ok,nincsen mitt koszonod udv.

Minden oké, már nem ugrál. Köszi szépen, hogy szántál rám is egy "kis" időt. Tényleg köszi! További jó munkát Stell. szia.

ok,szed le a combofixet-start-futatas masold be combofix /u ok
Fixeld le
O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - (no file)
es en szeintem renben van

Most el kell mennem, majd később idenézek. Üdv.

HijackThis Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:52:36, on 2009.01.14.
Platform: Windows XP Szervizcsomag 2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\xy\Asztal\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.allat-nevelde.hu/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hivatkozások
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live bejelentkezési segítség - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - (no file)
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader gyorsindító.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 4957 bytes

ComboFix Log:

ComboFix 09-01-13.04 - xy 2009-01-14 11:17:29.6 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1038.18.126.17 [GMT 1:00]
Running from: c:\documents and settings\xy\Asztal\ComboFix.exe
Command switches used :: c:\documents and settings\xy\Asztal\CFScript.txt
AV: avast! antivirus 4.8.1296 [VPS 090113-1] *On-access scanning disabled* (Outdated)
AV: NOD32 Antivirus System 2.51 *On-access scanning disabled* (Outdated)
FW: ZoneAlarm Firewall *disabled*
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-12-14 to 2009-01-14 )))))))))))))))))))))))))))))))
.

2009-01-11 16:53 . 2009-01-11 16:53 <DIR> d-------- c:\documents and settings\xy\Application Data\Malwarebytes
2009-01-11 16:52 . 2009-01-11 16:53 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-01-11 16:52 . 2009-01-11 16:52 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-11 16:52 . 2009-01-04 18:38 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-11 16:52 . 2009-01-04 18:38 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-01-11 14:29 . 2009-01-11 14:29 <DIR> d-------- c:\program files\thor
2009-01-08 20:46 . 2009-01-08 20:48 <DIR> d-------- c:\program files\SweetIM
2009-01-08 20:46 . 2009-01-08 20:50 <DIR> d-------- c:\documents and settings\All Users\Application Data\SweetIM
2009-01-03 06:48 . 2009-01-03 06:48 <DIR> d-------- c:\program files\Magic Tea
2009-01-03 06:47 . 2009-01-03 06:47 <DIR> d-------- c:\program files\ReflexiveArcade
2009-01-02 09:50 . 2009-01-02 09:50 <DIR> d-------- c:\program files\Zuma deluxe
2009-01-02 09:15 . 2009-01-02 14:27 <DIR> d-------- c:\program files\GameHouse
2008-12-31 09:36 . 2008-12-31 09:36 <DIR> d-------- c:\program files\JoWooD
2008-12-31 09:13 . 2008-12-31 09:19 <DIR> d-------- c:\documents and settings\xy\Pokoli2
2008-12-30 14:06 . 2008-12-30 14:04 410,984 --a------ c:\windows\system32\deploytk.dll
2008-12-28 17:11 . 2008-12-28 21:04 <DIR> d-------- c:\program files\RSL
2008-12-28 16:15 . 2009-01-02 19:44 <DIR> d-------- C:\totalcmd
2008-12-28 09:44 . 2008-12-28 09:44 <DIR> d-------- c:\documents and settings\xy\Application Data\Apple Computer
2008-12-14 11:12 . 2008-12-14 11:12 <DIR> d-------- c:\program files\ZoneAlarmSB
2008-12-14 11:09 . 2008-12-14 11:09 4,212 --ah----- c:\windows\system32\zllictbl.dat
2008-12-14 11:08 . 2008-12-14 11:09 <DIR> d-------- c:\windows\system32\ZoneLabs
2008-12-14 11:08 . 2008-12-14 11:08 <DIR> d-------- c:\program files\Zone Labs
2008-12-14 11:08 . 2008-08-21 20:41 1,221,008 --a------ c:\windows\system32\zpeng25.dll
2008-12-14 11:08 . 2009-01-14 11:28 348,371 --a------ c:\windows\system32\vsconfig.xml
2008-12-14 11:07 . 2009-01-14 11:37 <DIR> d-------- c:\windows\Internet Logs
2008-12-14 10:34 . 2008-12-14 10:34 <DIR> d-------- c:\program files\CCleaner

