ComboFix 10-04-26.05 - Delachron 010.04.28. 17:57:38.6.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1250.36.1038.18.256.121 [GMT 2:00]
Running from: c:\documents and settings\Delachron\Asztal\ComboFix.exe
Command switches used :: c:\documents and settings\Delachron\Asztal\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_MEMSWEEP2
-------\Service_MEMSWEEP2
-------\Service_ogjkdocd


((((((((((((((((((((((((( Files Created from 2010-03-28 to 2010-04-28 )))))))))))))))))))))))))))))))
.

2010-04-27 15:46 . 2010-04-27 20:09 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-04-27 15:17 . 2010-04-27 20:03 -------- d-----w- c:\program files\Sophos
2010-04-26 23:54 . 2010-04-27 14:56 -------- d-----w- c:\program files\Lavasoft
2010-04-26 23:54 . 2010-04-27 13:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-04-23 20:06 . 2010-04-23 20:06 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Nokia
2010-04-21 23:10 . 2010-04-21 23:10 -------- d-----w- c:\documents and settings\Delachron\Application Data\Ahead
2010-04-18 21:28 . 2010-04-18 21:28 -------- d-----w- C:\Ninja Tune Retrospective CD2
2010-04-14 13:20 . 2010-04-14 13:21 -------- d-----w- C:\Orbital_-_Brown_Album_1992
2010-04-14 13:20 . 2010-04-14 13:20 -------- d-----w- C:\Orbital_-_The_Box_[single-1996]
2010-04-12 16:53 . 2010-04-12 16:57 -------- d-----w- C:\Rave Mission 2 CD2
2010-04-12 16:46 . 2010-04-12 17:03 -------- d-----w- C:\Rave Mission 2 CD1
2010-04-09 21:09 . 2010-04-09 21:09 -------- d-----w- C:\fff
2010-04-07 19:27 . 2010-04-28 12:58 -------- d-----w- C:\VA_-_Rave_Now_Vol_06-2CD-_Retail_-1996
2010-04-06 22:14 . 2010-04-06 22:14 -------- d-----w- C:\Flying Trance Classics CD2
2010-04-06 21:57 . 2010-04-06 21:57 -------- d-----w- C:\Flying Trance classics CD1
2010-04-06 21:39 . 2010-04-06 21:39 -------- d-----w- C:\RMB
2010-04-04 19:08 . 2010-04-04 19:08 5918776 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-03-29 21:37 . 2003-03-19 09:03 544768 ----a-w- c:\windows\system32\msvcr71d.dll
2010-03-29 21:37 . 2002-01-05 12:37 344064 ----a-w- c:\windows\system32\msvcr70.dll
2010-03-29 21:37 . 2006-09-16 17:44 314368 ----a-w- c:\windows\system32\avisynth.dll
2010-03-29 21:37 . 2004-05-26 19:37 719872 ----a-w- c:\windows\system32\devil.dll
2010-03-29 20:39 . 2010-03-29 20:39 -------- d-----w- c:\documents and settings\Delachron\Application Data\FastStone
2010-03-29 20:39 . 2010-03-29 20:39 -------- d-----w- c:\program files\FastStone Photo Resizer
2010-03-29 18:59 . 2007-09-04 15:56 164352 ----a-w- c:\windows\system32\unrar.dll
2010-03-29 18:59 . 2008-01-10 11:15 755027 ----a-w- c:\windows\system32\xvidcore.dll
2010-03-29 18:59 . 2004-01-25 15:18 217088 ----a-w- c:\windows\system32\yv12vfw.dll
2010-03-29 18:59 . 2008-01-10 11:16 159839 ----a-w- c:\windows\system32\xvidvfw.dll
2010-03-29 18:59 . 2007-11-29 21:30 3596288 ----a-w- c:\windows\system32\qt-dx331.dll
2010-03-29 18:59 . 2007-11-29 21:28 81920 ----a-w- c:\windows\system32\dpl100.dll
2010-03-29 18:59 . 2007-12-04 00:33 682496 ----a-w- c:\windows\system32\divx.dll
2010-03-29 18:59 . 2008-03-04 10:33 7680 ----a-w- c:\windows\system32\ff_vfw.dll
2010-03-29 18:59 . 2010-03-29 18:59 -------- d-----w- c:\program files\K-Lite Codec Pack

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-28 13:49 . 2008-05-21 18:31 -------- d-----w- c:\program files\Winamp
2010-04-26 15:00 . 2008-08-11 14:54 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-04-24 18:05 . 2010-03-29 00:52 -------- d-----w- c:\program files\Common Files\Tomato
2010-04-23 22:16 . 2008-06-24 21:28 -------- d-----w- c:\program files\Soulseek
2010-04-23 16:42 . 2010-02-22 17:56 -------- d-----w- c:\program files\Magic Video Converter
2010-04-04 19:08 . 2010-03-19 15:49 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-04 13:07 . 2008-07-13 19:20 -------- d-----w- c:\program files\Sound Forge 6
2010-03-31 22:07 . 2008-05-21 18:25 13904 -c--a-w- c:\documents and settings\Delachron\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-03-29 22:46 . 2010-03-19 15:49 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-29 22:45 . 2010-03-19 15:49 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-29 13:40 . 2010-03-29 13:39 -------- d-----w- c:\program files\HUN2009
2010-03-29 13:38 . 2010-03-11 15:45 -------- d-----w- c:\program files\Common Files\InstallShield
2010-03-29 00:52 . 2010-03-29 00:52 -------- d-----w- c:\documents and settings\Delachron\Application Data\Tomato
2010-03-28 21:39 . 2010-03-28 13:25 -------- d-----w- c:\program files\Total Video Converter
2010-03-28 13:07 . 2008-05-21 17:38 303356 ----a-w- c:\windows\system32\perfh00E.dat
2010-03-28 13:07 . 2008-05-21 17:38 57716 ----a-w- c:\windows\system32\perfc00E.dat
2010-03-27 17:50 . 2010-04-07 00:41 187302 ----a-w- c:\windows\PCHealth\HelpCtr\Config\Cache\Professional_32_1038.dat
2010-03-19 22:54 . 2010-03-19 22:53 -------- d-----w- c:\program files\CCleaner
2010-03-19 11:54 . 2010-03-17 15:44 544 ---ha-w- c:\documents and settings\All Users\Application Data\mul.bin
2010-03-18 22:34 . 2010-03-11 15:45 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-03-18 13:39 . 2010-03-18 13:39 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
2010-03-18 00:39 . 2010-03-17 22:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2010-03-17 21:05 . 2008-05-21 17:34 14336 ------w- c:\windows\system32\svchost.exe
2010-03-11 15:42 . 2010-03-11 15:30 -------- d-----w- c:\documents and settings\Delachron\Application Data\DAEMON Tools Lite
2010-03-11 15:32 . 2010-03-11 15:32 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-03-11 15:30 . 2010-03-11 15:30 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
2010-03-10 00:35 . 2010-03-09 18:18 -------- d-----w- c:\program files\Common Files\AVSMedia
2010-03-09 19:00 . 2010-03-09 19:00 -------- d-----w- c:\program files\Free Audio Pack
2010-03-09 19:00 . 2010-03-09 19:00 -------- d-----w- c:\documents and settings\Delachron\Application Data\FreeAudioPack
2010-03-09 18:23 . 2010-03-09 18:23 -------- d-----w- c:\documents and settings\All Users\Application Data\AVS4YOU
2010-03-09 18:23 . 2010-03-09 18:23 -------- d-----w- c:\documents and settings\Delachron\Application Data\AVS4YOU
2010-03-03 17:52 . 2010-03-03 17:50 -------- d-----w- c:\documents and settings\Delachron\Application Data\avidemux
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NBJ"="c:\program files\Nero\Nero BackItUp\NBJ.exe" [2004-07-26 1867776]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-17 15360]

c:\documents and settings\All Users\Start Menu\Programs\Indˇt˘pult\
Adobe Reader gyorsindˇt˘.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-24 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

R3 atirage;atirage;c:\windows\SYSTEM32\DRIVERS\atiragem.sys [2008.05.21. 19:58 70528]
R3 ess;ESS audio-illesztőprogram (WDM);c:\windows\SYSTEM32\DRIVERS\ess.sys [2008.05.21. 19:58 63360]
S1 SASKUTIL;SASKUTIL;\??\c:\program files\SUPERAntiSpyware\SASKUTIL.sys --> c:\program files\SUPERAntiSpyware\SASKUTIL.sys [?]
S3 NtApm;NT APM/örökölt illesztő illesztőprogramja;c:\windows\SYSTEM32\DRIVERS\NtApm.sys [2008.05.21. 19:59 9472]
S4 sptd;sptd;c:\windows\SYSTEM32\DRIVERS\sptd.sys [2010.03.11. 17:32 691696]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
IE: Download &Flash Movies - c:\program files\Flash2X\Flash Hunter\save.htm
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-28 18:13
Windows 5.1.2600 Szervizcsomag 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-04-28 18:22:56 - machine was rebooted
ComboFix-quarantined-files.txt 2010-04-28 16:22
ComboFix2.txt 2010-04-28 14:20
ComboFix3.txt 2010-04-26 17:58

Pre-Run: 490 579 456 bájt szabad
Post-Run: 485 958 144 bájt szabad

- - End Of File - - ECDE8EFCA6A0B9FDB1F6522DD24E0CE8

1:Kikapcsolni a rendszer visszaalitasat
http://virus-stell.blogspot.com/2010/04 ... dszer.html


Kinyitunk - Notepadot (Jegyzetfüzetet)igy: Start>futtatás>beírod: notepad
és bemásolod- a Kód: címszó alatt található zöld textet(Kód: szó nélkül), aztán a notepadba beillesztett textet elmentjük scriptnek az asztalra , úgy:- Fájl>Mentés Másként>Fájlnév>CFScript.txt>Fájl típusa>Minden fájl>Mentés.(Ásztálra),.Kész, az astalon lévő CFScript txt húzzunk rá a ComboFix ikonnyara. Es mostan megcsinalod eztett:

A combofix maga elindul es lehet hogy restartol es befejezi a scent.Amit majd ad ted ide.

Íme a LOG:

ComboFix 10-04-26.05 - Delachron 010.04.28. 15:49:32.5.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1250.36.1038.18.256.140 [GMT 2:00]
Running from: c:\documents and settings\Delachron\Asztal\ComboFix.exe
Command switches used :: c:\documents and settings\Delachron\Asztal\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
"c:\documents and settings\All Users\Application Data\DQad4L6M.exe"
"c:\documents and settings\All Users\Application Data\KPY0T0n.dat"
"c:\windows\FONTS\7fQqFX4O.com"
"c:\windows\system32\o.sys"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\KPY0T0n.dat
c:\windows\system32\wpofnfgt.dll
c:\windows\Tasks\At10.job
c:\windows\Tasks\At100.job
c:\windows\Tasks\At101.job
c:\windows\Tasks\At102.job
c:\windows\Tasks\At103.job
c:\windows\Tasks\At104.job
c:\windows\Tasks\At105.job
c:\windows\Tasks\At106.job
c:\windows\Tasks\At107.job
c:\windows\Tasks\At108.job
c:\windows\Tasks\At109.job
c:\windows\Tasks\At11.job
c:\windows\Tasks\At110.job
c:\windows\Tasks\At111.job
c:\windows\Tasks\At112.job
c:\windows\Tasks\At113.job
c:\windows\Tasks\At114.job
c:\windows\Tasks\At115.job
c:\windows\Tasks\At116.job
c:\windows\Tasks\At117.job
c:\windows\Tasks\At118.job
c:\windows\Tasks\At119.job
c:\windows\Tasks\At12.job
c:\windows\Tasks\At120.job
c:\windows\Tasks\At121.job
c:\windows\Tasks\At122.job
c:\windows\Tasks\At123.job
c:\windows\Tasks\At124.job
c:\windows\Tasks\At125.job
c:\windows\Tasks\At126.job
c:\windows\Tasks\At127.job
c:\windows\Tasks\At128.job
c:\windows\Tasks\At129.job
c:\windows\Tasks\At13.job
c:\windows\Tasks\At130.job
c:\windows\Tasks\At131.job
c:\windows\Tasks\At132.job
c:\windows\Tasks\At133.job
c:\windows\Tasks\At134.job
c:\windows\Tasks\At135.job
c:\windows\Tasks\At136.job
c:\windows\Tasks\At137.job
c:\windows\Tasks\At138.job
c:\windows\Tasks\At139.job
c:\windows\Tasks\At14.job
c:\windows\Tasks\At140.job
c:\windows\Tasks\At141.job
c:\windows\Tasks\At142.job
c:\windows\Tasks\At143.job
c:\windows\Tasks\At144.job
c:\windows\Tasks\At145.job
c:\windows\Tasks\At146.job
c:\windows\Tasks\At147.job
c:\windows\Tasks\At148.job
c:\windows\Tasks\At149.job
c:\windows\Tasks\At15.job
c:\windows\Tasks\At150.job
c:\windows\Tasks\At151.job
c:\windows\Tasks\At152.job
c:\windows\Tasks\At153.job
c:\windows\Tasks\At154.job
c:\windows\Tasks\At155.job
c:\windows\Tasks\At156.job
c:\windows\Tasks\At157.job
c:\windows\Tasks\At158.job
c:\windows\Tasks\At159.job
c:\windows\Tasks\At16.job
c:\windows\Tasks\At160.job
c:\windows\Tasks\At161.job
c:\windows\Tasks\At162.job
c:\windows\Tasks\At163.job
c:\windows\Tasks\At164.job
c:\windows\Tasks\At165.job
c:\windows\Tasks\At166.job
c:\windows\Tasks\At167.job
c:\windows\Tasks\At168.job
c:\windows\Tasks\At169.job
c:\windows\Tasks\At17.job
c:\windows\Tasks\At170.job
c:\windows\Tasks\At171.job
c:\windows\Tasks\At172.job
c:\windows\Tasks\At173.job
c:\windows\Tasks\At174.job
c:\windows\Tasks\At175.job
c:\windows\Tasks\At176.job
c:\windows\Tasks\At177.job
c:\windows\Tasks\At178.job
c:\windows\Tasks\At179.job
c:\windows\Tasks\At18.job
c:\windows\Tasks\At180.job
c:\windows\Tasks\At181.job
c:\windows\Tasks\At182.job
c:\windows\Tasks\At183.job
c:\windows\Tasks\At184.job
c:\windows\Tasks\At185.job
c:\windows\Tasks\At186.job
c:\windows\Tasks\At187.job
c:\windows\Tasks\At188.job
c:\windows\Tasks\At189.job
c:\windows\Tasks\At19.job
c:\windows\Tasks\At190.job
c:\windows\Tasks\At191.job
c:\windows\Tasks\At192.job
c:\windows\Tasks\At193.job
c:\windows\Tasks\At194.job
c:\windows\Tasks\At195.job
c:\windows\Tasks\At196.job
c:\windows\Tasks\At197.job
c:\windows\Tasks\At198.job
c:\windows\Tasks\At199.job
c:\windows\Tasks\At2.job
c:\windows\Tasks\At20.job
c:\windows\Tasks\At200.job
c:\windows\Tasks\At201.job
c:\windows\Tasks\At202.job
c:\windows\Tasks\At203.job
c:\windows\Tasks\At204.job
c:\windows\Tasks\At205.job
c:\windows\Tasks\At206.job
c:\windows\Tasks\At207.job
c:\windows\Tasks\At208.job
c:\windows\Tasks\At209.job
c:\windows\Tasks\At21.job
c:\windows\Tasks\At210.job
c:\windows\Tasks\At211.job
c:\windows\Tasks\At212.job
c:\windows\Tasks\At213.job
c:\windows\Tasks\At214.job
c:\windows\Tasks\At215.job
c:\windows\Tasks\At216.job
c:\windows\Tasks\At217.job
c:\windows\Tasks\At218.job
c:\windows\Tasks\At219.job
c:\windows\Tasks\At22.job
c:\windows\Tasks\At220.job
c:\windows\Tasks\At221.job
c:\windows\Tasks\At222.job
c:\windows\Tasks\At223.job
c:\windows\Tasks\At224.job
c:\windows\Tasks\At225.job
c:\windows\Tasks\At226.job
c:\windows\Tasks\At227.job
c:\windows\Tasks\At228.job
c:\windows\Tasks\At229.job
c:\windows\Tasks\At23.job
c:\windows\Tasks\At230.job
c:\windows\Tasks\At231.job
c:\windows\Tasks\At232.job
c:\windows\Tasks\At233.job
c:\windows\Tasks\At234.job
c:\windows\Tasks\At235.job
c:\windows\Tasks\At236.job
c:\windows\Tasks\At237.job
c:\windows\Tasks\At238.job
c:\windows\Tasks\At239.job
c:\windows\Tasks\At24.job
c:\windows\Tasks\At240.job
c:\windows\Tasks\At241.job
c:\windows\Tasks\At242.job
c:\windows\Tasks\At243.job
c:\windows\Tasks\At244.job
c:\windows\Tasks\At245.job
c:\windows\Tasks\At246.job
c:\windows\Tasks\At247.job
c:\windows\Tasks\At248.job
c:\windows\Tasks\At249.job
c:\windows\Tasks\At25.job
c:\windows\Tasks\At250.job
c:\windows\Tasks\At251.job
c:\windows\Tasks\At252.job
c:\windows\Tasks\At253.job
c:\windows\Tasks\At254.job
c:\windows\Tasks\At255.job
c:\windows\Tasks\At256.job
c:\windows\Tasks\At257.job
c:\windows\Tasks\At258.job
c:\windows\Tasks\At259.job
c:\windows\Tasks\At26.job
c:\windows\Tasks\At260.job
c:\windows\Tasks\At261.job
c:\windows\Tasks\At262.job
c:\windows\Tasks\At263.job
c:\windows\Tasks\At264.job
c:\windows\Tasks\At265.job
c:\windows\Tasks\At266.job
c:\windows\Tasks\At267.job
c:\windows\Tasks\At268.job
c:\windows\Tasks\At269.job
c:\windows\Tasks\At27.job
c:\windows\Tasks\At270.job
c:\windows\Tasks\At271.job
c:\windows\Tasks\At272.job
c:\windows\Tasks\At273.job
c:\windows\Tasks\At274.job
c:\windows\Tasks\At275.job
c:\windows\Tasks\At276.job
c:\windows\Tasks\At277.job
c:\windows\Tasks\At278.job
c:\windows\Tasks\At279.job
c:\windows\Tasks\At28.job
c:\windows\Tasks\At280.job
c:\windows\Tasks\At281.job
c:\windows\Tasks\At282.job
c:\windows\Tasks\At283.job
c:\windows\Tasks\At284.job
c:\windows\Tasks\At285.job
c:\windows\Tasks\At286.job
c:\windows\Tasks\At287.job
c:\windows\Tasks\At288.job
c:\windows\Tasks\At289.job
c:\windows\Tasks\At29.job
c:\windows\Tasks\At290.job
c:\windows\Tasks\At291.job
c:\windows\Tasks\At292.job
c:\windows\Tasks\At293.job
c:\windows\Tasks\At294.job
c:\windows\Tasks\At295.job
c:\windows\Tasks\At296.job
c:\windows\Tasks\At297.job
c:\windows\Tasks\At298.job
c:\windows\Tasks\At299.job
c:\windows\Tasks\At3.job
c:\windows\Tasks\At30.job
c:\windows\Tasks\At300.job
c:\windows\Tasks\At301.job
c:\windows\Tasks\At302.job
c:\windows\Tasks\At303.job
c:\windows\Tasks\At304.job
c:\windows\Tasks\At305.job
c:\windows\Tasks\At306.job
c:\windows\Tasks\At307.job
c:\windows\Tasks\At308.job
c:\windows\Tasks\At309.job
c:\windows\Tasks\At31.job
c:\windows\Tasks\At310.job
c:\windows\Tasks\At311.job
c:\windows\Tasks\At312.job
c:\windows\Tasks\At313.job
c:\windows\Tasks\At314.job
c:\windows\Tasks\At315.job
c:\windows\Tasks\At316.job
c:\windows\Tasks\At317.job
c:\windows\Tasks\At318.job
c:\windows\Tasks\At319.job
c:\windows\Tasks\At32.job
c:\windows\Tasks\At320.job
c:\windows\Tasks\At321.job
c:\windows\Tasks\At322.job
c:\windows\Tasks\At323.job
c:\windows\Tasks\At324.job
c:\windows\Tasks\At325.job
c:\windows\Tasks\At326.job
c:\windows\Tasks\At327.job
c:\windows\Tasks\At328.job
c:\windows\Tasks\At329.job
c:\windows\Tasks\At33.job
c:\windows\Tasks\At330.job
c:\windows\Tasks\At331.job
c:\windows\Tasks\At332.job
c:\windows\Tasks\At333.job
c:\windows\Tasks\At334.job
c:\windows\Tasks\At335.job
c:\windows\Tasks\At336.job
c:\windows\Tasks\At34.job
c:\windows\Tasks\At35.job
c:\windows\Tasks\At36.job
c:\windows\Tasks\At37.job
c:\windows\Tasks\At38.job
c:\windows\Tasks\At39.job
c:\windows\Tasks\At4.job
c:\windows\Tasks\At40.job
c:\windows\Tasks\At41.job
c:\windows\Tasks\At42.job
c:\windows\Tasks\At43.job
c:\windows\Tasks\At44.job
c:\windows\Tasks\At45.job
c:\windows\Tasks\At46.job
c:\windows\Tasks\At47.job
c:\windows\Tasks\At48.job
c:\windows\Tasks\At49.job
c:\windows\Tasks\At5.job
c:\windows\Tasks\At50.job
c:\windows\Tasks\At51.job
c:\windows\Tasks\At52.job
c:\windows\Tasks\At53.job
c:\windows\Tasks\At54.job
c:\windows\Tasks\At55.job
c:\windows\Tasks\At56.job
c:\windows\Tasks\At57.job
c:\windows\Tasks\At58.job
c:\windows\Tasks\At59.job
c:\windows\Tasks\At6.job
c:\windows\Tasks\At60.job
c:\windows\Tasks\At61.job
c:\windows\Tasks\At62.job
c:\windows\Tasks\At63.job
c:\windows\Tasks\At64.job
c:\windows\Tasks\At65.job
c:\windows\Tasks\At66.job
c:\windows\Tasks\At67.job
c:\windows\Tasks\At68.job
c:\windows\Tasks\At69.job
c:\windows\Tasks\At7.job
c:\windows\Tasks\At70.job
c:\windows\Tasks\At71.job
c:\windows\Tasks\At72.job
c:\windows\Tasks\At73.job
c:\windows\Tasks\At74.job
c:\windows\Tasks\At75.job
c:\windows\Tasks\At76.job
c:\windows\Tasks\At77.job
c:\windows\Tasks\At78.job
c:\windows\Tasks\At79.job
c:\windows\Tasks\At8.job
c:\windows\Tasks\At80.job
c:\windows\Tasks\At81.job
c:\windows\Tasks\At82.job
c:\windows\Tasks\At83.job
c:\windows\Tasks\At84.job
c:\windows\Tasks\At85.job
c:\windows\Tasks\At86.job
c:\windows\Tasks\At87.job
c:\windows\Tasks\At88.job
c:\windows\Tasks\At89.job
c:\windows\Tasks\At9.job
c:\windows\Tasks\At90.job
c:\windows\Tasks\At91.job
c:\windows\Tasks\At92.job
c:\windows\Tasks\At93.job
c:\windows\Tasks\At94.job
c:\windows\Tasks\At95.job
c:\windows\Tasks\At96.job
c:\windows\Tasks\At97.job
c:\windows\Tasks\At98.job
c:\windows\Tasks\At99.job

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_EVAHQ
-------\Legacy_GKEWVNJTJ
-------\Service_evahq
-------\Service_gkewvnjtj
-------\Legacy_ogjkdocd
-------\Service_ogjkdocd


((((((((((((((((((((((((( Files Created from 2010-03-28 to 2010-04-28 )))))))))))))))))))))))))))))))
.

2010-04-27 15:46 . 2010-04-27 20:09 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-04-27 15:17 . 2010-04-27 20:03 -------- d-----w- c:\program files\Sophos
2010-04-26 23:54 . 2010-04-27 14:56 -------- d-----w- c:\program files\Lavasoft
2010-04-26 23:54 . 2010-04-27 13:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-04-23 20:06 . 2010-04-23 20:06 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Nokia
2010-04-21 23:10 . 2010-04-21 23:10 -------- d-----w- c:\documents and settings\Delachron\Application Data\Ahead
2010-04-18 21:28 . 2010-04-18 21:28 -------- d-----w- C:\Ninja Tune Retrospective CD2
2010-04-14 13:20 . 2010-04-14 13:21 -------- d-----w- C:\Orbital_-_Brown_Album_1992
2010-04-14 13:20 . 2010-04-14 13:20 -------- d-----w- C:\Orbital_-_The_Box_[single-1996]
2010-04-12 16:53 . 2010-04-12 16:57 -------- d-----w- C:\Rave Mission 2 CD2
2010-04-12 16:46 . 2010-04-12 17:03 -------- d-----w- C:\Rave Mission 2 CD1
2010-04-09 21:09 . 2010-04-09 21:09 -------- d-----w- C:\fff
2010-04-07 19:27 . 2010-04-28 12:58 -------- d-----w- C:\VA_-_Rave_Now_Vol_06-2CD-_Retail_-1996
2010-04-06 22:14 . 2010-04-06 22:14 -------- d-----w- C:\Flying Trance Classics CD2
2010-04-06 21:57 . 2010-04-06 21:57 -------- d-----w- C:\Flying Trance classics CD1
2010-04-06 21:39 . 2010-04-06 21:39 -------- d-----w- C:\RMB
2010-04-04 19:08 . 2010-04-04 19:08 5918776 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-03-29 21:37 . 2003-03-19 09:03 544768 ----a-w- c:\windows\system32\msvcr71d.dll
2010-03-29 21:37 . 2002-01-05 12:37 344064 ----a-w- c:\windows\system32\msvcr70.dll
2010-03-29 21:37 . 2006-09-16 17:44 314368 ----a-w- c:\windows\system32\avisynth.dll
2010-03-29 21:37 . 2004-05-26 19:37 719872 ----a-w- c:\windows\system32\devil.dll
2010-03-29 20:39 . 2010-03-29 20:39 -------- d-----w- c:\documents and settings\Delachron\Application Data\FastStone
2010-03-29 20:39 . 2010-03-29 20:39 -------- d-----w- c:\program files\FastStone Photo Resizer
2010-03-29 18:59 . 2007-09-04 15:56 164352 ----a-w- c:\windows\system32\unrar.dll
2010-03-29 18:59 . 2008-01-10 11:15 755027 ----a-w- c:\windows\system32\xvidcore.dll
2010-03-29 18:59 . 2004-01-25 15:18 217088 ----a-w- c:\windows\system32\yv12vfw.dll
2010-03-29 18:59 . 2008-01-10 11:16 159839 ----a-w- c:\windows\system32\xvidvfw.dll
2010-03-29 18:59 . 2007-11-29 21:30 3596288 ----a-w- c:\windows\system32\qt-dx331.dll
2010-03-29 18:59 . 2007-11-29 21:28 81920 ----a-w- c:\windows\system32\dpl100.dll
2010-03-29 18:59 . 2007-12-04 00:33 682496 ----a-w- c:\windows\system32\divx.dll
2010-03-29 18:59 . 2008-03-04 10:33 7680 ----a-w- c:\windows\system32\ff_vfw.dll
2010-03-29 18:59 . 2010-03-29 18:59 -------- d-----w- c:\program files\K-Lite Codec Pack

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-28 13:49 . 2008-05-21 18:31 -------- d-----w- c:\program files\Winamp
2010-04-26 15:00 . 2008-08-11 14:54 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-04-24 18:05 . 2010-03-29 00:52 -------- d-----w- c:\program files\Common Files\Tomato
2010-04-23 22:16 . 2008-06-24 21:28 -------- d-----w- c:\program files\Soulseek
2010-04-23 16:42 . 2010-02-22 17:56 -------- d-----w- c:\program files\Magic Video Converter
2010-04-04 19:08 . 2010-03-19 15:49 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-04 13:07 . 2008-07-13 19:20 -------- d-----w- c:\program files\Sound Forge 6
2010-03-31 22:07 . 2008-05-21 18:25 13904 -c--a-w- c:\documents and settings\Delachron\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-03-29 22:46 . 2010-03-19 15:49 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-29 22:45 . 2010-03-19 15:49 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-29 13:40 . 2010-03-29 13:39 -------- d-----w- c:\program files\HUN2009
2010-03-29 13:38 . 2010-03-11 15:45 -------- d-----w- c:\program files\Common Files\InstallShield
2010-03-29 00:52 . 2010-03-29 00:52 -------- d-----w- c:\documents and settings\Delachron\Application Data\Tomato
2010-03-28 21:39 . 2010-03-28 13:25 -------- d-----w- c:\program files\Total Video Converter
2010-03-28 13:07 . 2008-05-21 17:38 303356 ----a-w- c:\windows\system32\perfh00E.dat
2010-03-28 13:07 . 2008-05-21 17:38 57716 ----a-w- c:\windows\system32\perfc00E.dat
2010-03-27 17:50 . 2010-04-07 00:41 187302 ----a-w- c:\windows\PCHealth\HelpCtr\Config\Cache\Professional_32_1038.dat
2010-03-19 22:54 . 2010-03-19 22:53 -------- d-----w- c:\program files\CCleaner
2010-03-19 11:54 . 2010-03-17 15:44 544 ---ha-w- c:\documents and settings\All Users\Application Data\mul.bin
2010-03-18 22:34 . 2010-03-11 15:45 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-03-18 13:39 . 2010-03-18 13:39 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
2010-03-18 00:39 . 2010-03-17 22:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2010-03-17 21:05 . 2008-05-21 17:34 14336 ------w- c:\windows\system32\svchost.exe
2010-03-11 15:42 . 2010-03-11 15:30 -------- d-----w- c:\documents and settings\Delachron\Application Data\DAEMON Tools Lite
2010-03-11 15:32 . 2010-03-11 15:32 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-03-11 15:30 . 2010-03-11 15:30 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
2010-03-10 00:35 . 2010-03-09 18:18 -------- d-----w- c:\program files\Common Files\AVSMedia
2010-03-09 19:00 . 2010-03-09 19:00 -------- d-----w- c:\program files\Free Audio Pack
2010-03-09 19:00 . 2010-03-09 19:00 -------- d-----w- c:\documents and settings\Delachron\Application Data\FreeAudioPack
2010-03-09 18:23 . 2010-03-09 18:23 -------- d-----w- c:\documents and settings\All Users\Application Data\AVS4YOU
2010-03-09 18:23 . 2010-03-09 18:23 -------- d-----w- c:\documents and settings\Delachron\Application Data\AVS4YOU
2010-03-03 17:52 . 2010-03-03 17:50 -------- d-----w- c:\documents and settings\Delachron\Application Data\avidemux
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NBJ"="c:\program files\Nero\Nero BackItUp\NBJ.exe" [2004-07-26 1867776]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-17 15360]

c:\documents and settings\All Users\Start Menu\Programs\Indˇt˘pult\
Adobe Reader gyorsindˇt˘.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-24 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"2130:TCP"= 2130:TCP:exxoqozp

R3 atirage;atirage;c:\windows\SYSTEM32\DRIVERS\atiragem.sys [2008.05.21. 19:58 70528]
R3 ess;ESS audio-illesztőprogram (WDM);c:\windows\SYSTEM32\DRIVERS\ess.sys [2008.05.21. 19:58 63360]
S1 SASKUTIL;SASKUTIL;\??\c:\program files\SUPERAntiSpyware\SASKUTIL.sys --> c:\program files\SUPERAntiSpyware\SASKUTIL.sys [?]
S2 ogjkdocd;Support Center;c:\windows\system32\svchost.exe -k netsvcs [2008.05.21. 19:34 14336]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\32.tmp --> c:\windows\system32\32.tmp [?]
S3 NtApm;NT APM/örökölt illesztő illesztőprogramja;c:\windows\SYSTEM32\DRIVERS\NtApm.sys [2008.05.21. 19:59 9472]
S4 sptd;sptd;c:\windows\SYSTEM32\DRIVERS\sptd.sys [2010.03.11. 17:32 691696]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ogjkdocd
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
IE: Download &Flash Movies - c:\program files\Flash2X\Flash Hunter\save.htm
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-28 16:10
Windows 5.1.2600 Szervizcsomag 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet007\Services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\32.tmp"

[HKEY_LOCAL_MACHINE\System\ControlSet007\Services\ogjkdocd]
"ServiceDll"="c:\windows\system32\wpofnfgt.dll"
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-04-28 16:20:23 - machine was rebooted
ComboFix-quarantined-files.txt 2010-04-28 14:20
ComboFix2.txt 2010-04-26 17:58

Pre-Run: 522 856 448 bájt szabad
Post-Run: 510 470 144 bájt szabad

- - End Of File - - 7C9F49A2180B4489E638F03774A4BADC

nyugodtan vissza rakhatod,futtasd az Daemon eltavolito programot es klik install.

