ok,semi veszejes dolgokat mar nemlatok,telepits fell tuzfalat es okes.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:27, on 2008-12-28
Platform: Windows XP Szervizcsomag 3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
C:\WINDOWS\V0220Mon.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Documents and Settings\Kozmér Árpád\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\Documents and Settings\Kozmér Árpád\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Kozmér Árpád\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Giganology\Gigaget\Gigaget.exe
C:\Program Files\Xfire\xfire.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bsplayer-search.com/startpage
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hivatkozások
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: GigagetIEHelper - {111CAA23-6F4F-42AC-8555-B48C1D87BBAB} - C:\WINDOWS\system32\gigagetbho_v10.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live bejelentkezési segítség - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: BS.Player ControlBar - {2C688203-7EB3-4327-9995-1CB417BA23F9} - C:\Program Files\BS.Player ControlBar\BSToolbar.dll
O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SW20] C:\WINDOWS\system32\sw20.exe
O4 - HKLM\..\Run: [SW24] C:\WINDOWS\system32\sw24.exe
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Gigaget] "C:\Program Files\Giganology\Gigaget\GigagetShell.exe" /s
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [AVFX Engine] C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
O4 - HKLM\..\Run: [V0220Mon.exe] C:\WINDOWS\V0220Mon.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Kozmér Árpád\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Aero Sidebar.lnk = G:\Progik\Best Vista Theme 4 XP\Theme\Aero Sidebar Longhorn.exe
O4 - Startup: µTorrent.lnk = C:\Program Files\uTorrent\uTorrent.exe
O8 - Extra context menu item: &Download All by Gigaget - C:\Program Files\Giganology\Gigaget\getallurl.htm
O8 - Extra context menu item: &Download by Gigaget - C:\Program Files\Giganology\Gigaget\geturl.htm
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xportálás a Microsoft Excel programba - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint – Gyors nyomtatás - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint – Hozzáadás a nyomtatási listához - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint – Nyomtatás - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint – Nyomtatási kép - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O9 - Extra button: Küldés a OneNote programba - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Kül&dés a OneNote programba - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Mobil kedvenc létrehozása... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 1825195562
O17 - HKLM\System\CCS\Services\Tcpip\..\{5B3F1D2A-AE8D-40C3-84AE-747069036762}: NameServer = 217.145.192.3,217.145.194.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{5B3F1D2A-AE8D-40C3-84AE-747069036762}: NameServer = 217.145.192.3,217.145.194.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{5B3F1D2A-AE8D-40C3-84AE-747069036762}: NameServer = 217.145.192.3,217.145.194.1
O17 - HKLM\System\CS3\Services\Tcpip\..\{5B3F1D2A-AE8D-40C3-84AE-747069036762}: NameServer = 217.145.192.3,217.145.194.1
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 11727 bytes

ok,mostan ted ide de uj HiJack logot csinalj,ok.

********************************************************************************
* *
* FixIEDef Log *
* Version 1.7.20.7201 *
* *
********************************************************************************

Created at 14:53:50 on Sunday, December 28, 2008

Time Zone :

Logged On User : Kozmér Árpád

Operating System : Microsoft Windows XP Home Edition Szervizcsomag 3
OS Version : 5.1.2600
System Langauge : Hungarian
Keyboard Layout : Hungarian
Processor : X86 Intel(R) Pentium(R) 4 CPU 3.06GHz

System Drive : C:\
Windows Directory : C:\WINDOWS
System Directory : C:\WINDOWS\system32

System Drive Type : Fixed
System Drive Status : READY
System Drive Label :
System Drive Size : 80 GB
System Drive Free : 3.87 GB

Total Physical Memory: 1534 MB
Free Physical Memory : 1003 MB
Total Page File : 1534 MB
Free Page File : 1611 MB
Total Virtual Memory : 2048 MB
Free Virtual Memory : 1955 MB

Boot State : Normal boot

--------------------------------------------------------------------------------

!!! userinit.exe is Clean !!!

--------------------------------------------------------------------------------

!!! Files that have been deleted !!!

C:\Documents and Settings\Kozmér Árpád\Application Data\AntiSpyware\Full Backups\FULL-2008-05-28-21-08-57.rbu
C:\Documents and Settings\Kozmér Árpád\Application Data\AntiSpyware\Log\2008 Jun 29 - 03_00_00 AM_609.log
C:\Documents and Settings\Kozmér Árpád\Application Data\AntiSpyware\Log\2008 Jun 29 - 03_00_00 AM_953.log
C:\Documents and Settings\Kozmér Árpád\Application Data\AntiSpyware\Log\2008 Jun 30 - 07_56_18 AM_218.log
C:\Documents and Settings\Kozmér Árpád\Application Data\AntiSpyware\Registry Backups\FULL-2008-05-28-21-08-57.rbu
C:\Documents and Settings\Kozmér Árpád\Application Data\AntiSpyware\Settings\ScanResults.pie
C:\Documents and Settings\Kozmér Árpád\Application Data\AntiSpyware\rs.dat
C:\WINDOWS\system32\drv2.dll
C:\WINDOWS\system32\drv1.dll
C:\WINDOWS\system32\drv2.dll
C:\WINDOWS\system32\drvc.dll

--------------------------------------------------------------------------------

!!! Directories that have been removed !!!

C:\Documents and Settings\Kozmér Árpád\Application Data\AntiSpyware\Full Backups
C:\Documents and Settings\Kozmér Árpád\Application Data\AntiSpyware\Log
C:\Documents and Settings\Kozmér Árpád\Application Data\AntiSpyware\Registry Backups
C:\Documents and Settings\Kozmér Árpád\Application Data\AntiSpyware\Settings
C:\Documents and Settings\Kozmér Árpád\Application Data\Antispyware

--------------------------------------------------------------------------------

!!! Registry entries that have been removed !!!

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5B3142C6-A130-4BBB-A997-554C7F561D25}

================================================================================

All Done

ShadowPuterDude

Safe Surfing!!!

ok,start-futatas-masold be a combofix letelepitodik
combofix /u ok

fixeld le a hijackal
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: GigaNet.com - {DE2C5EF2-DFBF-49B0-BBF2-3B2805A52722} - C:\WINDOWS\system32\dhofozr.dll
O2 - BHO: ExtractorPlugin Class - {E49C2526-26BF-499f-912F-B97B44814087} - (no file)
O3 - Toolbar: Acmeta Fragmento - {807DADF1-18CF-4a7f-8792-8443C960E055} - (no file)
O9 - Extra button: (no name) - {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - (no file)

amugy uj logot tetel ide a HiJackbol??
pucold ki a gepet CCleaneral es meg futasd le ezt a programot


http://downloads.malwareteks.com/FixIEDef.exe
ted az asztalra-futatod-beleegyezes-klik-scan-mikor megjelenik
!!! All Finished !!!---varsz---egy csepet---aztan klik Exit.
qaz asztalra tesz logot aztata ted ide.

ES itt a Hijack Is!!

És már nincs probléma de nézd meg azer lecci nincs e még valami. Köszi!


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:34:08, on 2008.12.28.
Platform: Windows XP Szervizcsomag 3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
C:\WINDOWS\V0220Mon.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Documents and Settings\Kozmér Árpád\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Kozmér Árpád\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Kozmér Árpád\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Documents and Settings\Kozmér Árpád\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bsplayer-search.com/startpage
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hivatkozások
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: GigagetIEHelper - {111CAA23-6F4F-42AC-8555-B48C1D87BBAB} - C:\WINDOWS\system32\gigagetbho_v10.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live bejelentkezési segítség - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: GigaNet.com - {DE2C5EF2-DFBF-49B0-BBF2-3B2805A52722} - C:\WINDOWS\system32\dhofozr.dll
O2 - BHO: ExtractorPlugin Class - {E49C2526-26BF-499f-912F-B97B44814087} - (no file)
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Acmeta Fragmento - {807DADF1-18CF-4a7f-8792-8443C960E055} - (no file)
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: BS.Player ControlBar - {2C688203-7EB3-4327-9995-1CB417BA23F9} - C:\Program Files\BS.Player ControlBar\BSToolbar.dll
O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SW20] C:\WINDOWS\system32\sw20.exe
O4 - HKLM\..\Run: [SW24] C:\WINDOWS\system32\sw24.exe
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Gigaget] "C:\Program Files\Giganology\Gigaget\GigagetShell.exe" /s
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [AVFX Engine] C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
O4 - HKLM\..\Run: [V0220Mon.exe] C:\WINDOWS\V0220Mon.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Kozmér Árpád\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Aero Sidebar.lnk = G:\Progik\Best Vista Theme 4 XP\Theme\Aero Sidebar Longhorn.exe
O4 - Startup: µTorrent.lnk = C:\Program Files\uTorrent\uTorrent.exe
O8 - Extra context menu item: &Download All by Gigaget - C:\Program Files\Giganology\Gigaget\getallurl.htm
O8 - Extra context menu item: &Download by Gigaget - C:\Program Files\Giganology\Gigaget\geturl.htm
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xportálás a Microsoft Excel programba - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint – Gyors nyomtatás - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint – Hozzáadás a nyomtatási listához - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint – Nyomtatás - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint – Nyomtatási kép - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O9 - Extra button: Küldés a OneNote programba - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Kül&dés a OneNote programba - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Mobil kedvenc létrehozása... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 1825195562
O17 - HKLM\System\CCS\Services\Tcpip\..\{5B3F1D2A-AE8D-40C3-84AE-747069036762}: NameServer = 217.145.192.3,217.145.194.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{5B3F1D2A-AE8D-40C3-84AE-747069036762}: NameServer = 217.145.192.3,217.145.194.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{5B3F1D2A-AE8D-40C3-84AE-747069036762}: NameServer = 217.145.192.3,217.145.194.1
O17 - HKLM\System\CS3\Services\Tcpip\..\{5B3F1D2A-AE8D-40C3-84AE-747069036762}: NameServer = 217.145.192.3,217.145.194.1
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 12389 bytes

ComboFix 08-12-26.03 - Kozmér Árpád 2008-12-28 13:48:53.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1038.18.1534.998 [GMT 1:00]
Running from: c:\documents and settings\Kozmér Árpád\Asztal\ComboFix.exe
Command switches used :: c:\documents and settings\Kozmér Árpád\Asztal\CFScript.txt
AV: ESET NOD32 Antivirus System 2.70 *On-access scanning disabled* (Outdated)
* Created a new restore point
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
c:\windows\system32\dhofozr.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\dhofozr.dll

.
((((((((((((((((((((((((( Files Created from 2008-11-28 to 2008-12-28 )))))))))))))))))))))))))))))))
.

