és szerintem ezt már egyszer letöröltük, nemtom hogy került ez ide megint :S

Hello
most van közbe egy baj. a tűzfal ezt írja ki:
http://kepfeltoltes.hu/090104/130763328 ... es.hu_.jpg

letoltod az UPM-ert es csinals logot
http://download.lodusweb.net/upm_4_1_3.zip
a logot igy csinalod
1)letoltod szet csomagolod UPM
2)futatod a _MAKE_LOG_XX.bat, az XX a nyelvet kivalasztod,
3) az ablakban hagyd bepipazva ugy ahogy van - es klik-ok

muzaj gondolkoznom mert ez valami rootkit lesz ,ok

Igen, futtattuk.

hm,hat ez problem az MWAV programot mar futatuk e??

De ha a tesóm is bejelentkezik msn-re, akkor is küldi tőle is, de csak ezen a gépen, ha a másikon jelentkezek be, onnan nem küld semmit.

Megváltoztattam. Még most is küldi :S:S

Szinten BUEK-it
tehat valtoztas es meglasuk hogyfogja e kuldozgetn i a spamot linkeket.

Rendben.
Egyébként Boldog Új Évet!

szoval eztet kuldi


Megvaltoztatni a jelszavadat. az msn.ben

Csa! A hetvegi bulis kepeket muszaly megmutatnom neked, nagyon keszek voltunk rajta. Na tessek, lesd meg: http://upload.media20.eu/bulis_kepek08.jpg.exe

udv
Koszonjuk az elismerest a stab tobbi tagja neveben is,
udv

Kártevőmentes új évet!
Kedves stell , csak miattad regisztráltam ide a Terminal-ra , annyit tudtam meg tőlled a fenti témákban mint mástól , máshonnan soha eddig, (4 órán reresztül olvastam a témákat amelyekben segítettél), ahogy levezényled a problémamegoldásokat ,brilliáns..tanítanod kellene.Kevés , ilyen segítőkész embert találni ,még ezen az óriási hálón is. Nagyonsok egyszerű usernak ,Te vagy a mentsvára ....de dicséret illeti a "stáb" többi tagját is,természetesen. Köszönöm.

no csak ted ide megegyszer hogy mit kuldoz,

hello!
hát, ezt a kerio-t feltettem, de küldi még igy is :/

Tudom, hogy nem sokat ér, de (tudtommal!) nem volt semmi betörési kísérlet. Nekem tűzfal még soha nem riasztott.
Comodom is volt már. XP újratelepítés miatt került le véglegesen.
De ha ajánljátok, újra megpróbálkozok vele.

aha peti1114
rolad elfeledkeztem,kell irni mert nemlatok mindent
na miujsag van??

És pont annyit is ér.

Használj Komodo-t, ingyenes, alig van erőforrásigénye...

Az XP tűzfala nem foglal plusz helyet és nem zabálja a procit, memóriát.
Nekem a ZA nem jött be.

Az utóbbiakból nekem szólt valamelyik?:)

na epen ijen gepekre van a ZoneAlarm.

Gyenge gépem van. 900MHz és 1.6GHz. Kevés RAM, stb.

otlet??
nincsen tuzfalad az xp tuzfal nemtuzfall
telepits tuzfalat pldauj KERIO.

Én fájlokat soha nem kapok, csak linkeket offline partnerektől.
Webes msn-en is, sőt, másik gépen belépve is.
Ötlet?
PC1: Spybot,CCleaner,Avast,WinXP tűzfal
PC2: Spybot,CCleaner,NOD32, WinXP tűzfal

Hibák javítva/tisztítás lefuttatava.

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "C:\zjhdjzjh.txt" deleted successfully.
File "C:\WINDOWS\system32\eEmpty.exe" deleted successfully.

Error: "C:\cel" is a folder, not a file!
Deletion of file "C:\cel" failed!
Status: 0xc00000ba (STATUS_FILE_IS_A_DIRECTORY)
--> use "Folders to delete:" instead of "Files to delete:" to delete a directory


Error: "C:\f" is a folder, not a file!
Deletion of file "C:\f" failed!
Status: 0xc00000ba (STATUS_FILE_IS_A_DIRECTORY)
--> use "Folders to delete:" instead of "Files to delete:" to delete a directory


Error: file "C:\WINDOWS\system32\drivers\a0ctr8n5.sys" not found!
Deletion of file "C:\WINDOWS\system32\drivers\a0ctr8n5.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\a0ctr8n5" not found!
Deletion of driver "a0ctr8n5" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Completed script processing.

*******************

Finished! Terminate.



Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.

Hidden driver "sjabq" found!
Could not open driver sjabq for rootkit scan. Error:c0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

Rootkit scan completed.


Error: file "C:\zjhdjzjh.txt" not found!
Deletion of file "C:\zjhdjzjh.txt" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\WINDOWS\system32\eEmpty.exe" not found!
Deletion of file "C:\WINDOWS\system32\eEmpty.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: "C:\cel" is a folder, not a file!
Deletion of file "C:\cel" failed!
Status: 0xc00000ba (STATUS_FILE_IS_A_DIRECTORY)
--> use "Folders to delete:" instead of "Files to delete:" to delete a directory


Error: "C:\f" is a folder, not a file!
Deletion of file "C:\f" failed!
Status: 0xc00000ba (STATUS_FILE_IS_A_DIRECTORY)
--> use "Folders to delete:" instead of "Files to delete:" to delete a directory


Error: file "C:\WINDOWS\system32\drivers\a0ctr8n5.sys" not found!
Deletion of file "C:\WINDOWS\system32\drivers\a0ctr8n5.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\a0ctr8n5" not found!
Deletion of driver "a0ctr8n5" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Completed script processing.

*******************

Finished! Terminate.

Hasznald az AVANGERT

a logjat ted ide.

