Most már jobb,de igazából én még mindig nem értek valamit.
Ez a játék több mint fél éve fenn van a gépen a kisfiam kedvence,de eddig soha egyik vírusvizsgálat sem
jelezte pedig veled is csináltunk már egy párat.Mindenesetre én most törlöm az egész játékot az a biztos
Ne haragudj hogy ennyit kérdezek csak kicsit furának tartom ,bár tudom ez nem jelent semmit hiszen én nem értek ezekhez
a dolgokhoz.
Még valami: a karanténba tett dolgokat is törölhetem?
C:\Program Files\Common Files Erről például azt sem tudom mi célt szolgál?

Igen, az a Trojas ize, karantenban van, es igy bevan csukva zarva, lakat alat van, es igy nem csinalhat semmit se.
Tehat mar igy nincsen virus, most mi van jobb e a gep, vagy mindig lassu, ha lassu akkor mi lassu??, az bongeszses.??

szia!
Az a trojas izé akkor jólvan így a karanténban?
Az nem vírus? ezt nem értem!

duga

Csinald csokkentet modban, ez olyan 20-30 perc maximum, ha tovabb tart akkor irni.


évi67
Van meg problem, ??mert Virust nem latok.

gondoltam szólok,hogy van egy kis változás.
lefuttattam a blogodról a DoctorWeb programot a következőt dobta:
nem teszem ide az egészet csak a lényeget.
-----------------------------------------------------------------------------
Ellenőrzés eredménye
-----------------------------------------------------------------------------
Ellenőrzött: 235211
Fertőzött: 1
Módosított: 0
Gyanús: 0
Reklám: 1
Telefonáló: 0
Megtévesztő: 0
Kockázatos: 0
Behatoló-program: 0
Helyreállítva: 0
Törölve: 0
Átnevezve: 0
Áthelyezve: 1
Kihagyva: 0
Ellenőrzés sebessége: 151 Kb/s
Ellenőrzés ideje: 2:58:20
-----------------------------------------------------------------------------

C:\Program Files\Common Files\Sandlot Shared\slghex.dll - áthelyezve

=============================================================================
Teljes vizsgálat statisztikája
=============================================================================
Ellenőrzött: 256366
Fertőzött: 1
Módosított: 0
Gyanús: 0
Reklám: 1
Telefonáló: 0
Megtévesztő: 0
Kockázatos: 0
Behatoló-program: 0
Helyreállítva: 0
Törölve: 0
Átnevezve: 0
Áthelyezve: 2
Kihagyva: 0
Ellenőrzés sebessége: 79 Kb/s
Ellenőrzés ideje: 3:39:55
=============================================================================
C:\Program Files\Oberon Media\Zoo Tycoon 2 - Dino Danger Pack Installer\setup.exe fertőzött, vírus neve: Trojan.Inject.13951 - helyreállíthatatlan - áthelyezve
Csak karanténba tettem,hogy lásd,most hogyan tovább?

Tegnap elkezdtem amit írtál, el is indult a Combofix, még ma délben is ment, míg el nem ment az áram..
Elindítsam újra? Ilyen hosszú ideig megy amúgy nem baj?
Korai volt az öröm tegnap, alig indult a Windows és lassabb a net is megint.

Logfile of random's system information tool 1.06 (written by random/random)
Run by Évi at 2012-01-09 18:41:26
Microsoft Windows XP Professional Szervizcsomag 3
System drive C: has 41 GB (54%) free of 76 GB
Total RAM: 511 MB (50% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:41:45, on 2012.01.09.
Platform: Windows XP Szervizcsomag 3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Windows Live\Family Safety\fsssvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\PC Tools Firewall Plus\FWService.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\Évi\Asztal\vírus\RSIT.exe
C:\Program Files\trend micro\Évi.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hivatkozások
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Increase performance and video formats for your HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll
O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Windows Live bejelentkezési segítség - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [00PCTFW] "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O8 - Extra context menu item: E&xportálás Microsoft Excel formátumba - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint – Gyors nyomtatás - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint – Hozzáadás a nyomtatási listához - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint – Nyomtatás - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint – Nyomtatási kép - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
O9 - Extra button: Küldés blogba - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Küldés blogba a Windows Live Writer programmal - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Kutatás - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {226ACC34-3194-40E2-9AE8-834FCFE9E80D} (CPlayFirstmsiControl Object) - http://games.bigfishgames.com/en_myster ... .0.0.8.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4DCA1E08-4147-4A3D-8CA6-E095DF189FAB} (CPlayFirstNightshiftControl Object) - http://games.bigfishgames.com/en_nights ... .0.0.9.cab
O16 - DPF: {8FA2192F-B95D-40E3-898F-8D7ABB8E00D0} (SpinTop Games Launcher) - http://games.bigfishgames.com/en_myster ... uncher.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:\Program Files\PC Tools Firewall Plus\FWService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 7535 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{326E768D-4182-46FD-9C16-1449A49795F4}]
DivX Plus Web Player HTML5 <video> - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll [2011-12-12 194432]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4f3ed5cd-0726-42a9-87f5-d13f3d2976ac}]
Windows Live Family Safety Browser Helper Class - C:\Program Files\Windows Live\Family Safety\fssbho.dll [2010-04-28 113512]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{68F9551E-0411-48E4-9AAF-4BC42A6A46BE}]
EWPBrowseObject Class - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll [2006-04-18 34304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
Search Helper - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll [2010-07-27 191792]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2011-11-28 809040]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live bejelentkezési segítség - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17 408440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-04-10 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]
Windows Live Toolbar Helper - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2010-04-16 1067872]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-04-10 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{327C2873-E90D-4c37-AA9D-10AC9BABA46C} - Easy-WebPrint - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll [2006-04-18 552960]
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2011-11-28 809040]
{21FA44EF-376D-4D53-9B0F-8A89D3229068} - &Windows Live Toolbar - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2010-04-16 1067872]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"00PCTFW"=C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe [2011-04-07 2672600]
"avast"=C:\Program Files\AVAST Software\Avast\avastUI.exe [2011-11-28 3744552]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2011-09-07 37296]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\aswAhAScr.dll]
C:\Program Files\AVAST Software\Avast\aswRegSvr.exe [2011-04-18 22016]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe [2006-01-02 45056]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Device Detection]
C:\Program Files\FUJIFILM\MyFinePix Studio\dd.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
C:\Program Files\DivX\DivX Update\DivXUpdate.exe [2011-07-29 1259376]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FlashPlayerUpdate]
C:\WINDOWS\system32\Macromed\Flash\FlashUtil10x_Plugin.exe -update plugin []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpwareSE4]
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe [2006-03-21 69632]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask.exe [2009-11-10 417792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Évi^Start Menu^Programs^Indítópult^Ubisoft register.lnk]
C:\PROGRA~1\Ubisoft\Register\schedule.exe [2003-10-27 28672]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2006-05-03 61440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxsrvc.dll [2003-03-11 315392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\wpdshserviceobj.dll [2008-04-16 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"HideFastUserSwitching"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoSMMyDocs"=1
"NoSMMyPictures"=1
"NoSMConfigurePrograms"=1
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"="C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"="C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync"

======List of files/folders created in the last 1 months======

2012-01-09 18:41:29 ----D---- C:\Program Files\trend micro
2012-01-09 18:41:26 ----D---- C:\rsit
2012-01-08 13:39:26 ----D---- C:\Documents and Settings\All Users\Application Data\AquaFish 2
2012-01-05 16:26:34 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP
2012-01-05 15:28:02 ----SHD---- C:\RECYCLER
2012-01-05 12:03:32 ----A---- C:\WINDOWS\system32\ptpusb.dll
2012-01-05 12:03:27 ----A---- C:\WINDOWS\system32\ptpusd.dll
2012-01-05 11:57:56 ----A---- C:\WINDOWS\system32\FFRafShellEx.dll
2012-01-05 11:57:40 ----D---- C:\Program Files\RAF
2012-01-05 11:57:40 ----A---- C:\WINDOWS\system32\RFCLauncher.exe
2012-01-05 11:57:34 ----D---- C:\Documents and Settings\Évi\Application Data\InstallShield
2012-01-05 11:50:18 ----D---- C:\Program Files\QuickTime
2012-01-05 11:50:08 ----D---- C:\Documents and Settings\All Users\Application Data\Apple Computer
2012-01-05 11:49:20 ----D---- C:\Program Files\Common Files\Apple
2012-01-05 11:48:23 ----D---- C:\Program Files\Apple Software Update
2012-01-05 11:48:23 ----D---- C:\Documents and Settings\All Users\Application Data\Apple
2012-01-04 12:48:41 ----D---- C:\Documents and Settings\Évi\Application Data\LestaStudio
2011-12-30 20:21:53 ----D---- C:\Documents and Settings\Évi\Application Data\Amaranth Games
2011-12-29 21:14:17 ----D---- C:\Documents and Settings\Évi\Application Data\ERS Game Studios
2011-12-27 11:11:17 ----D---- C:\Documents and Settings\Évi\Application Data\Happy Artist Studio
2011-12-25 20:32:43 ----D---- C:\Documents and Settings\Évi\Application Data\Digital Quarter
2011-12-24 22:09:11 ----A---- C:\avp.txt
2011-12-23 23:49:27 ----D---- C:\WINDOWS\temp
2011-12-22 13:23:01 ----A---- C:\TDSSKiller.2.6.23.0_22.12.2011_13.23.01_log.txt
2011-12-22 13:21:45 ----A---- C:\TDSSKiller.2.6.22.0_22.12.2011_13.21.45_log.txt
2011-12-21 09:47:15 ----D---- C:\Documents and Settings\Évi\Application Data\DVDVideoSoftIEHelpers
2011-12-21 09:44:46 ----D---- C:\Documents and Settings\Évi\Application Data\DVDVideoSoft
2011-12-19 18:43:28 ----D---- C:\Documents and Settings\Évi\Application Data\Alawar Stargaze
2011-12-19 12:28:53 ----D---- C:\Documents and Settings\Évi\Application Data\Gogii
2011-12-17 17:14:44 ----D---- C:\Documents and Settings\Évi\Application Data\DDMSettings
2011-12-17 16:55:23 ----D---- C:\Documents and Settings\Évi\Application Data\DivX
2011-12-15 13:16:18 ----HDC---- C:\WINDOWS\$NtUninstallKB2639417$
2011-12-15 13:15:40 ----HDC---- C:\WINDOWS\$NtUninstallKB2624667$
2011-12-15 13:05:14 ----HDC---- C:\WINDOWS\$NtUninstallKB2633952$
2011-12-15 13:03:46 ----HDC---- C:\WINDOWS\$NtUninstallKB2619339$
2011-12-15 13:03:23 ----HDC---- C:\WINDOWS\$NtUninstallKB2618451$
2011-12-15 13:02:28 ----HDC---- C:\WINDOWS\$NtUninstallKB2620712$
2011-12-15 13:01:44 ----HDC---- C:\WINDOWS\$NtUninstallKB2633171$
2011-12-13 20:37:27 ----D---- C:\Documents and Settings\All Users\Application Data\Odian Games
2011-12-12 15:20:34 ----D---- C:\Documents and Settings\All Users\Application Data\FLEXnet
2011-12-12 12:57:16 ----HDC---- C:\WINDOWS\$NtUninstallKB952011$