2008-12-28 13:33 . 2008-12-28 13:33 <DIR> d-------- c:\program files\Trend Micro
2008-12-28 09:49 . 2008-12-28 09:49 <DIR> d-------- c:\program files\Lavasoft
2008-12-28 09:37 . 2008-12-28 10:18 <DIR> d-------- c:\program files\Spyware Terminator
2008-12-28 09:37 . 2008-12-28 09:37 <DIR> d-------- c:\program files\Crawler
2008-12-28 09:37 . 2008-12-28 10:20 <DIR> d-------- c:\documents and settings\Kozmér Árpád\Application Data\Spyware Terminator
2008-12-28 09:37 . 2008-12-28 10:20 <DIR> d-------- c:\documents and settings\Kozmér Árpád\Application Data\Spyware Terminator
2008-12-28 09:37 . 2008-12-28 10:19 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spyware Terminator
2008-12-28 09:37 . 2008-12-28 09:37 141,312 --a------ c:\windows\system32\drivers\sp_rsdrv2.sys
2008-12-27 14:55 . 2008-12-27 14:57 <DIR> d-------- c:\program files\Portrait Professional Max 6
2008-12-21 12:59 . 2008-12-23 14:43 7,680 --ahs---- c:\windows\Thumbs.db
2008-12-19 15:22 . 2008-12-19 15:23 <DIR> d-------- c:\program files\BS.Player ControlBar
2008-12-19 13:18 . 2008-12-19 14:10 <DIR> d-------- c:\program files\vanBasco's Karaoke Player
2008-12-14 16:41 . 2008-12-14 16:55 <DIR> d-------- c:\program files\SpeedFan
2008-12-14 16:41 . 2008-12-14 16:41 45 --a------ c:\windows\system32\initdebug.nfo
2008-12-11 21:37 . 2008-12-11 21:37 42,320 --a------ c:\windows\system32\xfcodec.dll
2008-12-11 21:33 . 2008-12-11 21:33 <DIR> d-------- c:\program files\PerfMon3x
2008-12-11 21:28 . 2008-12-11 21:28 <DIR> d-------- c:\program files\Lavalys
2008-12-11 17:04 . 2008-12-11 17:04 22,328 --a------ c:\documents and settings\Kozmér Árpád\Application Data\PnkBstrK.sys
2008-12-11 17:04 . 2008-12-11 17:04 22,328 --a------ c:\documents and settings\Kozmér Árpád\Application Data\PnkBstrK.sys
2008-12-11 17:04 . 2008-12-11 17:04 319 --a------ c:\windows\game.ini
2008-12-08 20:29 . 2008-12-08 20:29 <DIR> d-------- c:\program files\Infogrames
2008-12-08 20:04 . 2008-12-08 20:11 <DIR> d-------- c:\documents and settings\Kozmér Árpád\Application Data\Hamachi
2008-12-08 20:04 . 2008-12-08 20:11 <DIR> d-------- c:\documents and settings\Kozmér Árpád\Application Data\Hamachi
2008-12-08 20:03 . 2008-12-08 20:03 25,280 --a------ c:\windows\system32\drivers\hamachi.sys
2008-12-08 18:50 . 2008-12-08 18:50 <DIR> d-------- c:\windows\S.T.A.L.K.E.R. magyar fordítás
2008-12-08 18:14 . 2008-12-08 18:14 <DIR> d-------- c:\documents and settings\All Users\Application Data\NVIDIA
2008-12-07 12:54 . 2008-05-30 14:11 3,850,760 --a------ c:\windows\system32\D3DX9_38.dll
2008-12-07 12:54 . 2008-05-30 14:11 1,491,992 --a------ c:\windows\system32\D3DCompiler_38.dll
2008-12-07 12:54 . 2008-05-30 14:19 507,400 --a------ c:\windows\system32\XAudio2_1.dll
2008-12-07 12:54 . 2008-05-30 14:11 467,984 --a------ c:\windows\system32\d3dx10_38.dll
2008-12-07 12:54 . 2008-05-30 14:18 238,088 --a------ c:\windows\system32\xactengine3_1.dll
2008-12-07 12:54 . 2008-05-30 14:17 65,032 --a------ c:\windows\system32\XAPOFX1_0.dll
2008-12-07 12:54 . 2008-05-30 14:17 25,608 --a------ c:\windows\system32\X3DAudio1_4.dll
2008-12-07 12:53 . 2008-12-07 12:53 <DIR> d-------- c:\windows\Logs
2008-12-07 12:51 . 2008-12-07 12:51 <DIR> d-------- c:\windows\system32\xlive
2008-12-07 12:51 . 2008-12-07 13:40 <DIR> d-------- c:\program files\Microsoft Games for Windows - LIVE
2008-12-07 10:50 . 2008-12-07 10:52 <DIR> d-------- c:\program files\Photobie
2008-12-07 10:49 . 2008-12-07 10:49 82 --a------ c:\windows\netdet.ini
2008-12-07 10:49 . 2008-12-07 10:49 0 --ah----- c:\windows\91216742
2008-12-07 10:35 . 2008-12-07 10:50 <DIR> d-------- c:\program files\Minos album
2008-12-07 10:35 . 2008-06-01 17:50 1,056,768 --a------ c:\windows\system32\ChilkatFtp2.dll
2008-12-07 10:35 . 2007-01-08 14:26 856,064 --a------ c:\windows\system32\SWFGen.dll
2008-12-07 10:35 . 2007-02-14 11:49 781,824 --a------ c:\windows\system32\VBOLock.ocx
2008-12-07 10:35 . 2007-11-08 19:04 569,344 --a------ c:\windows\system32\Zip2Exe.dll
2008-12-07 10:35 . 2001-06-27 13:56 233,472 --a------ c:\windows\system32\TidyCOM.dll
2008-12-07 10:35 . 2004-03-09 12:00 132,880 --a------ c:\windows\system32\msinet.ocx
2008-12-07 10:35 . 2000-10-01 23:00 102,160 --a------ c:\windows\system32\VB6CHT.DLL
2008-12-07 10:35 . 2008-05-20 10:11 69,632 --a------ c:\windows\system32\OFBrowser.ocx
2008-12-07 10:35 . 1998-07-05 23:00 28,160 --a------ c:\windows\system32\CMDLGCHT.DLL
2008-12-07 10:35 . 2001-10-10 10:08 20,530 --a------ c:\windows\system32\scrrncht.dll
2008-12-07 10:35 . 1998-07-05 23:00 14,336 --a------ c:\windows\system32\WINSKCHT.DLL
2008-12-07 10:35 . 1998-07-05 23:00 13,824 --a------ c:\windows\system32\INETCHT.DLL
2008-12-07 10:32 . 2008-12-07 10:32 <DIR> d-------- c:\documents and settings\Kozmér Árpád\Application Data\IDimager
2008-12-07 10:32 . 2008-12-07 10:32 <DIR> d-------- c:\documents and settings\Kozmér Árpád\Application Data\IDimager
2008-12-07 10:32 . 2008-12-07 10:32 <DIR> d-------- c:\documents and settings\Kozmér Árpád\Application Data\Anthropics
2008-12-07 10:32 . 2008-12-07 10:32 <DIR> d-------- c:\documents and settings\Kozmér Árpád\Application Data\Anthropics
2008-12-07 10:00 . 2008-12-27 13:11 43 --a------ c:\windows\FFS20ChtReg.ini
2008-12-07 09:59 . 2008-12-07 09:59 <DIR> d-------- c:\documents and settings\Kozmér Árpád\Application Data\Reallusion
2008-12-07 09:59 . 2008-12-07 09:59 <DIR> d-------- c:\documents and settings\Kozmér Árpád\Application Data\Reallusion
2008-12-07 09:33 . 2008-12-27 12:04 <DIR> d-------- c:\documents and settings\Kozmér Árpád\Application Data\ZCDream
2008-12-07 09:33 . 2008-12-27 12:04 <DIR> d-------- c:\documents and settings\Kozmér Árpád\Application Data\ZCDream
2008-12-07 09:32 . 2008-12-07 09:32 <DIR> d-------- C:\ZC Dream Photo Editor
2008-12-07 09:18 . 2008-12-07 09:18 <DIR> d-------- c:\program files\Serif
2008-12-03 13:29 . 2008-12-03 13:29 <DIR> d-------- c:\program files\iTunes
2008-12-03 13:29 . 2008-12-03 13:29 <DIR> d-------- c:\program files\iPod
2008-12-03 13:29 . 2008-12-03 13:29 <DIR> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-03 13:27 . 2008-12-03 13:27 <DIR> d-------- c:\program files\QuickTime
2008-12-03 13:26 . 2008-12-03 13:26 <DIR> d-------- c:\program files\Apple Software Update
2008-12-02 18:44 . 2008-12-03 18:01 <DIR> d-------- C:\Ringtones
2008-12-02 18:40 . 2008-12-03 18:10 <DIR> d-------- c:\documents and settings\Kozmér Árpád\Application Data\iPhoneRingToneMaker
2008-12-02 18:40 . 2008-12-03 18:10 <DIR> d-------- c:\documents and settings\Kozmér Árpád\Application Data\iPhoneRingToneMaker
2008-12-01 16:14 . 2008-12-03 11:39 54,156 --ah----- c:\windows\QTFont.qfn
2008-12-01 16:14 . 2008-12-01 16:14 1,409 --a------ c:\windows\QTFont.for
2008-12-01 16:13 . 2008-12-03 13:29 <DIR> d-------- c:\program files\Common Files\Apple
2008-12-01 16:13 . 2008-11-07 14:23 32,000 --a------ c:\windows\system32\drivers\usbaapl.sys
2008-12-01 16:12 . 2008-12-01 16:12 <DIR> d-------- c:\documents and settings\All Users\Application Data\Apple
2008-11-28 23:13 . 2008-11-28 23:13 <DIR> d-------- c:\documents and settings\LocalService\Application Data\Xfire

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-28 12:53 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\uTorrent
2008-12-28 12:53 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\uTorrent
2008-12-28 09:05 137,688 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2008-12-27 17:09 --------- d-----w c:\program files\Omega One
2008-12-27 11:14 --------- d-----w c:\program files\Image-Line
2008-12-27 11:11 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-27 11:11 --------- d-----w c:\program files\ArcSoft
2008-12-27 11:05 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\ArcSoft
2008-12-27 11:05 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\ArcSoft
2008-12-24 13:10 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\LimeWire
2008-12-24 13:10 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\LimeWire
2008-12-22 16:26 --------- d-----w c:\program files\Activision
2008-12-22 16:05 --------- d-----w c:\program files\The Cleaner Demo
2008-12-22 16:00 --------- d-----w c:\program files\Rockstar Games
2008-12-21 14:39 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\Xfire
2008-12-21 14:39 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\Xfire
2008-12-19 14:23 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\BSplayer
2008-12-19 14:23 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\BSplayer
2008-12-17 14:18 --------- d-----w c:\program files\Xfire
2008-12-14 13:04 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\gtk-2.0
2008-12-14 13:04 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\gtk-2.0
2008-12-10 19:28 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-12-10 15:22 --------- d-----w c:\program files\Call of Duty
2008-12-08 17:25 --------- d-----w c:\program files\THQ
2008-12-07 10:01 --------- d-----w c:\program files\Warcraft III
2008-12-03 15:34 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\Apple Computer
2008-12-03 15:34 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\Apple Computer
2008-12-03 12:28 --------- d-----w c:\program files\Bonjour
2008-12-03 12:27 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2008-12-02 13:03 --------- d-----w c:\program files\Messenger Plus! Live
2008-11-28 22:10 --------- d-----w c:\program files\Java
2008-11-23 16:59 --------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2008-11-23 14:54 --------- d-----w c:\program files\Recolored
2008-11-23 12:13 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-11-21 15:10 --------- d-----w c:\documents and settings\NetworkService\Application Data\Xfire
2008-11-20 12:17 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller
2008-11-18 21:45 --------- d-----w c:\program files\Circle Developement
2008-11-18 20:57 5,376 ----a-w c:\windows\system32\drivers\MS1000.sys
2008-11-18 17:50 --------- d-----w c:\program files\Microsoft Games
2008-11-18 17:37 --------- d-----w c:\program files\DIFX
2008-11-18 17:10 --------- d-----w c:\program files\Windows Live
2008-11-17 11:07 --------- d-----w c:\program files\VstPlugins
2008-11-16 22:00 --------- d-----w c:\program files\OpenMortal
2008-11-16 14:07 --------- d-----w c:\program files\DreamLight Photo Editor
2008-11-16 14:04 --------- d-----w c:\program files\Magic Photo Editor
2008-11-11 14:07 --------- d-----w c:\program files\SEGA
2008-11-10 15:51 --------- d-----w c:\program files\Electronic Arts
2008-11-10 12:58 --------- d-----w c:\program files\PowerISO
2008-11-08 11:32 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\Microsoft Games
2008-11-08 11:32 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\Microsoft Games
2008-11-07 13:12 --------- d-----w c:\program files\Microsoft ActiveSync
2008-11-06 18:08 --------- d-----w c:\program files\TuneUp Utilities 2008
2008-11-06 18:07 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-11-06 18:07 --------- d-----w c:\documents and settings\All Users\Application Data\TuneUp Software
2008-11-05 20:07 --------- d-----w c:\program files\Avanquest update
2008-11-05 19:20 --------- d-----w c:\program files\FDRLab
2008-11-04 19:07 --------- d-----w c:\program files\JavaSoft
2008-11-03 18:52 --------- d-----w c:\program files\VirtualDJ
2008-11-03 18:39 --------- d-----w c:\program files\FreeNinjaSurfing
2008-11-03 08:48 --------- d-----w c:\program files\NinjaSurfing
2008-11-02 15:47 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\Hide IP NG
2008-11-02 15:47 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\Hide IP NG
2008-11-02 09:45 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\Capcom
2008-11-02 09:45 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\Capcom
2008-11-02 08:44 56,572 ----a-w c:\windows\system32\drivers\scdemu.sys
2008-11-01 12:51 --------- d-----w c:\program files\Wondershare
2008-11-01 12:23 --------- d-----w c:\program files\Common Files\Download Manager
2008-10-31 12:08 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\Leadertech
2008-10-31 12:08 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\Leadertech
2008-10-31 09:24 --------- d-----w c:\program files\Gimp-2.0
2008-10-31 08:51 --------- d-----w c:\documents and settings\All Users\Application Data\BVRP Software
2008-10-31 08:49 --------- d-----w c:\program files\Sony Ericsson
2008-10-31 08:49 --------- d-----w c:\documents and settings\All Users\Application Data\Sony Ericsson
2008-10-31 08:40 --------- d-----w c:\program files\Astroart4 Demo
2008-10-31 08:22 73,216 ----a-w c:\windows\ST6UNST.EXE
2008-10-31 08:22 249,856 ------w c:\windows\Setup1.exe
2008-08-29 15:58 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008082920080830\index.dat
.