Logfile of random's system information tool 1.05 (written by random/random)
Run by PISTA at 2008-12-29 14:13:32
Microsoft Windows XP Professional Szervizcsomag 3
System drive C: has 28 GB (49%) free of 56 GB
Total RAM: 1023 MB (48% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:13:43, on 2008.12.29.
Platform: Windows XP Szervizcsomag 3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\hphmon05.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\PISTA\Local Settings\Temporary Internet Files\Content.IE5\YB92408K\RSIT[1].exe
C:\Program Files\HijackThis\PISTA.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hivatkozások
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live bejelentkezési segítség - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{D946675D-1D6C-4dc8-9E0D-B4B8EAA30EAA}\hphupd05.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] "D:\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'HELYI SZOLGÁLTATÁS')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'HELYI SZOLGÁLTATÁS')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide2] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,L,,4,N (User 'HELYI SZOLGÁLTATÁS')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'HÁLÓZATI SZOLGÁLTATÁS')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'HÁLÓZATI SZOLGÁLTATÁS')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader gyorsindító.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: Add to VideoGet - {88CFA58B-A63F-4A94-9C54-0C7A58E3333E} - C:\NUCLEA~1\VideoGet\Plugins\VIDEOG~1.DLL
O9 - Extra 'Tools' menuitem: Add to &VideoGet - {88CFA58B-A63F-4A94-9C54-0C7A58E3333E} - C:\NUCLEA~1\VideoGet\Plugins\VIDEOG~1.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com.edgesuite.net ... plugin.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resour ... se6662.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Uninterruptible Power Supply (UPS) - Unknown owner - C:\WINDOWS\System32\ups.exe (file missing)

--
End of file - 7298 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\HP Usg Daily.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2005-09-24 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2008-11-10 320920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live bejelentkezési segítség - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2007-09-20 328752]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2008-11-10 34816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2008-11-10 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"C-Media Mixer"=Mixer.exe /startup []
"RemoteControl"=C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [2004-11-02 32768]
"HPDJ Taskbar Utility"=C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe [2003-12-05 176128]
"HPHUPD05"=C:\Program Files\Hewlett-Packard\{D946675D-1D6C-4dc8-9E0D-B4B8EAA30EAA}\hphupd05.exe [2003-11-13 49152]
"HP Component Manager"=C:\Program Files\HP\hpcoretech\hpcmpmgr.exe [2004-05-12 241664]
"HP Software Update"=C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe [2003-12-05 49152]
"HPHmon05"=C:\WINDOWS\system32\hphmon05.exe [2004-02-02 495616]
"NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2006-01-12 155648]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2008-08-11 413696]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2008-11-10 136600]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2008-07-01 1447168]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"DAEMON Tools"=D:\DAEMON Tools\daemon.exe [2007-08-16 167368]
"Orb"=C:\Program Files\Winamp Remote\bin\OrbTray.exe [2008-01-07 495616]

C:\Documents and Settings\All Users\Start Menu\Programs\Indítópult
Adobe Reader gyorsindító.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2005-08-04 46080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2007-04-10 236928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoResolveTrack"=1
"NoResolveSearch"=1
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=
"NoDrives"=
"NoDriveAutoRun"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\BCDC++\DCPlusPlus.exe"="D:\BCDC++\DCPlusPlus.exe:*:Enabled:BCDC++"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\IncrediMail\bin\ImpCnt.exe"="C:\Program Files\IncrediMail\bin\ImpCnt.exe:*:Enabled:IncrediMail"
"D:\Xfire\Xfire.exe"="D:\Xfire\Xfire.exe:*:Enabled:Xfire"
"C:\Program Files\Activision\Call of Duty 2\CoD2MP_s.exe"="C:\Program Files\Activision\Call of Duty 2\CoD2MP_s.exe:*:Enabled:CoD2MP_s"
"C:\Program Files\Winamp Remote\bin\Orb.exe"="C:\Program Files\Winamp Remote\bin\Orb.exe:*:Enabled:Orb"
"C:\Program Files\Winamp Remote\bin\OrbTray.exe"="C:\Program Files\Winamp Remote\bin\OrbTray.exe:*:Enabled:OrbTray"
"C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe"="C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:*:Enabled:Orb Stream Client"
"C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\Program Files\EA Sports\FIFA 09\FIFA09.exe"="C:\Program Files\EA Sports\FIFA 09\FIFA09.exe:*:Enabled:FIFA09"
"D:\BearShare\BearShare.exe"="D:\BearShare\BearShare.exe:*:Enabled:BearShare"
"D:\Soldat\Soldat.exe"="D:\Soldat\Soldat.exe:*:Enabled:Soldat"
"D:\Quake III Arena\quake3.exe"="D:\Quake III Arena\quake3.exe:*:Enabled:quake3"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{72cb5ebc-8038-11dd-a662-00196609868b}]
shell\AutoRun\command - G:\Web'n'walk_Helper.exe