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-13 08:32 --------- d-----w c:\program files\Common Files\Adobe
2009-01-09 12:47 --------- d-----w c:\documents and settings\xy\Application Data\Wildfire
2009-01-03 20:26 --------- d-----w c:\documents and settings\xy\Application Data\MSN6
2009-01-02 13:13 --------- d-----w c:\program files\Google
2008-12-22 16:50 --------- d-----w c:\program files\Opera
2008-12-11 17:23 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller
2008-11-26 16:29 --------- d-----w c:\program files\MSECache
2008-11-19 16:32 --------- d-----w c:\documents and settings\xy\Application Data\mbin.jp
2008-11-17 17:20 --------- d-----w c:\program files\OpenOffice.org 2.4
2008-11-16 09:58 --------- d-----w c:\program files\Sebran
2008-11-16 07:30 --------- d-----w c:\documents and settings\xy\Application Data\OpenOffice.org2
2008-11-15 10:27 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-15 10:26 --------- d--h--w c:\program files\InstallShield Installation Information
2008-01-13 13:29 32 -c--a-w c:\documents and settings\All Users\Application Data\ezsid.dat
.

((((((((((((((((((((((((((((( snapshot@2009-01-13_17.45.30.90 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-01-14 10:26:02 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_5dc.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-02 39408]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-08-21 981904]
"SweetIM"="c:\program files\SweetIM\Messenger\SweetIM.exe" [2009-01-01 111928]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-17 15360]

c:\documents and settings\All Users\Start Menu\Programs\Indˇt˘pult\
Adobe Reader gyorsindˇt˘.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 29696]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
--a------ 2007-10-18 11:34 5724184 c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
c:\program files\QuickTime\QTTask.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
c:\program files\Java\jre6\bin\jusched.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2009-01-02 14:13 39408 c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\WINDOWS\\PCHEALTH\\HELPCTR\\Binaries\\helpctr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9699:TCP"= 9699:TCP:BitComet 9699 TCP
"9699:UDP"= 9699:UDP:BitComet 9699 UDP
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-11-20 111184]
R4 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-11-20 20560]

--- Other Services/Drivers In Memory ---

*Deregistered* - NWCWorkstation
*Deregistered* - PolicyAgent
*Deregistered* - ProtectedStorage
*Deregistered* - RasMan
*Deregistered* - RemoteRegistry
*Deregistered* - RpcSs
*Deregistered* - SamSs
*Deregistered* - Schedule
*Deregistered* - seclogon
*Deregistered* - SENS
*Deregistered* - SharedAccess
*Deregistered* - ShellHWDetection
*Deregistered* - Spooler
*Deregistered* - srservice
*Deregistered* - SSDPSRV
*Deregistered* - TapiSrv
*Deregistered* - TermService
*Deregistered* - Themes
*Deregistered* - TrkWks
*Deregistered* - vsmon
*Deregistered* - W32Time
*Deregistered* - WebClient
*Deregistered* - winmgmt
*Deregistered* - wscsvc
*Deregistered* - wuauserv
*Deregistered* - WZCSVC
.
Contents of the 'Scheduled Tasks' folder

2009-01-10 c:\windows\Tasks\{06C4A412-99DD-4FF5-AAF0-1A9F333550B5}_OTTHONI_xy.job
- c:\windows\system32\mobsync.exe [2004-08-17 15:48]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.allat-nevelde.hu/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
uInternet Connection Wizard,ShellNext = iexplore
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
FF - ProfilePath - c:\documents and settings\xy\Application Data\Mozilla\Firefox\Profiles\ldl76qqr.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.live.com/
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt ... =MICPHU&q=
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-14 11:32:33
Windows 5.1.2600 Szervizcsomag 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ZoneLabs\vsmon.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-01-14 11:43:51 - machine was rebooted [xy]
ComboFix-quarantined-files.txt 2009-01-14 10:43:32
ComboFix2.txt 2009-01-13 17:34:54