((((((((((((((((((((((((((((( snapshot@2008-12-28_12.24.15.21 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-04-14 16:02:16 3,095 ----a-w c:\windows\ios.dat
+ 2008-12-28 12:52:28 16,384 ----atw c:\windows\temp\Perflib_Perfdata_5b4.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
"Creative Live! Cam Manager"="c:\program files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe" [2006-05-31 143360]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-08-08 490952]
"Google Update"="c:\documents and settings\Kozmér Árpád\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-03 133104]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2008-02-20 360448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-06-01 7618560]
"SW20"="c:\windows\system32\sw20.exe" [2006-05-18 208896]
"SW24"="c:\windows\system32\sw24.exe" [2006-05-17 69632]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2007-12-20 37376]
"Gigaget"="c:\program files\Giganology\Gigaget\GigagetShell.exe" [2006-02-07 495616]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"AVFX Engine"="c:\program files\Creative\Creative Live! Cam\VideoFX\StartFX.exe" [2006-06-09 24576]
"V0220Mon.exe"="c:\windows\V0220Mon.exe" [2006-05-16 28672]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-09-28 185896]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-10-11 75304]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2008-09-27 951624]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 63712]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2008-11-02 167936]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-28 136600]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"nwiz"="nwiz.exe" [2006-06-01 c:\windows\system32\nwiz.exe]
"NvMediaCenter"="NvMCTray.dll" [2006-06-01 c:\windows\system32\nvmctray.dll]
"SoundMan"="SOUNDMAN.EXE" [2006-03-01 c:\windows\soundman.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= ffdshow.ax
"VIDC.XFR1"= xfcodec.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Giganology\\Gigaget\\Gigaget.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Xfire\\xfire.exe"=
"c:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"=
"d:\\Documents and Settings\\Kozmér Árpád\\Dokumentumok\\Videók\\WLM Lite 8.5.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Microsoft Games\\Age of Empires III\\age3.exe"=
"c:\\Program Files\\MC2\\Sniper Elite\\SniperElite.exe"=
"c:\\Program Files\\Call of Duty\\CoDMP.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaW.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaWmp.exe"=
"c:\\Documents and Settings\\Kozmér Árpád\\Dokumentumok\\First to Fight\\CCF2F.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2008-09-27 15160]
R1 sp_rsdrv2;Spyware Terminator Driver 2;\??\c:\windows\system32\drivers\sp_rsdrv2.sys [2008-12-28 141312]
R3 V0220Dev;Live! Cam Video IM;c:\windows\system32\DRIVERS\V0220Dev.sys [2008-08-13 145472]
R3 V0220Vfx;V0220VFX;c:\windows\system32\DRIVERS\V0220Vfx.sys [2008-08-13 6272]
S3 a016bus;Sony Ericsson Device A016 driver (WDM);c:\windows\system32\DRIVERS\a016bus.sys [2008-10-31 83880]
S3 a016mdfl;Sony Ericsson Device A016 USB WMC Modeme Filter;c:\windows\system32\DRIVERS\a016mdfl.sys [2008-10-31 15016]
S3 a016mdm;Sony Ericsson Device A016 USB WMC Modem Driver;c:\windows\system32\DRIVERS\a016mdm.sys [2008-10-31 110504]
S3 a016mgmt;Sony Ericsson Device A016 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\a016mgmt.sys [2008-10-31 104488]
S3 a016obex;Sony Ericsson Device A016 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\a016obex.sys [2008-10-31 100648]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder

2008-12-28 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [2008-06-20 09:09]

2008-12-19 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2008-12-27 c:\windows\Tasks\GoogleUpdateTaskUser.job
- c:\documents and settings\Kozm []
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.bsplayer-search.com/startpage
uInternet Settings,ProxyOverride = *.local
IE: &Download All by Gigaget - c:\program files\Giganology\Gigaget\getallurl.htm
IE: &Download by Gigaget - c:\program files\Giganology\Gigaget\geturl.htm
IE: Crawler Search - tbr:iemenu
IE: Download ALL with IDA
IE: Download with IDA
IE: E&xportálás a Microsoft Excel programba - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Easy-WebPrint – Gyors nyomtatás - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
IE: Easy-WebPrint – Hozzáadás a nyomtatási listához - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
IE: Easy-WebPrint – Nyomtatás - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
IE: Easy-WebPrint – Nyomtatási kép - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
LSP: c:\windows\system32\imon.dll
TCP: {5B3F1D2A-AE8D-40C3-84AE-747069036762} = 217.145.192.3,217.145.194.1
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\Toolbar\ctbr.dll
FF - ProfilePath - c:\documents and settings\Kozmér Árpád\Application Data\Mozilla\Firefox\Profiles\8czi84zz.default\
FF - prefs.js: browser.search.selectedEngine - BS.Player Search
FF - prefs.js: browser.startup.homepage - google.hu
FF - component: c:\program files\BS.Player ControlBar\FirefoxDTT\components\BSToolbarFF.dll
FF - component: c:\program files\Crawler\Toolbar\firefox\components\xcomm.dll
FF - component: c:\program files\Crawler\Toolbar\firefox\components\xshared.dll
FF - component: c:\program files\Crawler\Toolbar\firefox\components\xsupport.dll
FF - component: c:\program files\Crawler\Toolbar\firefox\components\xwsg.dll
FF - component: c:\program files\DAEMON Tools Toolbar\FirefoxDTT\components\DTToolbarFF.dll
FF - component: c:\program files\Mozilla Firefox\components\iamfamous.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-28 13:52:46
Windows 5.1.2600 Szervizcsomag 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(776)
c:\windows\system32\imon.dll
c:\program files\Eset\pr_imon.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\ESET\nod32krn.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\PnkBstrB.exe
c:\program files\Spyware Terminator\sp_rsser.exe
c:\progra~1\MI3AA1~1\rapimgr.exe
c:\program files\uTorrent\uTorrent.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Java\jre6\bin\jucheck.exe
.
**************************************************************************
.
Completion time: 2008-12-28 13:58:41 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-28 12:58:38
ComboFix2.txt 2008-12-28 11:24:52

Pre-Run: 4 137 029 632 bájt szabad
Post-Run: 4,072,800,256 bájt szabad

332 --- E O F --- 2008-12-18 21:08:18




itt az uj Combo -log!

Kinyitod a Notepadot>Start>futatas>beirod notepad
Es bemasolod a piros textet

Mostan>a notepadon elso full-fajl>ballfelsosarokban>4-sor>lementenni mint....
A txt-hejetfajlnev beteszed eztett>CFScript.txt<alatta bealitod >minden fajl<
legfelull>asztall i<klik gomb letenni.Es mostan megcsinalod eztett:

A combofix maga elindul es lehet hogy restartol es befejezi a scent.Amit majd ad ted ide Es az uj HijackThis logjat ted ide OK

a hijackot itt nezd hogy kel csinalnod
http://forum.terminal.hu/viewtopic.php?t=35889

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:34:08, on 2008.12.28.
Platform: Windows XP Szervizcsomag 3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
C:\WINDOWS\V0220Mon.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Documents and Settings\Kozmér Árpád\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Kozmér Árpád\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Kozmér Árpád\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Documents and Settings\Kozmér Árpád\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bsplayer-search.com/startpage
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hivatkozások
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: GigagetIEHelper - {111CAA23-6F4F-42AC-8555-B48C1D87BBAB} - C:\WINDOWS\system32\gigagetbho_v10.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live bejelentkezési segítség - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: GigaNet.com - {DE2C5EF2-DFBF-49B0-BBF2-3B2805A52722} - C:\WINDOWS\system32\dhofozr.dll
O2 - BHO: ExtractorPlugin Class - {E49C2526-26BF-499f-912F-B97B44814087} - (no file)
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Acmeta Fragmento - {807DADF1-18CF-4a7f-8792-8443C960E055} - (no file)
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: BS.Player ControlBar - {2C688203-7EB3-4327-9995-1CB417BA23F9} - C:\Program Files\BS.Player ControlBar\BSToolbar.dll
O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SW20] C:\WINDOWS\system32\sw20.exe
O4 - HKLM\..\Run: [SW24] C:\WINDOWS\system32\sw24.exe
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Gigaget] "C:\Program Files\Giganology\Gigaget\GigagetShell.exe" /s
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [AVFX Engine] C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
O4 - HKLM\..\Run: [V0220Mon.exe] C:\WINDOWS\V0220Mon.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Kozmér Árpád\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Aero Sidebar.lnk = G:\Progik\Best Vista Theme 4 XP\Theme\Aero Sidebar Longhorn.exe
O4 - Startup: µTorrent.lnk = C:\Program Files\uTorrent\uTorrent.exe
O8 - Extra context menu item: &Download All by Gigaget - C:\Program Files\Giganology\Gigaget\getallurl.htm
O8 - Extra context menu item: &Download by Gigaget - C:\Program Files\Giganology\Gigaget\geturl.htm
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xportálás a Microsoft Excel programba - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint – Gyors nyomtatás - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint – Hozzáadás a nyomtatási listához - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint – Nyomtatás - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint – Nyomtatási kép - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O9 - Extra button: Küldés a OneNote programba - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Kül&dés a OneNote programba - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Mobil kedvenc létrehozása... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 1825195562
O17 - HKLM\System\CCS\Services\Tcpip\..\{5B3F1D2A-AE8D-40C3-84AE-747069036762}: NameServer = 217.145.192.3,217.145.194.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{5B3F1D2A-AE8D-40C3-84AE-747069036762}: NameServer = 217.145.192.3,217.145.194.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{5B3F1D2A-AE8D-40C3-84AE-747069036762}: NameServer = 217.145.192.3,217.145.194.1
O17 - HKLM\System\CS3\Services\Tcpip\..\{5B3F1D2A-AE8D-40C3-84AE-747069036762}: NameServer = 217.145.192.3,217.145.194.1
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 12389 bytes

ComboFix 08-12-26.03 - Kozmér Árpád 2008-12-28 12:15:12.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1038.18.1534.1018 [GMT 1:00]
Running from: c:\documents and settings\Kozmér Árpád\Asztal\ComboFix.exe
Command switches used :: c:\documents and settings\Kozmér Árpád\Asztal\CFScript.txt
AV: ESET NOD32 Antivirus System 2.70 *On-access scanning disabled* (Outdated)
* Created a new restore point
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
c:\windows\_MSRSTRT.EXE
c:\windows\ios.dat
c:\windows\system32\knzg.dll
c:\windows\system32\m3.ico
c:\windows\system32\sf.ico
H:\sal.xls.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Kozmér Árpád\Favorites\Cheap Pharmacy Online.url
c:\documents and settings\Kozmér Árpád\Favorites\Search Online.url
c:\documents and settings\Kozmér Árpád\Favorites\SMS TRAP.url
c:\documents and settings\Kozmér Árpád\Favorites\VIP Casino.url
c:\program files\Mozilla Firefox\components\iamfamous.dll
C:\resycled
c:\resycled\boot.com
c:\windows\ios.dat
c:\windows\system32\404Fix.exe
c:\windows\system32\c.ico
c:\windows\system32\drivers\msqpdxdukxqapb.sys
c:\windows\system32\drivers\msqpdxjeblgibo.sys
c:\windows\system32\dumphive.exe
c:\windows\system32\m.ico
c:\windows\system32\m3.ico
c:\windows\system32\msqpdxpesoirrn.dll
c:\windows\system32\p.ico
c:\windows\system32\Process.exe
c:\windows\system32\s.ico
c:\windows\system32\sf.ico
c:\windows\system32\SrchSTS.exe
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe
D:\Autorun.inf
D:\resycled
d:\resycled\boot.com
H:\autorun.inf
H:\resycled
h:\resycled\boot.com

.
((((((((((((((((((((((((( Files Created from 2008-11-28 to 2008-12-28 )))))))))))))))))))))))))))))))
.