======List of files/folders created in the last 3 months======

2008-12-28 19:42:16 ----D---- C:\rsit
2008-12-28 11:20:52 ----D---- C:\Program Files\ESET
2008-12-28 10:58:41 ----D---- C:\_OTMoveIt
2008-12-28 10:57:53 ----A---- C:\OTMoveIt3.exe
2008-12-27 15:00:30 ----DC---- C:\Documents and Settings\All Users\Application Data\{B46E1EF5-0B37-4DB4-A4E2-9F2B41036185}
2008-12-27 14:54:02 ----D---- C:\Program Files\Mplayer
2008-12-27 14:50:20 ----A---- C:\WINDOWS\QIII.INI
2008-12-21 11:47:10 ----A---- C:\zjhdjzjh.txt
2008-12-21 10:33:28 ----A---- C:\WINDOWS\system32\msvcr80.dll
2008-12-21 10:33:27 ----A---- C:\WINDOWS\system32\msvcp80.dll
2008-12-21 10:33:26 ----A---- C:\WINDOWS\system32\eEmpty.exe
2008-12-21 10:33:23 ----A---- C:\WINDOWS\system32\TASKMGR.COM
2008-12-21 10:33:23 ----A---- C:\WINDOWS\system32\T.COM
2008-12-21 10:33:23 ----A---- C:\WINDOWS\REGEDIT.COM
2008-12-21 10:33:23 ----A---- C:\WINDOWS\R.COM
2008-12-21 10:33:14 ----D---- C:\Documents and Settings\All Users\Application Data\MicroWorld
2008-12-21 10:32:36 ----A---- C:\mwav.exe
2008-12-20 18:48:37 ----A---- C:\WINDOWS\system32\javaws.exe
2008-12-20 18:48:37 ----A---- C:\WINDOWS\system32\javaw.exe
2008-12-20 18:48:37 ----A---- C:\WINDOWS\system32\java.exe
2008-12-14 18:22:21 ----D---- C:\Documents and Settings\PISTA\Application Data\Soldat
2008-12-11 21:37:44 ----A---- C:\WINDOWS\system32\xfcodec.dll
2008-12-11 17:07:38 ----HDC---- C:\WINDOWS\$NtUninstallKB955839$
2008-12-11 17:06:43 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$
2008-12-11 17:06:18 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$
2008-12-11 17:06:11 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
2008-12-07 12:52:17 ----A---- C:\avenger.txt
2008-12-01 17:26:37 ----A---- C:\kaspersky.txt
2008-11-25 14:21:24 ----D---- C:\Program Files\Free Internet Window Washer
2008-11-25 14:20:24 ----A---- C:\FIWWSetup.exe
2008-11-23 17:48:30 ----A---- C:\WINDOWS\system32\deploytk.dll
2008-11-18 11:14:39 ----SHD---- C:\RECYCLER
2008-11-18 10:41:52 ----D---- C:\WINDOWS\temp
2008-11-18 09:55:48 ----D---- C:\WINDOWS\ERDNT
2008-11-15 18:35:12 ----D---- C:\cel
2008-11-15 18:35:08 ----D---- C:\f
2008-11-15 18:32:37 ----D---- C:\Program Files\AVIConverter
2008-11-12 23:28:15 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
2008-11-12 23:28:09 ----HDC---- C:\WINDOWS\$NtUninstallKB954459$
2008-11-12 23:28:01 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2008-11-09 18:57:34 ----HD---- C:\WINDOWS\PIF
2008-11-09 16:19:12 ----D---- C:\Program Files\Windows Live Safety Center
2008-10-29 16:48:22 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$
2008-10-28 16:51:48 ----D---- C:\WINDOWS\system32\xircom
2008-10-28 16:51:48 ----D---- C:\Program Files\xerox
2008-10-28 16:51:47 ----D---- C:\Program Files\microsoft frontpage
2008-10-28 16:51:41 ----D---- C:\WINDOWS\Prefetch
2008-10-28 16:37:15 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2008-10-28 16:37:06 ----HDC---- C:\WINDOWS\$NtUninstallKB957095$
2008-10-28 16:36:56 ----HDC---- C:\WINDOWS\$NtUninstallKB956841$
2008-10-28 16:36:47 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2008-10-28 16:36:35 ----HDC---- C:\WINDOWS\$NtUninstallKB954211$
2008-10-28 16:36:24 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2008-10-28 16:36:15 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2008-10-28 16:36:03 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2008-10-28 16:35:54 ----HDC---- C:\WINDOWS\$NtUninstallKB951698$
2008-10-28 16:35:45 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2008-10-28 16:35:37 ----HDC---- C:\WINDOWS\$NtUninstallKB951376$
2008-10-28 16:35:24 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2008-10-28 16:35:15 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2008-10-28 16:35:06 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2008-10-28 16:34:55 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2008-10-28 16:34:47 ----HDC---- C:\WINDOWS\$NtUninstallKB938464$
2008-10-28 16:30:00 ----D---- C:\WINDOWS\system32\hu
2008-10-28 16:30:00 ----D---- C:\WINDOWS\l2schemas
2008-10-28 16:29:59 ----D---- C:\WINDOWS\system32\bits
2008-10-28 16:24:17 ----D---- C:\WINDOWS\ServicePackFiles
2008-10-28 16:14:01 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$
2008-10-24 16:09:05 ----HDC---- C:\WINDOWS\$NtUninstallKB958644_0$
2008-10-21 07:56:01 ----D---- C:\Program Files\VirtualDJ
2008-10-17 20:55:15 ----HDC---- C:\WINDOWS\$NtUninstallKB954211_0$
2008-10-16 18:33:04 ----HDC---- C:\WINDOWS\$NtUninstallKB956803_0$
2008-10-16 18:32:57 ----HDC---- C:\WINDOWS\$NtUninstallKB956391$
2008-10-16 18:32:49 ----HDC---- C:\WINDOWS\$NtUninstallKB957095_0$
2008-10-16 18:31:42 ----HDC---- C:\WINDOWS\$NtUninstallKB956841_0$
2008-10-13 15:54:12 ----D---- C:\Documents and Settings\PISTA\Application Data\Leadertech
2008-10-03 00:46:24 ----A---- C:\WINDOWS\system32\frapsvid.dll
2008-09-30 16:43:34 ----A---- C:\WINDOWS\system32\msxml4.dll