Pre-Run: 455,929,856 bájt szabad
Post-Run: 705,187,840 bájt szabad

180 --- E O F --- 2008-02-03 06:29:34

Kinyitod a Notepadot>Start>futatas>beirod notepad
Es bemasolod a piros textet

Mostan>a notepadon elso full-fajl>ballfelsosarokban>4-sor>lementenni mint....
A txt-hejetfajlnev beteszed eztett>CFScript.txt<alatta bealitod >minden fajl<
legfelull>asztall i<klik gomb letenni.Es mostan megcsinalod eztett:

A combofix maga elindul es lehet hogy restartol es befejezi a scent.Amit majd ad ted ide Es az uj HijackThis logjat ted ide OK

Türelemmel várok

aha rolad elfelejtkeztem

Ma reggel ismét ugrált a böngésző, most viszont nem csinálja.

holnap fojtasuk.

Tudod én is erre gondoltam egyből

Stell, semmi gond, de csak, ha sörözni mentél (persze ez csak vicc!!)

Jó éjt!

Elment sörözni (vagy málnázni )

ammi
csak holnap irom ide a megfejtest,ma mar nincsen idom,
bocs,

Van bizony, nem mindenki szereti a sört, van aki a málnát jobban

Nagy nehezen sikerült, azt hittem sosem lesz kesz kész.

ComboFix 09-01-12.04 - xy 2009-01-13 18:09:17.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1038.18.126.17 [GMT 1:00]
Running from: c:\documents and settings\xy\Asztal\ComboFix.exe
AV: avast! antivirus 4.8.1296 [VPS 090113-0] *On-access scanning disabled* (Outdated)
AV: NOD32 Antivirus System 2.51 *On-access scanning disabled* (Outdated)
FW: ZoneAlarm Firewall *disabled*

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-12-13 to 2009-01-13 )))))))))))))))))))))))))))))))
.

2009-01-11 16:53 . 2009-01-11 16:53 <DIR> d-------- c:\documents and settings\xy\Application Data\Malwarebytes
2009-01-11 16:52 . 2009-01-11 16:53 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-01-11 16:52 . 2009-01-11 16:52 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-11 16:52 . 2009-01-04 18:38 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-11 16:52 . 2009-01-04 18:38 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-01-11 14:29 . 2009-01-11 14:29 <DIR> d-------- c:\program files\thor
2009-01-08 20:46 . 2009-01-08 20:48 <DIR> d-------- c:\program files\SweetIM
2009-01-08 20:46 . 2009-01-08 20:50 <DIR> d-------- c:\documents and settings\All Users\Application Data\SweetIM
2009-01-03 06:48 . 2009-01-03 06:48 <DIR> d-------- c:\program files\Magic Tea
2009-01-03 06:47 . 2009-01-03 06:47 <DIR> d-------- c:\program files\ReflexiveArcade
2009-01-02 09:50 . 2009-01-02 09:50 <DIR> d-------- c:\program files\Zuma deluxe
2009-01-02 09:15 . 2009-01-02 14:27 <DIR> d-------- c:\program files\GameHouse
2008-12-31 09:36 . 2008-12-31 09:36 <DIR> d-------- c:\program files\JoWooD
2008-12-31 09:13 . 2008-12-31 09:19 <DIR> d-------- c:\documents and settings\xy\Pokoli2
2008-12-30 14:06 . 2008-12-30 14:04 410,984 --a------ c:\windows\system32\deploytk.dll
2008-12-28 17:11 . 2008-12-28 21:04 <DIR> d-------- c:\program files\RSL
2008-12-28 16:15 . 2009-01-02 19:44 <DIR> d-------- C:\totalcmd
2008-12-28 09:44 . 2008-12-28 09:44 <DIR> d-------- c:\documents and settings\xy\Application Data\Apple Computer
2008-12-14 11:12 . 2008-12-14 11:12 <DIR> d-------- c:\program files\ZoneAlarmSB
2008-12-14 11:09 . 2008-12-14 11:09 4,212 --ah----- c:\windows\system32\zllictbl.dat
2008-12-14 11:08 . 2008-12-14 11:09 <DIR> d-------- c:\windows\system32\ZoneLabs
2008-12-14 11:08 . 2008-12-14 11:08 <DIR> d-------- c:\program files\Zone Labs
2008-12-14 11:08 . 2008-08-21 20:41 1,221,008 --a------ c:\windows\system32\zpeng25.dll
2008-12-14 11:08 . 2009-01-13 18:18 348,371 --a------ c:\windows\system32\vsconfig.xml
2008-12-14 11:07 . 2009-01-13 18:17 <DIR> d-------- c:\windows\Internet Logs
2008-12-14 10:34 . 2008-12-14 10:34 <DIR> d-------- c:\program files\CCleaner