2008-12-28 09:49 . 2008-12-28 09:49 <DIR> d-------- c:\program files\Lavasoft
2008-12-28 09:37 . 2008-12-28 10:18 <DIR> d-------- c:\program files\Spyware Terminator
2008-12-28 09:37 . 2008-12-28 09:37 <DIR> d-------- c:\program files\Crawler
2008-12-28 09:37 . 2008-12-28 10:20 <DIR> d-------- c:\documents and settings\Kozmér Árpád\Application Data\Spyware Terminator
2008-12-28 09:37 . 2008-12-28 10:20 <DIR> d-------- c:\documents and settings\Kozmér Árpád\Application Data\Spyware Terminator
2008-12-28 09:37 . 2008-12-28 10:19 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spyware Terminator
2008-12-28 09:37 . 2008-12-28 09:37 141,312 --a------ c:\windows\system32\drivers\sp_rsdrv2.sys
2008-12-27 14:55 . 2008-12-27 14:57 <DIR> d-------- c:\program files\Portrait Professional Max 6
2008-12-27 11:12 . 2008-12-27 11:12 167,936 --a------ c:\windows\system32\dhofozr.dll
2008-12-21 12:59 . 2008-12-23 14:43 7,680 --ahs---- c:\windows\Thumbs.db
2008-12-19 15:22 . 2008-12-19 15:23 <DIR> d-------- c:\program files\BS.Player ControlBar
2008-12-19 13:18 . 2008-12-19 14:10 <DIR> d-------- c:\program files\vanBasco's Karaoke Player
2008-12-14 16:41 . 2008-12-14 16:55 <DIR> d-------- c:\program files\SpeedFan
2008-12-14 16:41 . 2008-12-14 16:41 45 --a------ c:\windows\system32\initdebug.nfo
2008-12-11 21:37 . 2008-12-11 21:37 42,320 --a------ c:\windows\system32\xfcodec.dll
2008-12-11 21:33 . 2008-12-11 21:33 <DIR> d-------- c:\program files\PerfMon3x
2008-12-11 21:28 . 2008-12-11 21:28 <DIR> d-------- c:\program files\Lavalys
2008-12-11 17:04 . 2008-12-11 17:04 22,328 --a------ c:\documents and settings\Kozmér Árpád\Application Data\PnkBstrK.sys
2008-12-11 17:04 . 2008-12-11 17:04 22,328 --a------ c:\documents and settings\Kozmér Árpád\Application Data\PnkBstrK.sys
2008-12-11 17:04 . 2008-12-11 17:04 319 --a------ c:\windows\game.ini
2008-12-08 20:29 . 2008-12-08 20:29 <DIR> d-------- c:\program files\Infogrames
2008-12-08 20:04 . 2008-12-08 20:11 <DIR> d-------- c:\documents and settings\Kozmér Árpád\Application Data\Hamachi
2008-12-08 20:04 . 2008-12-08 20:11 <DIR> d-------- c:\documents and settings\Kozmér Árpád\Application Data\Hamachi
2008-12-08 20:03 . 2008-12-08 20:03 25,280 --a------ c:\windows\system32\drivers\hamachi.sys
2008-12-08 18:50 . 2008-12-08 18:50 <DIR> d-------- c:\windows\S.T.A.L.K.E.R. magyar fordítás
2008-12-08 18:14 . 2008-12-08 18:14 <DIR> d-------- c:\documents and settings\All Users\Application Data\NVIDIA
2008-12-07 12:54 . 2008-05-30 14:11 3,850,760 --a------ c:\windows\system32\D3DX9_38.dll
2008-12-07 12:54 . 2008-05-30 14:11 1,491,992 --a------ c:\windows\system32\D3DCompiler_38.dll
2008-12-07 12:54 . 2008-05-30 14:19 507,400 --a------ c:\windows\system32\XAudio2_1.dll
2008-12-07 12:54 . 2008-05-30 14:11 467,984 --a------ c:\windows\system32\d3dx10_38.dll
2008-12-07 12:54 . 2008-05-30 14:18 238,088 --a------ c:\windows\system32\xactengine3_1.dll
2008-12-07 12:54 . 2008-05-30 14:17 65,032 --a------ c:\windows\system32\XAPOFX1_0.dll
2008-12-07 12:54 . 2008-05-30 14:17 25,608 --a------ c:\windows\system32\X3DAudio1_4.dll
2008-12-07 12:53 . 2008-12-07 12:53 <DIR> d-------- c:\windows\Logs
2008-12-07 12:51 . 2008-12-07 12:51 <DIR> d-------- c:\windows\system32\xlive
2008-12-07 12:51 . 2008-12-07 13:40 <DIR> d-------- c:\program files\Microsoft Games for Windows - LIVE
2008-12-07 10:50 . 2008-12-07 10:52 <DIR> d-------- c:\program files\Photobie
2008-12-07 10:49 . 2008-12-07 10:49 82 --a------ c:\windows\netdet.ini
2008-12-07 10:49 . 2008-12-07 10:49 0 --ah----- c:\windows\91216742
2008-12-07 10:35 . 2008-12-07 10:50 <DIR> d-------- c:\program files\Minos album
2008-12-07 10:35 . 2008-06-01 17:50 1,056,768 --a------ c:\windows\system32\ChilkatFtp2.dll
2008-12-07 10:35 . 2007-01-08 14:26 856,064 --a------ c:\windows\system32\SWFGen.dll
2008-12-07 10:35 . 2007-02-14 11:49 781,824 --a------ c:\windows\system32\VBOLock.ocx
2008-12-07 10:35 . 2007-11-08 19:04 569,344 --a------ c:\windows\system32\Zip2Exe.dll
2008-12-07 10:35 . 2001-06-27 13:56 233,472 --a------ c:\windows\system32\TidyCOM.dll
2008-12-07 10:35 . 2004-03-09 12:00 132,880 --a------ c:\windows\system32\msinet.ocx
2008-12-07 10:35 . 2000-10-01 23:00 102,160 --a------ c:\windows\system32\VB6CHT.DLL
2008-12-07 10:35 . 2008-05-20 10:11 69,632 --a------ c:\windows\system32\OFBrowser.ocx
2008-12-07 10:35 . 1998-07-05 23:00 28,160 --a------ c:\windows\system32\CMDLGCHT.DLL
2008-12-07 10:35 . 2001-10-10 10:08 20,530 --a------ c:\windows\system32\scrrncht.dll
2008-12-07 10:35 . 1998-07-05 23:00 14,336 --a------ c:\windows\system32\WINSKCHT.DLL
2008-12-07 10:35 . 1998-07-05 23:00 13,824 --a------ c:\windows\system32\INETCHT.DLL
2008-12-07 10:32 . 2008-12-07 10:32 <DIR> d-------- c:\documents and settings\Kozmér Árpád\Application Data\IDimager
2008-12-07 10:32 . 2008-12-07 10:32 <DIR> d-------- c:\documents and settings\Kozmér Árpád\Application Data\IDimager
2008-12-07 10:32 . 2008-12-07 10:32 <DIR> d-------- c:\documents and settings\Kozmér Árpád\Application Data\Anthropics
2008-12-07 10:32 . 2008-12-07 10:32 <DIR> d-------- c:\documents and settings\Kozmér Árpád\Application Data\Anthropics
2008-12-07 10:00 . 2008-12-27 13:11 43 --a------ c:\windows\FFS20ChtReg.ini
2008-12-07 09:59 . 2008-12-07 09:59 <DIR> d-------- c:\documents and settings\Kozmér Árpád\Application Data\Reallusion
2008-12-07 09:59 . 2008-12-07 09:59 <DIR> d-------- c:\documents and settings\Kozmér Árpád\Application Data\Reallusion
2008-12-07 09:33 . 2008-12-27 12:04 <DIR> d-------- c:\documents and settings\Kozmér Árpád\Application Data\ZCDream
2008-12-07 09:33 . 2008-12-27 12:04 <DIR> d-------- c:\documents and settings\Kozmér Árpád\Application Data\ZCDream
2008-12-07 09:32 . 2008-12-07 09:32 <DIR> d-------- C:\ZC Dream Photo Editor
2008-12-07 09:18 . 2008-12-07 09:18 <DIR> d-------- c:\program files\Serif
2008-12-03 13:29 . 2008-12-03 13:29 <DIR> d-------- c:\program files\iTunes
2008-12-03 13:29 . 2008-12-03 13:29 <DIR> d-------- c:\program files\iPod
2008-12-03 13:29 . 2008-12-03 13:29 <DIR> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-03 13:27 . 2008-12-03 13:27 <DIR> d-------- c:\program files\QuickTime
2008-12-03 13:26 . 2008-12-03 13:26 <DIR> d-------- c:\program files\Apple Software Update
2008-12-02 18:44 . 2008-12-03 18:01 <DIR> d-------- C:\Ringtones
2008-12-02 18:40 . 2008-12-03 18:10 <DIR> d-------- c:\documents and settings\Kozmér Árpád\Application Data\iPhoneRingToneMaker
2008-12-02 18:40 . 2008-12-03 18:10 <DIR> d-------- c:\documents and settings\Kozmér Árpád\Application Data\iPhoneRingToneMaker
2008-12-01 16:14 . 2008-12-03 11:39 54,156 --ah----- c:\windows\QTFont.qfn
2008-12-01 16:14 . 2008-12-01 16:14 1,409 --a------ c:\windows\QTFont.for
2008-12-01 16:13 . 2008-12-03 13:29 <DIR> d-------- c:\program files\Common Files\Apple
2008-12-01 16:13 . 2008-11-07 14:23 32,000 --a------ c:\windows\system32\drivers\usbaapl.sys
2008-12-01 16:12 . 2008-12-01 16:12 <DIR> d-------- c:\documents and settings\All Users\Application Data\Apple
2008-11-28 23:13 . 2008-11-28 23:13 <DIR> d-------- c:\documents and settings\LocalService\Application Data\Xfire

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-28 11:19 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\uTorrent
2008-12-28 11:19 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\uTorrent
2008-12-28 09:05 137,688 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2008-12-27 17:09 --------- d-----w c:\program files\Omega One
2008-12-27 11:14 --------- d-----w c:\program files\Image-Line
2008-12-27 11:11 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-27 11:11 --------- d-----w c:\program files\ArcSoft
2008-12-27 11:05 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\ArcSoft
2008-12-27 11:05 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\ArcSoft
2008-12-24 13:10 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\LimeWire
2008-12-24 13:10 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\LimeWire
2008-12-22 16:26 --------- d-----w c:\program files\Activision
2008-12-22 16:05 --------- d-----w c:\program files\The Cleaner Demo
2008-12-22 16:00 --------- d-----w c:\program files\Rockstar Games
2008-12-21 14:39 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\Xfire
2008-12-21 14:39 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\Xfire
2008-12-19 14:23 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\BSplayer
2008-12-19 14:23 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\BSplayer
2008-12-17 14:18 --------- d-----w c:\program files\Xfire
2008-12-14 13:04 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\gtk-2.0
2008-12-14 13:04 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\gtk-2.0
2008-12-10 19:28 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-12-10 15:22 --------- d-----w c:\program files\Call of Duty
2008-12-08 17:25 --------- d-----w c:\program files\THQ
2008-12-07 10:01 --------- d-----w c:\program files\Warcraft III
2008-12-03 15:34 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\Apple Computer
2008-12-03 15:34 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\Apple Computer
2008-12-03 12:28 --------- d-----w c:\program files\Bonjour
2008-12-03 12:27 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2008-12-02 13:03 --------- d-----w c:\program files\Messenger Plus! Live
2008-11-28 22:10 --------- d-----w c:\program files\Java
2008-11-23 16:59 --------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2008-11-23 14:54 --------- d-----w c:\program files\Recolored
2008-11-23 12:13 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-11-21 15:10 --------- d-----w c:\documents and settings\NetworkService\Application Data\Xfire
2008-11-20 12:17 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller
2008-11-18 21:45 --------- d-----w c:\program files\Circle Developement
2008-11-18 20:57 5,376 ----a-w c:\windows\system32\drivers\MS1000.sys
2008-11-18 17:50 --------- d-----w c:\program files\Microsoft Games
2008-11-18 17:37 --------- d-----w c:\program files\DIFX
2008-11-18 17:10 --------- d-----w c:\program files\Windows Live
2008-11-17 11:07 --------- d-----w c:\program files\VstPlugins
2008-11-16 22:00 --------- d-----w c:\program files\OpenMortal
2008-11-16 14:07 --------- d-----w c:\program files\DreamLight Photo Editor
2008-11-16 14:04 --------- d-----w c:\program files\Magic Photo Editor
2008-11-11 14:07 --------- d-----w c:\program files\SEGA
2008-11-10 15:51 --------- d-----w c:\program files\Electronic Arts
2008-11-10 12:58 --------- d-----w c:\program files\PowerISO
2008-11-08 11:32 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\Microsoft Games
2008-11-08 11:32 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\Microsoft Games
2008-11-07 13:12 --------- d-----w c:\program files\Microsoft ActiveSync
2008-11-06 18:08 --------- d-----w c:\program files\TuneUp Utilities 2008
2008-11-06 18:07 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-11-06 18:07 --------- d-----w c:\documents and settings\All Users\Application Data\TuneUp Software
2008-11-05 20:07 --------- d-----w c:\program files\Avanquest update
2008-11-05 19:20 --------- d-----w c:\program files\FDRLab
2008-11-04 19:07 --------- d-----w c:\program files\JavaSoft
2008-11-03 18:52 --------- d-----w c:\program files\VirtualDJ
2008-11-03 18:39 --------- d-----w c:\program files\FreeNinjaSurfing
2008-11-03 08:48 --------- d-----w c:\program files\NinjaSurfing
2008-11-02 15:47 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\Hide IP NG
2008-11-02 15:47 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\Hide IP NG
2008-11-02 09:45 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\Capcom
2008-11-02 09:45 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\Capcom
2008-11-02 08:44 56,572 ----a-w c:\windows\system32\drivers\scdemu.sys
2008-11-01 12:51 --------- d-----w c:\program files\Wondershare
2008-11-01 12:23 --------- d-----w c:\program files\Common Files\Download Manager
2008-10-31 12:08 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\Leadertech
2008-10-31 12:08 --------- d-----w c:\documents and settings\Kozmér Árpád\Application Data\Leadertech
2008-10-31 09:24 --------- d-----w c:\program files\Gimp-2.0
2008-10-31 08:51 --------- d-----w c:\documents and settings\All Users\Application Data\BVRP Software
2008-10-31 08:49 --------- d-----w c:\program files\Sony Ericsson
2008-10-31 08:49 --------- d-----w c:\documents and settings\All Users\Application Data\Sony Ericsson
2008-10-31 08:40 --------- d-----w c:\program files\Astroart4 Demo
2008-10-31 08:22 73,216 ----a-w c:\windows\ST6UNST.EXE
2008-10-31 08:22 249,856 ------w c:\windows\Setup1.exe
2008-08-29 15:58 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008082920080830\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DE2C5EF2-DFBF-49B0-BBF2-3B2805A52722}]
2008-12-27 11:12 167936 --a------ c:\windows\system32\dhofozr.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
"Creative Live! Cam Manager"="c:\program files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe" [2006-05-31 143360]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-08-08 490952]
"Google Update"="c:\documents and settings\Kozmér Árpád\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-03 133104]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2008-02-20 360448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-06-01 7618560]
"SW20"="c:\windows\system32\sw20.exe" [2006-05-18 208896]
"SW24"="c:\windows\system32\sw24.exe" [2006-05-17 69632]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2007-12-20 37376]
"Gigaget"="c:\program files\Giganology\Gigaget\GigagetShell.exe" [2006-02-07 495616]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"AVFX Engine"="c:\program files\Creative\Creative Live! Cam\VideoFX\StartFX.exe" [2006-06-09 24576]
"V0220Mon.exe"="c:\windows\V0220Mon.exe" [2006-05-16 28672]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-09-28 185896]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-10-11 75304]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2008-09-27 951624]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 63712]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2008-11-02 167936]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-28 136600]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"nwiz"="nwiz.exe" [2006-06-01 c:\windows\system32\nwiz.exe]
"NvMediaCenter"="NvMCTray.dll" [2006-06-01 c:\windows\system32\nvmctray.dll]
"SoundMan"="SOUNDMAN.EXE" [2006-03-01 c:\windows\soundman.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= ffdshow.ax
"VIDC.XFR1"= xfcodec.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Giganology\\Gigaget\\Gigaget.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Xfire\\xfire.exe"=
"c:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"=
"d:\\Documents and Settings\\Kozmér Árpád\\Dokumentumok\\Videók\\WLM Lite 8.5.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Microsoft Games\\Age of Empires III\\age3.exe"=
"c:\\Program Files\\MC2\\Sniper Elite\\SniperElite.exe"=
"c:\\Program Files\\Call of Duty\\CoDMP.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaW.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaWmp.exe"=
"c:\\Documents and Settings\\Kozmér Árpád\\Dokumentumok\\First to Fight\\CCF2F.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2008-09-27 15160]
R1 sp_rsdrv2;Spyware Terminator Driver 2;\??\c:\windows\system32\drivers\sp_rsdrv2.sys [2008-12-28 141312]
R3 V0220Dev;Live! Cam Video IM;c:\windows\system32\DRIVERS\V0220Dev.sys [2008-08-13 145472]
R3 V0220Vfx;V0220VFX;c:\windows\system32\DRIVERS\V0220Vfx.sys [2008-08-13 6272]
S3 a016bus;Sony Ericsson Device A016 driver (WDM);c:\windows\system32\DRIVERS\a016bus.sys [2008-10-31 83880]
S3 a016mdfl;Sony Ericsson Device A016 USB WMC Modeme Filter;c:\windows\system32\DRIVERS\a016mdfl.sys [2008-10-31 15016]
S3 a016mdm;Sony Ericsson Device A016 USB WMC Modem Driver;c:\windows\system32\DRIVERS\a016mdm.sys [2008-10-31 110504]
S3 a016mgmt;Sony Ericsson Device A016 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\a016mgmt.sys [2008-10-31 104488]
S3 a016obex;Sony Ericsson Device A016 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\a016obex.sys [2008-10-31 100648]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder

2008-12-28 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [2008-06-20 09:09]

2008-12-19 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2008-12-27 c:\windows\Tasks\GoogleUpdateTaskUser.job
- c:\documents and settings\Kozm []
.
- - - - ORPHANS REMOVED - - - -

ShellExecuteHooks-{16664848-0E00-11D2-8059-000000000000} - (no file)


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.bsplayer-search.com/startpage
uInternet Settings,ProxyOverride = *.local
IE: &Download All by Gigaget - c:\program files\Giganology\Gigaget\getallurl.htm
IE: &Download by Gigaget - c:\program files\Giganology\Gigaget\geturl.htm
IE: Crawler Search - tbr:iemenu
IE: Download ALL with IDA
IE: Download with IDA
IE: E&xportálás a Microsoft Excel programba - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Easy-WebPrint – Gyors nyomtatás - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
IE: Easy-WebPrint – Hozzáadás a nyomtatási listához - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
IE: Easy-WebPrint – Nyomtatás - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
IE: Easy-WebPrint – Nyomtatási kép - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
LSP: c:\windows\system32\imon.dll
TCP: {5B3F1D2A-AE8D-40C3-84AE-747069036762} = 217.145.192.3,217.145.194.1
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\Toolbar\ctbr.dll
FF - ProfilePath - c:\documents and settings\Kozmér Árpád\Application Data\Mozilla\Firefox\Profiles\8czi84zz.default\
FF - prefs.js: browser.search.selectedEngine - BS.Player Search
FF - prefs.js: browser.startup.homepage - google.hu
FF - component: c:\program files\BS.Player ControlBar\FirefoxDTT\components\BSToolbarFF.dll
FF - component: c:\program files\Crawler\Toolbar\firefox\components\xcomm.dll
FF - component: c:\program files\Crawler\Toolbar\firefox\components\xshared.dll
FF - component: c:\program files\Crawler\Toolbar\firefox\components\xsupport.dll
FF - component: c:\program files\Crawler\Toolbar\firefox\components\xwsg.dll
FF - component: c:\program files\DAEMON Tools Toolbar\FirefoxDTT\components\DTToolbarFF.dll
FF - component: c:\program files\Mozilla Firefox\components\iamfamous.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-28 12:19:14
Windows 5.1.2600 Szervizcsomag 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(776)
c:\windows\system32\imon.dll
c:\program files\Eset\pr_imon.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\ESET\nod32krn.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\PnkBstrB.exe
c:\program files\Spyware Terminator\sp_rsser.exe
c:\progra~1\MI3AA1~1\rapimgr.exe
c:\program files\uTorrent\uTorrent.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Java\jre6\bin\jucheck.exe
.
**************************************************************************
.
Completion time: 2008-12-28 12:24:51 - machine was rebooted [Kozmér Árpád]
ComboFix-quarantined-files.txt 2008-12-28 11:24:48

Pre-Run: 3,609,296,896 bájt szabad
Post-Run: 4,070,649,856 bájt szabad

366 --- E O F --- 2008-12-18 21:08:18

udv
igen ted be ide eloszor a combofix logjat,csinalj Hijack logot utana es ted azt is ide be.

Szia Stell!

nekem is ez a problémám van !!!

Van egy kis problémám. a gépen a mappákban való navigáció során minden valahanyadik kattintáskor felugrik egy popup ablak "warning!virus detected! Attention Én! stb" ajánl egy szoftvert és aztán persze a nemre kattintok de akkor is behozza azt a szemét honlapot (http://webfreescan.cn/id/4912933/3/1/) és már halálra idegesít. láttam már eddig is nagyon hasonlókat írtak többen is és végigjátszottam a combofix-hijackthis párost is de nem történt semmi. Továbbá néhány alkalommal arról tájékoztat hogy letöltöttem egy pornó avit (persze nem tettem) és meg akarom-e nézni most. Erre nem és legalább ezután nem navigál el sehova. ugyhogy betenném a két logot hátha látsz benne valamit ami segíthet.

ne segitett amit leirtal a combogfixe-s ugyanazt csinalja még mindig nem tudnal valamit? pls segits!!! köszi!!

igy is jo,de eleg let volna a javito telepites is.
nincsen mitt.

Sziasztok!

Stell!

Köszi szépen, de közben a türelemetlen kollégám újratelepítette a rendszerét.

na varjal csinald eloszor az useinit.exe paranccsot a javito konzolarol
a D:\a te CDROM meghajto betuje,ha neked mas van akor mas betut teszel.
minden parancs uta[enter]
cd system32
copy d:\i386\userinit.ex_
expand userinit.ex_ userinit.exe
exit

cd system32
copy d:\i386\user32.dl_
expand user32.dl_user32.dll
exit

vagy igy


utana lefutatni a combofixet.

javito konzola parancsor

D: [ENTER]
CD I386 [ENTER]
EXPAND USERINIT.EX_ C:\WINDOWS\SYSTEM32 [ENTER]
exit.
vagy a masik gepemn bemasolod az userinit.exe a system32-be.

Sziasztok!

Stell!
Hálás köszönet, kipróbáljuk!

udv
igen van megoldas az user32.dll megvan ferozve,kikel cserelni a windows system32-ben
1:vagy a javito konzolan a expand parancsal
2Vagy a masik gepen bemasolni a system32 be az user32.dll fajlot a regit at nevezni.

Sziasztok!

Az egyik kollégámnak olyan problémája van, hogy Windows XP van telepítve a gépére, és nem tud bejelentkezni a gépre, mert a bejelentkezés után rögtön visszadobja a bejelentkezés lapra. Tudja valaki mi lehet az oka?
Ui.: egy másik kollégánál már volt ilyen probléma régebben, akkor az újra telepítés segített, de gondoltam megkérdezem hátha van más megoldás is.

Előre is köszi!

jo ejt en is ma mar vegzek

megcsináltam mindent
és húúúú...még egyszer utoljára:
Nagyon Köszönöm
jó éjszakát Neked

P.

igen pucold at a gepet CCleaneral a haladot nebabrald es futasd a T-Cleanert,ez a cleaner eltavolitja a programokat amit a gep gyogyitasara hasznaltal es mar nem kell,Combofix, es igy tovab
es nincsen mitt koszonod
udv

megoldódott
komolyan mondom nem győzök ámulni Rajtad
zseni vagy (az én szememben biztosan)
nagyon-nagyon köszönöm
tényleg

nagyon

bárcsak én is tudnék valamiben segíteni Neked
mégegyszer köszi

u.i.:így van még bármi tennivalóm? ccleaner, egyéb?

ok,meg a problem fen al??
ha nem leszedni a geprol a combofixet-start-futatas-bemasolni combofix /u ok

letoltod a T-Cleanert lefutatod-klik-A-enter.
http://sweb.cz/Marinus/T-Cleaner.exe

CCleanert

ezt adta

ComboFix 08-12-14.04 - Pál 2008-12-15 22:36:30.7 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1250.1.1038.18.511.256 [GMT 1:00]
Running from: c:\documents and settings\Pál\Asztal\ComboFix.exe
Command switches used :: c:\documents and settings\Pál\Asztal\CFScript.txt
* Created a new restore point
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
c:\windows\_MSRSTRT.EXE
c:\windows\ios.dat
c:\windows\system32\knzg.dll
c:\windows\system32\m3.ico
c:\windows\system32\sf.ico
H:\sal.xls.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\_MSRSTRT.EXE
c:\windows\ios.dat
c:\windows\system32\knzg.dll
c:\windows\system32\m3.ico
c:\windows\system32\sf.ico

.
((((((((((((((((((((((((( Files Created from 2008-11-15 to 2008-12-15 )))))))))))))))))))))))))))))))
.