======List of files/folders modified in the last 3 months======

2008-12-29 14:13:36 ----D---- C:\Program Files\HijackThis
2008-12-28 19:42:59 ----A---- C:\WINDOWS\SchedLgU.Txt
2008-12-28 17:46:40 ----D---- C:\Program Files\Mozilla Firefox
2008-12-28 13:36:39 ----D---- C:\WINDOWS
2008-12-28 11:28:43 ----AC---- C:\WINDOWS\system32\PnkBstrB.exe
2008-12-28 11:28:37 ----D---- C:\Documents and Settings\PISTA\Application Data\Xfire
2008-12-28 11:21:31 ----SHD---- C:\WINDOWS\Installer
2008-12-28 11:21:25 ----HD---- C:\WINDOWS\inf
2008-12-28 11:21:25 ----D---- C:\WINDOWS\system32\drivers
2008-12-28 11:21:19 ----D---- C:\WINDOWS\system32\CatRoot2
2008-12-28 11:20:52 ----D---- C:\Program Files
2008-12-28 11:07:31 ----SHD---- C:\System Volume Information
2008-12-28 11:07:31 ----D---- C:\WINDOWS\system32\Restore
2008-12-27 12:36:34 ----D---- C:\Documents and Settings\PISTA\Application Data\LimeWire
2008-12-26 19:33:28 ----A---- C:\WINDOWS\system32\PnkBstrA.exe
2008-12-26 15:49:38 ----AC---- C:\WINDOWS\NeroDigital.ini
2008-12-23 15:09:42 ----D---- C:\WINDOWS\system32
2008-12-20 18:48:36 ----D---- C:\Program Files\Java
2008-12-18 14:52:25 ----D---- C:\WINDOWS\system32\dllcache
2008-12-18 14:52:09 ----HD---- C:\WINDOWS\$hf_mig$
2008-12-16 20:31:26 ----D---- C:\Documents and Settings\PISTA\Application Data\uTorrent
2008-12-14 18:22:44 ----RSD---- C:\WINDOWS\Fonts
2008-12-13 07:39:18 ----A---- C:\WINDOWS\system32\mshtml.dll
2008-12-12 13:02:53 ----D---- C:\WINDOWS\Debug
2008-12-11 17:07:18 ----D---- C:\Program Files\Internet Explorer
2008-12-10 00:24:37 ----AC---- C:\WINDOWS\system32\MRT.exe
2008-12-03 14:46:15 ----D---- C:\WINDOWS\system32\Adobe
2008-12-03 14:45:43 ----D---- C:\Documents and Settings\PISTA\Application Data\Adobe
2008-11-28 21:31:40 ----RD---- C:\Zene 1
2008-11-19 17:06:59 ----SD---- C:\WINDOWS\Tasks
2008-11-18 11:14:39 ----D---- C:\WINDOWS\Minidump
2008-11-18 10:35:05 ----A---- C:\WINDOWS\system.ini
2008-11-18 10:33:29 ----D---- C:\WINDOWS\AppPatch
2008-11-18 10:33:29 ----D---- C:\Program Files\Common Files
2008-11-18 09:57:17 ----D---- C:\WINDOWS\system
2008-11-17 15:54:08 ----D---- C:\WINDOWS\Help
2008-11-12 23:27:40 ----D---- C:\WINDOWS\WinSxS
2008-11-09 16:19:14 ----SD---- C:\WINDOWS\Downloaded Program Files
2008-11-08 13:46:54 ----D---- C:\Program Files\EA Sports
2008-11-08 00:16:04 ----AC---- C:\WINDOWS\wincmd.ini
2008-11-06 16:12:03 ----D---- C:\Program Files\LimeWire
2008-10-28 16:53:30 ----AC---- C:\WINDOWS\system32\PerfStringBackup.INI
2008-10-28 16:51:48 ----D---- C:\WINDOWS\system32\wbem
2008-10-28 16:51:48 ----D---- C:\WINDOWS\ime
2008-10-28 16:51:14 ----D---- C:\WINDOWS\system32\Setup
2008-10-28 16:51:14 ----D---- C:\Program Files\Messenger
2008-10-28 16:50:28 ----D---- C:\WINDOWS\security
2008-10-28 16:37:16 ----D---- C:\WINDOWS\system32\CatRoot
2008-10-28 16:30:29 ----D---- C:\WINDOWS\ehome
2008-10-28 16:30:26 ----D---- C:\WINDOWS\system32\inetsrv
2008-10-28 16:30:26 ----D---- C:\WINDOWS\Network Diagnostic
2008-10-28 16:30:03 ----D---- C:\WINDOWS\system32\usmt
2008-10-28 16:30:03 ----D---- C:\WINDOWS\system32\hu-hu
2008-10-28 16:29:59 ----D---- C:\WINDOWS\PeerNet
2008-10-28 16:29:59 ----D---- C:\Program Files\Movie Maker
2008-10-28 16:23:45 ----D---- C:\WINDOWS\system32\npp
2008-10-28 16:23:43 ----D---- C:\WINDOWS\msagent
2008-10-28 16:23:41 ----D---- C:\WINDOWS\srchasst
2008-10-28 16:23:40 ----D---- C:\Program Files\NetMeeting
2008-10-28 16:23:37 ----D---- C:\WINDOWS\system32\Com
2008-10-28 16:23:34 ----D---- C:\Program Files\Windows NT
2008-10-28 16:23:34 ----D---- C:\Program Files\Windows Media Player
2008-10-28 16:23:33 ----D---- C:\Program Files\Outlook Express
2008-10-28 16:23:30 ----D---- C:\Program Files\Common Files\System
2008-10-28 16:23:11 ----D---- C:\WINDOWS\system32\oobe
2008-10-28 16:18:35 ----D---- C:\WINDOWS\system32\ReinstallBackups
2008-10-23 13:42:23 ----A---- C:\WINDOWS\system32\gdi32.dll
2008-10-23 11:06:59 ----N---- C:\WINDOWS\system32\tzchange.exe
2008-10-22 16:07:40 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP
2008-10-20 17:02:58 ----HD---- C:\Program Files\InstallShield Installation Information
2008-10-20 11:36:01 ----D---- C:\Program Files\Activision
2008-10-20 08:46:11 ----D---- C:\WINDOWS\system32\Macromed
2008-10-16 21:33:32 ----A---- C:\WINDOWS\system32\wininet.dll
2008-10-16 21:33:32 ----A---- C:\WINDOWS\system32\webcheck.dll
2008-10-16 21:33:31 ----A---- C:\WINDOWS\system32\urlmon.dll
2008-10-16 21:33:30 ----A---- C:\WINDOWS\system32\url.dll
2008-10-16 21:33:30 ----A---- C:\WINDOWS\system32\pngfilt.dll
2008-10-16 21:33:30 ----A---- C:\WINDOWS\system32\occache.dll
2008-10-16 21:33:30 ----A---- C:\WINDOWS\system32\mstime.dll
2008-10-16 21:33:30 ----A---- C:\WINDOWS\system32\msrating.dll
2008-10-16 21:33:29 ----A---- C:\WINDOWS\system32\mshtmled.dll
2008-10-16 21:33:26 ----A---- C:\WINDOWS\system32\msfeedsbs.dll
2008-10-16 21:33:26 ----A---- C:\WINDOWS\system32\msfeeds.dll
2008-10-16 21:33:26 ----A---- C:\WINDOWS\system32\jsproxy.dll
2008-10-16 21:33:25 ----A---- C:\WINDOWS\system32\iertutil.dll
2008-10-16 21:33:25 ----A---- C:\WINDOWS\system32\iernonce.dll
2008-10-16 21:33:25 ----A---- C:\WINDOWS\system32\ieframe.dll
2008-10-16 21:33:23 ----A---- C:\WINDOWS\system32\iedkcs32.dll
2008-10-16 21:33:22 ----A---- C:\WINDOWS\system32\ieapfltr.dll
2008-10-16 21:33:22 ----A---- C:\WINDOWS\system32\ieaksie.dll
2008-10-16 21:33:22 ----A---- C:\WINDOWS\system32\ieakeng.dll
2008-10-16 21:33:22 ----A---- C:\WINDOWS\system32\icardie.dll