======List of files/folders modified in the last 1 months======

2012-01-09 18:41:29 ----D---- C:\Program Files
2012-01-09 18:31:36 ----D---- C:\Program Files\Common Files\DVDVideoSoft
2012-01-09 18:30:54 ----RSD---- C:\WINDOWS\assembly
2012-01-09 08:11:20 ----D---- C:\WINDOWS
2012-01-09 07:54:49 ----D---- C:\WINDOWS\system32\CatRoot2
2012-01-09 07:52:07 ----SHD---- C:\WINDOWS\CSC
2012-01-09 07:29:54 ----HD---- C:\WINDOWS\inf
2012-01-07 19:48:26 ----D---- C:\WINDOWS\SoftwareDistribution
2012-01-06 22:11:31 ----D---- C:\Program Files\Mozilla Firefox
2012-01-06 13:33:56 ----D---- C:\WINDOWS\system32\drivers
2012-01-06 10:21:56 ----SHD---- C:\System Volume Information
2012-01-06 08:20:40 ----D---- C:\Qoobox
2012-01-06 08:04:24 ----D---- C:\WINDOWS\system32\Restore
2012-01-06 07:59:46 ----D---- C:\WINDOWS\system32
2012-01-06 07:57:39 ----SHD---- C:\WINDOWS\Installer
2012-01-05 19:16:00 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2012-01-05 16:26:52 ----D---- C:\ProgramData
2012-01-05 15:17:32 ----A---- C:\WINDOWS\system.ini
2012-01-05 15:07:34 ----D---- C:\WINDOWS\AppPatch
2012-01-05 15:07:24 ----D---- C:\Program Files\Common Files
2012-01-05 11:57:39 ----HD---- C:\Program Files\InstallShield Installation Information
2012-01-05 11:56:32 ----D---- C:\WINDOWS\system32\DirectX
2012-01-05 11:48:52 ----SD---- C:\WINDOWS\Tasks
2012-01-05 10:31:15 ----AC---- C:\WINDOWS\ODBC.INI
2012-01-05 10:30:02 ----A---- C:\WINDOWS\win.ini
2012-01-05 09:23:33 ----D---- C:\WINDOWS\system32\CatRoot
2012-01-05 08:13:40 ----D---- C:\Documents and Settings\Évi\Application Data\ElevatedDiagnostics
2011-12-29 20:57:34 ----D---- C:\games
2011-12-23 23:40:08 ----D---- C:\WINDOWS\system32\oobe
2011-12-23 20:53:52 ----D---- C:\Program Files\CCleaner
2011-12-18 19:23:45 ----D---- C:\Documents and Settings\All Users\Application Data\Norton
2011-12-18 18:18:38 ----D---- C:\WINDOWS\system32\Macromed
2011-12-17 16:56:11 ----D---- C:\Documents and Settings\All Users\Application Data\DivX
2011-12-17 16:56:10 ----D---- C:\Program Files\DivX
2011-12-17 16:53:32 ----D---- C:\Program Files\Common Files\DivX Shared
2011-12-17 16:04:23 ----D---- C:\WINDOWS\pss
2011-12-17 08:59:03 ----D---- C:\Program Files\Ubisoft
2011-12-17 08:58:09 ----D---- C:\Program Files\Common Files\InstallShield
2011-12-17 08:47:04 ----D---- C:\Program Files\Disney Interactive
2011-12-17 08:46:51 ----AC---- C:\WINDOWS\disney.ini
2011-12-15 13:30:31 ----D---- C:\WINDOWS\Debug
2011-12-15 13:16:23 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-12-15 13:14:37 ----D---- C:\Program Files\Internet Explorer
2011-12-15 13:13:49 ----D---- C:\WINDOWS\ie8updates
2011-12-15 13:13:10 ----HD---- C:\WINDOWS\$hf_mig$
2011-12-15 13:06:29 ----AC---- C:\WINDOWS\system32\MRT.exe
2011-12-14 19:49:47 ----D---- C:\Documents and Settings\All Users\Application Data\Deep Shadows
2011-12-13 20:26:12 ----D---- C:\Documents and Settings\All Users\Application Data\Big Fish Games
2011-12-13 20:23:37 ----D---- C:\Documents and Settings\All Users\Application Data\BigFishGamesCache
2011-12-12 17:52:05 ----D---- C:\Program Files\Common Files\Adobe
2011-12-12 17:47:35 ----D---- C:\Documents and Settings\Évi\Application Data\Adobe
2011-12-12 17:41:35 ----D---- C:\Program Files\Adobe
2011-12-12 17:37:27 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2011-12-12 15:15:22 ----D---- C:\WINDOWS\WinSxS
2011-12-12 15:03:50 ----RSD---- C:\WINDOWS\Fonts
2011-12-12 13:48:32 ----D---- C:\Program Files\Google