2008-12-15 20:14 . 2008-12-15 20:26 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-15 20:14 . 2008-12-15 20:14 <DIR> d-------- c:\documents and settings\Pál\Application Data\Malwarebytes
2008-12-15 20:14 . 2008-12-15 20:14 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-15 20:14 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-15 20:14 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-15 19:28 . 2008-12-15 19:28 <DIR> d-------- c:\program files\Trend Micro
2008-12-15 01:09 . 2008-12-15 21:46 <DIR> d-------- c:\program files\Browser Hijack Recover
2008-12-15 01:09 . 2008-12-15 01:09 0 --a------ c:\windows\system32\8104297.jun
2008-12-15 01:00 . 2008-12-15 01:00 <DIR> d-------- c:\program files\CCleaner
2008-12-15 00:54 . 2008-12-15 00:54 <DIR> d-------- c:\program files\Combofix
2008-12-14 23:03 . 2008-12-14 23:02 512,096 --a------ c:\windows\system32\drivers\amon.sys
2008-12-14 23:03 . 2008-12-14 23:02 298,104 --a------ c:\windows\system32\imon.dll
2008-12-14 23:03 . 2008-12-14 23:02 15,424 --a------ c:\windows\system32\drivers\nod32drv.sys
2008-12-14 23:02 . 2008-12-15 00:49 <DIR> d-------- c:\program files\ESET
2008-12-14 20:59 . 2008-12-14 20:59 <DIR> d-------- c:\program files\Lavasoft
2008-12-14 20:59 . 2008-12-14 21:00 <DIR> d-------- c:\documents and settings\All Users\Application Data\Lavasoft
2008-12-14 20:58 . 2008-12-14 20:58 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
2008-12-05 15:10 . 2008-12-07 02:20 13,030 --a------ C:\PDOXUSRS.NET
2008-12-05 14:56 . 2008-12-05 14:56 <DIR> d-------- c:\program files\Common Files\Borland Shared
2008-12-05 14:55 . 2008-12-05 14:56 <DIR> d-------- c:\program files\KRESZ
2008-12-05 14:55 . 2008-12-05 14:55 <DIR> d-------- c:\documents and settings\Pál\WINDOWS
2008-12-05 14:55 . 2008-12-05 14:55 <DIR> d-------- c:\documents and settings\Pál\WINDOWS
2008-12-05 14:55 . 1999-03-23 09:12 299,520 --a------ c:\windows\uninst.exe
2008-12-04 13:38 . 2008-12-04 13:38 <DIR> d-------- c:\documents and settings\Pál\Application Data\Sibelius Software
2008-12-04 13:37 . 2008-12-04 13:37 <DIR> d-------- c:\program files\Musicnotes
2008-11-18 11:50 . 2008-11-18 11:50 <DIR> d-------- c:\program files\MSXML 4.0
2008-11-17 17:58 . 2008-11-17 17:58 <DIR> d-------- c:\program files\J River
2008-11-17 17:58 . 2008-07-03 09:07 585,728 --------- c:\windows\system32\AReadyLB.dll
2008-11-17 17:58 . 2008-09-18 11:15 323,584 --------- c:\windows\system32\MC12.exe
2008-11-17 17:58 . 2008-07-03 09:07 229,376 --------- c:\windows\system32\AudDevicePlugin.dll
2008-11-17 17:58 . 2008-07-03 09:07 183,129 --------- c:\windows\system32\AM Install1.INF
2008-11-17 17:58 . 2008-07-03 09:07 53,248 --------- c:\windows\system32\BBInstaller.exe
2008-11-17 17:57 . 2008-11-17 17:57 <DIR> d-------- c:\documents and settings\Pál\Application Data\J River
2008-11-17 15:18 . 2008-11-17 15:18 <DIR> d-------- c:\documents and settings\All Users\Application Data\Ahead
2008-11-17 14:39 . 2008-11-17 14:39 80 --a------ c:\windows\mmanager.ini
2008-11-17 14:39 . 2008-11-17 14:39 37 --a------ c:\windows\iltwain.ini
2008-11-17 14:04 . 2008-11-17 14:49 <DIR> d-------- c:\program files\Vamp
2008-11-17 14:04 . 1997-07-21 17:30 1,045,776 --a------ c:\windows\system32\MSJET35.DLL
2008-11-17 14:04 . 1997-06-23 10:06 123,664 --a------ c:\windows\system32\MSJINT35.DLL
2008-11-17 14:04 . 1997-06-23 10:06 24,848 --a------ c:\windows\system32\MSJTER35.DLL
2008-11-17 13:37 . 2008-11-17 17:26 <DIR> d-------- c:\program files\XBMC

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-14 13:02 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2008-12-09 21:07 --------- d-----w c:\documents and settings\All Users\Application Data\Soulseek
2008-12-03 11:42 --------- d-----w c:\program files\Java
2008-11-17 14:07 --------- d-----w c:\program files\Ahead
2008-11-14 21:12 --------- d-----w c:\program files\musikCube
2008-11-14 21:02 --------- d-----w c:\program files\musikCube_1.0
2008-11-14 20:12 --------- d-----w c:\program files\Tunatic
2008-11-13 21:59 --------- d-----w c:\program files\Ashampoo
2008-11-13 17:46 --------- d-----w c:\documents and settings\Pál\Application Data\Ashampoo
2008-11-13 17:37 --------- d-----w c:\documents and settings\All Users\Application Data\ashampoo
2008-11-13 16:58 --------- d-----w c:\documents and settings\Pál\Application Data\Media Player Classic
2008-11-13 16:00 --------- d-----w c:\program files\K-Lite Codec Pack
2008-11-13 12:28 --------- d-----w c:\program files\LG
2008-11-10 04:43 410,984 ----a-w c:\windows\system32\deploytk.dll
2008-11-07 22:20 --------- d-----w c:\documents and settings\Pál\Application Data\Publish Providers
2008-11-07 22:20 --------- d-----w c:\documents and settings\Pál\Application Data\NetMedia Providers
2008-11-07 22:09 --------- d-----w c:\program files\Microsoft SQL Server
2008-11-07 22:08 --------- d-----w c:\documents and settings\Pál\Application Data\Sony
2008-11-07 22:08 --------- d-----w c:\documents and settings\All Users\Application Data\Sony
2008-11-07 22:07 --------- d-----w c:\program files\Vstplugins
2008-11-07 22:06 --------- d-----w c:\program files\Sony
2008-11-07 21:53 --------- d-----w c:\documents and settings\Pál\Application Data\Sony Setup
2008-11-07 21:51 --------- d-----w c:\program files\Sony Setup
2008-11-06 11:07 --------- d-----w c:\program files\DC++
2008-10-26 19:56 164,352 ----a-w c:\windows\system32\SpoonUninstall.exe
2008-10-26 19:56 --------- d-----w c:\program files\Illustrate
2008-10-26 11:36 --------- d-----w c:\program files\Google
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-23 12:42 286,720 ----a-w c:\windows\system32\gdi32.dll
2008-10-20 09:22 --------- d--h--w c:\program files\InstallShield Installation Information
2008-10-20 09:22 --------- d-----w c:\program files\Philips
2008-10-20 09:22 --------- d-----w c:\documents and settings\Pál\Application Data\InstallShield
2008-10-17 17:12 --------- d-----w c:\documents and settings\Pál\Application Data\Ahead
2008-10-16 20:33 826,368 ----a-w c:\windows\system32\wininet.dll
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-12 19:18 20,656 ----a-w c:\documents and settings\Pál\Application Data\GDIPFONTCACHEV1.DAT
2008-10-03 10:04 247,326 ----a-w c:\windows\system32\strmdll.dll
2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
2008-09-15 15:27 1,846,400 ----a-w c:\windows\system32\win32k.sys
2008-11-13 23:39 67,696 ----a-w c:\program files\mozilla firefox\components\jar50.dll
2008-11-13 23:39 54,376 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll
2008-11-13 23:39 34,952 ----a-w c:\program files\mozilla firefox\components\myspell.dll
2008-11-13 23:39 46,720 ----a-w c:\program files\mozilla firefox\components\spellchk.dll
2008-11-13 23:39 172,144 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll
.

((((((((((((((((((((((((((((( snapshot@2008-12-15_ 1.31.18,18 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-12-15 21:40:45 16,384 ----atw c:\windows\temp\Perflib_Perfdata_2dc.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-08-04 36352]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"SsAAD.exe"="c:\progra~1\Sony\SONICS~1\SsAAD.exe" [2005-03-11 81920]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2008-12-14 949376]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Start Menu\Programs\Indˇt˘pult\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
Philips Device Manager.lnk - c:\program files\Philips\SA28XX Device Manager\main.exe [2008-10-20 7696118]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\SoulseekNS\\slsk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2008-12-14 15424]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://music.yahoo.com/launchcast/
uInternet Settings,ProxyServer = rikprx:8080
uInternet Settings,ProxyOverride = <local>
IE: E&xportálás Microsoft Excel formátumba - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
LSP: c:\windows\system32\imon.dll
FF - ProfilePath - c:\documents and settings\Pál\Application Data\Mozilla\Firefox\Profiles\z1tna5tz.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.hu/ig?hl=hu&source=iglk
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-15 22:40:28
Windows 5.1.2600 Szervizcsomag 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(612)
c:\windows\system32\imon.dll
c:\program files\Eset\pr_imon.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\program files\ESET\nod32krn.exe
c:\program files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
.
**************************************************************************
.
Completion time: 2008-12-15 22:43:25 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-15 21:43:15
ComboFix2.txt 2008-12-15 20:16:00
ComboFix3.txt 2008-12-15 18:46:07
ComboFix4.txt 2008-12-15 01:22:57
ComboFix5.txt 2008-12-15 21:35:32

Pre-Run: 86 130 638 848 bájt szabad
Post-Run: 86,121,021,440 bájt szabad

200 --- E O F --- 2008-12-13 01:43:03

udv
ha hasznalsz USB Kulcsot,FLASHT...dugd be a gepbe.

Kinyitod a Notepadot>Start>futatas>beirod notepad
Es bekopirozod a piros textet

Mostan>a notepadon elso full>ballfelsosarokban>4-sor>lementenni mint....
A txt-hejet beteszed eztett>CFScript.txt<alatta bealitod >minden mapak<
legfelull>asztall i<klik gomb letenni.Es mostan megcsinalod eztett:

A combofix maga elindul es lehet hogy restartol es befejezi a scent.Amit majd ad ted ide

Ez pedig a Combofixes log - előre is ezer hálám

ComboFix 08-12-14.04 - Pál 2008-12-15 21:11:53.6 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1250.1.1038.18.511.158 [GMT 1:00]
Running from: c:\documents and settings\Pál\Asztal\ComboFix.exe
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-11-15 to 2008-12-15 )))))))))))))))))))))))))))))))
.

2008-12-15 20:14 . 2008-12-15 20:26 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-15 20:14 . 2008-12-15 20:14 <DIR> d-------- c:\documents and settings\Pál\Application Data\Malwarebytes
2008-12-15 20:14 . 2008-12-15 20:14 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-15 20:14 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-15 20:14 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-15 19:28 . 2008-12-15 19:28 <DIR> d-------- c:\program files\Trend Micro
2008-12-15 01:09 . 2008-12-15 01:10 <DIR> d-------- c:\program files\Browser Hijack Recover
2008-12-15 01:09 . 2008-12-15 01:09 0 --a------ c:\windows\system32\8104297.jun
2008-12-15 01:00 . 2008-12-15 01:00 <DIR> d-------- c:\program files\CCleaner
2008-12-15 00:54 . 2008-12-15 00:54 <DIR> d-------- c:\program files\Combofix
2008-12-14 23:03 . 2008-12-14 23:02 512,096 --a------ c:\windows\system32\drivers\amon.sys
2008-12-14 23:03 . 2008-12-14 23:02 298,104 --a------ c:\windows\system32\imon.dll
2008-12-14 23:03 . 2008-12-14 23:02 15,424 --a------ c:\windows\system32\drivers\nod32drv.sys
2008-12-14 23:02 . 2008-12-15 00:49 <DIR> d-------- c:\program files\ESET
2008-12-14 20:59 . 2008-12-14 20:59 <DIR> d-------- c:\program files\Lavasoft
2008-12-14 20:59 . 2008-12-14 21:00 <DIR> d-------- c:\documents and settings\All Users\Application Data\Lavasoft
2008-12-14 20:58 . 2008-12-14 20:58 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
2008-12-14 15:58 . 2008-12-14 15:58 110,592 --a------ c:\windows\system32\knzg.dll
2008-12-14 15:58 . 2008-12-14 15:58 21,446 --a------ c:\windows\system32\sf.ico
2008-12-14 15:58 . 2008-12-14 15:58 13,942 --a------ c:\windows\system32\m3.ico
2008-12-14 15:58 . 2008-12-14 15:58 3,108 --a------ c:\windows\ios.dat
2008-12-05 15:10 . 2008-12-07 02:20 13,030 --a------ C:\PDOXUSRS.NET
2008-12-05 14:56 . 2008-12-05 14:56 <DIR> d-------- c:\program files\Common Files\Borland Shared
2008-12-05 14:55 . 2008-12-05 14:56 <DIR> d-------- c:\program files\KRESZ
2008-12-05 14:55 . 2008-12-05 14:55 <DIR> d-------- c:\documents and settings\Pál\WINDOWS
2008-12-05 14:55 . 2008-12-05 14:55 <DIR> d-------- c:\documents and settings\Pál\WINDOWS
2008-12-05 14:55 . 1999-03-23 09:12 299,520 --a------ c:\windows\uninst.exe
2008-12-04 13:38 . 2008-12-04 13:38 <DIR> d-------- c:\documents and settings\Pál\Application Data\Sibelius Software
2008-12-04 13:37 . 2008-12-04 13:37 <DIR> d-------- c:\program files\Musicnotes
2008-11-18 11:50 . 2008-11-18 11:50 <DIR> d-------- c:\program files\MSXML 4.0
2008-11-17 17:58 . 2008-11-17 17:58 <DIR> d-------- c:\program files\J River
2008-11-17 17:58 . 2008-07-03 09:07 585,728 --------- c:\windows\system32\AReadyLB.dll
2008-11-17 17:58 . 2008-09-18 11:15 323,584 --------- c:\windows\system32\MC12.exe
2008-11-17 17:58 . 2008-07-03 09:07 229,376 --------- c:\windows\system32\AudDevicePlugin.dll
2008-11-17 17:58 . 2008-07-03 09:07 183,129 --------- c:\windows\system32\AM Install1.INF
2008-11-17 17:58 . 2008-07-03 09:07 53,248 --------- c:\windows\system32\BBInstaller.exe
2008-11-17 17:57 . 2008-11-17 17:57 <DIR> d-------- c:\documents and settings\Pál\Application Data\J River
2008-11-17 15:18 . 2008-11-17 15:18 <DIR> d-------- c:\documents and settings\All Users\Application Data\Ahead
2008-11-17 14:40 . 2008-11-17 14:40 2,560 --a------ c:\windows\_MSRSTRT.EXE
2008-11-17 14:39 . 2008-11-17 14:39 80 --a------ c:\windows\mmanager.ini
2008-11-17 14:39 . 2008-11-17 14:39 37 --a------ c:\windows\iltwain.ini
2008-11-17 14:04 . 2008-11-17 14:49 <DIR> d-------- c:\program files\Vamp
2008-11-17 14:04 . 1997-07-21 17:30 1,045,776 --a------ c:\windows\system32\MSJET35.DLL
2008-11-17 14:04 . 1997-06-23 10:06 123,664 --a------ c:\windows\system32\MSJINT35.DLL
2008-11-17 14:04 . 1997-06-23 10:06 24,848 --a------ c:\windows\system32\MSJTER35.DLL
2008-11-17 13:37 . 2008-11-17 17:26 <DIR> d-------- c:\program files\XBMC