2008-10-16 21:33:22 ----A---- C:\WINDOWS\system32\extmgr.dll
2008-10-16 21:33:22 ----A---- C:\WINDOWS\system32\dxtrans.dll
2008-10-16 21:33:22 ----A---- C:\WINDOWS\system32\dxtmsft.dll
2008-10-16 21:33:22 ----A---- C:\WINDOWS\system32\advpack.dll
2008-10-16 14:13:40 ----A---- C:\WINDOWS\system32\wuweb.dll
2008-10-16 14:13:40 ----A---- C:\WINDOWS\system32\wuaueng.dll
2008-10-16 14:13:11 ----A---- C:\WINDOWS\system32\ie4uinit.exe
2008-10-16 14:12:22 ----A---- C:\WINDOWS\system32\wucltui.dll
2008-10-16 14:12:20 ----A---- C:\WINDOWS\system32\wuapi.dll
2008-10-16 14:11:09 ----A---- C:\WINDOWS\system32\ieudinit.exe
2008-10-16 14:09:44 ----AC---- C:\WINDOWS\system32\wups2.dll
2008-10-16 14:09:44 ----A---- C:\WINDOWS\system32\wuauclt.exe
2008-10-16 14:09:44 ----A---- C:\WINDOWS\system32\cdm.dll
2008-10-16 14:09:40 ----A---- C:\WINDOWS\system32\wucltui.dll.mui
2008-10-16 14:08:58 ----AC---- C:\WINDOWS\system32\wups.dll
2008-10-16 14:08:08 ----A---- C:\WINDOWS\system32\wuapi.dll.mui
2008-10-16 14:07:32 ----A---- C:\WINDOWS\system32\wuaueng.dll.mui
2008-10-16 14:06:48 ----A---- C:\WINDOWS\system32\muweb.dll
2008-10-16 14:06:48 ----A---- C:\WINDOWS\system32\mucltui.dll
2008-10-16 14:06:40 ----A---- C:\WINDOWS\system32\mucltui.dll.mui
2008-10-15 17:37:43 ----A---- C:\WINDOWS\system32\netapi32.dll
2008-10-15 08:04:53 ----A---- C:\WINDOWS\system32\ieakui.dll
2008-10-13 17:02:26 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2008-10-13 16:49:48 ----D---- C:\WINDOWS\system32\DirectX
2008-10-13 16:49:39 ----RSD---- C:\WINDOWS\assembly
2008-10-13 16:48:48 ----D---- C:\Program Files\Common Files\Microsoft Shared
2008-10-03 11:04:45 ----A---- C:\WINDOWS\system32\strmdll.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AFS2K;AFS2k; C:\WINDOWS\system32\drivers\AFS2K.sys [2007-05-11 82380]
R1 easdrv;easdrv; C:\WINDOWS\system32\DRIVERS\easdrv.sys [2008-07-01 53256]
R1 epfwtdir;epfwtdir; C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-07-01 34312]
R1 intelppm;Intel processzor illesztőprogramja; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40576]
R1 WS2IFSL;Windows Socket 2.0 - nem IFS-t szolgáltató támogatási környezet; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-10-26 12032]
R2 eamon;EAMON; C:\WINDOWS\system32\DRIVERS\eamon.sys [2008-07-01 39944]
R2 irda;IrDA protokoll; C:\WINDOWS\system32\DRIVERS\irda.sys [2008-04-13 88192]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2005-08-04 1273344]
R3 cmpci;C-Media PCI Audio Driver (WDM); C:\WINDOWS\system32\drivers\cmaudio.sys [2001-10-30 280782]
R3 GCR410P;GEMPLUS GCR410P Serial intelligenskártya-olvasó; C:\WINDOWS\system32\DRIVERS\grserial.sys [2008-04-14 28544]
R3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2003-05-14 51056]
R3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2003-05-14 16496]
R3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2003-05-14 21488]
R3 irsir;Microsoft soros infravörös illesztőprogram; C:\WINDOWS\system32\DRIVERS\irsir.sys [2001-08-17 18688]
R3 Rasirda;WAN miniport (IrDA); C:\WINDOWS\system32\DRIVERS\rasirda.sys [2001-08-17 19584]
R3 RTL8023xp;Realtek 10/100/1000 NIC Family all in one NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys [2005-03-04 74496]
R3 usbccgp;Microsoft USB általános szülő-illesztőprogram; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Microsoft USB 2.0 bővített állomásvezérlő miniport illesztőprogramja; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2-engedélyezett hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbprint;Microsoft USB PRINTER osztály; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
R3 USBSTOR;USB háttértár illesztőprogramja; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Microsoft USB univerzális állomásvezérlő miniport illesztőprogramja; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 a0ctr8n5;a0ctr8n5; C:\WINDOWS\system32\drivers\a0ctr8n5.sys []
S3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2008-08-26 26056]
S3 PnkBstrK;PnkBstrK; \??\C:\WINDOWS\system32\drivers\PnkBstrK.sys []
S3 rkhdrv40;Rootkit Unhooker Driver; C:\WINDOWS\system32\drivers\rkhdrv40.sys []
S3 rtl8139;Realtek RTL8139(A/B/C) alapú PCI gyors Ethernet-adapter NT illesztőprogramja; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
S3 SONYPVU1;Sony USB-szűrő illesztőprogramja (SONYPVU1); C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS [2001-08-17 7552]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2005-08-04 380928]
R2 ekrn;Eset Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2008-07-01 468224]
R2 Irmon;Infravörös figyelő; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2008-11-10 152984]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe [2003-06-20 322120]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2008-12-26 70968]
R2 PnkBstrB;PnkBstrB; C:\WINDOWS\system32\PnkBstrB.exe [2008-12-28 201872]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R3 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2003-05-14 65795]
R3 usnjsvc;Messenger megosztási mappák – USN-naplóolvasó szolgáltatás; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2005-08-05 516096]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 EhttpSrv;Eset HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2008-07-01 19200]
S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]
S3 WMPNetworkSvc;A Windows Media Player hálózatmegosztási szolgáltatása; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-10 919040]