OFF: Mióta rendbe raktuk a gépet nem merem/akarom visszarakni a Daemon Tools-t, de szükségem lenne rá. Rengeteg CD/DVD van képfájlként elmentve a gépemen és szükségem lenne egy programra ami ezeket kezeli, virtuális DVD-ként.
A gépem mintha újászületett volna, gyors és "egészséges" nem akarom újra elrontani.
Azért írtam ide, mert ezt a topicot valószínű stell gyakrabban nézi, és amúgy se tudom hová rakhattam volna ezt.

az biztos hogy nem oldodod meg.mivel ezeket a problemakot nem tudja a SAS megoldani.
Kinyitunk - Notepadot (Jegyzetfüzetet)igy: Start>futtatás>beírod: notepad
és bemásolod- a Kód: címszó alatt található zöld textet(Kód: szó nélkül), aztán a notepadba beillesztett textet elmentjük scriptnek az asztalra , úgy:- Fájl>Mentés Másként>Fájlnév>CFScript.txt>Fájl típusa>Minden fájl>Mentés.(Ásztálra),.Kész, az astalon lévő CFScript txt húzzunk rá a ComboFix ikonnyara. Es mostan megcsinalod eztett:

A combofix maga elindul es lehet hogy restartol es befejezi a scent.Amit majd ad ted ide.

Ez a lappangási idő. Muhahahahaaa
Nem akarom elkiabálni, de nem hiszem, hogy ennyivel megúszod. Bár, ha tényleg szerencséd volt akkor nem egy ilyen gonosz-gaz-galád és elvetemült, szompolygosz rémecske csücsült a gépedben.

Közben bevetettem a SUPERAntiSpyware progit. Frissítve full scan-t csináltam. Talált jó néhány csúnya dolgot. Nem akarom elkiabálni, de úgy néz ki ez megoldotta a gondot. Már kb. 30 perce netezek és nincs tünet.

Hát igen. Aki tud, az tud

Nem mondom szép hosszú log. Én kb két percig görgettem az egeret míg végigértem rajta, de szerintem stell feleennyi idő alatt el is olvasta. Nekem akkor gurult le az állam mikor egy hosszú logom után 4 percel kaptam egy realtive hosszú leírást mit tegyek. Szóval 4 perc alatt elolvasta, elemezte, majd még írt egy guide-ot is nekem.

ComboFix 10-04-21.01 - Delachron 010.04.26. 19:30:35.4.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1250.36.1038.18.256.100 [GMT 2:00]
Running from: c:\documents and settings\Delachron\Asztal\ComboFix.exe
Command switches used :: c:\documents and settings\Delachron\Asztal\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
"c:\program files\folder.htt"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
--------------- FCopy ---------------

c:\windows\ServicePackFiles\i386\tcpip.sys --> c:\windows\SYSTEM32\DRIVERS\tcpip.sys
c:\windows\ServicePackFiles\i386\tcpip.sys --> c:\windows\$NtServicePackUninstall$\tcpip.sys
.
((((((((((((((((((((((((( Files Created from 2010-03-26 to 2010-04-26 )))))))))))))))))))))))))))))))
.

2010-04-23 23:08 . 2010-04-26 15:31 66564 ----a-w- c:\documents and settings\All Users\Application Data\DQad4L6M.exe
2010-04-23 22:00 . 2010-04-23 22:00 4736 ----a-w- c:\windows\system32\o.sys
2010-04-23 20:06 . 2010-04-23 20:06 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Nokia
2010-04-21 23:10 . 2010-04-21 23:10 -------- d-----w- c:\documents and settings\Delachron\Application Data\Ahead
2010-04-18 21:28 . 2010-04-18 21:28 -------- d-----w- C:\Ninja Tune Retrospective CD2
2010-04-14 13:20 . 2010-04-14 13:21 -------- d-----w- C:\Orbital_-_Brown_Album_1992
2010-04-14 13:20 . 2010-04-14 13:20 -------- d-----w- C:\Orbital_-_The_Box_[single-1996]
2010-04-12 16:53 . 2010-04-12 16:57 -------- d-----w- C:\Rave Mission 2 CD2
2010-04-12 16:46 . 2010-04-12 17:03 -------- d-----w- C:\Rave Mission 2 CD1
2010-04-09 21:09 . 2010-04-09 21:09 -------- d-----w- C:\fff
2010-04-07 19:27 . 2010-04-22 23:33 -------- d-----w- C:\VA_-_Rave_Now_Vol_06-2CD-_Retail_-1996
2010-04-06 23:53 . 2010-04-06 23:53 -------- d-----w- c:\program files\pop
2010-04-06 22:14 . 2010-04-06 22:14 -------- d-----w- C:\Flying Trance Classics CD2
2010-04-06 21:57 . 2010-04-06 21:57 -------- d-----w- C:\Flying Trance classics CD1
2010-04-06 21:39 . 2010-04-06 21:39 -------- d-----w- C:\RMB
2010-04-04 19:08 . 2010-04-04 19:08 5918776 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-03-29 21:37 . 2003-03-19 09:03 544768 ----a-w- c:\windows\system32\msvcr71d.dll
2010-03-29 21:37 . 2002-01-05 12:37 344064 ----a-w- c:\windows\system32\msvcr70.dll
2010-03-29 21:37 . 2006-09-16 17:44 314368 ----a-w- c:\windows\system32\avisynth.dll
2010-03-29 21:37 . 2004-05-26 19:37 719872 ----a-w- c:\windows\system32\devil.dll
2010-03-29 20:39 . 2010-03-29 20:39 -------- d-----w- c:\documents and settings\Delachron\Application Data\FastStone
2010-03-29 20:39 . 2010-03-29 20:39 -------- d-----w- c:\program files\FastStone Photo Resizer
2010-03-29 18:59 . 2007-09-04 15:56 164352 ----a-w- c:\windows\system32\unrar.dll
2010-03-29 18:59 . 2008-01-10 11:15 755027 ----a-w- c:\windows\system32\xvidcore.dll
2010-03-29 18:59 . 2004-01-25 15:18 217088 ----a-w- c:\windows\system32\yv12vfw.dll
2010-03-29 18:59 . 2008-01-10 11:16 159839 ----a-w- c:\windows\system32\xvidvfw.dll
2010-03-29 18:59 . 2007-11-29 21:30 3596288 ----a-w- c:\windows\system32\qt-dx331.dll
2010-03-29 18:59 . 2007-11-29 21:28 81920 ----a-w- c:\windows\system32\dpl100.dll
2010-03-29 18:59 . 2007-12-04 00:33 682496 ----a-w- c:\windows\system32\divx.dll
2010-03-29 18:59 . 2008-03-04 10:33 7680 ----a-w- c:\windows\system32\ff_vfw.dll
2010-03-29 18:59 . 2010-03-29 18:59 -------- d-----w- c:\program files\K-Lite Codec Pack
2010-03-29 13:39 . 2010-03-29 13:40 -------- d-----w- c:\program files\HUN2009
2010-03-29 00:52 . 2010-03-29 00:52 -------- d-----w- c:\documents and settings\Delachron\Application Data\Tomato
2010-03-29 00:52 . 2010-04-24 18:05 -------- d-----w- c:\program files\Common Files\Tomato
2010-03-28 13:25 . 2010-03-28 21:39 -------- d-----w- c:\program files\Total Video Converter

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-26 15:31 . 2010-04-23 22:00 112 ----a-w- c:\documents and settings\All Users\Application Data\KPY0T0n.dat
2010-04-26 15:00 . 2008-08-11 14:54 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-04-23 22:16 . 2008-06-24 21:28 -------- d-----w- c:\program files\Soulseek
2010-04-23 20:05 . 2008-05-21 18:31 -------- d-----w- c:\program files\Winamp
2010-04-23 20:05 . 2010-04-23 20:05 34304 ----a-w- c:\windows\FONTS\7fQqFX4O.com
2010-04-23 16:42 . 2010-02-22 17:56 -------- d-----w- c:\program files\Magic Video Converter
2010-04-04 19:08 . 2010-03-19 15:49 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-04 13:07 . 2008-07-13 19:20 -------- d-----w- c:\program files\Sound Forge 6
2010-03-31 22:07 . 2008-05-21 18:25 13904 -c--a-w- c:\documents and settings\Delachron\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-03-29 22:46 . 2010-03-19 15:49 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-29 22:45 . 2010-03-19 15:49 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-29 13:38 . 2010-03-11 15:45 -------- d-----w- c:\program files\Common Files\InstallShield
2010-03-28 13:07 . 2008-05-21 17:38 303356 ----a-w- c:\windows\system32\perfh00E.dat
2010-03-28 13:07 . 2008-05-21 17:38 57716 ----a-w- c:\windows\system32\perfc00E.dat
2010-03-27 17:50 . 2010-04-07 00:41 187302 ----a-w- c:\windows\PCHealth\HelpCtr\Config\Cache\Professional_32_1038.dat
2010-03-19 22:54 . 2010-03-19 22:53 -------- d-----w- c:\program files\CCleaner
2010-03-19 11:54 . 2010-03-17 15:44 544 ---ha-w- c:\documents and settings\All Users\Application Data\mul.bin
2010-03-18 22:34 . 2010-03-11 15:45 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-03-18 13:39 . 2010-03-18 13:39 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
2010-03-18 00:39 . 2010-03-17 22:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2010-03-17 21:05 . 2008-05-21 17:34 14336 ------w- c:\windows\system32\svchost.exe
2010-03-17 16:09 . 2010-03-17 16:09 -------- d-----w- c:\documents and settings\Delachron\Application Data\SUPERAntiSpyware.com
2010-03-11 15:42 . 2010-03-11 15:30 -------- d-----w- c:\documents and settings\Delachron\Application Data\DAEMON Tools Lite
2010-03-11 15:32 . 2010-03-11 15:32 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-03-11 15:30 . 2010-03-11 15:30 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
2010-03-10 00:35 . 2010-03-09 18:18 -------- d-----w- c:\program files\Common Files\AVSMedia
2010-03-09 19:00 . 2010-03-09 19:00 -------- d-----w- c:\program files\Free Audio Pack
2010-03-09 19:00 . 2010-03-09 19:00 -------- d-----w- c:\documents and settings\Delachron\Application Data\FreeAudioPack
2010-03-09 18:23 . 2010-03-09 18:23 -------- d-----w- c:\documents and settings\All Users\Application Data\AVS4YOU
2010-03-09 18:23 . 2010-03-09 18:23 -------- d-----w- c:\documents and settings\Delachron\Application Data\AVS4YOU
2010-03-03 17:52 . 2010-03-03 17:50 -------- d-----w- c:\documents and settings\Delachron\Application Data\avidemux
.


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NBJ"="c:\program files\Nero\Nero BackItUp\NBJ.exe" [2004-07-26 1867776]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinampAgent"="c:\program files\Winamp\Winampa.exe" [2010-04-23 34308]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-17 15360]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2010-04-23 34308]

c:\documents and settings\All Users\Start Menu\Programs\Indˇt˘pult\
Adobe Reader gyorsindˇt˘.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-24 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

R2 k;k;c:\windows\SYSTEM32\o.sys [2010.04.24. 0:00 4736]
R3 atirage;atirage;c:\windows\SYSTEM32\DRIVERS\atiragem.sys [2008.05.21. 19:58 70528]
R3 ess;ESS audio-illesztőprogram (WDM);c:\windows\SYSTEM32\DRIVERS\ess.sys [2008.05.21. 19:58 63360]
S2 evahq;aglhyspgq;c:\windows\system32\svchost.exe -k netsvcs [2008.05.21. 19:34 14336]
S2 gkewvnjtj;Manager Microsoft;c:\windows\system32\svchost.exe -k netsvcs [2008.05.21. 19:34 14336]
S3 NtApm;NT APM/örökölt illesztő illesztőprogramja;c:\windows\SYSTEM32\DRIVERS\NtApm.sys [2008.05.21. 19:59 9472]
S4 sptd;sptd;c:\windows\SYSTEM32\DRIVERS\sptd.sys [2010.03.11. 17:32 691696]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
gkewvnjtj
evahq
.
Contents of the 'Scheduled Tasks' folder

2010-04-25 c:\windows\Tasks\At1.job
- c:\windows\Fonts\7fQqFX4O.com [2010-04-23 20:05]

2010-04-25 c:\windows\Tasks\At10.job
- c:\windows\Fonts\7fQqFX4O.com [2010-04-23 20:05]

2010-04-25 c:\windows\Tasks\At100.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At101.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At102.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At103.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At104.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At105.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At106.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At107.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At108.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At109.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At11.job
- c:\windows\Fonts\7fQqFX4O.com [2010-04-23 20:05]

2010-04-25 c:\windows\Tasks\At110.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At111.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At112.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At113.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At114.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At115.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At116.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At117.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At118.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At119.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At12.job
- c:\windows\Fonts\7fQqFX4O.com [2010-04-23 20:05]

2010-04-25 c:\windows\Tasks\At120.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At121.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At122.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At123.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At124.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At125.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At126.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At127.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At128.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At129.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At13.job
- c:\windows\Fonts\7fQqFX4O.com [2010-04-23 20:05]

2010-04-25 c:\windows\Tasks\At130.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At131.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At132.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At133.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At134.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At135.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At136.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At137.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At138.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At139.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At14.job
- c:\windows\Fonts\7fQqFX4O.com [2010-04-23 20:05]

2010-04-25 c:\windows\Tasks\At140.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At141.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At142.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At143.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At144.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At145.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At146.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At147.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At148.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At149.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At15.job
- c:\windows\Fonts\7fQqFX4O.com [2010-04-23 20:05]

2010-04-25 c:\windows\Tasks\At150.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At151.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At152.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At153.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At154.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At155.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At156.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At157.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At158.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At159.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At16.job
- c:\windows\Fonts\7fQqFX4O.com [2010-04-23 20:05]

2010-04-26 c:\windows\Tasks\At160.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At161.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At162.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At163.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At164.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At165.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At166.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At167.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At168.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At169.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At17.job
- c:\windows\Fonts\7fQqFX4O.com [2010-04-23 20:05]

2010-04-25 c:\windows\Tasks\At170.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At171.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At172.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At173.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At174.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At175.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At176.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At177.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At178.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At179.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At18.job
- c:\windows\Fonts\7fQqFX4O.com [2010-04-23 20:05]

2010-04-25 c:\windows\Tasks\At180.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At181.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At182.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At183.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At184.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At185.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At186.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At187.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At188.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At189.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At19.job
- c:\windows\Fonts\7fQqFX4O.com [2010-04-23 20:05]

2010-04-25 c:\windows\Tasks\At190.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At191.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At192.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At193.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At194.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At195.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At196.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At197.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At198.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At199.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At2.job
- c:\windows\Fonts\7fQqFX4O.com [2010-04-23 20:05]

2010-04-25 c:\windows\Tasks\At20.job
- c:\windows\Fonts\7fQqFX4O.com [2010-04-23 20:05]

2010-04-25 c:\windows\Tasks\At200.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At201.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At202.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At203.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At204.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At205.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At206.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At207.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At208.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At209.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At21.job
- c:\windows\Fonts\7fQqFX4O.com [2010-04-23 20:05]

2010-04-26 c:\windows\Tasks\At210.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At211.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At212.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At213.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At214.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At215.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At216.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At217.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At218.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At219.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At22.job
- c:\windows\Fonts\7fQqFX4O.com [2010-04-23 20:05]

2010-04-25 c:\windows\Tasks\At220.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At221.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At222.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At223.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At224.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At225.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At226.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At227.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At228.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At229.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At23.job
- c:\windows\Fonts\7fQqFX4O.com [2010-04-23 20:05]

2010-04-25 c:\windows\Tasks\At230.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At231.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At232.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At233.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At234.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At235.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At236.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At237.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At238.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At239.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At24.job
- c:\windows\Fonts\7fQqFX4O.com [2010-04-23 20:05]