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2011-11-28 30808]
R1 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2011-11-28 34392]
R1 aswSnx;aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [2011-11-28 435032]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2011-11-28 314456]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2011-11-28 52952]
R1 intelppm;Intel processzor illesztőprogramja; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40576]
R1 ISODrive;ISO DVD/CD-ROM Device Driver; \??\C:\Program Files\UltraISO\drivers\ISODrive.sys []
R1 kbdhid;Billentyűzet HID-illesztőprogram; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720]
R1 pctgntdi;pctgntdi; \??\C:\WINDOWS\system32\drivers\pctgntdi.sys []
R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-10-26 12032]
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.2.0.3; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2009-10-09 17801]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2011-11-28 20568]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2011-11-28 111320]
R2 fssfltr;FssFltr; C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys [2009-08-05 54752]
R2 litsgt;litsgt; C:\WINDOWS\system32\DRIVERS\litsgt.sys [2009-03-30 137344]
R2 MDC8021X;AEGIS Protocol (IEEE 802.1x) v2.3.1.10; C:\WINDOWS\system32\DRIVERS\mdc8021x.sys [2010-02-20 15890]
R2 PCTAppEvent;PCTAppEvent Driver; \??\C:\WINDOWS\system32\drivers\PCTAppEvent.sys []
R2 rspndr;Kapcsolati réteg topológiafelderítési válaszadója; C:\WINDOWS\system32\DRIVERS\rspndr.sys [2006-11-08 62336]
R2 tansgt;tansgt; C:\WINDOWS\system32\DRIVERS\tansgt.sys [2009-03-30 12032]
R3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2002-04-01 4816]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2006-05-03 1540608]
R3 E1000;Intel(R) PRO/1000 Network Connection Driver; C:\WINDOWS\system32\DRIVERS\e1000325.sys [2007-03-25 171416]
R3 hidusb;Microsoft HID osztályú illesztőprogram; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 mouhid;Egér HID-illesztőprogram; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-26 12160]
R3 PCTFW-PacketFilter;PCTools Firewall - Packet filter driver; \??\C:\WINDOWS\system32\drivers\pctNdis-PacketFilter.sys []
R3 pctNDIS;PC Tools Driver; C:\WINDOWS\system32\DRIVERS\pctNdis.sys [2010-07-08 57536]
R3 pctplfw;pctplfw; \??\C:\WINDOWS\system32\drivers\pctplfw.sys []
R3 Point32;Microsoft IntelliPoint Filter Driver; C:\WINDOWS\system32\DRIVERS\point32.sys [2009-11-11 27744]
R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\WINDOWS\System32\Drivers\RootMdm.sys [2001-10-26 5888]
R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2002-12-19 539008]
R3 usbccgp;Microsoft USB általános szülő-illesztőprogram; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Microsoft USB 2.0 bővített állomásvezérlő miniport illesztőprogramja; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2-engedélyezett hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Microsoft USB univerzális állomásvezérlő miniport illesztőprogramja; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S1 1289918drv;1289918drv; C:\WINDOWS\system32\DRIVERS\1289918drv.sys []
S2 adfs;adfs; C:\WINDOWS\system32\drivers\adfs.sys []
S3 {6080A529-897E-4629-A488-ABA0C29B635E};Intel(R) Graphics Platform (SoftBIOS) Driver; C:\WINDOWS\system32\drivers\ialmsbw.sys [2003-03-13 112288]
S3 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91};Intel(R) Graphics Chipset (KCH) Driver; C:\WINDOWS\system32\drivers\ialmkchw.sys [2003-03-13 78496]
S3 ATHFMWDL;NETGEAR WPN111 Bootloader driver; C:\WINDOWS\System32\Drivers\athwpn.sys [2004-10-14 43392]
S3 CCDECODE;Feliratdekódoló; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 cxbu0wdm;CardMan 3x21; C:\WINDOWS\system32\DRIVERS\cxbu0wdm.sys [2009-06-24 114304]
S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver; \??\C:\WINDOWS\system32\DNINDIS5.SYS []
S3 dtscsi;dtscsi; C:\WINDOWS\System32\Drivers\dtscsi.sys [2010-01-14 223128]
S3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2003-03-13 90395]
S3 MSTEE;Microsoft Streaming Tee/Sink - Sink átalakító; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI kodek; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV-/videokapcsolat; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbbus;LGE Mobile Composite USB Device; C:\WINDOWS\system32\DRIVERS\lgusbbus.sys []
S3 USBCM;Scientific Atlanta USB Cable Modem Driver; C:\WINDOWS\system32\DRIVERS\Sacm2K.sys [2004-06-10 15429]
S3 UsbDiag;LGE Mobile USB Serial Port; C:\WINDOWS\system32\DRIVERS\lgusbdiag.sys []
S3 USBModem;LGE Mobile USB Modem; C:\WINDOWS\system32\DRIVERS\lgusbmodem.sys []
S3 usbprint;Microsoft USB PRINTER osztály; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;USB-képolvasó illesztőprogramja; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;USB háttértár illesztőprogramja; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WPN111;Wireless USB 2.0 Adapter with RangeMax Service; C:\WINDOWS\system32\DRIVERS\WPN111.sys [2005-01-07 286720]
S3 WSTCODEC;World Standard Teletext kodek; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2008-04-16 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2008-04-16 82944]
S4 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys []
S4 Sr;Rendszer-helyreállító szűrő illesztőprogramja; C:\WINDOWS\system32\DRIVERS\sr.sys [2008-04-14 73472]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2006-05-03 413696]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2011-11-28 44768]
R2 ezSharedSvc;Easybits Shared Services for Windows; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 fsssvc;Windows Live Családbiztonság szolgáltatás; C:\Program Files\Windows Live\Family Safety\fsssvc.exe [2010-04-28 704872]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
R2 PCToolsFirewallPlus;PC Tools Firewall Plus; C:\Program Files\PC Tools Firewall Plus\FWService.exe [2011-01-24 286000]
R2 SeaPort;SeaPort; C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2010-07-27 249136]
R2 SoundMAX Agent Service (default);SoundMAX Agent Service; C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe [2002-09-20 45056]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2006-05-03 520192]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 nosGetPlusHelper;getPlus(R) Helper 3004; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 WMPNetworkSvc;A Windows Media Player hálózatmegosztási szolgáltatása; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-10 919040]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Szia Stell!
Először is Boldog Új Évet kívánok neked!
Másodszor az lenne a gondom, hogy mostanában elég sok felesleges programot/játékok,digitális fényképezőgép
telepítője,Stb./töröltem a gépről,de a szabad terület nemhogy nőne hanem fogy.
A net is lassabban tölt be,főleg a gép bekapcsolásakor ezt úgy érem,hogy Kb az első fél-egy órában csiga lassú
utána már jobb a helyzet.Nem ragozom tovább ide teszem a tegnap este lefuttatott két logot,majd te eldöntöd
mi a hiba ha van egyáltalán.Nem kell sietned mert látom vannak az enyémtől komolyabb gondokkal küzdők is,Én
várhatok!
ComboFix 12-01-09.03 - Évi 012.01.09. 19:09:27.49.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1250.36.1038.18.511.241 [GMT 1:00]
Running from: c:\combofix\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: PC Tools Firewall Plus *Enabled* {ABBD5028-5A95-4B6D-996E-98D64AE88D52}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\TEMP
.
.
((((((((((((((((((((((((( Files Created from 2011-12-09 to 2012-01-09 )))))))))))))))))))))))))))))))
.
.
2012-01-09 17:41 . 2012-01-09 17:41 -------- d-----w- c:\program files\trend micro
2012-01-09 17:41 . 2012-01-09 17:41 -------- d-----w- C:\rsit
2012-01-09 11:23 . 2012-01-09 11:23 -------- d-----w- c:\documents and settings\Évi\Local Settings\Application Data\ActionSoft
2012-01-08 12:39 . 2012-01-08 12:41 -------- d-----w- c:\documents and settings\All Users\Application Data\AquaFish 2
2012-01-08 12:39 . 2012-01-08 12:39 -------- d-----w- c:\documents and settings\Évi\Local Settings\Application Data\AquaFish 2
2012-01-06 21:10 . 2012-01-06 21:10 479232 ----a-w- c:\program files\Mozilla Firefox\msvcm80.dll
2012-01-06 21:10 . 2012-01-06 21:10 43992 ----a-w- c:\program files\Mozilla Firefox\mozutils.dll
2012-01-06 21:10 . 2012-01-06 21:10 626688 ----a-w- c:\program files\Mozilla Firefox\msvcr80.dll
2012-01-06 21:10 . 2012-01-06 21:10 548864 ----a-w- c:\program files\Mozilla Firefox\msvcp80.dll
2012-01-05 11:03 . 2001-10-26 20:25 5632 ----a-w- c:\windows\system32\ptpusb.dll
2012-01-05 11:03 . 2008-04-14 17:01 159232 ----a-w- c:\windows\system32\ptpusd.dll
2012-01-05 10:57 . 2006-07-12 13:39 208896 ----a-w- c:\windows\system32\FFRafShellEx.dll
2012-01-05 10:57 . 2012-01-05 10:57 -------- d-----w- c:\program files\RAF
2012-01-05 10:57 . 2010-02-10 13:26 233472 ----a-w- c:\windows\system32\RFCLauncher.exe
2012-01-05 10:57 . 2012-01-05 10:57 -------- d-----w- c:\documents and settings\Évi\Local Settings\Application Data\FUJIFILM
2012-01-05 10:57 . 2012-01-05 10:57 -------- d-----w- c:\documents and settings\Évi\Application Data\InstallShield
2012-01-05 10:52 . 2012-01-05 10:52 159744 ----a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin7.dll
2012-01-05 10:52 . 2012-01-05 10:52 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin7.dll
2012-01-05 10:50 . 2012-01-05 10:52 -------- d-----w- c:\program files\QuickTime
2012-01-05 10:50 . 2012-01-05 10:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2012-01-05 10:49 . 2012-01-05 10:49 -------- d-----w- c:\program files\Common Files\Apple
2012-01-05 10:48 . 2012-01-05 10:48 -------- d-----w- c:\documents and settings\Évi\Local Settings\Application Data\Apple
2012-01-05 10:48 . 2012-01-05 10:48 -------- d-----w- c:\program files\Apple Software Update
2012-01-05 10:48 . 2012-01-05 10:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2012-01-05 10:47 . 2012-01-05 10:47 -------- d-----w- c:\documents and settings\Évi\Local Settings\Application Data\Apple Computer
2012-01-04 11:48 . 2012-01-04 11:48 -------- d-----w- c:\documents and settings\Évi\Application Data\LestaStudio
2011-12-30 19:21 . 2011-12-30 19:21 -------- d-----w- c:\documents and settings\Évi\Application Data\Amaranth Games
2011-12-29 20:14 . 2011-12-29 20:14 -------- d-----w- c:\documents and settings\Évi\Application Data\ERS Game Studios
2011-12-27 10:11 . 2011-12-27 10:11 -------- d-----w- c:\documents and settings\Évi\Application Data\Happy Artist Studio
2011-12-25 19:32 . 2011-12-25 19:32 -------- d-----w- c:\documents and settings\Évi\Application Data\Digital Quarter
2011-12-21 08:44 . 2012-01-09 17:31 -------- d-----w- c:\documents and settings\Évi\Application Data\DVDVideoSoft
2011-12-19 17:43 . 2011-12-19 17:43 -------- d-----w- c:\documents and settings\Évi\Application Data\Alawar Stargaze
2011-12-19 11:28 . 2011-12-19 11:28 -------- d-----w- c:\documents and settings\Évi\Application Data\Gogii
2011-12-17 16:14 . 2011-12-17 16:14 -------- d-----w- c:\documents and settings\Évi\Application Data\DDMSettings
2011-12-17 15:55 . 2011-12-17 15:55 -------- d-----w- c:\documents and settings\Évi\Application Data\DivX
2011-12-17 07:58 . 2002-12-02 12:33 32768 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\Objectps.dll
2011-12-17 07:58 . 2002-12-05 13:10 155648 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iuser.dll
2011-12-17 07:58 . 2002-12-02 14:22 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\DotNetInstaller.exe
2011-12-17 07:58 . 2002-12-02 12:33 57344 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll
2011-12-17 07:58 . 2002-12-02 12:33 237568 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iscript.dll
2011-12-17 07:58 . 2003-02-27 15:12 696320 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iKernel.dll
2011-12-17 07:58 . 2011-12-17 07:58 163972 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iGdi.dll
2011-12-17 07:58 . 2011-12-17 07:58 282756 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\setup.dll
2011-12-13 19:37 . 2011-12-13 19:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Odian Games
2011-12-12 15:05 . 2011-12-13 19:32 -------- d-----w- c:\documents and settings\All Users\AdobeTemp
2011-12-12 14:20 . 2011-12-12 14:20 -------- d-----w- c:\documents and settings\All Users\Application Data\FLEXnet
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-06 06:29 . 2011-05-20 07:41 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-28 18:01 . 2011-04-28 09:39 41184 ----a-w- c:\windows\avastSS.scr
2011-11-28 18:01 . 2011-04-28 09:39 199816 ----a-w- c:\windows\system32\aswBoot.exe
2011-11-28 17:53 . 2011-04-28 09:40 435032 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-11-28 17:53 . 2011-04-28 09:40 314456 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-11-28 17:52 . 2011-04-28 09:40 34392 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-11-28 17:52 . 2011-04-28 09:40 52952 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-11-28 17:52 . 2011-04-28 09:40 111320 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-11-28 17:51 . 2011-04-28 09:40 105176 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-11-28 17:51 . 2011-04-28 09:40 20568 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-11-28 17:48 . 2011-04-28 09:40 30808 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-11-23 14:40 . 2009-08-08 12:50 1859584 ----a-w- c:\windows\system32\win32k.sys
2011-11-04 19:13 . 2008-04-16 17:45 916992 ----a-w- c:\windows\system32\wininet.dll
2011-11-04 19:13 . 2008-04-16 17:45 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2011-11-04 19:13 . 2008-04-16 17:29 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-11-04 11:24 . 2008-04-16 17:29 385024 ----a-w- c:\windows\system32\html.iec
2011-11-01 16:07 . 2009-08-08 12:50 1288192 ----a-w- c:\windows\system32\ole32.dll
2011-10-28 05:32 . 2009-08-08 12:50 33280 ----a-w- c:\windows\system32\csrsrv.dll
2011-10-26 10:49 . 2009-08-08 12:49 2194176 ------w- c:\windows\system32\ntoskrnl.exe
2011-10-26 10:49 . 2009-08-08 12:49 2070784 ------w- c:\windows\system32\ntkrnlpa.exe
2011-10-18 11:13 . 2009-08-08 12:51 186880 ----a-w- c:\windows\system32\encdec.dll
1998-06-26 18:18 . 2008-09-24 13:50 126 -c--a-w- c:\program files\Mk4.reg
2012-01-06 21:10 . 2011-11-11 10:45 121816 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2004-08-17 . 93F75FF033BAA186D08115D73BFE3D32 . 13824 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\wscntfy.exe
[-] 2004-08-17 . 93F75FF033BAA186D08115D73BFE3D32 . 13824 . . [5.1.2600.2180] . . c:\windows\ServicePackFiles\i386\wscntfy.exe
[-] 2004-08-17 . 93F75FF033BAA186D08115D73BFE3D32 . 13824 . . [5.1.2600.2180] . . c:\windows\system32\wscntfy.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-11-28 18:01 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"00PCTFW"="c:\program files\PC Tools Firewall Plus\FirewallGUI.exe" [2011-04-07 2672600]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-11-28 3744552]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2009-03-08 128512]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"HideFastUserSwitching"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyDocs"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoSMMyDocs"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
.
[HKLM\~\startupfolder\C:^Documents and Settings^Évi^Start Menu^Programs^Indítópult^Ubisoft register.lnk]
path=c:\documents and settings\Évi\Start Menu\Programs\Indítópult\Ubisoft register.lnk
backup=c:\windows\pss\Ubisoft register.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-09-07 22:58 37296 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\aswAhAScr.dll]
2011-04-18 16:51 22016 ----a-w- c:\program files\AVAST Software\Avast\aswRegSvr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
2006-01-02 14:41 45056 ----a-w- c:\program files\ATI Technologies\ATI.ACE\CLI.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 16:02 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2011-07-28 23:08 1259376 ----a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpwareSE4]
2006-03-21 12:19 69632 ----a-w- c:\program files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-10 22:08 417792 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
.
R1 1289918drv;1289918drv;c:\windows\system32\DRIVERS\1289918drv.sys [x]
R3 ATHFMWDL;NETGEAR WPN111 Bootloader driver;c:\windows\system32\Drivers\athwpn.sys [2004-10-14 43392]
R3 cxbu0wdm;CardMan 3x21;c:\windows\system32\DRIVERS\cxbu0wdm.sys [2009-06-24 114304]
R3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\system32\DNINDIS5.SYS [2003-07-24 17149]
R3 nosGetPlusHelper;getPlus(R) Helper 3004;c:\windows\System32\svchost.exe [2008-04-14 14336]
R3 WPN111;Wireless USB 2.0 Adapter with RangeMax Service;c:\windows\system32\DRIVERS\WPN111.sys [2005-01-07 286720]
R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [2011-01-17 251560]
S2 aswFsBlk;aswFsBlk; [x]
S2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe [2008-04-14 14336]
S2 litsgt;litsgt;c:\windows\system32\DRIVERS\litsgt.sys [2009-03-30 137344]
S2 PCTAppEvent;PCTAppEvent Driver;c:\windows\system32\drivers\PCTAppEvent.sys [2011-03-02 160576]
S2 tansgt;tansgt;c:\windows\system32\DRIVERS\tansgt.sys [2009-03-30 12032]
S3 PCTFW-PacketFilter;PCTools Firewall - Packet filter driver;c:\windows\system32\drivers\pctNdis-PacketFilter.sys [2011-01-12 89472]
S3 pctNDIS;PC Tools Driver;c:\windows\system32\DRIVERS\pctNdis.sys [2010-07-08 57536]
S3 pctplfw;pctplfw;c:\windows\system32\drivers\pctplfw.sys [2011-01-17 125248]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - CPUZ135
*Deregistered* - cpuz135
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ezSharedSvc
.
Contents of the 'Scheduled Tasks' folder
.
2012-01-05 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
IE: E&xportálás Microsoft Excel formátumba - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Easy-WebPrint – Gyors nyomtatás - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
IE: Easy-WebPrint – Hozzáadás a nyomtatási listához - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
IE: Easy-WebPrint – Nyomtatás - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
IE: Easy-WebPrint – Nyomtatási kép - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.0.1
DPF: {226ACC34-3194-40E2-9AE8-834FCFE9E80D} - hxxp://games.bigfishgames.com/en_myster ... .0.0.8.cab
DPF: {4DCA1E08-4147-4A3D-8CA6-E095DF189FAB} - hxxp://games.bigfishgames.com/en_nights ... .0.0.9.cab
FF - ProfilePath - c:\documents and settings\Évi\Application Data\Mozilla\Firefox\Profiles\dtyra91o.default\
FF - prefs.js: browser.search.defaulturl -
FF - prefs.js: browser.startup.homepage - hxxp://www.google.hu/
.
- - - - ORPHANS REMOVED - - - -
.
MSConfigStartUp-Device Detection - c:\program files\FUJIFILM\MyFinePix Studio\dd.exe
MSConfigStartUp-FlashPlayerUpdate - c:\windows\system32\Macromed\Flash\FlashUtil10x_Plugin.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-01-09 19:27
Windows 5.1.2600 Szervizcsomag 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(1008)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2012-01-09 19:34:51
ComboFix-quarantined-files.txt 2012-01-09 18:34
.
Pre-Run: 42 740 822 016 bájt szabad
Post-Run: 42 680 090 624 bájt szabad
.
- - End Of File - - 1C655F5F0D5371B233AD09F531B3A32E