-----------------EOF-----------------

hát eléggé hosszú lognak tünik:)
És nem mutatja hogy mi küldi.

ezert tegyel tuzfalat,ez erdekes mert ez mar nemvirus de spam,es nemutasa az utat hogy mi kuldi ??
futasd le es a logjat ted ide
http://images.malwareremoval.com/random/RSIT.exe

Letiltottam mindenkit, és ahogy küldené a vírust, kihozza az ablakot, hogy nem küldhetek neki üzenetet.

es ezt te honan tudod hogy kuld??
Tegyel fel tuzfalat,mondjuk a ZoneAlarmot.

Most is küldi még :S
Tűzfalam pedig nincsen. Melyiket ajánlod?

ok,peti,kiprobalni,es ha nincsen tuzfalad feltetlenul rakjal fell.

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
File/Folder C:\RECYCLER\S-1-5-21-515967899-790525478-839522115-1003\Dc44.wma not found.
C:\RECYCLER\S-1-5-21-515967899-790525478-839522115-1003\Dc63.12 moved successfully.
C:\RECYCLER\S-1-5-21-515967899-790525478-839522115-1003\Dc41 moved successfully.
C:\RECYCLER\S-1-5-21-515967899-790525478-839522115-1003\Dc40 moved successfully.
C:\RECYCLER\S-1-5-21-515967899-790525478-839522115-1003\Dc39\BackUpMSNCleaner moved successfully.
C:\RECYCLER\S-1-5-21-515967899-790525478-839522115-1003\Dc39 moved successfully.
C:\RECYCLER\S-1-5-21-515967899-790525478-839522115-1003\Dc38 moved successfully.
C:\RECYCLER\S-1-5-21-515967899-790525478-839522115-1003\Dc24 moved successfully.
C:\RECYCLER\S-1-5-21-515967899-790525478-839522115-1003 moved successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\PISTA\LOCALS~1\Temp\ mon074.log scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
Java cache emptied.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.7.2 log created on 12282008_105841

Files moved on Reboot...
C:\DOCUME~1\PISTA\LOCALS~1\Temp\ mon074.log moved successfully.
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.

itt is van a log:)

Még egyszer köszi.
Csáó

oki nincsen mit,torold ki az E-mail cimed mert nemszadad igy kialitani,veszejes,
udv

Oké. Ha van valami még írok. De szerintem eddig minden rendbe van vele.
Köszönöm a segítséged. Ha egyszer meghálálhatom vagy szükséged lenne segítségre akkor írj a (már tudod mi a címem ) -ra .

az lehet,ha nem gyorsul pucold a ccleaneral vagy haromszor a rendszerirot,is,
a windows tuzfalat kikapcsolni-start-vezerlo pult...tuzfall-kikapcs

Nem olyan vészes. Csak kicsit tovább tart még betölti a Windows-t. De a durva lassulás az alarmzone telepítése után volt. De az szerintem amiatt volt hogy frissen volt telepítve és összeakadhatott valamivel. Vagy lehet egyszerre sok volt a gépnek. Meg lehet hogy csak alapból a gépbe haldoklik valami alkatrész



Az alarmzone beállítva. Csak mindig kimegy a windows saját tűzfallal, de gondolom ezzel ne foglalkozzak.

a gep lelasult,mi lasult le??
AKLLOW megengedni-DENY-betiltani-tehat pldul telepitsz programot es beugrik a ablak akor klik ALLOW-es pipazd be felete akis negyzetet-remember...es ekor mar tobszor nemugrik ki a figyelmeztetes erre a programra,..tehat bealnak a szabajok ..
ezeket alitsd be igy

ide leirtam es a ZoneAlarmnak enyi eleg
http://forum.terminal.hu/viewtopic.php?t=32573&postdays=0&postorder=asc&start=850

Megy minden eddig nincs probléma vele. Bár a CCLeaner-nél én a haladót is benyomtam, de csak az IIS naplófájlokat, a Hotfix eltávolítókat, az egyéb fálj vagy mappa és a régi Prefetch adatokat pipáltam be. Remélem ez nem baj?

Meg durván belassult a gép. de az lehet a telepítés miatt is. Mert a gépem:
AMD 1800, Abit NF7, 768 Mb ddr ram, Ati radeon 9550se videókártya.

Szóval majd elvállik de az MSN-en eddig njincs baj meg a géppel se.
Tudnál segíteni még az alarm beállításába hogy amit kell felfogjon ?
Mert ha azt állítom be hogy kérdezzen rá akkor mit jelent az Allow meg a Deny?

MAjd még jelezz vissza

aCCleaner epen ere van,csak a haladot nembabralni,ok
csinald pontosan ugy ahogy leirtam es adig nyomjad majd a gombot a pucolasnal meg nemmarad tiszta a joboldalon az ablak

a pic zip mar renben van.Majd ird le hogy mukszik a gep,ma mar vegzek,
udv

Most szedtem le a zone alarmot. ÉS akkor ennyi ezzel kész is? Nem tudsz valami jó progit ami kitakarít mindent a gépről ami felesleges? Tudod temptől kezdve minden olyat kitakarít ami már nem kell. Vagy a CCleaner jó erre csak úgy kell beállítani?

Az autoshutdown kikapcsolja a gépet vagy hibernálja. Tudod ha elaludnék beállítom és leáll.

Még valami. Az nem jelent majd problémát hogy ez a pic zip amivel a baj volt azt a D-re tömörítetem ki és a pic zip meg a C: re volt letöltve?

szed le a geprol a combofixet-start-futatas-masold be combofix /u ok
pucold ki a gepet CCleaneral

felrakni tuzfalat az Avasthoz mehet az ZoneAlarm.
es ird le hogy viselkedik a gep.

ez pedig a hijack végeredménye:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:17:23, on 2008.12.27.
Platform: Windows XP Szervizcsomag 2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\gigabyte\RCApp\RCApp.exe
C:\Program Files\CyberLink\PowerCinema\PCMService.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\Rundll32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Creative\MediaSource\Go\CTCMSGo.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Download\AutoShutdown\autoshutdown2.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\LogMeIn\x86\RaMaint.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\Program Files\Cyberlink\Shared files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comodo.com/search/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedi ... t=&gc=1&q=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedi ... t=&gc=1&q=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hivatkozások
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live bejelentkezési segítség - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [RCApp] C:\Program Files\gigabyte\RCApp\RCApp.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\CyberLink\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [Creative MediaSource Go] "C:\Program Files\Creative\MediaSource\Go\CTCMSGo.exe" /SCB
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [AutoShutdown] C:\Download\AutoShutdown\autoshutdown2.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: FIFA 09 Regisztráció.lnk = D:\Fifa09\Support\EAregister.exe
O4 - Global Startup: Adobe Reader gyorsindító.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://vinczedenesakos.spaces.live.com/ ... nPUpld.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{716A3AFC-5C49-41DF-BBCE-3DB049FE68E1}: NameServer = 62.112.192.4 195.70.35.66
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe