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-13 08:32 --------- d-----w c:\program files\Common Files\Adobe
2009-01-09 12:47 --------- d-----w c:\documents and settings\xy\Application Data\Wildfire
2009-01-03 20:26 --------- d-----w c:\documents and settings\xy\Application Data\MSN6
2009-01-02 13:13 --------- d-----w c:\program files\Google
2008-12-22 16:50 --------- d-----w c:\program files\Opera
2008-12-11 17:23 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller
2008-11-26 16:29 --------- d-----w c:\program files\MSECache
2008-11-19 16:32 --------- d-----w c:\documents and settings\xy\Application Data\mbin.jp
2008-11-17 17:20 --------- d-----w c:\program files\OpenOffice.org 2.4
2008-11-16 09:58 --------- d-----w c:\program files\Sebran
2008-11-16 07:30 --------- d-----w c:\documents and settings\xy\Application Data\OpenOffice.org2
2008-11-15 10:27 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-15 10:26 --------- d--h--w c:\program files\InstallShield Installation Information
2008-01-13 13:29 32 -c--a-w c:\documents and settings\All Users\Application Data\ezsid.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]
2008-10-08 12:22 1172792 --a------ c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2008-10-08 1172792]

[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE.3]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2008-10-08 1172792]

[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE.3]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-02 39408]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-08-21 981904]
"SweetIM"="c:\program files\SweetIM\Messenger\SweetIM.exe" [2009-01-01 111928]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-17 15360]

c:\documents and settings\All Users\Start Menu\Programs\Indˇt˘pult\
Adobe Reader gyorsindˇt˘.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 29696]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
--a------ 2007-10-18 11:34 5724184 c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
c:\program files\QuickTime\QTTask.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
c:\program files\Java\jre6\bin\jusched.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2009-01-02 14:13 39408 c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\WINDOWS\\PCHEALTH\\HELPCTR\\Binaries\\helpctr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9699:TCP"= 9699:TCP:BitComet 9699 TCP
"9699:UDP"= 9699:UDP:BitComet 9699 UDP
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-11-20 111184]
R4 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-11-20 20560]
.
Contents of the 'Scheduled Tasks' folder

2009-01-10 c:\windows\Tasks\{06C4A412-99DD-4FF5-AAF0-1A9F333550B5}_OTTHONI_xy.job
- c:\windows\system32\mobsync.exe [2004-08-17 15:48]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.allat-nevelde.hu/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
uInternet Connection Wizard,ShellNext = iexplore
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
FF - ProfilePath - c:\documents and settings\xy\Application Data\Mozilla\Firefox\Profiles\ldl76qqr.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.live.com/
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt ... =MICPHU&q=
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-13 18:23:27
Windows 5.1.2600 Szervizcsomag 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
.
**************************************************************************
.
Completion time: 2009-01-13 18:34:51 - machine was rebooted [xy]
ComboFix-quarantined-files.txt 2009-01-13 17:34:34

Pre-Run: 798,494,720 bájt szabad
Post-Run: 784,015,360 bájt szabad

162 --- E O F --- 2008-02-03 06:29:34

Borzasztó. Van ilyen?

igen futasd -beleegyezers-aztan varni...varni...varni....a logra.
ok igyal meg egy malnat.

De én ilyen béna vagyok látod... Nem is szeretem a sört, he Akkor kikapcsolom a tűzfalat. És tudom nem babrál.

hm,a tuzfall fogja vagy mindig megengeded vagy kapcsold ki a tuzfalat
klikelj a combofix ikonra -beleegyezes -aztan elmegy a geptol egy sore -nebenaz mar. a combofix maga add logot a monitora

És jött valami, hogy egy program meg akarja változtatni a google keresési beállításokat. De aztán eltűnt.

Igenre klikkeltem, de nem történik semmi. A múltkor nem is volt ilyen ablak. A tűzfal is jelez, az mehet?

irtam belegyezes--

klik YES..Igen..Ano..

