Ja, még annyit, hogy te milyen vírusírtót ajánlanál? Most a Symantec elkezdett furán viselkedni, ha jobb gombbal kattintok bármilyen fájlra telepíteni akar vmit, majd kiírja: "You cannot install a licenced build over an unlicenced"
pedig "licenced" verzióm van... viszont 60 nap után úgyis lejár, szóval szívesen veszem a tanácsokat volt AVG-m, azzal nem volt sok baj, a NOD-ot nem szeretem..

ok ez megvolt (bár azt nem értettem pontosan a "Kapcsold ki a rendszer viszaalitasat" hogy működik)

mindenesetre, nagyon nagyon köszönöm a segítséget

oki.szed le a combofixet a geprol>
start>futatas >masold be>combofix /u ok
Kapcsold ki a rendszer viszaalitasat>restart es kapcsold be visza kiprobalni a gepet es ha meg lesz problem akor irni.

igen töröltem..

es min vagy tul.toroted e ezeket?? amit oda tetem??

ezen túl vagyok, csináljak még valamit?:)

oki,AGI:
Most pucold ki a gepet a CCleaneral ugy hogy adig nyomkodod a gombot >hogy a joboldalon tiszta maradjon az ablak:




Na es most EZEKET KITOROLJUK>de ha valami fontos ezek kozul es ismered teszteld le a Virusztotalon,ha kell neked .mert a MWAV eleg paranoikus,OK
Tehat ide teszem es ird ide ha kitorolhesuk e OK>

Hát talált... Ilyen rossz lenne a Symantec Antivirus progi, hogy ebből semmit sem talált?

Object "video activex access Trojan" found in File System! Action Taken: No Action Taken.
Object "kazaa Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "regsort Corrupted Adware/Spyware" found in File System! Action Taken: No Action Taken.
Object "backdoor (ircbot) trojans Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "diskknight Adware" found in File System! Action Taken: No Action Taken.
Object "backdoor (ircbot) trojans Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "spyware.expresskeylog Corrupted Adware/Spyware" found in File System! Action Taken: No Action Taken.
Entry "HKCU\Software\Netscape\Netscape Navigator\User Trusted External Applications" refers to invalid object ""C:\PROGRA~1\WINDOW~2\wmplayer.exe"". Action Taken: No Action Taken.
Entry "HKCU\Software\Netscape\Netscape Navigator\User Trusted External Applications" refers to invalid object "C:\PROGRA~1\WINDOW~2\wmplayer.exe". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".MRK". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{11783F13-C3A9-44A8-929B-21A476F65272}". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{1A07F627-0F8F-43EE-B667-38908DF85911}". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{6A6DC4BA-CF81-468A-B125-D844809C3653}". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{B193BF4A-EF82-4D29-93B8-C5005626CEC8}". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{BF90215F-2D7B-4C84-8A24-A03BC41B95DD}". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{DC78AACC-D3E4-4D92-95E8-42AFD802B8DB}". Action Taken: No Action Taken.
File D:\Nokia\névjegy\Mezot.vcf infected by "BkCln.Unknown" Virus! Action Taken: No Action Taken.
File D:\Nokia\névjegy\To.vcf infected by "BkCln.Unknown" Virus! Action Taken: No Action Taken.
File D:\Nokia\névjegy\Zengogumi.vcf infected by "BkCln.Unknown" Virus! Action Taken: No Action Taken.
File D:\School\2005-2006-2\Külgazd\tozsde.doc infected by "BkCln.Unknown" Virus! Action Taken: No Action Taken.
File D:\School\elolap.doc infected by "BkCln.Unknown" Virus! Action Taken: No Action Taken.
File D:\School\elolap2.doc infected by "BkCln.Unknown" Virus! Action Taken: No Action Taken.
File D:\School\Olasz\Olasz\ebédlo.mp3 infected by "BkCln.Unknown" Virus! Action Taken: No Action Taken.
File D:\School\Olasz\Olasz\ebédlo.wav infected by "BkCln.Unknown" Virus! Action Taken: No Action Taken.
File D:\School\Olasz\Olasz\ebédlo2.mp3 infected by "BkCln.Unknown" Virus! Action Taken: No Action Taken.
File D:\Segédek\Install_Perspector.exe infected by "NULL.Corrupted" Virus! Action Taken: No Action Taken.

csak futasd le ha talal valamit nemkel megvened de ted ide az also ablakbol es e szerint majd masik programal kiirtjuk oket.ok

ez a link sajnos nem működött, letöltöttem máshonnan, de nem tudom a végén tudom-e majd ezzel javítani, mert kiírta a progi, hogy vegyem meg a teljes verziót..
mindegy, még messze a vége

oki,Agi_006
Muszaj lefutatnod az MWAV programot,ez a program ojan 4-5>oraig megy.Majd az ALSO ABLAKBOL AMIT TALAL TED IDE:

A hosts-ban csupán ennyi volt:

127.0.0.1 localhost

http://www.virustotal.com/hu/analisis/1 ... 160d5399ae

http://www.virustotal.com/hu/analisis/4 ... 5f6753eeeb

ez a két eredmény, a harmadik elérési út megadása után ezt az infót kaptam...
0 bytes size received

igen ez a log.

Tehat a Combofix se nem talalt semit.
Most elmegy a Virustotalra:
VIRUSTOTALu
Leteszteled ezeket a Fajlkat>megtalalod>kuldod megvarod az eredmenyt es ide teszed a Linket,kuldod a kovetkezot.....

C:\WINDOWS\system32\drivers\LENOVO_1952_VL5.MRK
C:\WINDOWS\system32\pxwma.dll
C:\WINDOWS\system32\drivers\IBM_1952_VL5_TP.MRK

Utana >start>futatas>bemasolod eztet:
%windir%\system32\drivers\etc>kinyitod a HOST>mapat a Jedzettombel>NOTEPADAL>es a tartalmat ide teszed.
Es aztan majd meglasuk,

Ez lenne a log

ComboFix 08-08-26.03 - Ági 2008-08-27 16:11:00.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.529 [GMT 2:00]
Running from: C:\Documents and Settings\Ági\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-07-27 to 2008-08-27 )))))))))))))))))))))))))))))))
.