1:Tolds le innen ezt a fajlót,,usbehci.sys
http://leteckaposta.cz/710621311

2: Masold be, vagy egyenesen tolds le a C:\ meghajtora, igy lesz.
C:\usbehci.sys
Script készítés:
Kinyitunk - Notepadot (Jegyzetfüzetet)igy: Start>futtatás>beírod: notepad
és bemásolod- a Kód: címszó alatt található zöld textet(Kód: szó nélkül), aztán a notepadba beillesztett textet elmentjük scriptnek az asztalra , úgy:- Fájl>Mentés Másként>Fájlnév>CFScript.txt>Fájl típusa>Minden fájl>Mentés.(Ásztálra),.Kész, az astalon lévő CFScript txt húzzunk rá a ComboFix ikonnyara. Es mostan megcsinalod eztett:

A combofix maga elindul es lehet hogy restartol es befejezi a scent.Amit majd ad tedd ide.

Most sokkal jobb a helyzet, mondhatom, hogy jó! Újraindítottam kíváncsiságból, probléma nélkül el is indult.

Bocsánat, nem dehogy!

SystemLook 30.07.11 by jpshortstuff
Log created at 14:44 on 09/01/2012 by Dugó
Administrator - Elevation successful

========== filefind ==========

Searching for "usbehci*"
C:\cmdcons\USBEHCI.SY_ --a---- 15034 bytes [22:08 03/08/2004] [22:08 03/08/2004] 4622A7C6B2789441839796EDDDF180B0

Searching for "usbehci.sys"
No files found.

Searching for "c:\windows\system32\drivers\usbehci.sys"
No files found.

-= EOF =-

Az rendben van, az , az combofix,e, csinálni amit írok.

Ok csinálom.
A feladatkezelőben van két folyamat ami nem szokott ott lenni, ez jó vagy rosz? CF19741.3XE és grep.exe

1:letöltjük az asztalra.
http://www.virus-stell.com/2010/04/systemlook.html
2:Futtassuk.
3:Az ablakába bemásoljuk a scriptet.
4:Klik-look.



a naplojat ide.

A Combofix naplója újra:

ComboFix 12-01-09.02 - Dugó 012.01.09. 10:33:53.2.1 - x86
Running from: c:\documents and settings\Dugó\Asztal\ComboFix.exe
Command switches used :: c:\documents and settings\Dugó\Asztal\WindowsXP-KB310994-SP2-Home-BootDisk-HUN.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\drivers\usbehci.sys . . . is missing!!
.
.
((((((((((((((((((((((((( Files Created from 2011-12-09 to 2012-01-09 )))))))))))))))))))))))))))))))
.
.
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-17 15360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt]
2011-04-21 06:53 281768 ----a-w- c:\program files\Avira\AntiVir Desktop\avgnt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2004-08-17 14:47 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
.
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-04-21 136360]
.
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.hu/
TCP: DhcpNameServer = 84.1.98.182 195.70.36.127
FF - ProfilePath - c:\documents and settings\Dugó\Application Data\Mozilla\Firefox\Profiles\23n86ys9.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-01-09 11:31
Windows 5.1.2600 Szervizcsomag 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Completion time: 2012-01-09 11:55:30
ComboFix-quarantined-files.txt 2012-01-09 10:54
ComboFix2.txt 2012-01-07 20:22
.
Pre-Run: 7 510 114 304 bájt szabad
Post-Run: 7 378 149 376 bájt szabad
.
WindowsXP-KB310994-SP2-Home-BootDisk-HUN.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional - magyar" /noexecute=optin /fastdetect
.
- - End Of File - - 8C0E7B09DA3F667E662E1FCD6BE3809B

Udv.
Az leiras szerint feltelepiteni a combofixnek az helyreállító konzolt,,,
http://www.virus-stell.com/2010/04/combofix.html

Es ujbol lefuttatni, a naplojat ide tenni, amugy ahogy latom , hianyzik rendszer fajlo, majd meglassuk.

Üdv stell.

Párom gépét újratelepítettük, Avirát raktunk rá, egy darabig ment, aztán belassult, és állandóan lefagy.
Semmi extra nincs csinálva rajta, internetezésre használja csak a gépet.
Olvastam errefelé, a Combofix programot lefuttattuk tegnap, megnéznéd a naplót? Esetleg mit lehetne csinálni?