2010-04-25 c:\windows\Tasks\At240.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At241.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At242.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At243.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At244.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At245.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At246.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At247.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At248.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At249.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At25.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At250.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At251.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At252.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At253.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At254.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At255.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At256.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At257.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At258.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At259.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At26.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At260.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At261.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At262.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At263.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At264.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At265.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At266.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At267.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At268.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At269.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At27.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At270.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At271.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At272.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At273.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At274.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At275.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At276.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At277.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At278.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At279.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At28.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At280.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At281.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At282.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At283.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At284.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At285.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At286.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At287.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At288.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At289.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At29.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At290.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At291.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At292.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At293.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At294.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At295.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At296.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At297.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At298.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At299.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At3.job
- c:\windows\Fonts\7fQqFX4O.com [2010-04-23 20:05]

2010-04-25 c:\windows\Tasks\At30.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At300.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At301.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At302.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At303.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At304.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At305.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At306.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At307.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At308.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At309.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At31.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At310.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At311.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At312.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At32.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At33.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At34.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At35.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At36.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At37.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At38.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At39.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At4.job
- c:\windows\Fonts\7fQqFX4O.com [2010-04-23 20:05]

2010-04-26 c:\windows\Tasks\At40.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At41.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At42.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At43.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At44.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At45.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At46.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At47.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At48.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At49.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At5.job
- c:\windows\Fonts\7fQqFX4O.com [2010-04-23 20:05]

2010-04-25 c:\windows\Tasks\At50.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At51.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At52.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At53.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At54.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At55.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At56.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At57.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At58.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At59.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At6.job
- c:\windows\Fonts\7fQqFX4O.com [2010-04-23 20:05]

2010-04-25 c:\windows\Tasks\At60.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At61.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At62.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At63.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At64.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At65.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At66.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At67.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At68.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At69.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At7.job
- c:\windows\Fonts\7fQqFX4O.com [2010-04-23 20:05]

2010-04-25 c:\windows\Tasks\At70.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At71.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At72.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At73.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At74.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At75.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At76.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At77.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At78.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At79.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At8.job
- c:\windows\Fonts\7fQqFX4O.com [2010-04-23 20:05]

2010-04-25 c:\windows\Tasks\At80.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At81.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At82.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At83.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At84.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At85.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At86.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At87.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At88.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At89.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At9.job
- c:\windows\Fonts\7fQqFX4O.com [2010-04-23 20:05]

2010-04-26 c:\windows\Tasks\At90.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At91.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At92.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At93.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At94.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At95.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At96.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At97.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-25 c:\windows\Tasks\At98.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]

2010-04-26 c:\windows\Tasks\At99.job
- c:\documents and settings\All Users\Application Data\DQad4L6M.exe [2010-04-23 15:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
IE: Download &Flash Movies - c:\program files\Flash2X\Flash Hunter\save.htm
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-26 19:46
Windows 5.1.2600 Szervizcsomag 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\wscntfy.exe
c:\program files\Winamp\Winampa .exe
.
**************************************************************************
.
Completion time: 2010-04-26 19:58:21 - machine was rebooted
ComboFix-quarantined-files.txt 2010-04-26 17:58
ComboFix2.txt 2010-04-26 17:10

Pre-Run: 822 974 464 bájt szabad
Post-Run: 789 210 112 bájt szabad

- - End Of File - - 908E874A9E4A863C30F3219C110740F3

udv
tedd ide a combofix logjat
http://virus-stell.blogspot.com/2010/04/combofix.html

Sajnos ismét vírus van a gépemen, mégpedig igen makacs fajta. A gép lassulása és fagyás a tünetek. A feladatkezelőben pedig ezek tünnek fel tucatjával időközönként: DQad4L6M.exe; 7fQqFX4O.com; hki2506.exe...stb. Ami egy hónapja segített, pontról pontra végrehajtottam, de most nem használ.

Stell segíts

nincsen mit.mert nemcsinaltunk semmit,,majd ird le mi a hejzet.

OK. köszönöm.
Kössz a hihetetlen türelmet!

ugy nezem hogy a rendszer meg van serulve.vagy egy nagy Rootkit-ezert probald eloszor a regebi rendszert.ha nemmene akkor javito telepitest,
es aztan irjal,

Csökkentett módban nem engedi elindítani az Internet Explorert, - azzal a C:\WINDOWS\ie7updates\KB978207-IE7\iexplore.exe fájlal, amiről már írtam. Szóval nem megy az explorer. Ha rákattintok jobbal, és kérem a tulajdonságokat, nem reagál. A többi ikon az aztalon simán rámegy a tulajdonságokra. Ez is valami körmönfont rejtőzködése? Egyáltalán jó ez az IE-t indító fájl szerinted?
Még a kedvencek mappámat sem találom, gondoltam onnan a pl. gumicsizma.hu linkkel beindítom az IE-t, de nincsenek kedvencek.

Azt megkérdezném még, hogy amikor csökkentett módban indul a gép, felajánl egy választást régebbi rendszerre visszaállításra. Szerinted megpróbáljam?

Ja, és amikor mindez elkezdte (tegnap) a gépemmel, pontosan 88 chk fájt csinált. Jó mi?

Tegyem be a Win telepítő CD-t esetleg?

OK, megyek csinálom...

ok
probald ki a kemprogramok eltavolitasat pontrol pontra,,
http://virus-stell.blogspot.com/2010/04 ... itasa.html

Ha igy se menne akkor futtatod a combofixet csokentet modban
http://virus-stell.blogspot.com/2010/04/combofix.html

Hibára ment a malwarebites telepítése, több próbálkozásra is, és nem is lehet futtatni. Csökkentett módban ugyanott, ugyanúgy hibaüzenettel leáll a telepítés.
Mi ez, összeesküvés?
Hát ezek nem túl jó hírek, de ez van...

kifejezeten kartevot nemlatok,de ez nem jelent semit.
ok,futtasd le a malwarebytest.ha roblema vam akkor csokentet modban,teljes vizsgalat,
a logjat tedd ide
http://virus-stell.blogspot.com/2010/04 ... lware.html

Üdv!
Már is készen vagyok. Azért ilyen lassan, mert a gépen a log-ot nem tudom elküldeni, mert mint írtam, nem enged web-lapokra írni, így bejelentkezni se tudok ide... szóval szivatós. NNeemm éénn vvaaggyyookk iillyyeenn llaassssúú..

Logfile of random's system information tool 1.06 (written by random/random)
Run by Gazda at 2010-04-05 15:16:47
Microsoft Windows XP Home Edition Szervizcsomag 3
System drive C: has 11 GB (55%) free of 20 GB
Total RAM: 511 MB (42% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:17:24, on 2010.04.05.
Platform: Windows XP Szervizcsomag 3 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\Program Files\ASUS\Probe\AsusProb.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\Program Files\PCI Audio Applications\Bin\WDM\noSPDIF\Mixer.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\ie7updates\KB978207-IE7\iexplore.exe
C:\Documents and Settings\Gazda\Local Settings\Temporary Internet Files\Content.IE5\RDWIKL0C\RSIT[1].exe
C:\Program Files\Alwil Software\Avast4\setup\avast.setup
C:\Program Files\trend micro\Gazda.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hivatkozások
O2 - BHO: Adobe PDF Reader hivatkozássúgó - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [C-Media Mixer] C:\Program Files\PCI Audio Applications\Bin\AudioRack.exe /MixerStartup
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'HELYI SZOLGÁLTATÁS')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'HÁLÓZATI SZOLGÁLTATÁS')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportálás Microsoft Excel formátumba - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 8863731891
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/s ... DEXAXO.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 5531 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader hivatkozássúgó - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2009-12-21 61888]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21 75200]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-02-05 81000]
"COMODO Firewall Pro"=C:\Program Files\Comodo\Firewall\CPF.exe [2009-04-04 1115728]
"C-Media Mixer"=C:\Program Files\PCI Audio Applications\Bin\AudioRack.exe [2001-04-09 225280]
"ASUS Probe"=C:\Program Files\ASUS\Probe\AsusProb.exe [2000-07-06 596480]
"HPDJ Taskbar Utility"=C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe [2001-11-15 196608]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-12-22 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-12-11 948672]
"NeroCheck"=C:\WINDOWS\system32\NeroCheck.exe [2002-10-08 155648]
"InCD"=C:\Program Files\Ahead\InCD\InCD.exe [2002-10-10 1138688]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C-Media Mixer]
Mixer.exe /startup []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
NvQTwk,NvCplDaemon initialize []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask.exe -atboottime []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files\Skype\Phone\Skype.exe /nosplash /minimized []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="NVDESK32.DLL"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2010-04-05 15:16:50 ----D---- C:\Program Files\trend micro
2010-04-05 15:16:47 ----D---- C:\rsit
2010-04-03 14:22:38 ----SHD---- C:\FOUND.002
2010-04-03 11:00:52 ----D---- C:\Documents and Settings\All Users.WINDOWS\Application Data\MSN6
2010-04-03 11:00:51 ----D---- C:\Documents and Settings\Gazda\Application Data\MSN6
2010-04-02 23:12:22 ----SHD---- C:\FOUND.001
2010-03-26 14:53:03 ----N---- C:\WINDOWS\system32\browserchoice.exe
2010-03-21 12:21:21 ----A---- C:\WINDOWS\CMSurround.ini
2010-03-14 20:47:47 ----A---- C:\_NIM4711.TMP
2010-03-14 15:25:55 ----N---- C:\WINDOWS\UNMRW.exe
2010-03-14 15:25:29 ----N---- C:\WINDOWS\NuNinst.exe
2010-03-14 15:23:48 ----N---- C:\WINDOWS\UNNeroVision.exe
2010-03-14 15:23:30 ----N---- C:\WINDOWS\system32\bindfile.dll
2010-03-14 15:21:51 ----D---- C:\Program Files\Ahead
2010-03-12 16:16:24 ----HD---- C:\WINDOWS\$NtUninstallKB975561$
2010-03-11 14:35:21 ----A---- C:\WINDOWS\system32\SET5.tmp
2010-03-11 14:35:20 ----A---- C:\WINDOWS\system32\SET8.tmp
2010-03-11 14:35:19 ----A---- C:\WINDOWS\system32\SETF.tmp
2010-03-11 14:35:19 ----A---- C:\WINDOWS\system32\SET10.tmp
2010-03-11 14:35:18 ----A---- C:\WINDOWS\system32\SET18.tmp
2010-03-11 14:35:18 ----A---- C:\WINDOWS\system32\SET14.tmp
2010-03-11 14:35:17 ----A---- C:\WINDOWS\system32\SET26.tmp
2010-03-11 14:35:16 ----A---- C:\WINDOWS\system32\SET1A.tmp
2010-03-11 14:35:15 ----A---- C:\WINDOWS\system32\SET22.tmp
2010-03-10 15:19:44 ----A---- C:\WINDOWS\system32\SET1E.tmp
2010-03-06 19:20:02 ----D---- C:\proba 2009.05.15. CD-re

======List of files/folders modified in the last 1 months======

2010-04-05 10:47:36 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-04-05 10:47:06 ----A---- C:\WINDOWS\cmmixer.ini
2010-04-03 12:16:36 ----A---- C:\WINDOWS\ModemLog_Lucent Win Modem.txt
2010-03-21 12:28:20 ----A---- C:\WINDOWS\CMMPLAY.INI
2010-03-11 14:35:22 ----A---- C:\WINDOWS\system32\webcheck.dll
2010-03-11 14:35:20 ----N---- C:\WINDOWS\system32\occache.dll
2010-03-11 14:35:20 ----N---- C:\WINDOWS\system32\mstime.dll
2010-03-11 14:35:20 ----A---- C:\WINDOWS\system32\pngfilt.dll
2010-03-11 14:35:20 ----A---- C:\WINDOWS\system32\msrating.dll
2010-03-11 14:35:18 ----N---- C:\WINDOWS\system32\jsproxy.dll
2010-03-11 14:35:18 ----N---- C:\WINDOWS\system32\iernonce.dll
2010-03-11 14:35:18 ----A---- C:\WINDOWS\system32\iepeers.dll
2010-03-11 14:35:16 ----N---- C:\WINDOWS\system32\ieaksie.dll
2010-03-11 14:35:16 ----N---- C:\WINDOWS\system32\ieakeng.dll
2010-03-11 14:35:16 ----A---- C:\WINDOWS\system32\dxtmsft.dll
2010-03-10 15:19:44 ----A---- C:\WINDOWS\system32\ieudinit.exe
2010-03-06 12:43:34 ----A---- C:\WINDOWS\CMAURACK.INI

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2009-02-05 26944]
R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2009-02-05 114768]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2009-02-05 51376]
R1 CmdMon;Comodo Application Engine; C:\WINDOWS\System32\DRIVERS\cmdmon.sys [2009-04-04 75520]
R1 incdrm;InCD EasyWrite Reader; C:\WINDOWS\system32\drivers\incdrm.sys [2002-10-08 7582]
R1 P3;Intel PentiumIII processzor-illesztőprogram; C:\WINDOWS\System32\DRIVERS\p3.sys [2008-04-14 46976]
R1 VIAPFD;VIAPFD; C:\WINDOWS\System32\Drivers\VIAPFD.SYS [2001-12-18 3279]
R2 aslm75;aslm75; \??\C:\WINDOWS\system32\drivers\aslm75.sys []
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2009-02-05 94032]
R2 BsUDF;InCD UDF Driver; C:\WINDOWS\system32\drivers\BsUDF.sys [2002-10-10 454144]
R2 DgiVecp;Team MFP Comm Driver; C:\WINDOWS\System32\Drivers\DgiVecp.sys [2009-06-15 40448]
R2 Sentinel;Sentinel; C:\WINDOWS\System32\Drivers\SENTINEL.SYS [1997-06-27 64512]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2009-02-05 23152]
R3 cmpci;C-Media PCI Audio Driver (WDM); C:\WINDOWS\system32\drivers\cmaudio.sys [2001-04-25 270664]
R3 HidUsb;Microsoft HID osztályú illesztőprogram; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 ltmodem5;LT Modem Driver; C:\WINDOWS\System32\DRIVERS\ltmdmnt.sys [2004-08-18 606940]
R3 mouhid;Egér HID-illesztőprogram; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-26 12160]
R3 ms_mpu401;Microsoft MPU-401 MIDI UART illesztőprogram; C:\WINDOWS\system32\drivers\msmpu401.sys [2001-08-17 2944]
R3 nv4;nv4; C:\WINDOWS\System32\DRIVERS\nv4.sys [2001-08-17 731648]
R3 rtl8139;Realtek RTL8139(A/B/C) alapú PCI gyors Ethernet-adapter NT illesztőprogramja; C:\WINDOWS\System32\DRIVERS\RTL8139.SYS [2004-08-04 20992]
R3 usbhub;USB2-engedélyezett hub; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Microsoft USB univerzális állomásvezérlő miniport illesztőprogramja; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 nv;nv; C:\WINDOWS\System32\DRIVERS\nv4_mini.sys [2001-11-29 793065]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 usbprint;Microsoft USB PRINTER osztály; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;USB-képolvasó illesztőprogramja; C:\WINDOWS\System32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;USB háttértár illesztőprogramja; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-02-05 18752]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-02-05 138680]
R2 CmdAgent;Comodo Application Agent; C:\Program Files\Comodo\Firewall\cmdagent.exe [2009-04-04 361040]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe [2010-03-15 1029456]
R2 NVSvc;NVIDIA Driver Helper Service; C:\WINDOWS\System32\nvsvc32.exe [2001-11-29 57344]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-02-05 254040]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-02-05 352920]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2008-11-11 620544]
S3 WMPNetworkSvc;A Windows Media Player hálózatmegosztási szolgáltatása; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-10 919040]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]

-----------------EOF-----------------

udv
tedd ide az RSIT logjat
http://virus-stell.blogspot.com/2010/04/rsit.html

Vírus, vagy mi lehet, az én esetem?
Az internetexplorer ikonjára kattintva nem indult el az explorer. Nem tudtam mi a frássz lehet az oka. Nem is találtam iexplore.exe filét, amikor rákerestem, - etünt. Nagy nehezen el tudtam indítani a netet, a C:\Windows\ie7updates\KB987207.ie7\iexplorer.exe filével. De ez nekem gyanús...
Megpróbáltam rendszervisszaállítást végrehajtani, de eltüntek a rendszervisszaállítás kis naptár ablakai, vagy nincsenek benne adatok.
És mégegy tünet: ahogy -ezen a módon belépek a netre - semmilyen kereső ablakban (Googlee, egyéb keresések) nem jelenik meg a kurzor, semmiképpen nem tudok bele karaktert bevinni.
Tud segíteni valaki?
[/quote]

Köszönöm stell

Üdv

udv
ha a gepel nincsen problem,kekhalal,lassitas,stb akkor jo a az outpust es az Avast.it arrol van szo hogy nemkell a legszeb,legjobb tuzfall,hanem ojan amihez ertunk es tudjuk kezelni,,tehat rakhatsz fell akkar mijen tuzfallat csak hogy jol vedjen,jol legyen bealitva.A tuzfalakal ugy van mint mejik a legjobb bor??mejik a legjobb lany,,mind jo,,

cmdow.exe en szerintem ez hamis riasztas volt,,mivel ez valami windows utilit ,ha ijesmire talalsz eloszor le kell tesztelni a virus totalon vagy elkuldod a Free Online threatexpert Scanner ide.
http://www.virus-stell.com/

"Extrém" oldalakat nem látogatok /Warez,XXX/, ha erre gondolsz.
Nem gondolom, hogy sok fertőzésem ill. próblémám lenne.