2008-08-27 15:04 . 2008-08-27 15:04 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-08-27 14:38 . 2008-08-27 14:38 <DIR> d-------- C:\Program Files\Yahoo!
2008-08-27 14:38 . 2008-08-27 14:38 <DIR> d-------- C:\Program Files\CCleaner
2008-08-27 14:25 . 2008-08-27 14:25 577,024 --a------ C:\WINDOWS\system32\dllcache\user32.dll
2008-08-27 14:24 . 2008-08-27 14:24 <DIR> d-------- C:\WINDOWS\ERUNT
2008-08-27 14:11 . 2008-08-27 14:32 <DIR> d-------- C:\SDFix
2008-08-27 14:09 . 2008-08-27 14:09 0 --a------ C:\WINDOWS\VPC32.INI
2008-08-27 11:01 . 2008-07-18 22:07 270,880 --a------ C:\WINDOWS\system32\mucltui.dll
2008-08-27 11:01 . 2008-07-18 22:07 210,976 --a------ C:\WINDOWS\system32\muweb.dll
2008-08-27 11:01 . 2008-07-18 22:07 29,728 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-08-27 00:48 . 2008-08-27 00:48 <DIR> d-------- C:\Program Files\iTunes
2008-08-27 00:48 . 2008-08-27 00:48 <DIR> d-------- C:\Program Files\iPod
2008-08-27 00:47 . 2008-08-27 00:47 <DIR> d-------- C:\Program Files\QuickTime
2008-08-27 00:47 . 2008-08-27 00:47 <DIR> d-------- C:\Program Files\Bonjour
2008-08-27 00:25 . 2008-08-27 00:25 <DIR> d-------- C:\Program Files\Safari
2008-08-27 00:02 . 2008-08-27 00:02 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-08-27 00:02 . 2008-08-27 00:03 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-08-27 00:02 . 2008-08-27 00:03 1,409 --a------ C:\WINDOWS\QTFont.for
2008-08-27 00:01 . 2008-08-27 00:01 <DIR> d-------- C:\Program Files\Common Files\Apple
2008-08-27 00:01 . 2008-08-27 10:59 <DIR> d-------- C:\Program Files\Apple Software Update
2008-08-27 00:01 . 2008-08-27 00:01 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-08-26 13:25 . 2008-08-26 13:25 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat
2008-08-26 13:24 . 2008-08-26 13:24 <DIR> d-------- C:\Program Files\Skype
2008-08-26 13:24 . 2008-08-26 13:24 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-08-26 13:24 . 2008-08-26 13:24 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Skype
2008-08-26 11:03 . 2008-08-26 11:12 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-08-26 11:02 . 2008-08-26 11:18 <DIR> d-------- C:\Program Files\Windows Live
2008-08-26 11:02 . 2008-08-26 11:02 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-08-25 19:24 . 2008-08-25 19:24 <DIR> d-------- C:\Program Files\OpenOffice.org 2.2
2008-08-25 18:15 . 2008-08-25 18:15 <DIR> d-------- C:\Program Files\Lavasoft
2008-08-25 18:15 . 2008-08-25 18:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-25 17:09 . 2008-08-25 17:12 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-08-25 17:09 . 2008-08-27 16:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-25 12:09 . 2008-08-25 12:09 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-08-25 11:11 . 2008-08-25 11:11 227 --a------ C:\WINDOWS\HP_CounterReport_Update_HPSU.ini
2008-08-25 11:11 . 2008-08-25 11:11 214 --a------ C:\WINDOWS\HP_48BitScanUpdatePatch.ini
2008-08-25 11:04 . 2008-08-25 11:04 221 --a------ C:\WINDOWS\HP_RedboxHprblog_HPSU.ini
2008-08-25 10:25 . 2008-06-23 18:57 6,066,176 --------- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-08-25 10:25 . 2007-04-17 11:32 2,455,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-08-25 10:25 . 2007-03-08 07:10 991,232 --------- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-08-25 10:25 . 2008-06-23 18:57 459,264 --------- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-08-25 10:25 . 2008-06-23 18:57 383,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-08-25 10:25 . 2008-06-23 18:57 267,776 --------- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-08-25 10:25 . 2008-06-23 18:57 63,488 --------- C:\WINDOWS\system32\dllcache\icardie.dll
2008-08-25 10:25 . 2008-06-23 18:57 52,224 --------- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-08-25 10:25 . 2008-06-23 11:20 13,824 --------- C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-08-25 10:18 . 2008-06-13 15:10 272,128 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-08-25 10:18 . 2008-06-13 15:10 272,128 --------- C:\WINDOWS\system32\dllcache\bthport.sys
2008-08-25 09:50 . 2008-05-01 16:30 331,776 --------- C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-25 09:50 . 2008-05-08 14:28 202,752 --------- C:\WINDOWS\system32\dllcache\rmcast.sys
2008-08-25 09:44 . 2008-08-26 00:31 <DIR> d-------- C:\Program Files\MBMAKA+
2008-08-23 04:19 . 2008-08-23 04:19 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PC Suite
2008-08-23 04:18 . 2008-08-23 04:18 <DIR> d-------- C:\Program Files\PC Connectivity Solution
2008-08-23 04:18 . 2008-08-23 04:18 <DIR> d-------- C:\Program Files\Nokia
2008-08-23 04:18 . 2008-08-23 04:18 <DIR> d-------- C:\Program Files\DIFX
2008-08-23 04:18 . 2008-08-23 04:18 <DIR> d-------- C:\Program Files\Common Files\PCSuite
2008-08-23 04:18 . 2008-08-23 04:18 <DIR> d-------- C:\Program Files\Common Files\Nokia
2008-08-23 04:18 . 2007-02-22 20:15 137,216 --a------ C:\WINDOWS\system32\drivers\nmwcd.sys
2008-08-23 04:18 . 2007-02-22 20:15 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll
2008-08-23 04:18 . 2007-02-22 20:15 65,536 --a------ C:\WINDOWS\system32\nmwcdcocls.dll
2008-08-23 04:18 . 2007-02-22 20:15 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys
2008-08-23 04:18 . 2007-02-22 20:15 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcj.sys
2008-08-23 04:18 . 2007-02-22 20:15 8,320 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys
2008-08-23 04:17 . 2008-08-23 04:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Installations
2008-08-23 04:08 . 2008-08-23 04:08 <DIR> d-------- C:\WINDOWS\system32\Client Security Solution
2008-08-23 04:08 . 2008-08-23 04:08 3,216 --a------ C:\WINDOWS\system32\encobject.dat
2008-08-23 04:03 . 2008-08-23 03:21 <DIR> d-------- C:\WINDOWS\system32\config\systemprofile\Bluetooth Software
2008-08-23 04:03 . 2008-08-23 04:03 <DIR> d-------- C:\Program Files\Windows Live Toolbar
2008-08-23 04:03 . <DIR> C:\Documents and Settings\Agi
2008-08-23 04:03 . 2004-08-04 14:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-08-23 04:03 . 2008-08-23 04:03 50 --a------ C:\WINDOWS\system32\drivers\LENOVO_1952_VL5.MRK
2008-08-23 04:03 . 2008-08-23 04:03 10 --a------ C:\WINDOWS\system32\firstboot.ibm
2008-08-23 04:02 . 2008-08-23 03:21 <DIR> d-------- C:\Documents and Settings\Default User\Bluetooth Software
2008-08-23 03:56 . 2008-08-23 03:56 61 --a------ C:\WINDOWS\smscfg.ini
2008-08-23 03:47 . 2008-08-23 03:47 <DIR> d-------- C:\Program Files\Microsoft Works
2008-08-23 03:46 . 2008-08-23 03:46 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-08-23 03:44 . 2008-08-22 23:35 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-08-23 03:44 . 2008-08-23 03:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-08-23 03:43 . 2008-08-23 03:43 <DIR> dr-h----- C:\MSOCache
2008-08-23 03:42 . 2008-08-23 04:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lenovo
2008-08-23 03:42 . 2008-08-23 03:42 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\ThinkVantage
2008-08-23 03:42 . 2008-08-23 04:05 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Lenovo
2008-08-23 03:42 . 2006-05-12 23:26 157,352 --------- C:\WINDOWS\system32\pxwma.dll
2008-08-23 03:38 . 2008-08-23 03:38 <DIR> dr-hs---- C:\RRbackups
2008-08-23 03:35 . 2008-08-23 03:36 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2008-08-23 03:35 . 2008-08-23 03:35 <DIR> d-------- C:\Program Files\TVT SMBus
2008-08-23 03:35 . 2008-08-23 03:35 <DIR> d-------- C:\Program Files\SMI2
2008-08-23 03:30 . 2008-08-23 03:30 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Symantec
2008-08-23 03:30 . 2008-08-23 03:30 8,192 --a------ C:\WINDOWS\REGLOCS.OLD
2008-08-23 03:30 . 2008-08-27 16:12 40 --a------ C:\WINDOWS\system32\profile.dat
2008-08-23 03:29 . 2008-08-23 03:29 <DIR> d-------- C:\Program Files\Symantec Client Security
2008-08-23 03:29 . 2008-08-23 03:30 <DIR> d-------- C:\Program Files\Symantec
2008-08-23 03:29 . 2008-08-26 21:32 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2008-08-23 03:29 . 2008-08-23 03:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Symantec
2008-08-23 03:29 . 2005-04-02 05:36 123,200 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-08-23 03:29 . 2005-04-02 05:36 91,856 --a------ C:\WINDOWS\system32\S32EVNT1.DLL
2008-08-23 03:28 . 2008-08-23 03:29 <DIR> d-------- C:\Program Files\PCDR5
2008-08-23 03:28 . 2008-08-23 03:36 <DIR> d-------- C:\Program Files\Common Files\Lenovo
2008-08-23 03:27 . 2008-08-23 03:27 <DIR> d-------- C:\Program Files\InterVideo
2008-08-23 03:27 . 2002-11-22 11:57 204,800 --a------ C:\WINDOWS\system32\IVIresizeW7.dll
2008-08-23 03:27 . 2002-11-22 11:57 200,704 --a------ C:\WINDOWS\system32\IVIresizeA6.dll
2008-08-23 03:27 . 2002-11-22 11:57 192,512 --a------ C:\WINDOWS\system32\IVIresizeP6.dll
2008-08-23 03:27 . 2002-11-22 11:57 192,512 --a------ C:\WINDOWS\system32\IVIresizeM6.dll
2008-08-23 03:27 . 2002-11-22 11:57 188,416 --a------ C:\WINDOWS\system32\IVIresizePX.dll
2008-08-23 03:27 . 2005-11-10 22:03 49,265 --a------ C:\WINDOWS\system32\jpicpl32.cpl
2008-08-23 03:27 . 2002-11-22 11:57 20,480 --a------ C:\WINDOWS\system32\IVIresize.dll
2008-08-23 03:26 . 2008-08-23 03:26 <DIR> d-------- C:\Program Files\ThinkVantage
2008-08-23 03:26 . 2008-08-23 03:27 <DIR> d-------- C:\Program Files\Java
2008-08-23 03:26 . 2008-08-23 03:26 <DIR> d-------- C:\Program Files\Common Files\Java
2008-08-23 03:26 . 2003-03-19 23:20 1,060,864 --a------ C:\WINDOWS\system32\MFC71.DLL
2008-08-23 03:26 . 2003-03-19 23:12 1,047,552 --a------ C:\WINDOWS\system32\MFC71U.DLL
2008-08-23 03:25 . 2006-07-25 08:17 139,264 --a------ C:\WINDOWS\system32\igfxres.dll
2008-08-23 03:24 . 2008-08-23 03:24 <DIR> d-------- C:\Documents and Settings\NetworkService\Application Data\Intel
2008-08-23 03:22 . 2008-08-23 03:22 <DIR> d-------- C:\Program Files\NetWaiting
2008-08-23 03:22 . 2008-08-23 03:22 <DIR> d-------- C:\Program Files\Digital Line Detect
2008-08-23 03:22 . 2008-08-23 03:22 <DIR> d-------- C:\Program Files\CONEXANT
2008-08-23 03:22 . 2008-08-23 03:22 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Intel
2008-08-23 03:21 . 2008-08-23 03:21 <DIR> d-------- C:\Documents and Settings\Administrator\Bluetooth Software
2008-08-23 03:21 . 2001-09-12 00:20 1,285,632 --a------ C:\WINDOWS\system32\SMMedia.dll
2008-08-23 03:20 . 2008-08-27 00:45 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-08-23 03:20 . 2008-08-23 03:20 <DIR> d-------- C:\Program Files\ThinkVantage Fingerprint Software
2008-08-23 03:20 . 2008-08-23 03:36 <DIR> d-------- C:\Program Files\Lenovo
2008-08-23 03:20 . 2008-08-23 03:20 <DIR> d-------- C:\Program Files\Intel
2008-08-23 03:20 . 2008-08-25 18:14 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-08-23 03:20 . 2008-08-23 03:20 <DIR> d-------- C:\Program Files\Common Files\ThinkVantage Fingerprint Software