ComboFix 12-01-06.01 - Dugó 012.01.07. 13:36:31.1.1 - x86
Running from: c:\documents and settings\Dugˇ\Asztal\ComboFix.exe
AV: AntiVir Desktop *Enabled/Outdated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\msmqinst.log
c:\windows\regopt.log
.
c:\windows\system32\drivers\usbehci.sys . . . is missing!!
.
.
((((((((((((((((((((((((( Files Created from 2011-12-07 to 2012-01-07 )))))))))))))))))))))))))))))))
.
.
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
.
.
.
.
[7] 2004-08-03 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ndis.sys
[7] 2004-08-03 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\system32\drivers\ndis.sys
.
[7] 2004-08-03 . B78BE402C3F63DD55521F73876951CDD . 574592 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ntfs.sys
[7] 2004-08-03 . B78BE402C3F63DD55521F73876951CDD . 574592 . . [5.1.2600.2180] . . c:\windows\system32\drivers\ntfs.sys
.
.
[-] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\SoftwareDistribution\Download\884a6b06224d64e89caf015c949a0a71\sp3qfe\tcpip.sys
.
[7] 2004-08-17 . CC90D53B49724DFD30C9FA654E1ACFB2 . 77312 . . [5.1.2600.2180] . . c:\windows\system32\browser.dll
.
.
.
.
[7] 2004-08-17 . 8830CD268072D0679D419511D5E28CD1 . 382464 . . [6.6.2600.2180] . . c:\windows\system32\qmgr.dll
[7] 2004-08-17 . 8830CD268072D0679D419511D5E28CD1 . 382464 . . [6.6.2600.2180] . . c:\windows\system32\dllcache\qmgr.dll
.
.
[-] 2009-02-09 . 9CEDBFBE08BC1C4F35F74B8F96E0289A . 111104 . . [5.1.2600.5755] . . c:\windows\SoftwareDistribution\Download\a993fd5527ea7331bb50cf97656f4d60\SP3GDR\services.exe
[-] 2009-02-09 . BDEB2B3B235C8488BC7BAE94143415EF . 111104 . . [5.1.2600.5755] . . c:\windows\SoftwareDistribution\Download\a993fd5527ea7331bb50cf97656f4d60\SP3QFE\services.exe
.
[7] 2004-08-17 . EDE7EC5AC7126B17E66D653A34E7C3B2 . 57856 . . [5.1.2600.2180] . . c:\windows\system32\spoolsv.exe
[7] 2004-08-17 . EDE7EC5AC7126B17E66D653A34E7C3B2 . 57856 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\spoolsv.exe
.
[7] 2004-08-17 . 63E65D180BB0607B7240E700D2F73EAD . 504320 . . [5.1.2600.2180] . . c:\windows\system32\winlogon.exe
[7] 2004-08-17 . 63E65D180BB0607B7240E700D2F73EAD . 504320 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\winlogon.exe
.
[7] 2009-08-06 . 62BB79160F86CD962F312C68C6239BFD . 53472 . . [7.4.7600.226] . . c:\windows\system32\wuauclt.exe
[7] 2009-08-06 . 62BB79160F86CD962F312C68C6239BFD . 53472 . . [7.4.7600.226] . . c:\windows\system32\dllcache\wuauclt.exe
.
.
.
[7] 2004-08-17 . 98EA924C4C1B0EA53393289D64218822 . 60416 . . [5.1.2600.2180] . . c:\windows\system32\cryptsvc.dll
[7] 2004-08-17 . 98EA924C4C1B0EA53393289D64218822 . 60416 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\cryptsvc.dll
.
.
[7] 2004-08-17 . 35F7E50DB7BDD9AA2A5D28A9DFD1D962 . 110080 . . [5.1.2600.2180] . . c:\windows\system32\imm32.dll
[7] 2004-08-17 . 35F7E50DB7BDD9AA2A5D28A9DFD1D962 . 110080 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\imm32.dll
.
.
[7] 2004-08-17 . 0B2EA4848C172B629B344227EBBF5B51 . 18944 . . [5.1.2600.2180] . . c:\windows\system32\linkinfo.dll
.
.
.
[7] 2004-08-17 . 6C4E26090757609C76E907D197572639 . 343040 . . [7.0.2600.2180] . . c:\windows\system32\msvcrt.dll
[7] 2004-08-17 . 6C4E26090757609C76E907D197572639 . 343040 . . [7.0.2600.2180] . . c:\windows\system32\dllcache\msvcrt.dll
[7] 2004-08-17 . 8177C4243D7A9F804F8E5A8F305EFC1D . 343040 . . [7.0.2600.2180] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9\msvcrt.dll
[7] 2001-10-26 . 4200BE3808F6406DBE45A7B88DAE5035 . 322560 . . [7.0.2600.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\msvcrt.dll
.
[-] 2008-06-20 . CF16F63E9FFB002BA14C788030323F78 . 246784 . . [5.1.2600.5625] . . c:\windows\SoftwareDistribution\Download\884a6b06224d64e89caf015c949a0a71\sp3gdr\mswsock.dll
[-] 2008-06-20 . A89B80B5A9DFABAFB420EF7137068804 . 246784 . . [5.1.2600.5625] . . c:\windows\SoftwareDistribution\Download\884a6b06224d64e89caf015c949a0a71\sp3qfe\mswsock.dll
.
[7] 2004-08-17 . 38A4E873DEBBA38F1E7E8D9D6AF593D8 . 407040 . . [5.1.2600.2180] . . c:\windows\SoftwareDistribution\Download\2d1d4fca40c24fb744d2cf1ea1ee720e\backup\sp2qfe\netlogon.dll
.
[7] 2004-08-17 . 940A0DDC89B0A22225B185AB5B05C1AE . 17408 . . [6.00.2900.2180] . . c:\windows\system32\powrprof.dll
[7] 2004-08-17 . 940A0DDC89B0A22225B185AB5B05C1AE . 17408 . . [6.00.2900.2180] . . c:\windows\system32\dllcache\powrprof.dll
.
[7] 2004-08-17 . DE117DA3508ECAAECEA21901DBA31DAB . 185856 . . [5.1.2600.2180] . . c:\windows\system32\scecli.dll
[7] 2004-08-17 . DE117DA3508ECAAECEA21901DBA31DAB . 185856 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\scecli.dll
.
[7] 2004-08-17 . ECA8C8B8B6D91E03845698A9402DF904 . 5120 . . [5.1.2600.2180] . . c:\windows\system32\sfc.dll
[7] 2004-08-17 . ECA8C8B8B6D91E03845698A9402DF904 . 5120 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\sfc.dll
.
[7] 2004-08-17 . 22D8D9F0F5EBE312A1747D6172205F1B . 14336 . . [5.1.2600.2180] . . c:\windows\system32\svchost.exe
[7] 2004-08-17 . 22D8D9F0F5EBE312A1747D6172205F1B . 14336 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\svchost.exe
.
[7] 2004-08-17 . 828F1AAB3E09B46866086EB1EB51D22F . 246784 . . [5.1.2600.2180] . . c:\windows\system32\tapisrv.dll
[7] 2004-08-17 . 828F1AAB3E09B46866086EB1EB51D22F . 246784 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\tapisrv.dll
.
[7] 2004-08-17 . A8F55F8707849E5AA70643188B4AD573 . 577024 . . [5.1.2600.2180] . . c:\windows\system32\user32.dll
.
[7] 2004-08-17 . B722651FB16A7777E885711DB94571DA . 24576 . . [5.1.2600.2180] . . c:\windows\system32\userinit.exe
[7] 2004-08-17 . B722651FB16A7777E885711DB94571DA . 24576 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\userinit.exe
.
.
[7] 2004-08-17 . AF3CC3CB92FB06A47CE979FB9D2CA127 . 82944 . . [5.1.2600.2180] . . c:\windows\system32\ws2_32.dll
[7] 2004-08-17 . AF3CC3CB92FB06A47CE979FB9D2CA127 . 82944 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ws2_32.dll
.
[7] 2004-08-17 . 5D70CE80E6A2FB4709B5744979A1EF26 . 19968 . . [5.1.2600.2180] . . c:\windows\system32\ws2help.dll
[7] 2004-08-17 . 5D70CE80E6A2FB4709B5744979A1EF26 . 19968 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ws2help.dll
.
[7] 2004-08-17 . 5BF20DA8E16049C4BE8E15EEE1F427C1 . 1034240 . . [6.00.2900.2180] . . c:\windows\explorer.exe
.
[7] 2004-08-17 . C684DFCC5FE7D9FE63D8D9FFA7D0F094 . 152576 . . [5.1.2600.2180] . . c:\windows\regedit.exe
[7] 2004-08-17 . C684DFCC5FE7D9FE63D8D9FFA7D0F094 . 152576 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\regedit.exe
.
[7] 2004-08-17 . 98ADCBCA2FD44EF8699A1729E1350D73 . 1281024 . . [5.1.2600.2180] . . c:\windows\system32\ole32.dll
[7] 2004-08-17 . 98ADCBCA2FD44EF8699A1729E1350D73 . 1281024 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ole32.dll
.
[7] 2004-08-17 . DDF7EB3A9DEB2A5942844A292F2566F9 . 406528 . . [1.0420.2600.2180] . . c:\windows\system32\usp10.dll
[7] 2004-08-17 . DDF7EB3A9DEB2A5942844A292F2566F9 . 406528 . . [1.0420.2600.2180] . . c:\windows\system32\dllcache\usp10.dll
.
.
.
[7] 2004-08-17 . ABCDC593FA5D84486675DC026B1FCB4E . 135168 . . [6.00.2900.2180] . . c:\windows\system32\shsvcs.dll
[7] 2004-08-17 . ABCDC593FA5D84486675DC026B1FCB4E . 135168 . . [6.00.2900.2180] . . c:\windows\system32\dllcache\shsvcs.dll
.
[7] 2004-08-17 . D5540A6FC6FBF1019F443953C1EC802E . 171008 . . [5.1.2600.2180] . . c:\windows\system32\srsvc.dll
[7] 2004-08-17 . D5540A6FC6FBF1019F443953C1EC802E . 171008 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\srsvc.dll
.
[7] 2004-08-17 . 2AD0B9BC6F5DEEE2E0E73DC51212E1A5 . 13824 . . [5.1.2600.2180] . . c:\windows\system32\wscntfy.exe
[7] 2004-08-17 . 2AD0B9BC6F5DEEE2E0E73DC51212E1A5 . 13824 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\wscntfy.exe
.
[7] 2004-08-17 . B874FCD14B68A824ACF8DDAC1C0AD945 . 129536 . . [5.1.2600.2180] . . c:\windows\system32\xmlprov.dll
[7] 2004-08-17 . B874FCD14B68A824ACF8DDAC1C0AD945 . 129536 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\xmlprov.dll
.
[7] 2004-08-17 . 9BF16BF2A92E9946C034947E45C6FB4E . 55808 . . [5.1.2600.2180] . . c:\windows\system32\eventlog.dll
[7] 2004-08-17 . 9BF16BF2A92E9946C034947E45C6FB4E . 55808 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\eventlog.dll
.
[7] 2004-08-17 . D8846BDADD422E8BA89561C1530CB4BC . 1548288 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll
[7] 2004-08-17 . D8846BDADD422E8BA89561C1530CB4BC . 1548288 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\sfcfiles.dll
.
.
[7] 2004-08-17 . 4B80B8F958BCB28602DD71BB7A915589 . 59904 . . [5.1.2600.2180] . . c:\windows\system32\regsvc.dll
.
[7] 2004-08-17 . D820AA37B17A0953379533FD51017B2E . 192000 . . [5.1.2600.2180] . . c:\windows\system32\schedsvc.dll
[7] 2004-08-17 . D820AA37B17A0953379533FD51017B2E . 192000 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\schedsvc.dll
.
[7] 2004-08-17 . C68B2C55787FCB51B3EE525DDC8FA6D9 . 71680 . . [5.1.2600.2180] . . c:\windows\system32\ssdpsrv.dll
[7] 2004-08-17 . C68B2C55787FCB51B3EE525DDC8FA6D9 . 71680 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ssdpsrv.dll
.
[7] 2004-08-17 . 31C19AA96A1DB7EEC02394FFF8FFE3AD . 296960 . . [5.1.2600.2180] . . c:\windows\system32\termsrv.dll
[7] 2004-08-17 . 31C19AA96A1DB7EEC02394FFF8FFE3AD . 296960 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\termsrv.dll
.
[7] 2004-08-17 . B0C6F5F51A4B5B34460930E45BF47B63 . 346624 . . [5.1.2600.2180] . . c:\windows\system32\hnetcfg.dll
.
.
.
[7] 2004-08-03 22:39 . 841F385C6CFAF66B58FBD898722BB4F0 . 142464 . . [5.1.2601.2078] . . c:\windows\system32\drivers\aec.sys
.
.
.
[7] 2004-08-17 . E8A1A5C0F362C878D38B858E6BF2AF90 . 33792 . . [5.1.2600.2180] . . c:\windows\system32\msgsvc.dll
[7] 2004-08-17 . E8A1A5C0F362C878D38B858E6BF2AF90 . 33792 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\msgsvc.dll
.
[7] 2004-08-17 14:47 . 4D40C627448406CCA8EA70DB7DC04284 . 52224 . . [9.0.1.56] . . c:\windows\system32\mspmsnsv.dll
[7] 2004-08-17 14:47 . 4D40C627448406CCA8EA70DB7DC04284 . 52224 . . [9.0.1.56] . . c:\windows\system32\dllcache\mspmsnsv.dll
.
.
[7] 2004-08-17 14:47 . 2A183CA577B1544276EEA08410DD9085 . 438272 . . [5.1.2400.2180] . . c:\windows\system32\ntmssvc.dll
[7] 2004-08-17 14:47 . 2A183CA577B1544276EEA08410DD9085 . 438272 . . [5.1.2400.2180] . . c:\windows\system32\dllcache\ntmssvc.dll
.
[7] 2004-08-17 . 4F2873C96DB0FC560C13B5B369688E71 . 185856 . . [5.1.2600.2180] . . c:\windows\system32\upnphost.dll
[7] 2004-08-17 . 4F2873C96DB0FC560C13B5B369688E71 . 185856 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\upnphost.dll
.
.
.
[7] 2004-08-17 . FB011DBFB87DBCA91D3F4AF187588925 . 266240 . . [5.03.2600.2180] . . c:\windows\system32\ddraw.dll
.
[7] 2004-08-17 14:47 . CECF2F8210AB99F95BCC25373C8279D4 . 83456 . . [5.1.2600.2180] . . c:\windows\system32\olepro32.dll
[7] 2004-08-17 14:47 . CECF2F8210AB99F95BCC25373C8279D4 . 83456 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\olepro32.dll
.
[7] 2004-08-17 . 3E30219ADE6B27044476361F03340655 . 40448 . . [5.1.2600.2180] . . c:\windows\system32\perfctrs.dll
[7] 2004-08-17 . 3E30219ADE6B27044476361F03340655 . 40448 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\perfctrs.dll
.
[7] 2004-08-17 . FC188F43296005E186042DFCB5BB1602 . 18944 . . [5.1.2600.2180] . . c:\windows\system32\version.dll
[7] 2004-08-17 . FC188F43296005E186042DFCB5BB1602 . 18944 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\version.dll
.
.
.
.
.
[7] 2004-08-17 . 73BF64C9A387F732E17FAC874C46C7BE . 176640 . . [5.1.2600.2180] . . c:\windows\system32\w32time.dll
[7] 2004-08-17 . 73BF64C9A387F732E17FAC874C46C7BE . 176640 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\w32time.dll
.
[7] 2004-08-17 . 55B36D00211932788DDFDD069AE8E293 . 333312 . . [5.1.2600.2180] . . c:\windows\system32\wiaservc.dll
[7] 2004-08-17 . 55B36D00211932788DDFDD069AE8E293 . 333312 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\wiaservc.dll
.
[7] 2004-08-17 . FB8C4FA0FF3F95658D5102BCE065022B . 18944 . . [5.1.2600.2180] . . c:\windows\system32\midimap.dll
[7] 2004-08-17 . FB8C4FA0FF3F95658D5102BCE065022B . 18944 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\midimap.dll
.
[7] 2004-08-17 . 4E37F9C386A8B6121BDF4ADC42A44A1C . 8192 . . [5.1.2600.2180] . . c:\windows\system32\rasadhlp.dll
[7] 2004-08-17 . 4E37F9C386A8B6121BDF4ADC42A44A1C . 8192 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\rasadhlp.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-17 15360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt]
2011-04-21 06:53 281768 ----a-w- c:\program files\Avira\AntiVir Desktop\avgnt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2004-08-17 14:47 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
.
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-04-21 136360]
.
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.hu/
TCP: DhcpNameServer = 84.1.98.182 195.70.36.127
FF - ProfilePath - c:\documents and settings\Dugó\Application Data\Mozilla\Firefox\Profiles\23n86ys9.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-01-07 17:44
Windows 5.1.2600 Szervizcsomag 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(516)
c:\windows\system32\wbem\fastprox.dll
.
Completion time: 2012-01-07 21:21:38
ComboFix-quarantined-files.txt 2012-01-07 20:20
.
Pre-Run: 7 348 215 808 bájt szabad
Post-Run: 7 409 741 824 bájt szabad
.
WinXP_EN_HOM_BF.EXE
.
- - End Of File - - 682CCD121767CF16E026EA572B423460