--
End of file - 11123 bytes

ComboFix 08-12-26.03 - Admin 2008-12-27 21:04:27.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1038.18.767.364 [GMT 1:00]
Running from: c:\documents and settings\Admin\Asztal\ComboFix.exe
Command switches used :: c:\documents and settings\Admin\Asztal\CFScript.txt
AV: avast! antivirus 4.8.1296 [VPS 081227-0] *On-access scanning disabled* (Outdated)
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
c:\documents and settings\Admin\Application Data\WinGuards.exe
c:\program files\AskBarDis\bar\bin\askBar.dll
c:\windows\pic-001.zip
c:\windows\pic-004.zip
c:\windows\pic-006.zip
c:\windows\pic-018.zip
c:\windows\pic-021.zip
c:\windows\pic-023.zip
c:\windows\pic-102.zip
c:\windows\pic-105.zip
c:\windows\pic-106.zip
c:\windows\pic-108.zip
c:\windows\pic-113.zip
c:\windows\pic-116.zip
c:\windows\pic-117.zip
c:\windows\pic-121.zip
c:\windows\pic-122.zip
c:\windows\pic-131.zip
c:\windows\pic-133.zip
c:\windows\pic0382.zip
G:\sal.xls.exe
h:\.autorun\835694854683549385398626893468946\Autorun.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Admin\Application Data\WinGuards.exe
c:\documents and settings\All Users\Application Data\_comodo_
c:\program files\AskBarDis
c:\program files\AskBarDis\bar\bin\askBar.dll
c:\program files\AskBarDis\bar\bin\askPopStp.dll
c:\program files\AskBarDis\bar\bin\psvince.dll
c:\program files\AskBarDis\bar\Cache\01AD44E2
c:\program files\AskBarDis\bar\Cache\01AD7AE6
c:\program files\AskBarDis\bar\Cache\01AD83EE.bin
c:\program files\AskBarDis\bar\Cache\01AD8824.bin
c:\program files\AskBarDis\bar\Cache\01AD8C7A.bin
c:\program files\AskBarDis\bar\Cache\01AD911D.bin
c:\program files\AskBarDis\bar\Cache\01AD97A5.bin
c:\program files\AskBarDis\bar\Cache\01AD9C58.bin
c:\program files\AskBarDis\bar\Cache\01ADA12B.bin
c:\program files\AskBarDis\bar\Cache\01ADA580.bin
c:\program files\AskBarDis\bar\Cache\01ADA958.bin
c:\program files\AskBarDis\bar\Cache\files.ini
c:\program files\AskBarDis\bar\History\search
c:\program files\AskBarDis\bar\Settings\config.dat
c:\program files\AskBarDis\bar\Settings\config.dat.bak
c:\program files\AskBarDis\bar\Settings\prevcfg.htm
c:\program files\AskBarDis\unins000.dat
c:\program files\AskBarDis\unins000.exe
c:\program files\AskSearch
c:\program files\AskSearch\bin\DefaultSearch.dll
c:\windows\pic-001.zip
c:\windows\pic-004.zip
c:\windows\pic-006.zip
c:\windows\pic-018.zip
c:\windows\pic-021.zip
c:\windows\pic-023.zip
c:\windows\pic-102.zip
c:\windows\pic-105.zip
c:\windows\pic-106.zip
c:\windows\pic-108.zip
c:\windows\pic-113.zip
c:\windows\pic-116.zip
c:\windows\pic-117.zip
c:\windows\pic-121.zip
c:\windows\pic-122.zip
c:\windows\pic-131.zip
c:\windows\pic-133.zip
c:\windows\pic0382.zip
c:\windows\system32\cssdll32.dll\
G:\autorun.inf
h:\.autorun\835694854683549385398626893468946\Autorun.exe
H:\autorun.inf

.
((((((((((((((((((((((((( Files Created from 2008-11-27 to 2008-12-27 )))))))))))))))))))))))))))))))
.

2008-12-27 17:20 . 2008-12-27 17:20 249,592 --a------ c:\windows\system32\cssdll32.dll
2008-12-27 16:48 . 2008-12-27 16:48 <DIR> d-------- c:\program files\Trend Micro
2008-12-25 14:04 . 2008-12-25 14:05 <DIR> d-------- c:\program files\DVD Shrink
2008-12-25 14:04 . 2008-12-25 14:04 <DIR> d-------- c:\documents and settings\All Users\Application Data\DVD Shrink
2008-12-22 20:36 . 2008-12-22 20:36 <DIR> d-------- c:\documents and settings\Admin\.webrenderer
2008-12-22 07:01 . 2005-06-24 16:24 438,272 -ra------ c:\windows\system32\vp6vfw.dll
2008-12-22 07:01 . 2004-12-10 09:06 327,680 --a------ c:\windows\system32\vp6dec.ax
2008-12-14 17:03 . 2008-12-14 17:03 410,984 --a------ c:\windows\system32\deploytk.dll
2008-12-14 16:41 . 2008-12-14 16:41 1,420 --a------ c:\windows\system32\ealregsnapshot1.reg
2008-12-14 16:40 . 2008-12-14 16:40 <DIR> d-------- c:\documents and settings\Admin\Application Data\Leadertech
2008-12-14 16:20 . 2008-03-05 15:56 3,786,760 --a------ c:\windows\system32\D3DX9_37.dll
2008-12-14 16:20 . 2007-07-19 18:14 3,727,720 --a------ c:\windows\system32\d3dx9_35.dll
2008-12-14 16:20 . 2007-05-16 16:45 3,497,832 --a------ c:\windows\system32\d3dx9_34.dll
2008-12-14 16:20 . 2007-03-12 16:42 3,495,784 --a------ c:\windows\system32\d3dx9_33.dll
2008-12-14 16:20 . 2006-11-29 13:06 3,426,072 --a------ c:\windows\system32\d3dx9_32.dll
2008-12-14 16:20 . 2006-09-28 16:05 2,414,360 --a------ c:\windows\system32\d3dx9_31.dll
2008-12-14 16:20 . 2007-04-04 18:53 81,768 --a------ c:\windows\system32\xinput1_3.dll
2008-12-14 14:32 . 2008-12-14 14:36 <DIR> d-------- c:\program files\Ahead
2008-12-13 01:57 . 2008-12-13 02:02 <DIR> d-------- c:\program files\uTorrent
2008-12-13 01:53 . 2008-12-27 15:41 <DIR> d-------- c:\documents and settings\Admin\Application Data\uTorrent

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-27 20:07 --------- d-----w c:\program files\Steam
2008-12-27 20:07 --------- d-----w c:\documents and settings\Admin\Application Data\Skype
2008-12-27 17:23 --------- d-----w c:\documents and settings\Admin\Application Data\skypePM
2008-12-27 00:01 --------- d-----w c:\program files\LogMeIn
2008-12-25 13:09 --------- d-----w c:\program files\Common Files\Ahead
2008-12-22 17:27 --------- d-----w c:\program files\ParadisePoker
2008-12-22 06:01 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-20 11:36 --------- d-----w c:\program files\Mozilla Thunderbird
2008-12-19 10:31 --------- d-----w c:\documents and settings\Admin\Application Data\LimeWire
2008-12-14 16:03 --------- d-----w c:\program files\Java
2008-11-16 09:18 --------- d-----w c:\program files\GRETECH
2008-11-16 09:18 --------- d-----w c:\documents and settings\All Users\Application Data\GRETECH
2008-11-16 09:18 --------- d-----w c:\documents and settings\Admin\Application Data\GRETECH
2008-04-25 13:35 32 ----a-w c:\documents and settings\All Users\Application Data\ezsid.dat
2007-08-09 11:08 8,784 ----a-w c:\program files\mozilla firefox\plugins\ractrlkeyhook.dll
2007-08-09 11:10 245,408 ----a-w c:\program files\mozilla firefox\plugins\unicows.dll
.