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-25 09:04 139,264 ----a-w C:\WINDOWS\system32\hpzjrd01.dll
2008-08-25 07:38 5,427 ----a-w C:\WINDOWS\system32\EGATHDRV.SYS
2008-08-23 01:36 23,552 ----a-w C:\WINDOWS\system32\drivers\psasrv.exe
2008-08-23 01:36 2,560 ----a-w C:\WINDOWS\system32\drivers\cdralw2k.sys
2008-08-23 01:36 2,432 ----a-w C:\WINDOWS\system32\drivers\cdr4_xp.sys
2008-08-23 01:35 7,012 ----a-w C:\WINDOWS\system32\drivers\pmemnt.sys
2008-08-23 01:35 17,536 ----a-w C:\WINDOWS\system32\drivers\psadd.sys
2008-08-23 01:21 0 ---ha-r C:\WINDOWS\system32\drivers\IBM_1952_VL5_TP.MRK
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe
2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\dllcache\wups.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\dllcache\wuapi.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\dllcache\wucltui.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\dllcache\wuweb.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll
2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-07-07 20:32 253,952 ------w C:\WINDOWS\system32\dllcache\es.dll
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-24 16:23 74,240 ------w C:\WINDOWS\system32\dllcache\mscms.dll
2008-06-24 08:57 3,592,192 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-06-23 09:20 70,656 ----a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-06-23 09:20 625,664 ----a-w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-06-21 05:23 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll
2008-06-20 17:36 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 17:36 245,248 ------w C:\WINDOWS\system32\dllcache\mswsock.dll
2008-06-20 10:44 360,960 ------w C:\WINDOWS\system32\dllcache\tcpip.sys
2008-06-20 10:44 138,368 ------w C:\WINDOWS\system32\dllcache\afd.sys
2008-06-20 09:32 225,920 ------w C:\WINDOWS\system32\dllcache\tcpip6.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00 15360]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-08-18 18:41 1832272]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 10:06 1667584]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PWRMGRTR"="C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL" [2006-05-25 18:13 151552]
"BLOG"="C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL" [2006-05-25 18:13 208896]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2006-02-14 07:17 110592]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-02-14 07:16 512000]
"EZEJMNAP"="C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2006-02-23 19:22 237568]
"TPKMAPHELPER"="C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe" [2006-06-03 07:00 856064]
"TPHOTKEY"="C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe" [2006-07-25 03:19 94208]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 02:11 925696]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2006-07-25 08:21 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2006-07-25 08:17 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2006-07-25 08:21 118784]
"LPManager"="C:\PROGRA~1\THINKV~2\PrdCtr\LPMGR.exe" [2006-07-04 18:11 110592]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 22:03 36975]
"TVT Scheduler Proxy"="C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe" [2006-07-15 03:05 503808]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2005-06-02 18:21 48752]
"vptray"="C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe" [2005-08-19 02:22 85696]
"PDService.exe"="C:\Program Files\Lenovo\SafeGuard PrivateDisk\pdservice.exe" [2006-03-14 01:38 41472]
"cssauth"="C:\Program Files\Lenovo\Client Security Solution\cssauth.exe" [2006-07-15 03:13 2341632]
"TpShocks"="TpShocks.exe" [2006-03-16 04:04 106496 C:\WINDOWS\system32\TpShocks.exe]
"TP4EX"="tp4ex.exe" [2005-10-17 10:11 65536 C:\WINDOWS\system32\TP4EX.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 14:00 15360]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 19:17 1241088]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe [2006-05-31 23:51:02 622653]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2008-08-23 03:22:19 24576]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 11:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ACNotify]
2007-02-20 01:03 32768 C:\Program Files\ThinkPad\ConnectUtilities\ACNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
2006-04-26 04:20 40448 C:\WINDOWS\system32\psqlpwd.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]
2005-07-05 16:45 28672 C:\WINDOWS\system32\notifyf2.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
2005-11-30 13:16 24576 C:\WINDOWS\system32\tphklock.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
--a------ 2008-07-22 20:42 116040 C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2007-05-08 16:24 54840 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-07-30 10:47 289064 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
--a------ 2007-06-19 00:10 271360 C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-05-27 10:50 413696 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2008-08-11 17:46 21741864 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 Shockprf;Shockprf;C:\WINDOWS\system32\drivers\Shockprf.sys [2006-03-16 02:08]
R1 ANC;ANC;C:\WINDOWS\system32\drivers\ANC.SYS [2005-11-08 18:27]
R1 IBMTPCHK;IBMTPCHK;C:\WINDOWS\system32\Drivers\IBMBLDID.sys [2006-01-13 09:33]
R1 ShockMgr;ShockMgr;C:\WINDOWS\system32\drivers\ShockMgr.sys [2005-06-20 21:18]
R1 TPPWRIF;TPPWRIF;C:\WINDOWS\system32\drivers\Tppwrif.sys [2006-05-25 18:13]
R2 PrivateDisk;PrivateDisk;C:\Program Files\Lenovo\SafeGuard PrivateDisk\PrivateDiskM.sys [2006-03-14 01:05]
R2 smi2;smi2;C:\Program Files\SMI2\smi2.sys [2006-07-15 00:55]
R2 smihlp;SMI helper driver;C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys [2006-04-26 04:00]
.
Contents of the 'Scheduled Tasks' folder