Köszi

Sanyi46

Merre jársz te a Neten, hogy ennyi gondod, fertőzésed van?

Ma feltettem az Avast 4.8 Home Edition mellé az Outpost Firewall Pro-t telepítve a kémprogram védelmet és Web felügyeletet/Avastnál a Web felügyelet leállítva/.
Az Outpost kémprogram keresőjét lefutattam/gyors vizsgálat/ és rörtön talált:Tool-Hide Windows/Malware/, c:\Windows\system 32\cmdow.exe.Karanténba helyezve!
Két kérdésem lenne:
1. Optimális így a páros/Avast és Outpost/?
2. Veszélyes a talált malware?

Köszi

Nezd meg ha nincsen e kikapcsolva-start-vezerlo pult Hangog-a kartyan fent-masodik ful-es a hosszukas ablakban alisd be hogy be legyen kapcsolva-ok-restart,
Nincsen mit koszonod ha maeg van problem akkor irjal,
udv

Arra van valami ötleted, hogy miért nincs még mindig hangja amikor az intézőben a mappákat megnyitom? Arra klikkelő hangra gondolok. A vírus már kizárt, akkor mi okozhatja?

Csak azt csináltam amit írtál. Az AVIRA-hoz nem nyúltam, csak letöröltem a telepítő fájlt, a Nod32-vel és a Kaspersky-vel egyetemben (Mivel nem sokra mentem velük). De látom kár volt, mivel az AVIRA-t ajánlod

Amúgy nagyon jó lett a gép, gyors és nyugodt a működése. Ezért örök hálával tartozom. Köszi

ok,latom hogy mindig eloszor masat csinalsz amit irok,mit csinal mar ot az AVIRA??
most mar renben van,,szed le a combofixet a geprol igy
start futtatas bemasold inen az abalkba combofix /uninstall
klik ok.
tisztisd ki a gepet a CCleaner programmal es kapcsold ki a rendszervisszaalitasat.
http://www.virus-stell.com/


Mivel hogy keves a RAM-telepitsd fell az ingyenes AVIRAT
http://virus-stell.blogspot.com/2010/04 ... delem.html
es hozza a PCTOOLS tuzfalat es keszen vagyunk

Elkészültem, íme a log:

ComboFix 10-03-19.06 - Delachron 010.03.20. 19:05:56.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1250.36.1038.18.256.34 [GMT 1:00]
Running from: c:\documents and settings\Delachron\Asztal\ComboFix.exe
Command switches used :: c:\documents and settings\Delachron\Asztal\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
"c:\program files\folder.htt"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Shortcuts
c:\documents and settings\All Users\Application Data\Microsoft\Shortcuts\Adobe Reader gyorsindító.lnk
c:\program files\folder.htt

.
--------------- FCopy ---------------

c:\windows\ServicePackFiles\i386\tcpip.sys --> c:\windows\SYSTEM32\DRIVERS\tcpip.sys
c:\windows\ServicePackFiles\i386\tcpip.sys --> c:\windows\$NtServicePackUninstall$\tcpip.sys
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_CABANIA
-------\Legacy_KE386IO
-------\Legacy_KVCZSZB
-------\Legacy_ORTULL
-------\Service_cabania
-------\Service_hzhkfodn
-------\Service_Ke386IO
-------\Service_kvczszb
-------\Service_ortull
-------\Service_pgemimjb


((((((((((((((((((((((((( Files Created from 2010-02-20 to 2010-03-20 )))))))))))))))))))))))))))))))
.

2010-03-19 22:53 . 2010-03-19 22:54 -------- d-----w- c:\program files\CCleaner
2010-03-19 15:49 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-19 15:49 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-19 15:49 . 2010-03-19 15:49 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-03-18 21:09 . 2010-03-18 22:34 -------- d-----w- c:\program files\VirusBuster
2010-03-18 18:43 . 2010-03-19 21:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2010-03-18 13:45 . 2010-03-18 13:45 -------- d-----w- c:\documents and settings\Delachron\Local Settings\Application Data\ESET
2010-03-18 13:39 . 2010-03-18 13:39 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
2010-03-17 22:38 . 2010-03-18 00:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2010-03-17 22:13 . 2010-03-18 02:43 -------- d-----w- c:\program files\ATS2
2010-03-17 16:29 . 2010-03-17 16:29 -------- d-----w- c:\program files\Alwil Software
2010-03-17 16:09 . 2010-03-17 16:09 -------- d-----w- c:\documents and settings\Delachron\Application Data\SUPERAntiSpyware.com
2010-03-11 15:45 . 2010-03-11 15:46 -------- d-----w- c:\program files\HUN2009
2010-03-11 15:45 . 2010-03-18 22:34 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-03-11 15:45 . 2010-03-18 21:08 -------- d-----w- c:\program files\Common Files\InstallShield
2010-03-11 15:32 . 2010-03-11 15:32 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-03-11 15:31 . 2010-03-11 15:32 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-03-11 15:30 . 2010-03-11 15:42 -------- d-----w- c:\documents and settings\Delachron\Application Data\DAEMON Tools Lite
2010-03-11 15:30 . 2010-03-11 15:30 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
2010-03-09 18:57 . 2010-03-09 18:58 -------- d-----w- c:\documents and settings\Delachron\Local Settings\Application Data\xrecode2
2010-03-09 18:23 . 2010-03-09 18:23 -------- d-----w- c:\documents and settings\All Users\Application Data\AVS4YOU
2010-03-09 18:23 . 2010-03-09 18:23 -------- d-----w- c:\documents and settings\Delachron\Application Data\AVS4YOU
2010-03-09 18:18 . 2010-03-10 00:35 -------- d-----w- c:\program files\Common Files\AVSMedia
2010-03-09 18:17 . 2007-12-29 09:42 974848 ----a-w- c:\windows\system32\mfc70.dll
2010-03-09 18:17 . 2007-12-29 09:42 487424 ----a-w- c:\windows\system32\msvcp70.dll
2010-03-09 18:17 . 2008-07-17 16:25 1700352 ----a-w- c:\windows\system32\GdiPlus.dll
2010-03-09 18:17 . 2007-12-29 09:42 24576 ----a-w- c:\windows\system32\msxml3a.dll
2010-03-03 17:50 . 2010-03-03 17:52 -------- d-----w- c:\documents and settings\Delachron\Application Data\avidemux
2010-03-01 18:39 . 2010-03-01 18:39 -------- d-----w- c:\documents and settings\Delachron\Local Settings\Application Data\WMTools Downloaded Files
2010-02-23 23:47 . 2010-02-23 23:47 -------- d-----w- c:\documents and settings\Delachron\Application Data\Malwarebytes
2010-02-23 23:46 . 2010-02-23 23:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-23 22:39 . 2010-02-23 22:39 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-02-22 17:57 . 2003-03-19 10:03 544768 ----a-w- c:\windows\system32\msvcr71d.dll
2010-02-22 17:57 . 2002-01-05 13:37 344064 ----a-w- c:\windows\system32\msvcr70.dll
2010-02-22 17:56 . 2004-05-26 20:37 719872 ----a-w- c:\windows\system32\devil.dll
2010-02-22 17:56 . 2006-09-16 18:44 314368 ----a-w- c:\windows\system32\avisynth.dll
2010-02-22 17:56 . 2010-03-16 18:18 -------- d-----w- c:\program files\Magic Video Converter
2010-02-21 19:54 . 2010-02-21 19:54 -------- d-----w- c:\documents and settings\Delachron\Application Data\Nokia Multimedia Player
2010-02-20 18:34 . 2010-02-20 18:35 -------- d-----w- c:\documents and settings\Delachron\Application Data\PC Suite
2010-02-20 18:34 . 2010-02-20 18:34 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Suite
2010-02-20 18:33 . 2010-02-20 18:33 -------- d-----w- c:\program files\DIFX
2010-02-20 18:31 . 2010-02-20 18:31 -------- d-----w- c:\program files\Common Files\PCSuite
2010-02-20 18:31 . 2010-02-20 18:31 -------- d-----w- c:\program files\Common Files\Nokia
2010-02-20 18:30 . 2010-02-20 18:30 -------- d-----w- c:\program files\Nokia
2010-02-20 18:28 . 2008-05-10 13:28 27837040 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{29466F9C-7C6A-419C-B301-F440FAF78760}\Nokia_PC_Suite_rel_6_85_14_1_hun_web.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-20 01:16 . 2008-05-21 18:25 13512 -c--a-w- c:\documents and settings\Delachron\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-03-19 11:54 . 2010-03-17 15:44 544 ---ha-w- c:\documents and settings\All Users\Application Data\mul.bin
2010-03-17 21:05 . 2008-05-21 17:34 14336 ------w- c:\windows\system32\svchost.exe
2010-03-17 01:47 . 2008-06-24 21:28 -------- d-----w- c:\program files\Soulseek
2010-03-09 19:00 . 2010-03-09 19:00 -------- d-----w- c:\program files\Free Audio Pack
2010-03-09 19:00 . 2010-03-09 19:00 -------- d-----w- c:\documents and settings\Delachron\Application Data\FreeAudioPack
2010-02-24 00:23 . 2008-05-21 17:38 303356 ----a-w- c:\windows\system32\perfh00E.dat
2010-02-24 00:23 . 2008-05-21 17:38 57716 ----a-w- c:\windows\system32\perfc00E.dat
2010-02-20 18:27 . 2010-02-16 23:27 733783 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{29466F9C-7C6A-419C-B301-F440FAF78760}\Packages\Nokia_PC_Suite\CustomActions\NSU_Inst_fix.exe
2010-02-20 18:27 . 2009-08-01 19:29 8192 -c--a-w- c:\documents and settings\All Users\Application Data\Installations\{29466F9C-7C6A-419C-B301-F440FAF78760}\Installer\CommonCustomActions\UninstCCD.exe
2010-02-20 18:27 . 2009-08-01 19:29 61440 -c--a-w- c:\documents and settings\All Users\Application Data\Installations\{29466F9C-7C6A-419C-B301-F440FAF78760}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2010-02-20 18:27 . 2009-08-01 19:29 10240 -c--a-w- c:\documents and settings\All Users\Application Data\Installations\{29466F9C-7C6A-419C-B301-F440FAF78760}\Installer\CommonCustomActions\UninstPCS.exe
2010-02-18 22:29 . 2008-08-11 14:54 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-02-18 18:34 . 2008-05-31 15:33 -------- d-----w- c:\program files\CDex_140b9
2010-01-28 23:33 . 2010-01-28 23:33 -------- d-----w- c:\program files\YouTube Downloader
2010-01-28 23:26 . 2010-01-28 23:26 -------- d-----w- c:\documents and settings\Delachron\Application Data\AdobeUM
2010-01-22 23:54 . 2010-01-22 23:54 7168 ----a-w- c:\documents and settings\Delachron\Application Data\Thinstall\save2pc Pro 3.35\40000074100003i\Eaj28q_cfdg.exe
2010-01-22 23:54 . 2010-01-22 23:54 7168 ----a-w- c:\documents and settings\Delachron\Application Data\Thinstall\save2pc Pro 3.35\40000074100003i\Jyd8Os_cfdg.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinampAgent"="c:\program files\Winamp\Winampa.exe" [2003-04-02 12288]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-17 15360]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 1294336]

c:\documents and settings\All Users\Start Menu\Programs\Indˇt˘pult\
Adobe Reader gyorsindˇt˘.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-24 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Soulseek\\slsk.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=

R3 atirage;atirage;c:\windows\SYSTEM32\DRIVERS\atiragem.sys [2008.05.21. 18:58 70528]
R3 ess;ESS audio-illesztőprogram (WDM);c:\windows\SYSTEM32\DRIVERS\ess.sys [2008.05.21. 18:58 63360]
S3 NtApm;NT APM/örökölt illesztő illesztőprogramja;c:\windows\SYSTEM32\DRIVERS\NtApm.sys [2008.05.21. 18:59 9472]
S4 sptd;sptd;c:\windows\SYSTEM32\DRIVERS\sptd.sys [2010.03.11. 16:32 691696]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
TCP: {89CA6D4D-E2BE-4245-82FB-8B2857D8A40D} = 217.79.128.40 217.79.128.45
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-20 19:21
Windows 5.1.2600 Szervizcsomag 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-03-20 19:31:12 - machine was rebooted
ComboFix-quarantined-files.txt 2010-03-20 18:31
ComboFix2.txt 2010-03-20 00:28

Pre-Run: 1 157 219 328 bájt szabad
Post-Run: 1 143 276 544 bájt szabad

- - End Of File - - 85337B79907F7FF8D303AB610647455F

mert biztos a 64 bitest toltotedd le neked a 32.bites kell,
ha az se megy akkor futtasd ezt a programot
ttp://jpshortstuff.247fixes.com/beta/Defogger.exe
futtasd---klik DISABLE -restart es csinald a combofixel amit leirtam

Csináltam egy Malware full scant, és elég biztató. Íme:

Malwarebytes' Anti-Malware 1.44
Adatbázis verzió: 3885
Windows 5.1.2600 Szervizcsomag 2
Internet Explorer 6.0.2900.2180

2010.03.20. 15:58:20
mbam-log-2010-03-20 (15-58-20).txt

Vizsgálat típusa: Teljes vizsgálat (A:\|C:\|D:\|E:\|F:\|)
Átvizsgált objektumok: 150492
Eltelt idő: 1 hour(s), 1 minute(s), 27 second(s)

Fertőzött memóriafolyamatok: 0
Fertőzött memória modulok: 0
Fertőzött rendszerleíró kulcsok: 0
Fertőzött rendszerleíró értékek: 0
Fertőzött rednszerleíró elemek: 0
Fertőzött mappák: 0
Fertőzött fájlok: 0

Fertőzött memóriafolyamatok:
(Nem észleltem rosszindulatú elemeket)

Fertőzött memória modulok:
(Nem észleltem rosszindulatú elemeket)

Fertőzött rendszerleíró kulcsok:
(Nem észleltem rosszindulatú elemeket)

Fertőzött rendszerleíró értékek:
(Nem észleltem rosszindulatú elemeket)

Fertőzött rednszerleíró elemek:
(Nem észleltem rosszindulatú elemeket)

Fertőzött mappák:
(Nem észleltem rosszindulatú elemeket)

Fertőzött fájlok:
(Nem észleltem rosszindulatú elemeket)

Nem lehet letölteni vagy futtatni az SPTD-t. Azt írja: nem Win32 alkalmazás.

Meg egy kicsit varsz hogy renbe jojon a gep.
1:Ideglenesen szed le a geprol az emulatort c:\program files\DAEMON Tools Lite.
http://sites.google.com/site/virusstell ... on-Alcohol

2:
Kinyitunk - Notepadot (Jegyzetfüzetet)igy: Start>futtatás>beírod: notepad
és bemásolod- a Kód: címszó alatt található zöld textet(Kód: szó nélkül), aztán a notepadba beillesztett textet elmentjük scriptnek az asztalra , úgy:- Fájl>Mentés Másként>Fájlnév>CFScript.txt>Fájl típusa>Minden fájl>Mentés.(Ásztálra),.Kész, az astalon lévő CFScript txt húzzunk rá a ComboFix ikonnyara. Es mostan megcsinalod eztett:

A combofix maga elindul es lehet hogy restartol es befejezi a scent.Amit majd ad ted ide.


a logjat tedd ide.