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-14 13:02 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2008-12-09 21:07 --------- d-----w c:\documents and settings\All Users\Application Data\Soulseek
2008-12-03 11:42 --------- d-----w c:\program files\Java
2008-11-17 14:07 --------- d-----w c:\program files\Ahead
2008-11-14 21:12 --------- d-----w c:\program files\musikCube
2008-11-14 21:02 --------- d-----w c:\program files\musikCube_1.0
2008-11-14 20:12 --------- d-----w c:\program files\Tunatic
2008-11-13 21:59 --------- d-----w c:\program files\Ashampoo
2008-11-13 17:46 --------- d-----w c:\documents and settings\Pál\Application Data\Ashampoo
2008-11-13 17:37 --------- d-----w c:\documents and settings\All Users\Application Data\ashampoo
2008-11-13 16:58 --------- d-----w c:\documents and settings\Pál\Application Data\Media Player Classic
2008-11-13 16:00 --------- d-----w c:\program files\K-Lite Codec Pack
2008-11-13 12:28 --------- d-----w c:\program files\LG
2008-11-10 04:43 410,984 ----a-w c:\windows\system32\deploytk.dll
2008-11-07 22:20 --------- d-----w c:\documents and settings\Pál\Application Data\Publish Providers
2008-11-07 22:20 --------- d-----w c:\documents and settings\Pál\Application Data\NetMedia Providers
2008-11-07 22:09 --------- d-----w c:\program files\Microsoft SQL Server
2008-11-07 22:08 --------- d-----w c:\documents and settings\Pál\Application Data\Sony
2008-11-07 22:08 --------- d-----w c:\documents and settings\All Users\Application Data\Sony
2008-11-07 22:07 --------- d-----w c:\program files\Vstplugins
2008-11-07 22:06 --------- d-----w c:\program files\Sony
2008-11-07 21:53 --------- d-----w c:\documents and settings\Pál\Application Data\Sony Setup
2008-11-07 21:51 --------- d-----w c:\program files\Sony Setup
2008-11-06 11:07 --------- d-----w c:\program files\DC++
2008-10-26 19:56 164,352 ----a-w c:\windows\system32\SpoonUninstall.exe
2008-10-26 19:56 --------- d-----w c:\program files\Illustrate
2008-10-26 11:36 --------- d-----w c:\program files\Google
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-23 12:42 286,720 ----a-w c:\windows\system32\gdi32.dll
2008-10-20 09:22 --------- d--h--w c:\program files\InstallShield Installation Information
2008-10-20 09:22 --------- d-----w c:\program files\Philips
2008-10-20 09:22 --------- d-----w c:\documents and settings\Pál\Application Data\InstallShield
2008-10-17 17:12 --------- d-----w c:\documents and settings\Pál\Application Data\Ahead
2008-10-16 20:33 826,368 ----a-w c:\windows\system32\wininet.dll
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-12 19:18 20,656 ----a-w c:\documents and settings\Pál\Application Data\GDIPFONTCACHEV1.DAT
2008-10-03 10:04 247,326 ----a-w c:\windows\system32\strmdll.dll
2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
2008-09-15 15:27 1,846,400 ----a-w c:\windows\system32\win32k.sys
2008-11-13 23:39 67,696 ----a-w c:\program files\mozilla firefox\components\jar50.dll
2008-11-13 23:39 54,376 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll
2008-11-13 23:39 34,952 ----a-w c:\program files\mozilla firefox\components\myspell.dll
2008-11-13 23:39 46,720 ----a-w c:\program files\mozilla firefox\components\spellchk.dll
2008-11-13 23:39 172,144 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll
.

((((((((((((((((((((((((((((( snapshot@2008-12-15_ 1.31.18,18 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-12-15 18:06:53 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_3b0.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{46CFEC0B-CA28-4C82-BD91-EF9C6AE197B5}]
2008-12-14 15:58 110592 --a------ c:\windows\system32\knzg.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-08-04 36352]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"SsAAD.exe"="c:\progra~1\Sony\SONICS~1\SsAAD.exe" [2005-03-11 81920]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2008-12-14 949376]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Start Menu\Programs\Indˇt˘pult\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
Philips Device Manager.lnk - c:\program files\Philips\SA28XX Device Manager\main.exe [2008-10-20 7696118]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\SoulseekNS\\slsk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2008-12-14 15424]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{63e1b907-9633-11dd-90d9-000ae6275fb7}]
\shell\verb1\command - desktop.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f06e16a2-9a41-11dd-90e1-000ae6275fb7}]
\Shell\Auto\command - H:\sal.xls.exe
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sal.xls.exe
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://music.yahoo.com/launchcast/
uInternet Settings,ProxyServer = rikprx:8080
uInternet Settings,ProxyOverride = <local>
IE: E&xportálás Microsoft Excel formátumba - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
LSP: c:\windows\system32\imon.dll
FF - ProfilePath - c:\documents and settings\Pál\Application Data\Mozilla\Firefox\Profiles\z1tna5tz.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.hu/ig?hl=hu&source=iglk
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-15 21:14:16
Windows 5.1.2600 Szervizcsomag 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(608)
c:\windows\system32\imon.dll
c:\program files\Eset\pr_imon.dll
.
Completion time: 2008-12-15 21:15:58
ComboFix-quarantined-files.txt 2008-12-15 20:15:42
ComboFix2.txt 2008-12-15 18:46:07
ComboFix3.txt 2008-12-15 01:22:57
ComboFix4.txt 2008-12-15 00:56:45
ComboFix5.txt 2008-12-15 20:11:23

Pre-Run: 86 156 619 776 bájt szabad
Post-Run: 86,150,098,944 bájt szabad

184 --- E O F --- 2008-12-13 01:43:03

mégegyszer nagyon köszönöm

Szia Stell!

Van egy kis problémám. a gépen a mappákban való navigáció során minden valahanyadik kattintáskor felugrik egy popup ablak "warning!virus detected! Attention Én! stb" ajánl egy szoftvert és aztán persze a nemre kattintok de akkor is behozza azt a szemét honlapot (http://webfreescan.cn/id/4912933/3/1/) és már halálra idegesít. láttam már eddig is nagyon hasonlókat írtak többen is és végigjátszottam a combofix-hijackthis párost is de nem történt semmi. Továbbá néhány alkalommal arról tájékoztat hogy letöltöttem egy pornó avit (persze nem tettem) és meg akarom-e nézni most. Erre nem és legalább ezután nem navigál el sehova. ugyhogy betenném a két logot hátha látsz benne valamit ami segíthet.

Hijackthis log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:08:26, on 2008.12.15.
Platform: Windows XP Szervizcsomag 3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Philips\SA28XX Device Manager\main.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://music.yahoo.com/launchcast/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = rikprx:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hivatkozások
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: LamasBar.Ie - {46CFEC0B-CA28-4C82-BD91-EF9C6AE197B5} - C:\WINDOWS\system32\knzg.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live bejelentkezési segítség - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Philips Device Manager.lnk = C:\Program Files\Philips\SA28XX Device Manager\main.exe
O8 - Extra context menu item: E&xportálás Microsoft Excel formátumba - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/Mi ... b56986.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe

--
End of file - 6073 bytes

oki,nincsen mit koszonod.udv

Hálás köszönet az önzetlen segítségedért!! Sokkal gyorsabb is lett most a gépünk. Most akkor letöltöm a Zone Alarm tűzfalat, remélem beválik.

olvasd it hogy kel fixelni

http://forum.terminal.hu/viewtopic.php?t=35889

"a combofix letelepitodik fixeld le a HiJackal" Indítsam el a HiJacket?

ok
start-futatas-masold be combofix /u ok
a combofix letelepitodik
fixeld le a HiJackal
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resourc ... oscan8.cab
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
pucold at a gepet CCleaneral+T-Cleaneral

Idézet:

Mostan toldsd le a -CCleanert-futatod-kinyilik a Windows Full-mindent bepipazol-klik-analyze-klik run cleaner-de a bongeszokett zard be.Adig nyomkodod a cleaner gombott meg nemtiszta a joboldalon az ablak.
http://www.ccleaner.com/download/downloadpage.aspx?f=2
Klik -Full-Aplikaciok-itt is bepipazni mindent-es ugyanugy csinalod.

Utana klik ISSUES-az a kocka=register->rendszer iro>itt is bepipazni mindent ugyanugy ha valamitt kerdez beleegyezel-klik fix problem.

rakjal fel Tuzfalat.mehet a ZoneAlarm es kesz.

Itt a másik log is. Remélem jól csináltam eddig mindent...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:19:20, on 2008.12.14.
Platform: Windows XP Szervizcsomag 2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\xy\Asztal\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.allat-nevelde.hu/index.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hivatkozások
O2 - BHO: Adobe PDF Reader hivatkozássúgó - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live bejelentkezési segítség - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resourc ... oscan8.cab
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

--
End of file - 4083 bytes

ComboFix 08-12-12.05 - xy 2008-12-14 5:51:02.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1038.18.126.9 [GMT 1:00]
Running from: c:\documents and settings\xy\Asztal\ComboFix.exe
Command switches used :: c:\documents and settings\xy\Asztal\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
c:\windows\Tasks\At10.job
c:\windows\Tasks\At11.job
c:\windows\Tasks\At13.job
c:\windows\Tasks\At14.job
c:\windows\Tasks\At15.job
c:\windows\Tasks\At16.job
c:\windows\Tasks\At17.job
c:\windows\Tasks\At18.job
c:\windows\Tasks\At19.job
c:\windows\Tasks\At2.job
c:\windows\Tasks\At20.job
c:\windows\Tasks\At21.job
c:\windows\Tasks\At22.job
c:\windows\Tasks\At23.job
c:\windows\Tasks\At24.job
c:\windows\Tasks\At3.job
c:\windows\Tasks\At4.job
c:\windows\Tasks\At5.job
c:\windows\Tasks\At6.job
c:\windows\Tasks\At7.job
c:\windows\Tasks\At8.job
c:\windows\Tasks\At9.job
c:\windows\Tasks\rpc.job
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\3QigiqxQ.exe
c:\windows\Tasks\At10.job
c:\windows\Tasks\At11.job
c:\windows\Tasks\At13.job
c:\windows\Tasks\At14.job
c:\windows\Tasks\At15.job
c:\windows\Tasks\At16.job
c:\windows\Tasks\At17.job
c:\windows\Tasks\At18.job
c:\windows\Tasks\At19.job
c:\windows\Tasks\At2.job
c:\windows\Tasks\At20.job
c:\windows\Tasks\At21.job
c:\windows\Tasks\At22.job
c:\windows\Tasks\At23.job
c:\windows\Tasks\At24.job
c:\windows\Tasks\At3.job
c:\windows\Tasks\At4.job
c:\windows\Tasks\At5.job
c:\windows\Tasks\At6.job
c:\windows\Tasks\At7.job
c:\windows\Tasks\At8.job
c:\windows\Tasks\At9.job
c:\windows\Tasks\rpc.job

.
((((((((((((((((((((((((( Files Created from 2008-11-14 to 2008-12-14 )))))))))))))))))))))))))))))))
.

2008-11-29 17:40 . 2008-11-29 17:41 191 --a------ c:\windows\MPLAYER.INI
2008-11-26 17:29 . 2008-11-26 17:29 <DIR> d-------- c:\program files\MSECache
2008-11-19 17:31 . 2008-11-19 17:32 <DIR> d-------- c:\documents and settings\xy\Application Data\mbin.jp
2008-11-16 10:58 . 2008-11-16 10:58 <DIR> d-------- c:\program files\Sebran
2008-11-16 10:58 . 2004-08-23 16:51 109,472 --a------ c:\windows\system32\Sebran3_.ttf
2008-11-16 10:58 . 2003-11-12 22:38 31,732 --a------ c:\windows\system32\SEBRS___.TTF
2008-11-15 12:41 . 2008-11-17 18:20 <DIR> d-------- c:\program files\OpenOffice.org 2.4
2008-11-15 10:41 . 2008-11-15 11:26 <DIR> d-------- c:\program files\Pixia

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-13 06:12 --------- d-----w c:\program files\Opera
2008-12-11 17:23 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller
2008-12-11 17:10 --------- d-----w c:\program files\Opera7
2008-11-26 22:39 --------- d-----w c:\program files\Common Files\Adobe
2008-11-16 07:30 --------- d-----w c:\documents and settings\xy\Application Data\OpenOffice.org2
2008-11-15 10:27 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-15 10:26 --------- d--h--w c:\program files\InstallShield Installation Information
2008-10-30 20:20 --------- d-----w c:\documents and settings\All Users\Application Data\Skype
2008-10-30 08:25 --------- d-----w c:\documents and settings\xy\Application Data\skypePM
2008-10-28 11:45 --------- d-----w c:\documents and settings\xy\Application Data\Chocolate Castle
2008-10-27 18:12 --------- d-----w c:\documents and settings\xy\Application Data\MSN6
2008-01-13 13:29 32 -c--a-w c:\documents and settings\All Users\Application Data\ezsid.dat
.