2008-08-26 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2008-08-27 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE [2007-02-13 00:54]

2008-08-27 C:\WINDOWS\Tasks\PMTask.job
- C:\PROGRA~1\ThinkPad\UTILIT~1\PWMIDTSK.EXE [2006-05-25 18:13]

2008-08-23 C:\WINDOWS\Tasks\Symantec NetDetect.job
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE [2005-04-01 02:32]
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Ági\Application Data\Mozilla\Firefox\Profiles\95oeku84.default\
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-27 16:14:14
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\Program Files\ThinkPad\ConnectUtilities\ACNotify.dll
-> C:\Program Files\ThinkPad\ConnectUtilities\AcSvcStub.dll
-> C:\Program Files\ThinkPad\ConnectUtilities\AcLocSettings.dll
-> C:\Program Files\ThinkPad\ConnectUtilities\ACHelper.dll
-> C:\WINDOWS\system32\tphklock.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ibmpmsvc.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Lenovo\System Update\SUService.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe
C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
C:\WINDOWS\system32\TPHDEXLG.exe
C:\WINDOWS\system32\TpKmpSvc.exe
C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exe
C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
C:\Program Files\Common Files\Lenovo\Logger\logmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ThinkPad\UltraNav Wizard\UNavTray.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
C:\Program Files\OpenOffice.org 2.2\program\soffice.exe
C:\Program Files\OpenOffice.org 2.2\program\soffice.bin
C:\WINDOWS\system32\msiexec.exe
.
**************************************************************************
.
Completion time: 2008-08-27 16:16:58 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-27 14:16:55

Pre-Run: 12,473,622,528 bytes free
Post-Run: 12,387,856,384 bytes free

349 --- E O F --- 2008-08-26 08:22:17

Szia Agi_006
Hat igen egy kicsit most sokan szorulnak segitsegre meg szerencse hogy a TARGE T>cimbora it ot segit ,mert maskep mar nemgyoznem a munkat
A logokban nemlatok semi veszejeset de ez nemjelent semit mert az ugyes virusok elbujnak ezert most csinald meg eztett.
1:kipucolod a gepet>CCleaneral


2: lefutatod a Combofixet a logjat ted ide:


es aztan meglask.

A másik:


SDFix: Version 1.219
Run by Administrator on 2008. 08. 27. at 14:25

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

No Trojan Files Found






Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-27 14:30:51
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe:*:Enabled:hposid01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe:*:Enabled:hpqdia.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

Remaining Files :



Files with Hidden Attributes :

Mon 7 Jul 2008 1,429,840 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
Mon 7 Jul 2008 4,891,472 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
Mon 18 Aug 2008 1,832,272 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"

Finished!

Szia stell!

Ahogy látom lassan érdemes lenne egy "Donate to stell" ikont rakni az oldalra, mert úgy látom szinte főállásban nyújtasz segítséget... Nekem is van egy hasonló problémám, jelezték ismerősök, hogy linket küldözget az MSN-em. Csináltam egy log fájlt a HijackThis programmal, ill egy SDFix logot is... bemásolom mindkettőt.

Előre is nagyon köszi a segítséget!!!



Logfile of HijackThis v1.99.1
Scan saved at 14:47:59, on 2008. 08. 27.
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
c:\program files\lenovo\system update\suservice.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe
C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
C:\WINDOWS\System32\TPHDEXLG.EXE
C:\WINDOWS\system32\TpKmpSVC.exe
C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
C:\Program Files\Common Files\Lenovo\Logger\logmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\WINDOWS\system32\TpShocks.exe
C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\PROGRA~1\THINKV~2\PrdCtr\LPMGR.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe
C:\Program Files\Lenovo\SafeGuard PrivateDisk\pdservice.exe
C:\Program Files\Lenovo\Client Security Solution\cssauth.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\OpenOffice.org 2.2\program\soffice.exe
C:\Program Files\OpenOffice.org 2.2\program\soffice.BIN
C:\PROGRA~1\ThinkPad\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
D:\Segédek\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live bejelentkezési segítség - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: CPwmIEBrowserHelper Object - {F040E541-A427-4CF7-85D8-75E3E0F476C5} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [LPManager] C:\PROGRA~1\THINKV~2\PrdCtr\LPMGR.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [TVT Scheduler Proxy] C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [PDService.exe] "C:\Program Files\Lenovo\SafeGuard PrivateDisk\pdservice.exe"
O4 - HKLM\..\Run: [cssauth] "C:\Program Files\Lenovo\Client Security Solution\cssauth.exe" silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: OpenOffice.org 2.2.lnk = C:\Program Files\OpenOffice.org 2.2\program\quickstart.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportálás Microsoft Excel formátumba - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {0045D4BC-5189-4b67-969C-83BB1906C421} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll
O9 - Extra 'Tools' menuitem: ThinkVantage Password Manager... - {0045D4BC-5189-4b67-969C-83BB1906C421} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: System Update - {DA320635-F48C-4613-8325-D75A933C549E} - C:\Program Files\Lenovo\System Update\sulauncher.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B5A2FB6B-757B-44C9-9643-AFF869551CCE}: NameServer = 212.51.115.1 194.176.224.6
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: ACNotify - ACNotify.dll (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: psfus - C:\WINDOWS\SYSTEM32\psqlpwd.dll
O20 - Winlogon Notify: tpfnf2 - C:\WINDOWS\SYSTEM32\notifyf2.dll
O20 - Winlogon Notify: tphotkey - C:\WINDOWS\SYSTEM32\tphklock.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) - Unknown owner - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
O23 - Service: Access Connections Main Service (AcSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IS Service (ISSVC) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: System Update (SUService) - - c:\program files\lenovo\system update\suservice.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Symantec SecurePort (SymSecurePort) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe
O23 - Service: ThinkVantage Registry Monitor Service - Unknown owner - C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.EXE
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe
O23 - Service: TSS Core Service (TSSCoreService) - IBM - C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exe
O23 - Service: TVT Backup Service - Lenovo Group Limited - C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
O23 - Service: TVT Scheduler - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
O23 - Service: tvtnetwk - Unknown owner - C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe

udv:

sziasztok!

szeretném én is a segítségeteket kérni...
asszem az én gépem is teli van szeméttel, tipikus buta felhazsnáló.