Végre hajtottam az utasításokat, és most úgy tűnik rendeződött a rendszer! Kipusztultak a férgek
Ami furcsa talán, hogy a feladatkezelőböl eltünt a ctfmon.exe. És hogy az intézőben még mindig nincs hangja, ahogy a mappákat megnyitom. Lehet hogy nem létszükséglet de én hozzászoktam


Ime a logok:

MALWAREBYTES:

Malwarebytes' Anti-Malware 1.44
Adatbázis verzió: 3885
Windows 5.1.2600 Szervizcsomag 2
Internet Explorer 6.0.2900.2180

2010.03.20. 0:23:37
mbam-log-2010-03-20 (00-23-37).txt

Vizsgálat típusa: Gyorsvizsgálat
Átvizsgált objektumok: 109465
Eltelt idő: 16 minute(s), 56 second(s)

Fertőzött memóriafolyamatok: 0
Fertőzött memória modulok: 0
Fertőzött rendszerleíró kulcsok: 3
Fertőzött rendszerleíró értékek: 3
Fertőzött rednszerleíró elemek: 3
Fertőzött mappák: 1
Fertőzött fájlok: 5

Fertőzött memóriafolyamatok:
(Nem észleltem rosszindulatú elemeket)

Fertőzött memória modulok:
(Nem észleltem rosszindulatú elemeket)

Fertőzött rendszerleíró kulcsok:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Fci (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\icf (Rootkit.ADS) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DbgMgr (Malware.Trace) -> Quarantined and deleted successfully.

Fertőzött rendszerleíró értékek:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\internet connection wizard setup tool (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore\disableconfig (Windows.Tool.Disabled) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\appsecdll (Trojan.Agent) -> Quarantined and deleted successfully.

Fertőzött rednszerleíró elemek:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell) -> Bad: (explorer.exe rundll32.exe) Good: (Explorer.exe) -> Quarantined and deleted successfully.

Fertőzött mappák:
C:\WINDOWS\_VOIDwtrxiqxyri (Rootkit.TDSS) -> Quarantined and deleted successfully.

Fertőzött fájlok:
C:\WINDOWS\cidrive32.exe (Worm.Autorun) -> Quarantined and deleted successfully.
C:\WINDOWS\_VOIDwtrxiqxyri\_VOIDd.sys (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Program Files\Internet Explorer\Connection Wizard\icwsetup.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\svchost.exe:exe.exe (Rootkit.ADS) -> Quarantined and deleted successfully.
C:\WINDOWS\Prefetch\SVCHOST.EXE (Trojan.Agent) -> Quarantined and deleted successfully.

COMBOFIX:

ComboFix 10-03-19.06 - Delachron 010.03.20. 1:00.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1250.36.1038.18.256.50 [GMT 1:00]
Running from: c:\documents and settings\Delachron\Asztal\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Default User\Local Settings\Application Data\Windows Server
c:\documents and settings\Delachron\Application Data\Desktopicon
c:\documents and settings\Delachron\Application Data\Desktopicon\eBay.ico
c:\documents and settings\Delachron\Application Data\Desktopicon\uninst.exe
c:\documents and settings\Delachron\Local Settings\Application Data\Windows Server
c:\documents and settings\Delachron\Local Settings\Application Data\Windows Server\flags.ini
c:\documents and settings\Delachron\Local Settings\Application Data\Windows Server\uses32.dat
c:\documents and settings\LocalService\Local Settings\Application Data\Windows Server
c:\documents and settings\NetworkService\Local Settings\Application Data\Windows Server
c:\dokumentumok\Scratch Massive_-_Girls On Top (MBF_2005)\_desktop.ini
c:\recycler\S-1-5-21-0064808204-5076390446-526669363-5434
c:\windows\command
c:\windows\system32\ieuinit.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ICF
-------\Legacy_TCPSR


((((((((((((((((((((((((( Files Created from 2010-02-20 to 2010-03-20 )))))))))))))))))))))))))))))))
.

2010-03-19 22:53 . 2010-03-19 22:54 -------- d-----w- c:\program files\CCleaner
2010-03-19 15:49 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-19 15:49 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-19 15:49 . 2010-03-19 15:49 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-03-18 21:09 . 2010-03-18 22:34 -------- d-----w- c:\program files\VirusBuster
2010-03-18 18:43 . 2010-03-19 21:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2010-03-18 13:45 . 2010-03-18 13:45 -------- d-----w- c:\documents and settings\Delachron\Local Settings\Application Data\ESET
2010-03-18 13:39 . 2010-03-18 13:39 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
2010-03-17 22:38 . 2010-03-18 00:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2010-03-17 22:13 . 2010-03-18 02:43 -------- d-----w- c:\program files\ATS2
2010-03-17 18:56 . 2010-03-17 18:57 -------- d-----w- C:\TEMP
2010-03-17 16:29 . 2010-03-17 16:29 -------- d-----w- c:\program files\Alwil Software
2010-03-17 16:09 . 2010-03-17 16:09 -------- d-----w- c:\documents and settings\Delachron\Application Data\SUPERAntiSpyware.com
2010-03-11 15:45 . 2010-03-11 15:46 -------- d-----w- c:\program files\HUN2009
2010-03-11 15:45 . 2010-03-18 22:34 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-03-11 15:45 . 2010-03-18 21:08 -------- d-----w- c:\program files\Common Files\InstallShield
2010-03-11 15:32 . 2010-03-11 15:32 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-03-11 15:31 . 2010-03-11 15:32 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-03-11 15:30 . 2010-03-11 15:42 -------- d-----w- c:\documents and settings\Delachron\Application Data\DAEMON Tools Lite
2010-03-11 15:30 . 2010-03-11 15:30 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
2010-03-09 18:57 . 2010-03-09 18:58 -------- d-----w- c:\documents and settings\Delachron\Local Settings\Application Data\xrecode2
2010-03-09 18:23 . 2010-03-09 18:23 -------- d-----w- c:\documents and settings\All Users\Application Data\AVS4YOU
2010-03-09 18:23 . 2010-03-09 18:23 -------- d-----w- c:\documents and settings\Delachron\Application Data\AVS4YOU
2010-03-09 18:18 . 2010-03-10 00:35 -------- d-----w- c:\program files\Common Files\AVSMedia
2010-03-09 18:17 . 2007-12-29 09:42 974848 ----a-w- c:\windows\system32\mfc70.dll
2010-03-09 18:17 . 2007-12-29 09:42 487424 ----a-w- c:\windows\system32\msvcp70.dll
2010-03-09 18:17 . 2008-07-17 16:25 1700352 ----a-w- c:\windows\system32\GdiPlus.dll
2010-03-09 18:17 . 2007-12-29 09:42 24576 ----a-w- c:\windows\system32\msxml3a.dll
2010-03-03 17:50 . 2010-03-03 17:52 -------- d-----w- c:\documents and settings\Delachron\Application Data\avidemux
2010-03-01 18:39 . 2010-03-01 18:39 -------- d-----w- c:\documents and settings\Delachron\Local Settings\Application Data\WMTools Downloaded Files
2010-02-23 23:47 . 2010-02-23 23:47 -------- d-----w- c:\documents and settings\Delachron\Application Data\Malwarebytes
2010-02-23 23:46 . 2010-02-23 23:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-23 22:39 . 2010-02-23 22:39 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-02-22 17:57 . 2003-03-19 10:03 544768 ----a-w- c:\windows\system32\msvcr71d.dll
2010-02-22 17:57 . 2002-01-05 13:37 344064 ----a-w- c:\windows\system32\msvcr70.dll
2010-02-22 17:56 . 2004-05-26 20:37 719872 ----a-w- c:\windows\system32\devil.dll
2010-02-22 17:56 . 2006-09-16 18:44 314368 ----a-w- c:\windows\system32\avisynth.dll
2010-02-22 17:56 . 2010-03-16 18:18 -------- d-----w- c:\program files\Magic Video Converter
2010-02-21 19:54 . 2010-02-21 19:54 -------- d-----w- c:\documents and settings\Delachron\Application Data\Nokia Multimedia Player
2010-02-20 18:34 . 2010-02-20 18:35 -------- d-----w- c:\documents and settings\Delachron\Application Data\PC Suite
2010-02-20 18:34 . 2010-02-20 18:34 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Suite
2010-02-20 18:33 . 2010-02-20 18:33 -------- d-----w- c:\program files\DIFX
2010-02-20 18:31 . 2010-02-20 18:31 -------- d-----w- c:\program files\Common Files\PCSuite
2010-02-20 18:31 . 2010-02-20 18:31 -------- d-----w- c:\program files\Common Files\Nokia
2010-02-20 18:30 . 2010-02-20 18:30 -------- d-----w- c:\program files\Nokia
2010-02-20 18:28 . 2008-05-10 13:28 27837040 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{29466F9C-7C6A-419C-B301-F440FAF78760}\Nokia_PC_Suite_rel_6_85_14_1_hun_web.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-19 11:54 . 2010-03-17 15:44 544 ---ha-w- c:\documents and settings\All Users\Application Data\mul.bin
2010-03-17 21:05 . 2008-05-21 17:34 14336 ----a-w- c:\windows\system32\svchost.exe
2010-03-17 01:47 . 2008-06-24 21:28 -------- d-----w- c:\program files\Soulseek
2010-03-09 19:00 . 2010-03-09 19:00 -------- d-----w- c:\program files\Free Audio Pack
2010-03-09 19:00 . 2010-03-09 19:00 -------- d-----w- c:\documents and settings\Delachron\Application Data\FreeAudioPack
2010-03-09 18:23 . 2008-05-21 18:25 13512 -c--a-w- c:\documents and settings\Delachron\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-02-24 00:23 . 2008-05-21 17:38 303356 ----a-w- c:\windows\system32\perfh00E.dat
2010-02-24 00:23 . 2008-05-21 17:38 57716 ----a-w- c:\windows\system32\perfc00E.dat
2010-02-20 18:27 . 2010-02-16 23:27 733783 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{29466F9C-7C6A-419C-B301-F440FAF78760}\Packages\Nokia_PC_Suite\CustomActions\NSU_Inst_fix.exe
2010-02-20 18:27 . 2009-08-01 19:29 8192 -c--a-w- c:\documents and settings\All Users\Application Data\Installations\{29466F9C-7C6A-419C-B301-F440FAF78760}\Installer\CommonCustomActions\UninstCCD.exe
2010-02-20 18:27 . 2009-08-01 19:29 61440 -c--a-w- c:\documents and settings\All Users\Application Data\Installations\{29466F9C-7C6A-419C-B301-F440FAF78760}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2010-02-20 18:27 . 2009-08-01 19:29 10240 -c--a-w- c:\documents and settings\All Users\Application Data\Installations\{29466F9C-7C6A-419C-B301-F440FAF78760}\Installer\CommonCustomActions\UninstPCS.exe
2010-02-18 22:29 . 2008-08-11 14:54 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-02-18 18:34 . 2008-05-31 15:33 -------- d-----w- c:\program files\CDex_140b9
2010-01-28 23:33 . 2010-01-28 23:33 -------- d-----w- c:\program files\YouTube Downloader
2010-01-28 23:26 . 2010-01-28 23:26 -------- d-----w- c:\documents and settings\Delachron\Application Data\AdobeUM
2010-01-22 23:54 . 2010-01-22 23:54 7168 ----a-w- c:\documents and settings\Delachron\Application Data\Thinstall\save2pc Pro 3.35\40000074100003i\Eaj28q_cfdg.exe
2010-01-22 23:54 . 2010-01-22 23:54 7168 ----a-w- c:\documents and settings\Delachron\Application Data\Thinstall\save2pc Pro 3.35\40000074100003i\Jyd8Os_cfdg.exe
2008-05-21 16:26 . 2008-05-21 16:26 11231 -c-ha-w- c:\program files\folder.htt
.

------- Sigcheck -------

[7] 2004-08-03 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\ServicePackFiles\i386\tcpip.sys
[-] 2004-08-03 . 7399D854596BFEFEED6B60879F28CE07 . 359040 . . [5.1.2600.2180] . . c:\windows\SYSTEM32\DRIVERS\tcpip.sys
[-] 2002-08-29 . 244A2F9816BC9B593957281EF577D976 . 332928 . . [5.1.2600.1106] . . c:\windows\$NtServicePackUninstall$\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinampAgent"="c:\program files\Winamp\Winampa.exe" [2003-04-02 12288]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-17 15360]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 1294336]

c:\documents and settings\All Users\Application Data\Microsoft\Shortcuts\
Adobe Reader gyorsindˇt˘.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-24 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Soulseek\\slsk.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\system32\\drivers\\svchost.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"2130:TCP"= 2130:TCP:exxoqozp

R0 sptd;sptd;c:\windows\SYSTEM32\DRIVERS\sptd.sys [2010.03.11. 16:32 691696]
R3 atirage;atirage;c:\windows\SYSTEM32\DRIVERS\atiragem.sys [2008.05.21. 18:58 70528]
R3 ess;ESS audio-illesztőprogram (WDM);c:\windows\SYSTEM32\DRIVERS\ess.sys [2008.05.21. 18:58 63360]
S2 cabania;Center Manager;c:\windows\system32\svchost.exe -k netsvcs [2008.05.21. 18:34 14336]
S2 kvczszb;Monitor Security;c:\windows\system32\svchost.exe -k netsvcs [2008.05.21. 18:34 14336]
S2 ortull;Config System;c:\windows\system32\svchost.exe -k netsvcs [2008.05.21. 18:34 14336]
S3 hzhkfodn;hzhkfodn;\??\c:\windows\System32\Drivers\hzhkfodn.sys --> c:\windows\System32\Drivers\hzhkfodn.sys [?]
S3 Ke386IO;Ke386IO;\??\c:\docume~1\DELACH~1\LOCALS~1\Temp\WZS2.tmp\Ke386IO.sys --> c:\docume~1\DELACH~1\LOCALS~1\Temp\WZS2.tmp\Ke386IO.sys [?]
S3 NtApm;NT APM/örökölt illesztő illesztőprogramja;c:\windows\SYSTEM32\DRIVERS\NtApm.sys [2008.05.21. 18:59 9472]
S3 pgemimjb;pgemimjb;\??\c:\windows\System32\Drivers\pgemimjb.sys --> c:\windows\System32\Drivers\pgemimjb.sys [?]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
kvczszb
ortull
cabania
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
- - - - ORPHANS REMOVED - - - -

AddRemove-eBay Icon - c:\documents and settings\Delachron\Application Data\Desktopicon\uninst.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-20 01:18
Windows 5.1.2600 Szervizcsomag 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x823751F8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf9974fc3
\Driver\atapi -> 0x823751f8
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a1afe
ParseProcedure -> ntoskrnl.exe @ 0x80570a6e
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a1afe
ParseProcedure -> ntoskrnl.exe @ 0x80570a6e
NDIS: -> SendCompleteHandler -> 0x0
PacketIndicateHandler -> 0x0
SendHandler -> 0x0
Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-03-20 01:28:15 - machine was rebooted
ComboFix-quarantined-files.txt 2010-03-20 00:28

Pre-Run: 1 273 035 776 bájt szabad
Post-Run: 1 185 168 896 bájt szabad

Current=6 Default=6 Failed=5 LastKnownGood=7 Sets=1,2,3,4,5,6,7
- - End Of File - - EA32BA19740DE9EC6379AB2003C6F80A

OK, és köszi!

Futtasd le a CCleanert:
http://sites.google.com/site/virusstell ... C-CCleaner

Futtasd le a Malwarebytest gyors vizsgalatot,amit talal torolni a LOGJAT TEDD IDE
http://sites.google.com/site/virusstell ... rogramok-3

Futtasd le a Combofixet alogjat tedd ide
http://sites.google.com/site/virusstell/combofix

A logokat rakdd ide majd holnap fojtasukk,es ird le hogy viselkedik a rendszer.

All processes killed
========== OTL ==========
Service vtiqrdbd stopped successfully!
Service vtiqrdbd deleted successfully!
C:\WINDOWS\SYSTEM32\DRIVERS\vtiqrdbd.sys moved successfully.
Service qwuiaimm stopped successfully!
Service qwuiaimm deleted successfully!
C:\WINDOWS\SYSTEM32\DRIVERS\qwuiaimm.sys moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:wrdr.kuo deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:gxsad deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\ deleted successfully.
C:\WINDOWS\System32\wmicvrt.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\\AppSecDll:C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Windows Server\kfqsmr.dll deleted successfully.
========== FILES ==========
File\Folder C:\WINDOWS\System32\drivers\vtiqrdbd.sys not found.
File\Folder C:\WINDOWS\System32\drivers\qwuiaimm.sys not found.
C:\Documents and Settings\Delachron\secupdat.dat moved successfully.
C:\WINDOWS\System32\secupdat.dat moved successfully.
File\Folder C:\WINDOWS\System32\wmicvrt.exe not found.
C:\WINDOWS\System32\drivers\usbf27.sys moved successfully.
C:\WINDOWS\System32\CddbCdda.dll moved successfully.
File\Folder C:\Documents and Settings\Delachron\iemst.exe not found.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\\%windir%\system32\drivers\svchost.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\\C:\WINDOWS\system32\wmicvrt.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\\C:\Program Files\Soulseek\slsk.exe not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\\C:\Documents and Settings\Delachron\iemst.exe not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\\C:\WINDOWS\system32\blew.exe not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\\%windir%\system32\drivers\svchost.exe not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\\C:\WINDOWS\system32\wmicvrt.exe not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Delachron
->Temp folder emptied: 102562413 bytes
->Temporary Internet Files folder emptied: 144772839 bytes
->Flash cache emptied: 29133 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 672079 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 3304210 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 1119633 bytes
%systemroot%\System32 .tmp files removed: 2855 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2411524 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 243,00 mb


[EMPTYFLASH]

User: All Users

User: Default User

User: Delachron
->Flash cache emptied: 0 bytes

User: LocalService

User: NetworkService

Total Flash Files Cleaned = 0,00 mb

Restore points cleared and new OTL Restore Point set!
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.1.37.3 log created on 03192010_224012

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

1:Keves a RAM 256MB
2:A geped tele van Keylogeral ,trojaval,,es megvan hekkelve
3:Pontosan csinald amit irokk.