((((((((((((((((((((((((((((( snapshot@2008-12-13_21.55.03.51 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-12-14 04:57:39 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_4a8.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-17 15360]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
--a------ 2007-10-18 11:34 5724184 c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\PCHEALTH\\HELPCTR\\Binaries\\helpctr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9699:TCP"= 9699:TCP:BitComet 9699 TCP
"9699:UDP"= 9699:UDP:BitComet 9699 UDP
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

.
Contents of the 'Scheduled Tasks' folder

2008-12-11 c:\windows\Tasks\{06C4A412-99DD-4FF5-AAF0-1A9F333550B5}_OTTHONI_xy.job
- c:\windows\system32\mobsync.exe [2004-08-17 15:48]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.allat-nevelde.hu/index.php
mStart Page = hxxp://home.sweetim.com
uInternet Connection Wizard,ShellNext = iexplore
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-14 06:02:14
Windows 5.1.2600 Szervizcsomag 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
.
**************************************************************************
.
Completion time: 2008-12-14 6:09:33 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-14 05:09:20
ComboFix2.txt 2008-12-13 20:57:15

Pre-Run: 3˙077˙623˙808 b jt szabad
Post-Run: 3,077,742,592 b jt szabad

157 --- E O F --- 2008-02-03 06:29:34

Kinyitod a Notepadot>Start>futatas>beirod notepad
Es bekopirozod a piros textet

Mostan>a notepadon elso full>ballfelsosarokban>4-sor>lementenni mint....
A txt-hejet beteszed eztett>CFScript.txt<alatta bealitod >minden mapak<
legfelull>asztall i<klik gomb letenni.Es mostan megcsinalod eztett:

A combofix maga elindul es lehet hogy restartol es befejezi a scent.Amit majd ad ted ide Es az uj HijackThis logjat ted ide OK,majd holnap megnezem

Ez már okés?

ComboFix 08-12-12.05 - xy 2008-12-13 21:38:32.2 - NTFSx86
Running from: c:\documents and settings\xy\Asztal\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
c:\windows\Downloaded Program Files\setup.inf
c:\windows\system32\3QigiqxQ.exe
c:\windows\system32\3QigiqxQ.exe.a_a
c:\windows\Tasks\At1.job
c:\windows\Tasks\At12.job

.
((((((((((((((((((((((((((((((((((((((( )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_VFILT


((((((((((((((((((((((((( Files Created from 2008-11-13 to 2008-12-13 )))))))))))))))))))))))))))))))
.

2008-11-29 17:40 . 2008-11-29 17:41 191 --a------ c:\windows\MPLAYER.INI
2008-11-26 17:29 . 2008-11-26 17:29 <DIR> d-------- c:\program files\MSECache
2008-11-19 17:31 . 2008-11-19 17:32 <DIR> d-------- c:\documents and settings\xy\Application Data\mbin.jp
2008-11-16 10:58 . 2008-11-16 10:58 <DIR> d-------- c:\program files\Sebran
2008-11-16 10:58 . 2004-08-23 16:51 109,472 --a------ c:\windows\system32\Sebran3_.ttf
2008-11-16 10:58 . 2003-11-12 22:38 31,732 --a------ c:\windows\system32\SEBRS___.TTF
2008-11-15 12:41 . 2008-11-17 18:20 <DIR> d-------- c:\program files\OpenOffice.org 2.4
2008-11-15 10:41 . 2008-11-15 11:26 <DIR> d-------- c:\program files\Pixia

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-13 06:12 --------- d-----w c:\program files\Opera
2008-12-11 17:23 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller
2008-12-11 17:10 --------- d-----w c:\program files\Opera7
2008-11-26 22:39 --------- d-----w c:\program files\Common Files\Adobe
2008-11-16 07:30 --------- d-----w c:\documents and settings\xy\Application Data\OpenOffice.org2
2008-11-15 10:27 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-15 10:26 --------- d--h--w c:\program files\InstallShield Installation Information
2008-10-30 20:20 --------- d-----w c:\documents and settings\All Users\Application Data\Skype
2008-10-30 08:25 --------- d-----w c:\documents and settings\xy\Application Data\skypePM
2008-10-28 11:45 --------- d-----w c:\documents and settings\xy\Application Data\Chocolate Castle
2008-10-27 18:12 --------- d-----w c:\documents and settings\xy\Application Data\MSN6
2008-01-13 13:29 32 -c--a-w c:\documents and settings\All Users\Application Data\ezsid.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-17 15360]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
--a------ 2007-10-18 11:34 5724184 c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\PCHEALTH\\HELPCTR\\Binaries\\helpctr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9699:TCP"= 9699:TCP:BitComet 9699 TCP
"9699:UDP"= 9699:UDP:BitComet 9699 UDP
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

.
Contents of the 'Scheduled Tasks' folder

2008-12-13 c:\windows\Tasks\At10.job
- c:\windows\system32\3QigiqxQ.exe []

2008-12-13 c:\windows\Tasks\At11.job
- c:\windows\system32\3QigiqxQ.exe []

2008-12-12 c:\windows\Tasks\At13.job
- c:\windows\system32\3QigiqxQ.exe []

2008-12-12 c:\windows\Tasks\At14.job
- c:\windows\system32\3QigiqxQ.exe []

2008-12-12 c:\windows\Tasks\At15.job
- c:\windows\system32\3QigiqxQ.exe []

2008-12-12 c:\windows\Tasks\At16.job
- c:\windows\system32\3QigiqxQ.exe []

2008-12-13 c:\windows\Tasks\At17.job
- c:\windows\system32\3QigiqxQ.exe []

2008-12-12 c:\windows\Tasks\At18.job
- c:\windows\system32\3QigiqxQ.exe []

2008-12-12 c:\windows\Tasks\At19.job
- c:\windows\system32\3QigiqxQ.exe []

2008-12-12 c:\windows\Tasks\At2.job
- c:\windows\system32\3QigiqxQ.exe []

2008-12-12 c:\windows\Tasks\At20.job
- c:\windows\system32\3QigiqxQ.exe []

2008-12-12 c:\windows\Tasks\At21.job
- c:\windows\system32\3QigiqxQ.exe []

2008-12-13 c:\windows\Tasks\At22.job
- c:\windows\system32\3QigiqxQ.exe []

2008-12-12 c:\windows\Tasks\At23.job
- c:\windows\system32\3QigiqxQ.exe []

2008-12-12 c:\windows\Tasks\At24.job
- c:\windows\system32\3QigiqxQ.exe []

2008-12-12 c:\windows\Tasks\At3.job
- c:\windows\system32\3QigiqxQ.exe []

2008-12-12 c:\windows\Tasks\At4.job
- c:\windows\system32\3QigiqxQ.exe []

2008-12-12 c:\windows\Tasks\At5.job
- c:\windows\system32\3QigiqxQ.exe []

2008-12-12 c:\windows\Tasks\At6.job
- c:\windows\system32\3QigiqxQ.exe []

2008-12-12 c:\windows\Tasks\At7.job
- c:\windows\system32\3QigiqxQ.exe []

2008-12-13 c:\windows\Tasks\At8.job
- c:\windows\system32\3QigiqxQ.exe []

2008-12-13 c:\windows\Tasks\At9.job
- c:\windows\system32\3QigiqxQ.exe []

2008-12-04 c:\windows\Tasks\rpc.job
- c:\program files\Winferno\RegistryPowerCleaner\RegPowerClean.exe []

2008-12-11 c:\windows\Tasks\{06C4A412-99DD-4FF5-AAF0-1A9F333550B5}_OTTHONI_xy.job
- c:\windows\system32\mobsync.exe [2004-08-17 15:48]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-20896009665632295573215164150315 - c:\program files\A360\av360.exe
MSConfigStartUp-COMODO Firewall Pro - c:\program files\Comodo\Firewall\CPF.exe
MSConfigStartUp-nod32kui - c:\program files\Eset\nod32kui.exe
MSConfigStartUp-Orb - c:\program files\Winamp Remote\bin\OrbTray.exe
MSConfigStartUp-Outpost Firewall - c:\program files\Agnitum\Outpost Firewall\outpost.exe
MSConfigStartUp-OutpostFeedBack - c:\program files\Agnitum\Outpost Firewall\feedback.exe
MSConfigStartUp-Picasa Media Detector - c:\program files\Picasa2\PicasaMediaDetector.exe
MSConfigStartUp-QuickTime Task - c:\program files\QuickTime\qttask.exe
MSConfigStartUp-SpybotSD TeaTimer - c:\program files\Spybot - Search & Destroy\TeaTimer.exe
MSConfigStartUp-WinampAgent - c:\program files\Winamp\winampa.exe
MSConfigStartUp-Tweak UI - TWEAKUI.CPL


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.allat-nevelde.hu/index.php
mStart Page = hxxp://home.sweetim.com
uInternet Connection Wizard,ShellNext = iexplore
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-13 21:50:19
Windows 5.1.2600 Szervizcsomag 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
.
**************************************************************************
.
Completion time: 2008-12-13 21:57:11 - machine was rebooted [xy]
ComboFix-quarantined-files.txt 2008-12-13 20:57:01

Pre-Run: 3,101,712,384 bájt szabad
Post-Run: 3,099,090,944 bájt szabad

170 --- E O F --- 2008-02-03 06:29:34

de ez nem az egesz log csak egy kis darabja,ha nincsen tob futasd le megegyszer es adig nebabrald meg sajat magatol nem ad a monitora logot.

Szia. Erre gondolsz?

ComboFix 08-12-12.05 - xy 2008-12-13 17:12:15.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1038.18.126.17 [GMT 1:00]
: C:\Documents and Settings\xy\Asztal\ComboFix.exe


.

.

C:\WINDOWS\Downloaded Program Files\setup.inf
C:\WINDOWS\system32\3QigiqxQ.exe
C:\WINDOWS\system32\3QigiqxQ.exe.a_a
C:\WINDOWS\Tasks\At1.job
C:\WINDOWS\Tasks\At12.job

.
((((((((((((((((((((((((((((((((((((((( )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_VFILT

no ted ide a C:\combofix.txt mert meg nemvegeztunk a combofix se varazslo.

Köszönöm szépen a segítséget!! Meg is volnék. annyi kérdésem lenne még, hogy az a antivírus 360 akármi még mindig fent van a gépen, viszont a programok közt nincsen. ezzel mit lehet csinálni? Most el kell mennem este még visszanézek.

igen ha lefutot a T-Cleaner akor a combofix is eltunt,Indits ujra a gepet es tolds le a combofixet az asztalra es futasd le ahogy leirtam,ok,ha valami nemvilagos akor kerdez.

akkor most újraindítsam és combofixet töltsem ugye?

de fog varjal,ha megint kinalna akor megint az A-bilentyut es az [entert a vegen mikor lefut akarmijen bilentyut.

de most nem csinál semmit.

Nyomd be az A bilentyut [enter] aztan a vegen mikor lefut akar mijent.

nyomtam a-t és enter, na most elindult valami.

Letöltöötem a TCleaner-t, egy szürke képernyő bejön, de nem csinál semmit. A-t kell nyomni vagy mi? Ne haragudj, de ezt nem értem.

ok,mostan kipocojuk a hasznalt gyogyito programoktol a gepet ,tolds le ezt a programot,ted az asztalra es futasd-beleegyezel A-aano,leszedi a combofixet es az Avangert,utana- restart- es ujbol tolds le a combofixet es futasd.Futatas utan RESTART

http://sweb.cz/Marinus/T-Cleaner.exe


es a combofix
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

nincsen felugró ablak semmi. ugyanúgy indult a gép, mint máskor. most akkor oké is??

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "C:\Program Files\A360\av360.exe" deleted successfully.
File "C:\DOCUME~1\xy\LOCALS~1\Temp\a.exe" deleted successfully.
File "C:\DOCUME~1\xy\LOCALS~1\Temp\~tmpb.exe" deleted successfully.
File "C:\DOCUME~1\xy\LOCALS~1\Temp\~tmpd.exe" deleted successfully.
File "C:\WINDOWS\system32\msxml71.dll" deleted successfully.
Folder "C:\Program Files\A360" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.