A leírtak bekopizom amit hijack kiírt, ha valamikro van türelme kiböngészni miket írtsak, az nagy segítség nekem

köszönöm

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:58:19, on 2008. 08. 24.
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\NetSwitcher for Windows\NetSwTray.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Winamp\winamp.exe
C:\DOCUME~1\Piros\LOCALS~1\Temp\Rar$EX00.641\setup.exe
C:\DOCUME~1\Piros\LOCALS~1\Temp\is-EJF5D.tmp\is-8LH85.tmp
C:\WINDOWS\system32\rundll32.exe
D:\ProgramFiles\hij\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.epiteszforum.hu/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.epiteszforum.hu/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live bejelentkezési segítség - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [NetSwitcher Tray Application] C:\Program Files\NetSwitcher for Windows\NetSwTray.exe
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\JMRaidSetup.exe boot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [SpyHunter Security Suite] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" /NoDialog
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xportálás Microsoft Excel formátumba - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Küldés blogba - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Küldés blogba a Windows Live Writer programmal - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Kutatás - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDow ... eqlab2.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://cid-86aeab0fe0c061e5.spaces.live ... nPUpld.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A0D4C1AE-241C-4456-8962-AA820EF2587A}: NameServer = 172.16.1.254,213.46.246.53
O17 - HKLM\System\CCS\Services\Tcpip\..\{E40024F8-AEAB-4B2C-98A1-3818E3EE3FE3}: NameServer = 172.16.1.254,213.46.246.53
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI.SP1\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI.SP1\RpcSandraSrv.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

--
End of file - 11919 bytes

Lehet, hogy volt róla szó, de nincs türelmem végigrágni a fórumot, ezért elnézést, ha mindennapos a kérdésem.
Msn-en egy linket kapok, amin a következő van:
http://majd a nevem.is-dat-u.com
Mi lehet ez? Nem nyitottam meg, de szeretnék meggyőződni róla, hogy a gépem nem fertőzött-e? Mivel lehetne megnézni, és persze eltávolítani?
Válaszokat előre is köszönöm

oki,nincsen mit.

Köszi az eddigieket is stell.

oki akor renben van,kiprobalni es ha lesznek problemak akor kihuzunk nehez fegyvereket.

Messenger Plus! Live 4.60.0.326 2008.05.06

Ez a Live Messenger mijen verzio PLUS 3??Egy kicsit akaszkodik.

>Shadow
>Processes
>Drivers
>Stealth
>Files
>Hooks
ntoskrnl.exe+0x00005032, Type: Inline - RelativeJump at address 0x804DC032 hook handler located in [ntoskrnl.exe]
[1236]msnmsgr.exe-->advapi32.dll-->CryptDecrypt, Type: Inline - RelativeJump at address 0x77DDA7B1 hook handler located in [MsgPlusLive.dll]
[1236]msnmsgr.exe-->advapi32.dll-->CryptDecrypt, Type: Inline - SEH at address 0x77DDA7B6 hook handler located in [unknown_code_page]
[1236]msnmsgr.exe-->advapi32.dll-->CryptDecrypt, Type: Inline - SEH at address 0x77DDA7B7 hook handler located in [unknown_code_page]
[1236]msnmsgr.exe-->advapi32.dll-->CryptDeriveKey, Type: Inline - RelativeJump at address 0x77DDA685 hook handler located in [MsgPlusLive.dll]
[1236]msnmsgr.exe-->advapi32.dll-->CryptDeriveKey, Type: Inline - SEH at address 0x77DDA68A hook handler located in [unknown_code_page]
[1236]msnmsgr.exe-->advapi32.dll-->CryptDeriveKey, Type: Inline - SEH at address 0x77DDA68B hook handler located in [unknown_code_page]
[1236]msnmsgr.exe-->kernel32.dll-->CreateEventA, Type: Inline - RelativeJump at address 0x7C81E4BD hook handler located in [MsgPlusLive.dll]
[1236]msnmsgr.exe-->kernel32.dll-->FindResourceA, Type: Inline - RelativeJump at address 0x7C80C7B1 hook handler located in [MsgPlusLive.dll]
[1236]msnmsgr.exe-->kernel32.dll-->FindResourceA, Type: Inline - SEH at address 0x7C80C7B6 hook handler located in [unknown_code_page]
[1236]msnmsgr.exe-->kernel32.dll-->FindResourceA, Type: Inline - SEH at address 0x7C80C7B7 hook handler located in [unknown_code_page]
[1236]msnmsgr.exe-->kernel32.dll-->FindResourceExA, Type: Inline - RelativeJump at address 0x7C822C2D hook handler located in [MsgPlusLive.dll]
[1236]msnmsgr.exe-->kernel32.dll-->FindResourceExA, Type: Inline - SEH at address 0x7C822C32 hook handler located in [unknown_code_page]
[1236]msnmsgr.exe-->kernel32.dll-->FindResourceExA, Type: Inline - SEH at address 0x7C822C33 hook handler located in [unknown_code_page]
[1236]msnmsgr.exe-->kernel32.dll-->FindResourceExW, Type: Inline - RelativeJump at address 0x7C80AB10 hook handler located in [MsgPlusLive.dll]
[1236]msnmsgr.exe-->kernel32.dll-->FindResourceExW, Type: Inline - SEH at address 0x7C80AB15 hook handler located in [unknown_code_page]
[1236]msnmsgr.exe-->kernel32.dll-->FindResourceExW, Type: Inline - SEH at address 0x7C80AB16 hook handler located in [unknown_code_page]
[1236]msnmsgr.exe-->kernel32.dll-->FindResourceW, Type: Inline - RelativeJump at address 0x7C80BA56 hook handler located in [MsgPlusLive.dll]
[1236]msnmsgr.exe-->kernel32.dll-->FindResourceW, Type: Inline - SEH at address 0x7C80BA5B hook handler located in [unknown_code_page]
[1236]msnmsgr.exe-->kernel32.dll-->FindResourceW, Type: Inline - SEH at address 0x7C80BA5C hook handler located in [unknown_code_page]
[1236]msnmsgr.exe-->kernel32.dll-->LoadResource, Type: Inline - RelativeJump at address 0x7C80A065 hook handler located in [MsgPlusLive.dll]
[1236]msnmsgr.exe-->kernel32.dll-->LoadResource, Type: Inline - SEH at address 0x7C80A06A hook handler located in [unknown_code_page]
[1236]msnmsgr.exe-->kernel32.dll-->LoadResource, Type: Inline - SEH at address 0x7C80A06B hook handler located in [unknown_code_page]
[1236]msnmsgr.exe-->kernel32.dll-->LockResource, Type: Inline - RelativeJump at address 0x7C80C6CF hook handler located in [MsgPlusLive.dll]
[1236]msnmsgr.exe-->kernel32.dll-->OutputDebugStringW, Type: Inline - RelativeJump at address 0x7C85A215 hook handler located in [MsgPlusLive.dll]
[1236]msnmsgr.exe-->kernel32.dll-->SetUnhandledExceptionFilter, Type: Inline - RelativeJump at address 0x7C810386 hook handler located in [msnmsgr.exe]
[1236]msnmsgr.exe-->kernel32.dll-->SizeofResource, Type: Inline - RelativeJump at address 0x7C80BAF1 hook handler located in [MsgPlusLive.dll]
[1236]msnmsgr.exe-->kernel32.dll-->SizeofResource, Type: Inline - SEH at address 0x7C80BAF6 hook handler located in [unknown_code_page]
[1236]msnmsgr.exe-->kernel32.dll-->SizeofResource, Type: Inline - SEH at address 0x7C80BAF7 hook handler located in [unknown_code_page]
[1236]msnmsgr.exe-->shell32.dll-->Shell_NotifyIconW, Type: Inline - RelativeJump at address 0x7CA37CE1 hook handler located in [MsgPlusLive.dll]
[1236]msnmsgr.exe-->user32.dll-->CreateDialogParamW, Type: Inline - RelativeJump at address 0x77D5629F hook handler located in [MsgPlusLive.dll]
[1236]msnmsgr.exe-->user32.dll-->CreateWindowExW, Type: Inline - RelativeJump at address 0x77D41AD5 hook handler located in [MsgPlusLive.dll]
[1236]msnmsgr.exe-->user32.dll-->LoadIconW, Type: Inline - RelativeJump at address 0x77D42174 hook handler located in [MsgPlusLive.dll]
[1236]msnmsgr.exe-->user32.dll-->LoadImageW, Type: Inline - RelativeJump at address 0x77D442A4 hook handler located in [MsgPlusLive.dll]
[1236]msnmsgr.exe-->user32.dll-->MessageBoxIndirectW, Type: Inline - RelativeJump at address 0x77D860B7 hook handler located in [MsgPlusLive.dll]
[1236]msnmsgr.exe-->user32.dll-->PeekMessageW, Type: Inline - RelativeJump at address 0x77D39278 hook handler located in [MsgPlusLive.dll]
[1236]msnmsgr.exe-->user32.dll-->SetWindowPlacement, Type: Inline - RelativeJump at address 0x77D5FBEA hook handler located in [MsgPlusLive.dll]
[1236]msnmsgr.exe-->user32.dll-->SetWindowRgn, Type: Inline - RelativeJump at address 0x77D41DE0 hook handler located in [MsgPlusLive.dll]
[1236]msnmsgr.exe-->user32.dll-->SetWindowRgn, Type: Inline - SEH at address 0x77D41DE5 hook handler located in [unknown_code_page]
[1236]msnmsgr.exe-->user32.dll-->SetWindowRgn, Type: Inline - SEH at address 0x77D41DE6 hook handler located in [unknown_code_page]
[1236]msnmsgr.exe-->user32.dll-->TrackPopupMenuEx, Type: Inline - RelativeJump at address 0x77D8CAFE hook handler located in [MsgPlusLive.dll]
[1236]msnmsgr.exe-->wininet.dll-->HttpOpenRequestA, Type: Inline - RelativeJump at address 0x771B4AC5 hook handler located in [MsgPlusLive.dll]
[1236]msnmsgr.exe-->wininet.dll-->HttpSendRequestA, Type: Inline - RelativeJump at address 0x771B76B8 hook handler located in [MsgPlusLive.dll]
[1236]msnmsgr.exe-->wininet.dll-->InternetCloseHandle, Type: Inline - RelativeJump at address 0x771B61DC hook handler located in [MsgPlusLive.dll]
[1236]msnmsgr.exe-->wininet.dll-->InternetReadFile, Type: Inline - RelativeJump at address 0x771B9555 hook handler located in [MsgPlusLive.dll]
[1236]msnmsgr.exe-->ws2_32.dll-->closesocket, Type: Inline - RelativeJump at address 0x71A59639 hook handler located in [MsgPlusLive.dll]
[1236]msnmsgr.exe-->ws2_32.dll-->recv, Type: Inline - RelativeJump at address 0x71A5615A hook handler located in [MsgPlusLive.dll]
[1236]msnmsgr.exe-->ws2_32.dll-->send, Type: Inline - RelativeJump at address 0x71A5428A hook handler located in [MsgPlusLive.dll]
[1236]msnmsgr.exe-->ws2_32.dll-->WSARecv, Type: Inline - RelativeJump at address 0x71A54318 hook handler located in [MsgPlusLive.dll]
[1236]msnmsgr.exe-->ws2_32.dll-->WSASend, Type: Inline - RelativeJump at address 0x71A56233 hook handler located in [MsgPlusLive.dll]
!!POSSIBLE ROOTKIT ACTIVITY DETECTED!! =)