Szia.
Tehat tudod mit kel csinalnod, ide kel tenned az RSIT logjat, es leirni, mi, hol eszlelte a trojat.

szia stell!
a gépem tróját észlelt. segitenél megszabadulni tőle?

Köszönöm.
Es neked is es csaladodnak is BOLDOG KARACSONYT es BOLDOG Uj EVET kivannok.

Igen, biztosan talakozunk.
udv.

Szia Stell!

Szeretnék BÉKÉS BOLDOG KARÁCSONYT kívánni Neked a családodnak és minden
fórumozónak!

Remélem jövőre kevesebbet,de azért találkozunk.
Üdv.:Évi

nincsen mit koszonod szia.
De maskor ha valamit jelez az Antivirus, soha ne torold, vagy josz ide hozzam, vagy karantenba, mert az antivirusok, itt ott hamis jelzeseket is produkalnak, es ha torosz rendszer fajlot, akkor a rendszer meghal.

Rendben!
Köszönöm szépen!
Bízom benne,hogy nem lesz semmi probléma.
Szia és szép estét:ÉVI

Ez renben van, az Avast mukodik, es figyel, na mostan egyelore hagyuk igy ahogy van, a combofixet is hagyd meg,, ha lassulas lenne, akkor alitsd vissza a rendszert az eloti datumra amikor az Avastal torolted azt az ismeretlen Rootkitet, es futtasd le a combofixet es tedd ide a logjat.Ha semmi furcsa dolgot nem eszlelsz akkor hagyd igy.

Na sikerültek a képek:
http://kepkezelo.com/images/phmh8xqh3xtjkunloqye.jpg
http://kepkezelo.com/images/o4h4uexfy6sza0ntg0jd.jpg
http://kepkezelo.com/images/yr24wd5yx6427lc2t9hu.jpg
Riasztási ablak nincs csak ha belépek akkor látom ezeket!

6.-án Kedden ,Mondtam,hogy a télapó hozta
Nem tudom megcsinálni azt a képet az Avastról pedig jó lenne ha látnád mert elég ijesztő.

Igen, igy ahogy irtad, de azok a driverek amiket torolni akartam eppen ehez a programhoz vannak,
.Nem azt hiszem hogy hamis riasztas volt,
De megcsinaljuk igy, .Mikkor torolted az Avastal a Rootkitet?? ma??tegnap??

Letelepítés.
A fő ablakban kattintson a jobb felső sarokban a fehér keresztre a vörös mezőben.
A program befejeződik, és ő csendesen le telepítődik a gépről.
A teljes uninstall után végül ajánlom manuálisan indítsa újra a számítógépet.
Ezt a blogodon olvastam és így is csináltam,lehet hogy valamit nem jól csináltam?

Most működik rendesen,csak az Avastban a viselkedés védelemnél vannak furcsa dolgok.
Majd megpróbálok egy képet átküldeni róla.
Akkor most nálam nem hamis riasztás volt a rootkit hanem igazi?

Figyelj csak ide, a multkor az AVPTOOL programot, miert nem telepitedet le??

