 19:59 . 93657E7157F7F060342AC9602D56CDD3 . 95360 . . [------] . . c:\windows\system32\drivers\atapi.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{0b876028-b388-4f6d-922f-f52faec8535f}"= "c:\program files\WeFiBar\tbWeF1.dll" [2010-03-22 2349080]

[HKEY_CLASSES_ROOT\clsid\{0b876028-b388-4f6d-922f-f52faec8535f}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0b876028-b388-4f6d-922f-f52faec8535f}]
2010-03-22 14:33 2349080 ----a-w- c:\program files\WeFiBar\tbWeF1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{0b876028-b388-4f6d-922f-f52faec8535f}"= "c:\program files\WeFiBar\tbWeF1.dll" [2010-03-22 2349080]

[HKEY_CLASSES_ROOT\clsid\{0b876028-b388-4f6d-922f-f52faec8535f}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{0B876028-B388-4F6D-922F-F52FAEC8535F}"= "c:\program files\WeFiBar\tbWeF1.dll" [2010-03-22 2349080]

[HKEY_CLASSES_ROOT\clsid\{0b876028-b388-4f6d-922f-f52faec8535f}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-09-02 13351304]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-12-22 39408]
"Google Update"="c:\documents and settings\Gyebnár\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-12-22 133104]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-09-25 328056]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883840]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-11-11 1451520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2009-12-10 18789920]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-12-09 7311360]
"nwiz"="nwiz.exe" [2005-12-09 1519616]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-12-09 86016]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"LXSUPMON"="c:\windows\system32\LXSUPMON.EXE" [2001-10-09 818176]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
InterVideo WinCinema Manager.lnk - c:\program files\InterVideo\Common\Bin\WinCinemaMgr.exe [2010-1-16 114688]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"d:\\Program Files\\Counter-Strike\\hl.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\EA Games\\Battlefield 2\\BF2.exe"=
"c:\\Program Files\\Free Music Zilla\\FMZilla.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8394:TCP"= 8394:TCP:League of Legends Launcher
"8394:UDP"= 8394:UDP:League of Legends Launcher
"6983:TCP"= 6983:TCP:League of Legends Launcher
"6983:UDP"= 6983:UDP:League of Legends Launcher

S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010. 01. 25. 15:59 135664]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2009. 12. 22. 19:18 1691480]
S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\ASPI32.SYS [2010. 01. 30. 18:29 16512]
S3 CamSuiteVAC;CamSuite Virtual Audio;c:\windows\system32\drivers\CamSuiteVAC.sys [2010. 09. 29. 14:59 37560]
S3 pccsmcfd;PCCS Mode Change Filter Driver;c:\windows\system32\drivers\pccsmcfd.sys [2010. 02. 07. 22:04 18816]
S4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys --> c:\windows\system32\Drivers\sptd.sys [?]
.
Contents of the 'Scheduled Tasks' folder

2010-11-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-25 14:59]

2010-11-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-25 14:59]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://search.freemusiczilla.com
IE: E&xportálás Microsoft Excel formátumba - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
FF - ProfilePath - c:\documents and settings\Gyebnár\Application Data\Mozilla\Firefox\Profiles\g2amj3ta.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.as ... ource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - DAEMON Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.hu/
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true); // Simplified
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKCU-Run-EA Core - c:\program files\Electronic Arts\EADM\Core.exe
HKLM-Run-NWEReboot - (no file)
HKU-Default-Run-Nokia.PCSync - c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe
Notify-avgrsstarter - avgrsstx.dll



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-01 19:10
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1659004503-2000478354-682003330-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-1659004503-2000478354-682003330-1003\Software\SecuROM\License information*]
"datasecu"=hex:f2,28,ba,1b,37,93,96,e8,5d,2e,17,e1,8f,24,98,d8,be,66,39,b7,02,
77,7d,09,ec,6d,91,f6,99,04,2f,72,e5,bc,78,21,95,ca,bc,71,20,5a,08,b3,f5,aa,\
"rkeysecu"=hex:d4,86,b3,92,34,3d,43,02,bf,4a,51,76,c8,43,6c,52
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(124)
c:\windows\system32\msi.dll
.
Completion time: 2010-11-01 19:12:20
ComboFix-quarantined-files.txt 2010-11-01 18:12

Pre-Run: 3 800 805 376 bytes free
Post-Run: 5 238 738 944 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - B9727FCA5EEFECA8D2878A085060D7E0

De van ilyen, ezt mind a Rootkit jelenti,
Innen hasznald az AVG-letelepítési segéd programot.
http://www.virus-stell.com/2010/04/anti ... ramok.html

Aztan probald itt a csokkentet modban eloszor futtatni az TDSSKILLERT, ha nemmene akkor a combofixet.

hát ilyen nincs....még ezt a rohadt avg-t se hagyja simán letelepiteni.ezt dobja ki,amikor uninstallálom:
Error: Action failed for registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: creating registry key....
Error 0x80070005

Telepitsd le a vezerlo pulton az AVG-t, ugyis gyenge Antivirus, majd teszunk oda masat.

megint ugyanazt irja ki az avg-vel kapcsolatban,mint az előbb...

Hard disk
[enter]
Es gyorsan megint nyomod az F-8-ast meg kapod a menut csokkentet mod halozatal, kivalasztod, ha kesve nyomod az F-8 akkor megint csak a windowsba bootol,

ujrainditom.nyomok F8at.ezt teszi ki:
Hard disk
3rd masret...
bootable addin cards

CD ROM
1st master

most ezek közöl melyikre menjek?

igen
http://www.virus-stell.com/2010/04/csok ... win-7.html