oké

Ok;
Meg tolds le a Rootkit unhookert es futasd.

Nohát ez sem talált sokmindent, néhány cooki es annyi. Eltávolitottam azokat is. Köszi a segitséget still.

Ha jatszol az Lineagen jatekokat akor ok.
Nemlatok sehol semit>Meg futasd le a SAS>programot>SuperAntispyware es hgyd is meg.Mar tob hejre leirtam hogy kel hasznalni,tehat talald meg es futasd le amit talal torolni.Es aztan ird le hogy mit talalt vagy ted ide a logjat.

# Copyright (c) 1993-1999 Microsoft Corp.
#
# Mintafájl a Microsoft TCP/IP for Windows-hoz.
#
# Ez a fájl IP címek és NT számítógépnevek (NetBIOS nevek) egymáshoz
# rendelésére szolgál. Minden egyes tételt külön sorba kell írni, először
# az IP címet, azt követően pedig a hozzá tartozó nevet. A cím és
# a név között legalább egy szóköz vagy tabulátor karakternek kell lennie.
#
# A # jel általában a megjegyzést tartalmazó sorokat jelöli, néhány
# kivételtől eltekintve (ezeket lásd alább).
#
# Példák:
#
# 102.54.94.97 rhino.acme.com # forráskiszolgáló
# 38.25.63.10 x.acme.com # x ügyfélállomás

127.0.0.1 localhost
89.149.200.219 l2authd.lineage2.com
89.149.200.219 l2testauthd.lineage2.com
216.107.250.194 nprotect.lineage2.com

10:15:45 2008.08.01.
mbam-log-8-1-2008 (10-15-45).txt
Eztet a logot most csinaltad en ara letem volna kivancsi amit tegnap csinaltal,de mindegy.
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS>nyisd ki a notepadal>jedzettomb.> es a tartalmat ted ide