Most hogy viselkedik a gep??

wscntfy.exe
Submission date:
2011-12-09 14:31:11 (UTC)
Current status:
finished
Result:
0/ 43 (0.0%)

VT Community

not reviewed
Safety score: -
Compact
Print results
Antivirus Version Last Update Result
AhnLab-V3 2011.12.08.02 2011.12.08 -
AntiVir 7.11.19.52 2011.12.09 -
Antiy-AVL 2.0.3.7 2011.12.09 -
Avast 6.0.1289.0 2011.12.09 -
AVG 10.0.0.1190 2011.12.09 -
BitDefender 7.2 2011.12.09 -
ByteHero 1.0.0.1 2011.12.07 -
CAT-QuickHeal 12.00 2011.12.09 -
ClamAV 0.97.3.0 2011.12.09 -
Commtouch 5.3.2.6 2011.12.09 -
Comodo 10897 2011.12.09 -
DrWeb 5.0.2.03300 2011.12.09 -
Emsisoft 5.1.0.11 2011.12.09 -
eSafe 7.0.17.0 2011.12.08 -
eTrust-Vet 37.0.9615 2011.12.09 -
F-Prot 4.6.5.141 2011.11.29 -
F-Secure 9.0.16440.0 2011.12.09 -
Fortinet 4.3.388.0 2011.12.09 -
GData 22 2011.12.09 -
Ikarus T3.1.1.109.0 2011.12.09 -
Jiangmin 13.0.900 2011.12.09 -
K7AntiVirus 9.119.5619 2011.12.07 -
Kaspersky 9.0.0.837 2011.12.09 -
McAfee 5.400.0.1158 2011.12.09 -
McAfee-GW-Edition 2010.1E 2011.12.09 -
Microsoft 1.7903 2011.12.09 -
NOD32 6691 2011.12.07 -
Norman 6.07.13 2011.12.09 -
nProtect 2011-12-09.01 2011.12.09 -
Panda 10.0.3.5 2011.12.09 -
PCTools 8.0.0.5 2011.12.09 -
Prevx 3.0 2011.12.09 -
Rising 23.87.03.02 2011.12.08 -
Sophos 4.72.0 2011.12.09 -
SUPERAntiSpyware 4.40.0.1006 2011.12.09 -
Symantec 20111.2.0.82 2011.12.09 -
TheHacker 6.7.0.1.353 2011.12.07 -
TrendMicro 9.500.0.1008 2011.12.09 -
TrendMicro-HouseCall 9.500.0.1008 2011.12.09 -
VBA32 3.12.16.4 2011.12.09 -
VIPRE 11223 2011.12.09 -
ViRobot 2011.12.9.4817 2011.12.09 -
VirusBuster 14.1.106.0 2011.12.08 -
Additional information
MD5 : 93f75ff033baa186d08115d73bfe3d32
SHA1 : fd087d96c12436912f8ee093b6f44abf17275452
SHA256: 85f8b1633de754f9efafc34a088be16a5cb8b2ef4dea5e3cae30524b2429fe56

1289918drv.sys
Submission date:
2011-12-09 14:37:01 (UTC)
Current status:
finished
Result:
0/ 43 (0.0%)

VT Community

not reviewed
Safety score: -
Compact
Print results
Antivirus Version Last Update Result
AhnLab-V3 2011.12.08.02 2011.12.08 -
AntiVir 7.11.19.52 2011.12.09 -
Antiy-AVL 2.0.3.7 2011.12.09 -
Avast 6.0.1289.0 2011.12.09 -
AVG 10.0.0.1190 2011.12.09 -
BitDefender 7.2 2011.12.09 -
ByteHero 1.0.0.1 2011.12.07 -
CAT-QuickHeal 12.00 2011.12.09 -
ClamAV 0.97.3.0 2011.12.09 -
Commtouch 5.3.2.6 2011.12.09 -
Comodo 10897 2011.12.09 -
DrWeb 5.0.2.03300 2011.12.09 -
Emsisoft 5.1.0.11 2011.12.09 -
eSafe 7.0.17.0 2011.12.08 -
eTrust-Vet 37.0.9615 2011.12.09 -
F-Prot 4.6.5.141 2011.11.29 -
F-Secure 9.0.16440.0 2011.12.09 -
Fortinet 4.3.388.0 2011.12.09 -
GData 22 2011.12.09 -
Ikarus T3.1.1.109.0 2011.12.09 -
Jiangmin 13.0.900 2011.12.09 -
K7AntiVirus 9.119.5619 2011.12.07 -
Kaspersky 9.0.0.837 2011.12.09 -
McAfee 5.400.0.1158 2011.12.09 -
McAfee-GW-Edition 2010.1E 2011.12.09 -
Microsoft 1.7903 2011.12.09 -
NOD32 6691 2011.12.07 -
Norman 6.07.13 2011.12.09 -
nProtect 2011-12-09.01 2011.12.09 -
Panda 10.0.3.5 2011.12.09 -
PCTools 8.0.0.5 2011.12.09 -
Prevx 3.0 2011.12.09 -
Rising 23.87.03.02 2011.12.08 -
Sophos 4.72.0 2011.12.09 -
SUPERAntiSpyware 4.40.0.1006 2011.12.09 -
Symantec 20111.2.0.82 2011.12.09 -
TheHacker 6.7.0.1.353 2011.12.07 -
TrendMicro 9.500.0.1008 2011.12.09 -
TrendMicro-HouseCall 9.500.0.1008 2011.12.09 -
VBA32 3.12.16.4 2011.12.09 -
VIPRE 11223 2011.12.09 -
ViRobot 2011.12.9.4817 2011.12.09 -
VirusBuster 14.1.106.0 2011.12.08 -
Additional information
MD5 : cd40157a1a5cddc6ca219ab14a17692a
SHA1 : ecd4a6cac869218eb50d09e5c810aec989fd39d3
SHA256: d43153049c4a812a2f035cb3dd37d4f47e66b85921710f4db54c45585f5d3634

hmm,,
Teszteld le a
www.virustotal.com
c:\windows\system32\wscntfy.exe
itt majd klik>>Reanalyse
a linket a tesztrol tedd ide.

Es teszteld le
c:\windows\system32\drivers\1289918drv.sys
a linket a tesztrol tedd ide.

ComboFix 11-12-09.02 - Évi 011.12.09. 14:46:33.43.1 - x86 NETWORK
Microsoft Windows XP Professional 5.1.2600.3.1250.36.1038.18.511.364 [GMT 1:00]
Running from: c:\documents and settings\-vi\Asztal\ComboFix.exe
Command switches used :: c:\documents and settings\-vi\Asztal\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: PC Tools Firewall Plus *Disabled* {ABBD5028-5A95-4B6D-996E-98D64AE88D52}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\TEMP
c:\windows\CSC\d6
.
.
((((((((((((((((((((((((( Files Created from 2011-11-09 to 2011-12-09 )))))))))))))))))))))))))))))))
.
.
2011-12-08 17:53 . 2011-12-08 17:53 -------- d-----w- c:\documents and settings\Évi\Application Data\FriendsGamesNetwork
2011-12-03 18:02 . 2011-12-03 18:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Christmasville
2011-11-30 11:12 . 2011-11-30 11:12 -------- d-----w- c:\documents and settings\Évi\Local Settings\Application Data\STARGAZE_IMAGE_CACHE
2011-11-24 19:22 . 2011-11-25 10:43 -------- d-----w- c:\documents and settings\All Users\Application Data\RescueFrenzy
2011-11-23 17:12 . 2011-11-23 17:12 -------- d-----w- c:\documents and settings\Évi\Application Data\Big Fish Games
2011-11-22 18:39 . 2011-11-22 18:39 -------- d-----w- c:\documents and settings\Évi\Application Data\IronCode
2011-11-22 13:37 . 2011-11-22 13:37 -------- d-----w- c:\documents and settings\Évi\Application Data\GameCards
2011-11-18 19:42 . 2011-11-18 19:42 -------- d-----w- c:\documents and settings\Évi\Local Settings\Application Data\tabagames
2011-11-17 10:30 . 2011-11-17 10:30 -------- d-----w- c:\documents and settings\Évi\Application Data\Fanda Games
2011-11-11 10:45 . 2011-11-11 10:45 19416 ----a-w- c:\program files\Mozilla Firefox\AccessibleMarshal.dll
2011-11-11 10:45 . 2011-11-11 10:45 2106216 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2011-11-11 10:45 . 2011-11-11 10:45 134104 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2011-11-11 10:45 . 2011-11-11 10:45 125912 ----a-w- c:\program files\Mozilla Firefox\crashreporter.exe
2011-11-11 10:45 . 2011-11-11 10:45 1998168 ----a-w- c:\program files\Mozilla Firefox\d3dx9_43.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-28 18:01 . 2011-04-28 09:39 41184 ----a-w- c:\windows\avastSS.scr
2011-11-28 18:01 . 2011-04-28 09:39 199816 ----a-w- c:\windows\system32\aswBoot.exe
2011-11-28 17:53 . 2011-04-28 09:40 435032 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-11-28 17:53 . 2011-04-28 09:40 314456 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-11-28 17:52 . 2011-04-28 09:40 34392 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-11-28 17:52 . 2011-04-28 09:40 52952 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-11-28 17:52 . 2011-04-28 09:40 111320 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-11-28 17:51 . 2011-04-28 09:40 105176 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-11-28 17:51 . 2011-04-28 09:40 20568 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-11-28 17:48 . 2011-04-28 09:40 30808 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-10-10 14:22 . 2009-08-08 12:50 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-10-06 05:20 . 2011-10-06 05:35 475736 ------w- c:\windows\system32\drivers\7795807drv.sys
2011-10-02 14:36 . 2011-05-20 07:41 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-09-28 07:06 . 2009-08-08 12:50 602624 ----a-w- c:\windows\system32\crypt32.dll
2011-09-26 09:41 . 2008-07-29 17:59 613888 ----a-w- c:\windows\system32\uiautomationcore.dll
2011-09-26 09:41 . 2001-10-26 12:00 22016 ----a-w- c:\windows\system32\oleaccrc.dll
2011-09-26 09:41 . 2001-10-26 12:00 220160 ----a-w- c:\windows\system32\oleacc.dll
2011-09-16 19:07 . 2011-09-16 17:45 133208 ----a-w- c:\windows\system32\drivers\54188230.sys
2011-09-16 19:07 . 2011-09-16 17:44 475736 ----a-w- c:\windows\system32\drivers\0356777drv.sys
1998-06-26 18:18 . 2008-09-24 13:50 126 -c--a-w- c:\program files\Mk4.reg
2011-11-11 10:45 . 2011-11-11 10:45 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2004-08-17 . 93F75FF033BAA186D08115D73BFE3D32 . 13824 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\wscntfy.exe
[-] 2004-08-17 . 93F75FF033BAA186D08115D73BFE3D32 . 13824 . . [5.1.2600.2180] . . c:\windows\ServicePackFiles\i386\wscntfy.exe
[-] 2004-08-17 . 93F75FF033BAA186D08115D73BFE3D32 . 13824 . . [5.1.2600.2180] . . c:\windows\system32\wscntfy.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-11-28 18:01 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"00PCTFW"="c:\program files\PC Tools Firewall Plus\FirewallGUI.exe" [2011-04-07 2672600]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-11-28 3744552]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2009-03-08 128512]
.
c:\documents and settings\Évi\Start Menu\Programs\Indítópult\
_uninst_96306396.lnk - c:\documents and settings\Évi\Local Settings\temp\_uninst_96306396.bat [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"HideFastUserSwitching"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyDocs"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoSMMyDocs"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\aswAhAScr.dll]
2011-04-18 16:51 22016 ----a-w- c:\program files\AVAST Software\Avast\aswRegSvr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
2006-01-02 14:41 45056 ----a-w- c:\program files\ATI Technologies\ATI.ACE\CLI.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 16:02 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FlashPlayerUpdate]
2011-10-02 14:36 243360 ----a-w- c:\windows\system32\Macromed\Flash\FlashUtil10x_Plugin.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpwareSE4]
2006-03-21 12:19 69632 ----a-w- c:\program files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
.
R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [2010.11.23. 11:04 251560]
R3 pctNDIS;PC Tools Driver;c:\windows\system32\drivers\pctNdis.sys [2010.11.23. 11:03 57536]
S1 1289918drv;1289918drv;c:\windows\system32\drivers\1289918drv.sys [2011.07.12. 21:04 475736]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011.04.28. 10:40 435032]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2011.04.28. 10:40 314456]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2011.04.28. 10:40 20568]
S2 litsgt;litsgt;c:\windows\system32\drivers\litsgt.sys [2009.03.30. 15:01 137344]
S2 PCTAppEvent;PCTAppEvent Driver;c:\windows\system32\drivers\PCTAppEvent.sys [2010.11.23. 11:04 160576]
S3 ATHFMWDL;NETGEAR WPN111 Bootloader driver;c:\windows\system32\drivers\athwpn.sys [2010.02.20. 14:08 43392]
S3 cxbu0wdm;CardMan 3x21;c:\windows\system32\drivers\cxbu0wdm.sys [2009.06.24. 11:16 114304]
S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\system32\DNINDIS5.sys [2009.10.09. 18:00 17149]
S3 PCTFW-PacketFilter;PCTools Firewall - Packet filter driver;c:\windows\system32\drivers\pctNdis-PacketFilter.sys [2010.11.23. 11:03 89472]
S3 pctplfw;pctplfw;c:\windows\system32\drivers\pctplfw.sys [2010.11.23. 11:03 125248]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ezSharedSvc
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
IE: E&xportálás Microsoft Excel formátumba - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Easy-WebPrint – Gyors nyomtatás - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
IE: Easy-WebPrint – Hozzáadás a nyomtatási listához - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
IE: Easy-WebPrint – Nyomtatás - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
IE: Easy-WebPrint – Nyomtatási kép - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.0.1
DPF: {226ACC34-3194-40E2-9AE8-834FCFE9E80D} - hxxp://games.bigfishgames.com/en_myster ... .0.0.8.cab
DPF: {4DCA1E08-4147-4A3D-8CA6-E095DF189FAB} - hxxp://games.bigfishgames.com/en_nights ... .0.0.9.cab
FF - ProfilePath - c:\documents and settings\Évi\Application Data\Mozilla\Firefox\Profiles\dtyra91o.default\
FF - prefs.js: browser.search.defaulturl -
FF - prefs.js: browser.startup.homepage - hxxp://www.google.hu/
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-09 15:00
Windows 5.1.2600 Szervizcsomag 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(856)
c:\windows\system32\Ati2evxx.dll
.
- - - - - - - > 'explorer.exe'(128)
c:\windows\system32\WININET.dll
.
Completion time: 2011-12-09 15:04:41
ComboFix-quarantined-files.txt 2011-12-09 14:04
ComboFix2.txt 2011-12-09 11:44
ComboFix3.txt 2011-12-09 09:06
ComboFix4.txt 2011-12-08 20:56
.
Pre-Run: 46 013 018 112 bájt szabad
Post-Run: 45 983 248 384 bájt szabad
.
- - End Of File - - D2858B96C92DA51CB921902BF34D5DC5