((((((((((((((((((((((((((((( snapshot@2008-12-27_19.29.15.18 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-12-27 20:07:13 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_664.dat
+ 2008-12-27 20:08:50 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_794.dat
+ 2008-12-27 20:08:21 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_f40.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-17 15360]
"Creative Detector"="c:\program files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 102400]
"Creative MediaSource Go"="c:\program files\Creative\MediaSource\Go\CTCMSGo.exe" [2004-11-30 135168]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"Steam"="c:\program files\Steam\Steam.exe" [2006-03-10 1249280]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-02-06 21898024]
"AutoShutdown"="c:\download\AutoShutdown\autoshutdown2.exe" [2001-05-15 572416]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RCApp"="c:\program files\gigabyte\RCApp\RCApp.exe" [2007-04-24 689664]
"PCMService"="c:\program files\CyberLink\PowerCinema\PCMService.exe" [2006-12-29 155648]
"CTSysVol"="c:\program files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-02-15 57344]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-02-23 278528]
"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2007-08-03 63048]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-14 136600]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2005-12-10 133016]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"P17Helper"="P17.dll" [2005-05-03 c:\windows\system32\P17.dll]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-17 c:\windows\system32\bthprops.cpl]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-17 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2008-10-17 18:44 87352 c:\windows\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.sl_anet"= c:\progra~1\ACEMEG~1\SystemS\sl_anet.acm
"vidc.yv12"= c:\progra~1\ACEMEG~1\SystemS\ATI\atiyuv12.DLL
"vidc.divx"= c:\progra~1\ACEMEG~1\SystemS\DivX\DivX520.dll
"msacm.divxa32"= msaud32_divx.acm
"msacm.msaudio1"= c:\progra~1\ACEMEG~1\SystemS\MICROS~1\msaud32.acm

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Download\\utorrent_1.8.1.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"13871:TCP"= 13871:TCP:BitComet 13871 TCP
"13871:UDP"= 13871:UDP:BitComet 13871 UDP

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-04-12 111184]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-04-12 20560]
R2 LMIInfo;LogMeIn Kernel Information Provider;\??\c:\program files\LogMeIn\x86\RaInfo.sys [2007-08-03 12856]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;\??\c:\windows\system32\drivers\LMIRfsDriver.sys [2008-04-13 47640]
R3 3xHybrid;Philips SAA713x PCI Card;c:\windows\system32\DRIVERS\3xHybrid.sys [2006-03-22 1121536]
S3 CTL518;Video Blaster WebCam (WDM);c:\windows\system32\DRIVERS\wcvid.sys [2000-10-20 178408]
S4 LMIRfsClientNP;LMIRfsClientNP; []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{eda08022-cfe9-11dd-8921-00508d63b4fb}]
\Shell\AutoRun\command - G:\AutoTransfer.exe
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-Microsoft Drives Guard - c:\documents and settings\Admin\Application Data\WinGuards.exe


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.comodo.com/search/
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedi ... t=&gc=1&q=%s
IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: &Google Search - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: Backward &Links - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cac&hed Snapshot of Page - c:\program files\Google\GoogleToolbar1.dll/cmcache.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Si&milar Pages - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate into English - c:\program files\Google\GoogleToolbar1.dll/cmtrans.html
FF - ProfilePath - c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\ak81dcwc.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.imdb.com/
FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedi ... t=&gc=1&q=
FF - plugin: c:\program files\Mozilla Firefox\plugins\npRACtrl.dll
FF - plugin: c:\program files\Yahoo!\Common\npyaxmpb.dll

ATTENTION: FIREFOX POLICES IS IN FORCE
pref(dom.disable_open_during_load, true);.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-27 21:08:45
Windows 5.1.2600 Szervizcsomag 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(720)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\LMIinit.dll
c:\windows\system32\LMIRfsClientNP.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\LogMeIn\x86\LMIGuardian.exe
c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\WIDCOMM\Bluetooth Software\BTStackServer.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Cyberlink\PowerCinema\Kernel\TV\CLCapSvc.exe
c:\windows\system32\CTSVCCDA.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\LogMeIn\x86\ramaint.exe
c:\program files\LogMeIn\x86\LogMeIn.exe
c:\program files\LogMeIn\x86\LMIGuardian.exe
c:\program files\Cyberlink\Shared files\RichVideo.exe
c:\program files\Cyberlink\PowerCinema\Kernel\TV\CLSched.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2008-12-27 21:12:44 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-27 20:12:41
ComboFix2.txt 2008-12-27 18:29:59

Pre-Run: 4 501 848 064 bájt szabad
Post-Run: 4,460,142,592 b jt szabad

266 --- E O F --- 2008-12-18 17:28:23

ez a combofix vége.

Még most is leszedjem és belerakjam mert már megcsináltam és ráhúztam?

ok megnezem
szed le inen ,ted az asztalra,nemszabad kinyitnod es dobd be a combofixbe
http://leteckaposta.cz/181615837

ha gondolod itt meg tudod nézni hogy milyen a mentés a magyar xp-n. Itt amire gondolsz az a mentés másként a neve. De azt értettem csak a többibe nem voltam biztos.
http://kepfeltoltes.hu/view/081227/stel ... es.hu_.gif

A másikat itt minden fáljnak írja. Mármint ha azt akarod hogy mindet lássa ne csak a szöveges doc-okat.

start-futatas-beirod-notepadklik ok
most inen bemasolod a piros textett a kinyilt notepadba.
most enek a notepadnak a bal felso sarokban van FUL-raklikelsz az elso fulre-a kinyilt menuben kivalasztod-lementeni mint....
a neve ide beirod CFScript.txt
alata bealitod-minden mapak,fajlok....
legfelull asztal es leteszed az asztalra
megfogod az egerel es beledobod a combofixbe es megint csak varsz meg a combofix nem ad logot.Sajnos jobban nemtudom leirni mert nincsen magyar windowsom,es meg senki se irta le nekem eztet pontosan

Bocs nem nagyon értem ezért leírom hogy ugyan arra gondolunk-e.

Beraktam a szöveget
Most menteni kéne a szöveget ezen a néven amit írtál.
Utána át kell állítani minden fáljra a fálj tipusát
És utána meg az asztalra menteni.
aztán mentés.
Jól gondolom?