Letöltöttem a combofix-t, mintha elindulna, sípol párszor és befejezi. Bedob egy ablakot, nem tudom mi az.

Üdv Stell.

Úgy látszik mégsem oldódott meg a probléma. Ismét elkezdett ma ugrálni a böngésző. Van valami ötleted?

ok,nincsen mit koszonod

Ez szuper. Örök hálám.. Nagyon köszönöm ismét a segítséged!

igen,nembabraljuk tovab,ha nemugral akor renben van

Szia Stell.

Lefutattam a programot, és nem talált semmit sem. Ez jó hír, ugye? Nem ugrál már a böngésző. Akkor valószínű, hogy ettől volt, mármint tegnap amiket talált és töröltem?

ok,nincsen mit.

Oké. Holnap ide teszem. Addig is köszi. Szia.

ez,hamis program es trojakat telepit a gepre,futas le teljes skent es a logjat ted ide.

Most nem ugrál épp. Amúgy mi ez amiket talált ez a program?

Bocs, nem tudtam, hogyan másoljam ide. Töröltem, s ezt adta ki:

Malwarebytes' Anti-Malware 1.32
Adatbázis verzió: 1643
Windows 5.1.2600 Szervizcsomag 2

2009.01.11. 18:05:06
mbam-log-2009-01-11 (18-05-06).txt

Vizsgálat típusa: Gyorsvizsgálat
Átvizsgált objektumok: 50684
Eltelt idő: 12 minute(s), 19 second(s)

Fertőzött memóriafolyamatok: 0
Fertőzött memória modulok: 0
Fertőzött rendszerleíró kulcsok: 0
Fertőzött rendszerleíró értékek: 0
Fertőzött rednszerleíró elemek: 0
Fertőzött mappák: 0
Fertőzött fájlok: 6

Fertőzött memóriafolyamatok:
(Nem észleltem rosszindulatú elemeket)

Fertőzött memória modulok:
(Nem észleltem rosszindulatú elemeket)

Fertőzött rendszerleíró kulcsok:
(Nem észleltem rosszindulatú elemeket)

Fertőzött rendszerleíró értékek:
(Nem észleltem rosszindulatú elemeket)

Fertőzött rednszerleíró elemek:
(Nem észleltem rosszindulatú elemeket)

Fertőzött mappák:
(Nem észleltem rosszindulatú elemeket)

Fertőzött fájlok:
C:\WINDOWS\system32\CriticalProcesses.dll (Rogue.EAntiSpy) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ESignature.dll (Rogue.EAntiSpy) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\RSignature.dll (Rogue.EAntiSpy) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\FSignature.dll (Rogue.EAntiSpy) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\SKNames.dll (Rogue.EAntiSpy) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\CompanyList.dll (Rogue.EAntiSpy) -> Quarantined and deleted successfully.

es miert nemteted ide az egesz protokolt -kelet klikelni lementeni a protokolt es bemasolni ide,de mindegy torold le mindet,es ird le mia hejzet.

Kész van, itt az eredmény:

Rogue.EAntiSpy C:\WINDOWS\system32\CriticalProcesses.dll
Rogue.EAntiSpy C:\WINDOWS\system32\ESignature.dll
Rogue.EAntiSpy C:\WINDOWS\system32\RSignature.dll
Rogue.EAntiSpy C:\WINDOWS\system32\FSignature.dll
Rogue.EAntiSpy C:\WINDOWS\system32\SKNames.dll
Rogue.EAntiSpy C:\WINDOWS\system32\CompanyList.dll

fixeld le
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll

tolds le a malwarebytes programot-telepitsd fel-valaszt ki a magyar nyelvet ,es csinalj gyors skent-a logjat ted ide-netorolj semmit meg a logjat megnem nezem es jova hagyom.
http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?part=dl-10804572&subj=dl&tag=button

Itt a log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:59:21, on 2009.01.11.
Platform: Windows XP Szervizcsomag 2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Documents and Settings\xy\Asztal\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.allat-nevelde.hu/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hivatkozások
R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
O2 - BHO: Windows Live bejelentkezési segítség - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - (no file)
O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 4757 bytes