Malwarebytes' Anti-Malware 1.24
Adatbázis verzió: 1012
Windows 5.1.2600 Szervizcsomag 2

10:15:45 2008.08.01.
mbam-log-8-1-2008 (10-15-45).txt

Vizsgálat típusa: Teljes vizsgálat (C:\|D:\|E:\|)
Átvizsgált objektumok: 108263
Eltelt idő: 5 hour(s), 15 minute(s), 22 second(s)

Fertőzött memóriafolyamatok: 0
Fertőzött memória modulok: 0
Fertőzött rendszerleíró kulcsok: 0
Fertőzött rendszerleíró értékek: 0
Fertőzött rednszerleíró elemek: 0
Fertőzött mappák: 0
Fertőzött fájlok: 0

Fertőzött memóriafolyamatok:
(Nem észleltem rosszindulatú elemeket)

Fertőzött memória modulok:
(Nem észleltem rosszindulatú elemeket)

Fertőzött rendszerleíró kulcsok:
(Nem észleltem rosszindulatú elemeket)

Fertőzött rendszerleíró értékek:
(Nem észleltem rosszindulatú elemeket)

Fertőzött rednszerleíró elemek:
(Nem észleltem rosszindulatú elemeket)

Fertőzött mappák:
(Nem észleltem rosszindulatú elemeket)

Fertőzött fájlok:
(Nem észleltem rosszindulatú elemeket)

Oksi csinálom is

En nemondtam hogy tiszta a gep mert a HiJackThis nemtokeletes,vagyis egy program se.Csak tudnom kel a reszleteket hogy mijen orvosagot irjak elol a gepnek Akor megkezdjuk evel a programal:

Sikerült elérnem egy partnerem akinap a mai nap is küldtem üzenetet.
Logot nemtudott nézni mit küldtem,de a sajat email címe volt benne meg egy port utánna.

Msn es vírusom van szerintem. A partnereimnek időközönként üzeneteket írok stb..a tudtomon kívül különbözö linkekkel. Továbbá észrevettem hogy bejelentkezett msn mellett, minha bejelentkeznék másik gépről is vhol pedig semmi ilyesmi nincs. Nemrég bedőltem egy ilyen vírusos kollega által küldött üzinek, hogy nézzek photoalbumot. Néztem!:) Azota történnek ienek. Dehát mostmeg tiszta vagyok? hm..

Udv;
Es mibol gondolod hogy Virus van a gepben,ird le reszleteseben a problemat.
Mert a HiJack>logja tiszta de efelol meg lehet virus.

Üdv stell!
Msn es vírusom van. Kérlek segíts!
Itt a hijack log.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:25:11, on 2008.07.31.
Platform: Windows XP Szervizcsomag 2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Belkin\Nostromo\nost_LM.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\PrevxCSI\prevxcsi.exe
C:\Program Files\PrevxCSI\prevxcsi.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Somodi Dávid\Asztal\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.goldengate.hu/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hivatkozások
O1 - Hosts: 89.149.200.219 l2authd.lineage2.com
O1 - Hosts: 89.149.200.219 l2testauthd.lineage2.com
O1 - Hosts: 216.107.250.194 nprotect.lineage2.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'HELYI SZOLGÁLTATÁS')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'HÁLÓZATI SZOLGÁLTATÁS')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Loadout Manager.lnk = C:\Program Files\Belkin\Nostromo\nost_LM.exe
O8 - Extra context menu item: Letöltés a FlashGet-tel - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: MINDEN letöltése a FlashGet-tel - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: CSIScanner - Prevx - C:\Program Files\PrevxCSI\prevxcsi.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 4457 bytes

ok,megnezem

Hello stell!!

Csináltam új témát MSN vírus néven Elküldtem oda a log file-t

Stratotibi
Csak nyugodtan ted de nyis uj temat it valahol mert mar azt se tudom hogy kie mejik log.

ez ugy nezki hogy- tudjak az email cimedet es fognak is kuldeni,ha ojan 3-napig nemnyitod ki nemreagalsz hanem rogton torlod akor mar nemkuldenek.Ez elem sajnos nehez vedekezni mert ez nem virus ha kinyitod az zip.akor mar baj van.
Ezert futasd le ezt a programoT:,Futasd le ezt a programot

utana>



Es aztan meglasuk

Ebből h ilyen üziket kapok:
1:
here, this picure is GREAT for your desktop wallpaper.

2:
ez te vagy http://msnphotos.info/images/picture01.php?=email címem

3:
Look photos of my new car and my girlfriend. But she looks like I am here
You remember this photo? We were weak ...
I have to raise my new photos on facebook.com
That bank is on the rocks. Do you have accounts in it?
I don't know how he did it but i like it. Look this too
**** a következő fájlt küldi: photo.zip
Nem sikerült fogadni a fájlt („photo.zip”) ***** nevű partnerétől.

Így már elé nyomós az indok? Van olyan amelyik a képenyőkímélő megszünésével indul el. Kezd elegem lenni belőle/ük.

Szia stell!

Nekem is hasonlo problémám lenne az msn-ben, mint doll000-nak tehát: "ez te vagy http://msnphotos.info/image.php?=selmecibia@hotmail.com
elfogadta :@ és a virus saját magát küldözgeti!!" (bocs doll000, h csak bemnásoltam amit írtál de nem léptem be azóta az msn-be). Követtem az utasításokat amiket írtál neki, letöltöttem már minden progit is de sajna csak holnap (júl. 22-én) tudom véghezvinni 14.00 után!Nagyon megköszönném ha tudnál segíteni benne, megírnád, h neked mikor lenne jó!(stratotibi@gmail.com)! Bocsi a szerencsétlenségemért!Előre is köszi mindent.

Üdv: Tibi

Jo hagyad a SDFIX programot:Csinald meg eztet igy ahogy most leirom:

Utana a Combofixet:

Akkor ismét segítség még ne pucoltam mappát és mondtam nem nagyon értek a gépekhez röviden le tudnád írni h kell?

Mr-Pamacs
Es mibol gondolod hogy Virus van a gepben??

Csinald igy az SDFIX nem Virus csak az AVAST egy kicsit >Paraonikus.
Torold ki az SDFIX mapat>pucold ki CCleaneral>restart>kapcsold kiaz AVAST vedopajzat>tolds le ujbol ugy ahogy leirtam.Eridj csokentet modba es klik.RunThisBat