1:Szed le a Geprol a vezerlo pulton keresztul a Kaspersky Anti-Virus 2010
2:Futtasd ujbol az OTL programot-az ablakjaba CUSTOMSCAN/FIXES.masold be a kek textet amit ide teszek es klik RUNFIX-hagyd lefutni a programot es restartolja a gepet,,a restart utan add logot tedd ide.

:OTL
DRV - [2010.03.18 14:56:12 | 000,040,128 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\vtiqrdbd.sys -- (vtiqrdbd)
DRV - [2010.03.18 01:55:24 | 000,040,128 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\qwuiaimm.sys -- (qwuiaimm)
O20 - HKLM Winlogon: Shell - (wrdr.kuo) - File not found
O20 - HKLM Winlogon: Shell - (gxsad) - File not found
O27 - HKLM IFEO\ctfmon.exe: Debugger - wmicvrt.exe ()
O36 - AppCertDlls: AppSecDll - (C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Windows Server\kfqsmr.dll) - C:\WINDOWS\System32\config\systemprofile\Local Settings\Application Data\Windows Server\kfqsmr.dll File not found
:files
C:\WINDOWS\System32\drivers\vtiqrdbd.sys
C:\WINDOWS\System32\drivers\qwuiaimm.sys
C:\Documents and Settings\Delachron\secupdat.dat
C:\WINDOWS\System32\secupdat.dat
C:\WINDOWS\System32\wmicvrt.exe
C:\WINDOWS\System32\drivers\usbf27.sys
C:\WINDOWS\System32\CddbCdda.dll
C:\Documents and Settings\Delachron\iemst.exe
:reg
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\drivers\svchost.exe"=-
"C:\WINDOWS\system32\wmicvrt.exe"=-
"C:\Program Files\Soulseek\slsk.exe"=-
"C:\Documents and Settings\Delachron\iemst.exe"=-
"C:\WINDOWS\system32\blew.exe"=-
"%windir%\system32\drivers\svchost.exe"=-
"C:\WINDOWS\system32\wmicvrt.exe"=-
:commands
[emptytemp]
[emptyflash]
[ClearAllRestorePoints]
[resethosts]
[start explorer]
[Reboot]

Többször megszakad a net, miután ez az üzenet megjelenik:

"A Generic Host Process for Win32 Services hibát észlelt ezért leáll"

Ez is a vírusok műve lehet?

Bocs, hogy ilyen lassú vagyok de kegyetlenül fagyogat a gép meg néha újra is indu.

XP Professional SP2-vel a rendszerem.

OTL.txt

OTL logfile created on: 2010.03.19. 20:03:24 - Run 1
OTL by OldTimer - Version 3.1.37.3 Folder = E:\Zenei infók\'10 Marcius 11
Windows XP Professional Edition Szervizcsomag 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 0000040E | Country: Magyarország | Language: HUN | Date Format: yyyy.MM.dd.

256,00 Mb Total Physical Memory | 38,00 Mb Available Physical Memory | 15,00% Memory free
619,00 Mb Paging File | 400,00 Mb Available in Paging File | 65,00% Paging File free
Paging file location(s): C:\pagefile.sys 384 768 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 13,99 Gb Total Space | 0,29 Gb Free Space | 2,10% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 37,27 Gb Total Space | 0,22 Gb Free Space | 0,58% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: DELACHRO-JTBJ6Z
Current User Name: Delachron
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 7 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2020.03.18 18:20:34 | 000,555,520 | ---- | M] (OldTimer Tools) -- E:\Zenei infók\'10 Marcius 11\OTL.exe
PRC - [2009.10.20 19:39:28 | 000,340,456 | ---- | M] (Kaspersky Lab) -- C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe
PRC - [2009.10.20 19:34:38 | 000,207,376 | ---- | M] (Kaspersky Lab) -- C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtblfs.exe
PRC - [2007.12.10 12:59:04 | 000,353,280 | ---- | M] (Nokia.) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
PRC - [2004.08.17 15:47:58 | 001,034,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2003.04.02 03:20:37 | 000,012,288 | ---- | M] () -- C:\Program Files\Winamp\winampa.exe


========== Modules (SafeList) ==========

MOD - [2020.03.18 18:20:34 | 000,555,520 | ---- | M] (OldTimer Tools) -- E:\Zenei infók\'10 Marcius 11\OTL.exe
MOD - [2004.08.17 15:42:00 | 001,050,624 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- -- (avast! Antivirus)
SRV - [2009.10.20 19:39:28 | 000,340,456 | ---- | M] (Kaspersky Lab) [Auto | Running] -- C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe -- (AVP)
SRV - [2007.12.10 12:59:04 | 000,353,280 | ---- | M] (Nokia.) [On_Demand | Running] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)


========== Driver Services (SafeList) ==========

DRV - [2010.03.19 01:10:31 | 000,315,408 | ---- | M] (Kaspersky Lab) [File_System | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\klif.sys -- (KLIF)
DRV - [2010.03.18 14:56:12 | 000,040,128 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\vtiqrdbd.sys -- (vtiqrdbd)
DRV - [2010.03.18 01:55:24 | 000,040,128 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\qwuiaimm.sys -- (qwuiaimm)
DRV - [2010.03.11 16:32:36 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)
DRV - [2010.01.07 16:07:14 | 000,038,224 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV - [2009.10.14 20:18:34 | 000,036,880 | ---- | M] (Kaspersky Lab) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\klbg.sys -- (klbg)
DRV - [2009.10.02 18:39:44 | 000,019,472 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\klmouflt.sys -- (klmouflt)
DRV - [2009.09.14 13:42:46 | 000,032,272 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\klim5.sys -- (klim5)
DRV - [2009.09.01 14:29:50 | 000,128,016 | ---- | M] (Kaspersky Lab) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\kl1.sys -- (kl1)
DRV - [2007.02.22 09:15:56 | 000,137,216 | ---- | M] (Nokia) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\nmwcd.sys -- (nmwcd)
DRV - [2007.02.22 09:15:14 | 000,012,288 | ---- | M] (Nokia) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\nmwcdcm.sys -- (nmwcdcm)
DRV - [2007.02.22 09:15:14 | 000,008,320 | ---- | M] (Nokia) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\nmwcdc.sys -- (nmwcdc)
DRV - [2004.08.03 22:08:22 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\gameenum.sys -- (gameenum)
DRV - [2004.08.03 21:29:56 | 001,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\nv4_mini.sys -- (nv)
DRV - [2001.10.26 20:46:18 | 000,009,472 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\NtApm.sys -- (NtApm)
DRV - [2001.10.26 19:28:42 | 000,070,528 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\atiragem.sys -- (atirage)
DRV - [2001.08.17 21:20:18 | 000,334,208 | ---- | M] (Yamaha Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\ds1wdm.sys -- (ds1) Yamaha DS1 audio-illesztőprogram (WDM)
DRV - [2001.08.17 21:19:56 | 000,063,360 | ---- | M] (ESS Technology, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\ess.sys -- (ess) ESS audio-illesztőprogram (WDM)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60327
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60327


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-220523388-1993962763-854245398-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-21-220523388-1993962763-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird


O1 HOSTS File: ([2010.03.18 00:39:18 | 004,829,352 | ---- | M]) - C:\WINDOWS\SYSTEM32\DRIVERS\etc\hosts
O1 - Hosts: 96.205.30.144 msnfix.changelog.fr
O1 - Hosts: 96.205.30.144 www.incodesolutions.com
O1 - Hosts: 96.205.30.144 virusinfo.prevx.com
O1 - Hosts: 96.205.30.144 download.bleepingcomputer.com
O1 - Hosts: 96.205.30.144 www.dazhizhu.cn
O1 - Hosts: 96.205.30.144 foro.noticias3d.com
O1 - Hosts: 96.205.30.144 www.spybotupdates.com
O1 - Hosts: 96.205.30.144 club.myce.com
O1 - Hosts: 96.205.30.144 www.k7computing.com
O1 - Hosts: 96.205.30.144 softwaresecuritysolutions.com
O1 - Hosts: 96.205.30.144 www.nabble.com
O1 - Hosts: 96.205.30.144 lurker.clamav.net
O1 - Hosts: 96.205.30.144 lexikon.ikarus.at
O1 - Hosts: 96.205.30.144 research.sunbelt-software.com
O1 - Hosts: 96.205.30.144 www.virusdoctor.jp
O1 - Hosts: 96.205.30.144 www.elitepvpers.de
O1 - Hosts: 96.205.30.144 guru.avg.com
O1 - Hosts: 96.205.30.144 downloads.sophos.com
O1 - Hosts: 96.205.30.144 share.skype.com
O1 - Hosts: 96.205.30.144 myantispyware.com
O1 - Hosts: 96.205.30.144 www.computerhilfen.de
O1 - Hosts: 96.205.30.144 www.superuser.co.kr
O1 - Hosts: 96.205.30.144 ntfaq.co.kr
O1 - Hosts: 96.205.30.144 v.dreamwiz.com
O1 - Hosts: 96.205.30.144 cit.kookmin.ac.kr
O1 - Hosts: 16356 more lines...
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\ievkbd.dll (Kaspersky Lab)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll (Kaspersky Lab)
O3 - HKU\S-1-5-21-220523388-1993962763-854245398-1003\..\Toolbar\WebBrowser: (no name) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No CLSID value found.
O4 - HKLM..\Run: [AVP] C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe (Kaspersky Lab)
O4 - HKLM..\Run: [Internet Connection Wizard Setup Tool] C:\Program Files\Internet Explorer\Connection Wizard\icwsetup.exe ()
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\SYSTEM32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\Winampa.exe ()
O4 - HKU\.DEFAULT..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe (Time Information Services Ltd.)
O4 - HKU\S-1-5-18..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe (Time Information Services Ltd.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Indítópult\Adobe Reader gyorsindító.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-220523388-1993962763-854245398-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: &Virtuális billentyűzet - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll (Kaspersky Lab)
O9 - Extra Button: URL-ek &ellenőrzése - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll (Kaspersky Lab)
O15 - HKU\S-1-5-21-220523388-1993962763-854245398-1003\..Trusted Domains: ([]msn in Sajátgép)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shoc ... wflash.cab (Shockwave Flash Object)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll) - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\mzvkbd3.dll (Kaspersky Lab)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (rundll32.exe) - File not found
O20 - HKLM Winlogon: Shell - (wrdr.kuo) - File not found
O20 - HKLM Winlogon: Shell - (gxsad) - File not found
O20 - Winlogon\Notify\klogon: DllName - C:\WINDOWS\system32\klogon.dll - C:\WINDOWS\SYSTEM32\klogon.dll (Kaspersky Lab)
O24 - Desktop Components:0 (Jelenlegi saját honlap) - About:Home
O27 - HKLM IFEO\ctfmon.exe: Debugger - wmicvrt.exe ()
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008.05.21 17:28:02 | 000,000,133 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{b6a3b651-276f-11dd-94ba-a968755f6a3b}\Shell - "" = AutoRun
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O36 - AppCertDlls: AppSecDll - (C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Windows Server\kfqsmr.dll) - C:\WINDOWS\System32\config\systemprofile\Local Settings\Application Data\Windows Server\kfqsmr.dll File not found
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 7 Days ==========

[2010.03.19 18:51:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Windows Server
[2010.03.19 18:51:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Windows Server
[2010.03.19 16:49:41 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.03.19 16:49:32 | 000,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.03.19 16:49:31 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010.03.19 01:12:52 | 000,000,000 | ---D | C] -- C:\Program Files\Kaspersky Lab
[2010.03.19 01:12:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
[2010.03.19 01:10:31 | 000,315,408 | ---- | C] (Kaspersky Lab) -- C:\WINDOWS\System32\drivers\klif.sys
[2010.03.18 22:09:06 | 000,000,000 | ---D | C] -- C:\Program Files\VirusBuster
[2010.03.18 19:43:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
[2010.03.18 14:45:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Delachron\Local Settings\Application Data\ESET
[2010.03.18 14:39:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\ESET
[2010.03.17 23:38:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Avira
[2010.03.17 23:13:58 | 000,000,000 | ---D | C] -- C:\Program Files\ATS2
[2010.03.17 19:56:45 | 000,000,000 | ---D | C] -- C:\TEMP
[2010.03.17 17:29:13 | 000,000,000 | ---D | C] -- C:\Program Files\Alwil Software
[2010.03.17 17:09:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Delachron\Application Data\SUPERAntiSpyware.com
[2008.05.21 19:26:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2008.05.21 17:24:33 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft
[2008.05.21 17:24:32 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2008.05.21 17:24:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 7 Days ==========

[2010.03.19 20:02:03 | 000,000,584 | ---- | M] () -- C:\Documents and Settings\Delachron\Asztal\Parancsikon - OTL.lnk
[2010.03.19 19:46:30 | 011,796,480 | ---- | M] () -- C:\Documents and Settings\Delachron\ntuser.dat
[2010.03.19 19:39:52 | 000,002,341 | ---- | M] () -- C:\Documents and Settings\All Users\Asztal\Nokia PC Suite.lnk
[2010.03.19 19:12:39 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.03.19 19:12:26 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.03.19 19:12:22 | 268,017,664 | -HS- | M] () -- C:\hiberfil.sys
[2010.03.19 18:49:52 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Delachron\ntuser.ini
[2010.03.19 16:49:45 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Asztal\Malwarebytes' Anti-Malware.lnk
[2010.03.19 15:47:21 | 000,000,132 | ---- | M] () -- C:\WINDOWS\winamp.ini
[2010.03.19 13:54:36 | 000,052,736 | ---- | M] () -- C:\WINDOWS\System32\drivers\usbf27.sys
[2010.03.19 12:54:19 | 000,000,544 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\mul.bin
[2010.03.19 01:21:04 | 000,108,059 | ---- | M] () -- C:\WINDOWS\System32\drivers\klin.dat
[2010.03.19 01:21:03 | 000,095,259 | ---- | M] () -- C:\WINDOWS\System32\drivers\klick.dat
[2010.03.19 01:10:31 | 000,315,408 | ---- | M] (Kaspersky Lab) -- C:\WINDOWS\System32\drivers\klif.sys
[2010.03.18 23:26:21 | 000,097,456 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010.03.18 14:56:12 | 000,040,128 | ---- | M] () -- C:\WINDOWS\System32\drivers\vtiqrdbd.sys
[2010.03.18 01:55:24 | 000,040,128 | ---- | M] () -- C:\WINDOWS\System32\drivers\qwuiaimm.sys
[2010.03.18 00:55:04 | 000,044,032 | -H-- | M] () -- C:\WINDOWS\System32\secupdat.dat
[2010.03.18 00:55:04 | 000,044,032 | -H-- | M] () -- C:\Documents and Settings\Delachron\secupdat.dat
[2010.03.18 00:47:14 | 000,002,855 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2010.03.17 22:05:24 | 000,014,336 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\svchost.exe
[2010.03.17 16:29:13 | 000,245,760 | RHS- | M] () -- C:\WINDOWS\System32\wmicvrt.exe
[2010.03.16 20:52:48 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2010.03.16 20:50:51 | 000,180,736 | ---- | M] () -- C:\Documents and Settings\Delachron\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.03.15 18:01:27 | 000,003,526 | ---- | M] () -- C:\WINDOWS\wincmd.ini
[2010.03.13 14:38:21 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010.03.19 20:02:02 | 000,000,584 | ---- | C] () -- C:\Documents and Settings\Delachron\Asztal\Parancsikon - OTL.lnk
[2010.03.19 16:49:45 | 000,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Asztal\Malwarebytes' Anti-Malware.lnk
[2010.03.19 01:21:04 | 000,108,059 | ---- | C] () -- C:\WINDOWS\System32\drivers\klin.dat
[2010.03.19 01:21:03 | 000,095,259 | ---- | C] () -- C:\WINDOWS\System32\drivers\klick.dat
[2010.03.18 14:56:12 | 000,040,128 | ---- | C] () -- C:\WINDOWS\System32\drivers\vtiqrdbd.sys
[2010.03.18 01:55:24 | 000,040,128 | ---- | C] () -- C:\WINDOWS\System32\drivers\qwuiaimm.sys
[2010.03.18 00:55:04 | 000,044,032 | -H-- | C] () -- C:\Documents and Settings\Delachron\secupdat.dat
[2010.03.17 23:45:57 | 000,044,032 | -H-- | C] () -- C:\WINDOWS\System32\secupdat.dat
[2010.03.17 17:49:12 | 000,052,736 | ---- | C] () -- C:\WINDOWS\System32\drivers\usbf27.sys
[2010.03.17 16:44:57 | 000,000,544 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\mul.bin
[2010.03.17 16:42:47 | 000,001,757 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\Microsoft\Shortcuts\Adobe Reader gyorsindító.lnk
[2010.03.17 16:29:24 | 000,245,760 | RHS- | C] () -- C:\WINDOWS\System32\wmicvrt.exe
[2010.03.11 16:32:33 | 000,691,696 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2010.03.09 20:00:47 | 000,484,352 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll
[2009.07.12 23:23:02 | 000,002,119 | ---- | C] () -- C:\Documents and Settings\Delachron\Application Data\5eT7WQpJat.gif
[2009.07.12 23:23:02 | 000,000,607 | ---- | C] () -- C:\Documents and Settings\Delachron\Application Data\5eT7WQpJzn.gif
[2009.07.12 23:23:02 | 000,000,598 | ---- | C] () -- C:\Documents and Settings\Delachron\Application Data\5eT7WQpJby.gif
[2009.01.16 15:00:49 | 000,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.INI
[2008.05.26 00:41:05 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
[2008.05.22 17:42:19 | 000,003,526 | ---- | C] () -- C:\WINDOWS\wincmd.ini
[2008.05.21 20:27:12 | 000,180,736 | ---- | C] () -- C:\Documents and Settings\Delachron\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.05.21 20:20:26 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2008.05.21 20:17:38 | 000,164,352 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2008.05.21 20:17:27 | 002,085,376 | ---- | C] () -- C:\WINDOWS\System32\x264vfw.dll
[2008.05.21 20:17:26 | 000,755,027 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2008.05.21 20:17:26 | 000,159,839 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2008.05.21 20:17:24 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2008.05.21 20:17:20 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2008.05.21 20:17:20 | 000,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
[2008.05.21 19:32:13 | 000,000,132 | ---- | C] () -- C:\WINDOWS\winamp.ini
[2008.05.21 18:46:58 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll
[2008.05.21 18:33:26 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys
[2008.05.21 17:26:22 | 000,011,231 | -H-- | C] () -- C:\Program Files\folder.htt
[2007.03.29 22:00:40 | 000,203,264 | R--- | C] () -- C:\WINDOWS\System32\CddbCdda.dll

========== LOP Check ==========

[2010.03.11 16:30:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Lite
[2010.03.18 14:39:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ESET
[2008.05.28 16:17:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Installations
[2010.02.20 19:34:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PC Suite
[2010.03.03 18:52:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Delachron\Application Data\avidemux
[2010.03.11 16:42:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Delachron\Application Data\DAEMON Tools Lite
[2010.02.18 22:09:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Delachron\Application Data\Desktopicon
[2010.03.09 20:00:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Delachron\Application Data\FreeAudioPack
[2008.10.03 17:23:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Delachron\Application Data\HTML Executable
[2009.08.01 20:52:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Delachron\Application Data\Nokia
[2010.02.21 20:54:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Delachron\Application Data\Nokia Multimedia Player
[2010.02.20 19:35:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Delachron\Application Data\PC Suite
[2008.09.05 23:01:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Delachron\Application Data\Thinstall

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 390184 bytes -> C:\WINDOWS\TEMP:temp
@Alternate Data Stream - 35328 bytes -> C:\WINDOWS\System32\svchost.exe:exe.exe
< End of report >

EXTRAS.txt

OTL Extras logfile created on: 2010.03.19. 20:03:25 - Run 1
OTL by OldTimer - Version 3.1.37.3 Folder = E:\Zenei infók\'10 Marcius 11
Windows XP Professional Edition Szervizcsomag 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 0000040E | Country: Magyarország | Language: HUN | Date Format: yyyy.MM.dd.

256,00 Mb Total Physical Memory | 38,00 Mb Available Physical Memory | 15,00% Memory free
619,00 Mb Paging File | 400,00 Mb Available in Paging File | 65,00% Paging File free
Paging file location(s): C:\pagefile.sys 384 768 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 13,99 Gb Total Space | 0,29 Gb Free Space | 2,10% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 37,27 Gb Total Space | 0,22 Gb Free Space | 0,58% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: DELACHRO-JTBJ6Z
Current User Name: Delachron
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 7 Days
Output = Standard

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\Winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\Winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\Winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1
"" =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"2130:TCP" = 2130:TCP:*:Enabled:exxoqozp

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\drivers\svchost.exe" = %windir%\system32\drivers\svchost.exe:*:Enabled:svchost -- File not found
"C:\WINDOWS\system32\wmicvrt.exe" = C:\WINDOWS\system32\wmicvrt.exe:*:Enabled:DHCP Router -- ()

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Soulseek\slsk.exe" = C:\Program Files\Soulseek\slsk.exe:*:Enabled:SoulSeek -- ()
"C:\Documents and Settings\Delachron\iemst.exe" = C:\Documents and Settings\Delachron\iemst.exe:*:Enabled:ENABLE -- File not found
"C:\WINDOWS\system32\blew.exe" = C:\WINDOWS\system32\blew.exe:*:Enabled:ENABLE -- File not found
"C:\WINDOWS\explorer.exe" = C:\WINDOWS\explorer.exe:*:Enabled:Windows Explorer -- (Microsoft Corporation)
"%windir%\system32\drivers\svchost.exe" = %windir%\system32\drivers\svchost.exe:*:Enabled:svchost -- File not found
"c:\program files\relevantknowledge\rlvknlg.exe" = c:\program files\relevantknowledge\rlvknlg.exe:*:Enabled:rlvknlg.exe -- File not found
"C:\WINDOWS\system32\wmicvrt.exe" = C:\WINDOWS\system32\wmicvrt.exe:*:Enabled:DHCP Router -- ()


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0A3D3C54-2EC0-4D67-B265-FF17926E6D67}" = Nokia Connectivity Cable Driver
"{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}" = YouTube Downloader 2.5.3
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{29466F9C-7C6A-419C-B301-F440FAF78760}" = Nokia PC Suite
"{350C940e-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{943B6738-4801-4982-90EC-0442EF7AEB16}" = Kaspersky Anti-Virus 2010
"{968CB479-6163-415F-A9D3-4489BF07DAFF}" = Sonic Foundry Sound Forge 6.0b
"{AC76BA86-7AD7-1038-7B44-A70500000002}" = Adobe Reader 7.0.5 - Hungarian
"{BA084E7C-8ABA-4670-BDE8-B85E689A5C1B}" = PC Connectivity Solution
"{F2A4D775-E5A2-4BE1-88D8-598EE4868F32}" = Magyar posta- és illetékbélyeg katalógus 2009.
"6A630DCEC5EEC912115F2FF59D8C2C769798D930" = Windows illesztőprogram-csomag - Nokia Modem (10/12/2007 3.6)
"819D45A9F73817F5B6D7C71A33ADAB88C5DA1765" = Windows illesztőprogram-csomag - Nokia Modem (08/03/2007 6.84.0.2)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"CDex" = CDex extraction audio
"eBay Icon" = eBay Icon
"EVEREST Ultimate Edition_is1" = EVEREST Ultimate Edition v4.60
"Free Mp3 Wma Converter_is1" = Free Mp3 Wma Converter V 1.9
"InstallWIX_{943B6738-4801-4982-90EC-0442EF7AEB16}" = Kaspersky Anti-Virus 2010
"KLiteCodecPack_is1" = K-Lite Codec Pack 3.8.5 Full
"Magic Video Converter_is1" = Magic Video Converter Trial Version (English) 8.0.2.18
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Native Instruments - Traktor 1.06" = Native Instruments - Traktor 1.06
"Nero - Burning Rom!UninstallKey" = Nero 6 Ultra Edition
"Nokia PC Suite" = Nokia PC Suite
"Reason 1.0" = Reason 1.0
"Soulseek" = SoulSeek Client 156c
"Totalcmd" = Total Commander (Remove or Repair)
"Winamp" = Winamp (remove only)
"WinAVI Video Converter_is1" = WinAVI Video Converter
"Windows XP Service Pack" = Windows XP Service Pack 2
"WinRAR archiver" = WinRAR archiváló

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 2010.03.18. 18:35:41 | Computer Name = DELACHRO-JTBJ6Z | Source = Application Error | ID = 1000
Description = Hibás alkalmazás: 517948877exe, verzió: 0.0.0.0, hibás modul: 517948877exe,
verzió: 0.0.0.0, memóriacím: 0x00003ec8.

Error - 2010.03.18. 19:11:15 | Computer Name = DELACHRO-JTBJ6Z | Source = Application Error | ID = 1000
Description = Hibás alkalmazás: 1355064587exe.1352, verzió: 0.0.0.0, hibás modul:
1355064587exe.1352, verzió: 0.0.0.0, memóriacím: 0x00003ec8.

Error - 2010.03.19. 7:40:22 | Computer Name = DELACHRO-JTBJ6Z | Source = Application Error | ID = 1000
Description = Hibás alkalmazás: iexplore.exe, verzió: 6.0.2900.2180, hibás modul:
mshtml.dll, verzió: 6.0.2900.2180, memóriacím: 0x0012bd68.

Error - 2010.03.19. 8:00:58 | Computer Name = DELACHRO-JTBJ6Z | Source = Application Error | ID = 1000
Description = Hibás alkalmazás: 910942279exe, verzió: 0.0.0.0, hibás modul: 910942279exe,
verzió: 0.0.0.0, memóriacím: 0x00003ec8.

Error - 2010.03.19. 9:26:18 | Computer Name = DELACHRO-JTBJ6Z | Source = Application Hang | ID = 1002
Description = Nem válaszoló alkalmazás: iexplore.exe, verzió: 6.0.2900.2180, nem
válaszoló modul: hungapp, verzió: 0.0.0.0, memóriacím: 0x00000000.

Error - 2010.03.19. 10:47:01 | Computer Name = DELACHRO-JTBJ6Z | Source = Application Error | ID = 1000
Description = Hibás alkalmazás: iexplore.exe, verzió: 6.0.2900.2180, hibás modul:
mshtml.dll, verzió: 6.0.2900.2180, memóriacím: 0x0012bd68.

Error - 2010.03.19. 12:21:13 | Computer Name = DELACHRO-JTBJ6Z | Source = Application Error | ID = 1000
Description = Hibás alkalmazás: 852977374exe, verzió: 0.0.0.0, hibás modul: 852977374exe,
verzió: 0.0.0.0, memóriacím: 0x00003ec8.

Error - 2010.03.19. 14:02:28 | Computer Name = DELACHRO-JTBJ6Z | Source = Application Error | ID = 1000
Description = Hibás alkalmazás: 2122579466exe, verzió: 0.0.0.0, hibás modul: 2122579466exe,
verzió: 0.0.0.0, memóriacím: 0x00003ec8.

Error - 2010.03.19. 14:07:37 | Computer Name = DELACHRO-JTBJ6Z | Source = Application Error | ID = 1000
Description = Hibás alkalmazás: svchost.exe, verzió: 5.1.2600.2180, hibás modul:
unknown, verzió: 0.0.0.0, memóriacím: 0x001f1cb0.

Error - 2010.03.19. 14:18:53 | Computer Name = DELACHRO-JTBJ6Z | Source = Application Hang | ID = 1002
Description = Nem válaszoló alkalmazás: iexplore.exe, verzió: 6.0.2900.2180, nem
válaszoló modul: hungapp, verzió: 0.0.0.0, memóriacím: 0x00000000.

[ System Events ]
Error - 2010.03.19. 13:54:00 | Computer Name = DELACHRO-JTBJ6Z | Source = Service Control Manager | ID = 7000
Description = A szolgáltatás (Alkalmazási réteg átjárószolgáltatása) a következő
hiba következtében leállt: %%1053

Error - 2010.03.19. 14:13:16 | Computer Name = DELACHRO-JTBJ6Z | Source = Service Control Manager | ID = 7003
Description = A(z) avast! Antivirus szolgáltatás a következő, nem létező szolgáltatástól
függ: aswMon2

Error - 2010.03.19. 14:13:16 | Computer Name = DELACHRO-JTBJ6Z | Source = Service Control Manager | ID = 7023
Description = A szolgáltatás (Center Manager) leállt a következő hibával: %%126

Error - 2010.03.19. 14:13:16 | Computer Name = DELACHRO-JTBJ6Z | Source = Service Control Manager | ID = 7009
Description = Várakozó időkorlát (30000 ms) - a(z) ICF szolgáltatás kapcsolódása.

Error - 2010.03.19. 14:13:16 | Computer Name = DELACHRO-JTBJ6Z | Source = Service Control Manager | ID = 7000
Description = A szolgáltatás (ICF) a következő hiba következtében leállt: %%1053

Error - 2010.03.19. 14:13:16 | Computer Name = DELACHRO-JTBJ6Z | Source = Service Control Manager | ID = 7023
Description = A szolgáltatás (Monitor Security) leállt a következő hibával: %%126

Error - 2010.03.19. 14:13:16 | Computer Name = DELACHRO-JTBJ6Z | Source = Service Control Manager | ID = 7023
Description = A szolgáltatás (Config System) leállt a következő hibával: %%126

Error - 2010.03.19. 14:21:17 | Computer Name = DELACHRO-JTBJ6Z | Source = Service Control Manager | ID = 7031
Description = A(z) Kaspersky Anti-Virus szolgáltatás váratlanul leállt. Ez a(z)
1. alkalommal fordult elő. 0 milliszekundumon belül a következő ellenintézkedés
történik: A szolgáltatás újraindítása.

Error - 2010.03.19. 14:21:23 | Computer Name = DELACHRO-JTBJ6Z | Source = Service Control Manager | ID = 7031
Description = A(z) Kaspersky Anti-Virus szolgáltatás váratlanul leállt. Ez a(z)
1. alkalommal fordult elő. 0 milliszekundumon belül a következő ellenintézkedés
történik: A szolgáltatás újraindítása.

Error - 2010.03.19. 14:21:37 | Computer Name = DELACHRO-JTBJ6Z | Source = Service Control Manager | ID = 7031
Description = A(z) Kaspersky Anti-Virus szolgáltatás váratlanul leállt. Ez a(z)
1. alkalommal fordult elő. 0 milliszekundumon belül a következő ellenintézkedés
történik: A szolgáltatás újraindítása.


< End of report >

igen futtasd,,mijen rendszer van egyaltalan a gepeden??

Letölteni nem ment, de letöltöttem telóra és felmásoltam a PC-re. Viszont a RSIT.exe ismeretlen kiterjesztésű. Akkor futtatom zaz OTL-t.

Letolteni az asztalra>OTListIt2>> http://oldtimer.geekstogo.com/OTL.exe
-Futatni
- file age at valtoztani 30 > 7day ra.
-bepipazni
-Scan all users.
-Lop check.
-Purity check.
-v sekciobaExtra Registry>bepotyozni>Use SafeList
-KLIK>Run Scan
-scan t [5-10 perc mulva kesz]>ted a hozaszolasodba >>
-OTL.txt (az asztalon lesz).

,Ne csinalj masat csakk amit irok:
mi nem megy letolteni??vagy futtatni.

Most sem megy, cél mentésével sem.
Közben letöltöttem és frisítettem a Malwarebytes Anti-Malware progit. Feltelepítettem, majd az XP-t csökkentett módban akartam indítani, hogy majd úgy futtatom a Malware-t. Viszont, miközben indulna a csökkentett mód, a gép újraindul állandóan. Szóval nagy itt a ****.