Ugyes vagy, igy kel, ha nemmegy rendesen akkor csokkentet modban, ezt a scriptet is csinald csokkentet modban,

Script készítés:
Kinyitunk - Notepadot (Jegyzetfüzetet)igy: Start>futtatás>beírod: notepad
és bemásolod- a Kód: címszó alatt található zöld textet(Kód: szó nélkül), aztán a notepadba beillesztett textet elmentjük scriptnek az asztalra , úgy:- Fájl>Mentés Másként>Fájlnév>CFScript.txt>Fájl típusa>Minden fájl>Mentés.(Ásztálra),.Kész, az astalon lévő CFScript txt húzzunk rá a ComboFix ikonnyara. Es mostan megcsinalod eztett:

A combofix maga elindul es lehet hogy restartol es befejezi a scent.Amit majd ad ted ide.

Lehet,hogy haragudni fogsz,de csak csökkentett módban tudtam megcsinálni
mert,amikor ráhúztam elindult ugyan de a szokásos kék ablakot már nem adta be,
lefagyott.Ezért újraindítottam csökkentettbe ott már jó volt.Ezt adta:

ComboFix 11-12-09.02 - Évi 011.12.09. 12:11:01.42.1 - x86 NETWORK
Microsoft Windows XP Professional 5.1.2600.3.1250.36.1038.18.511.364 [GMT 1:00]
Running from: c:\documents and settings\Évi\Asztal\ComboFix.exe
Command switches used :: c:\documents and settings\Évi\Asztal\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: PC Tools Firewall Plus *Enabled* {ABBD5028-5A95-4B6D-996E-98D64AE88D52}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\TEMP
c:\windows\CSC\d6
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_36098572
-------\Legacy_SETUP_9.0.0.722_21.06.2011_11-00DRV
-------\Service_36098572
-------\Service_setup_9.0.0.722_21.06.2011_11-00drv
.
.
((((((((((((((((((((((((( Files Created from 2011-11-09 to 2011-12-09 )))))))))))))))))))))))))))))))
.
.
2011-12-09 11:29 . 2011-12-09 11:30 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2011-12-08 17:53 . 2011-12-08 17:53 -------- d-----w- c:\documents and settings\Évi\Application Data\FriendsGamesNetwork
2011-12-03 18:02 . 2011-12-03 18:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Christmasville
2011-11-30 11:12 . 2011-11-30 11:12 -------- d-----w- c:\documents and settings\Évi\Local Settings\Application Data\STARGAZE_IMAGE_CACHE
2011-11-24 19:22 . 2011-11-25 10:43 -------- d-----w- c:\documents and settings\All Users\Application Data\RescueFrenzy
2011-11-23 17:12 . 2011-11-23 17:12 -------- d-----w- c:\documents and settings\Évi\Application Data\Big Fish Games
2011-11-22 18:39 . 2011-11-22 18:39 -------- d-----w- c:\documents and settings\Évi\Application Data\IronCode
2011-11-22 13:37 . 2011-11-22 13:37 -------- d-----w- c:\documents and settings\Évi\Application Data\GameCards
2011-11-18 19:42 . 2011-11-18 19:42 -------- d-----w- c:\documents and settings\Évi\Local Settings\Application Data\tabagames
2011-11-17 10:30 . 2011-11-17 10:30 -------- d-----w- c:\documents and settings\Évi\Application Data\Fanda Games
2011-11-11 10:45 . 2011-11-11 10:45 19416 ----a-w- c:\program files\Mozilla Firefox\AccessibleMarshal.dll
2011-11-11 10:45 . 2011-11-11 10:45 2106216 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2011-11-11 10:45 . 2011-11-11 10:45 134104 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2011-11-11 10:45 . 2011-11-11 10:45 125912 ----a-w- c:\program files\Mozilla Firefox\crashreporter.exe
2011-11-11 10:45 . 2011-11-11 10:45 1998168 ----a-w- c:\program files\Mozilla Firefox\d3dx9_43.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-28 18:01 . 2011-04-28 09:39 41184 ----a-w- c:\windows\avastSS.scr
2011-11-28 18:01 . 2011-04-28 09:39 199816 ----a-w- c:\windows\system32\aswBoot.exe
2011-11-28 17:53 . 2011-04-28 09:40 435032 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-11-28 17:53 . 2011-04-28 09:40 314456 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-11-28 17:52 . 2011-04-28 09:40 34392 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-11-28 17:52 . 2011-04-28 09:40 52952 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-11-28 17:52 . 2011-04-28 09:40 111320 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-11-28 17:51 . 2011-04-28 09:40 105176 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-11-28 17:51 . 2011-04-28 09:40 20568 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-11-28 17:48 . 2011-04-28 09:40 30808 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-10-10 14:22 . 2009-08-08 12:50 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-10-06 05:20 . 2011-10-06 05:35 475736 ------w- c:\windows\system32\drivers\7795807drv.sys
2011-10-02 14:36 . 2011-05-20 07:41 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-09-28 07:06 . 2009-08-08 12:50 602624 ----a-w- c:\windows\system32\crypt32.dll
2011-09-26 09:41 . 2008-07-29 17:59 613888 ----a-w- c:\windows\system32\uiautomationcore.dll
2011-09-26 09:41 . 2001-10-26 12:00 22016 ----a-w- c:\windows\system32\oleaccrc.dll
2011-09-26 09:41 . 2001-10-26 12:00 220160 ----a-w- c:\windows\system32\oleacc.dll
2011-09-16 19:07 . 2011-09-16 17:45 133208 ----a-w- c:\windows\system32\drivers\54188230.sys
2011-09-16 19:07 . 2011-09-16 17:44 475736 ----a-w- c:\windows\system32\drivers\0356777drv.sys
1998-06-26 18:18 . 2008-09-24 13:50 126 -c--a-w- c:\program files\Mk4.reg
2011-11-11 10:45 . 2011-11-11 10:45 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-11-28 18:01 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"00PCTFW"="c:\program files\PC Tools Firewall Plus\FirewallGUI.exe" [2011-04-07 2672600]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-11-28 3744552]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2009-03-08 128512]
.
c:\documents and settings\Évi\Start Menu\Programs\Indítópult\
_uninst_96306396.lnk - c:\documents and settings\Évi\Local Settings\temp\_uninst_96306396.bat [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"HideFastUserSwitching"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyDocs"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoSMMyDocs"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\aswAhAScr.dll]
2011-04-18 16:51 22016 ----a-w- c:\program files\AVAST Software\Avast\aswRegSvr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
2006-01-02 14:41 45056 ----a-w- c:\program files\ATI Technologies\ATI.ACE\CLI.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 16:02 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FlashPlayerUpdate]
2011-10-02 14:36 243360 ----a-w- c:\windows\system32\Macromed\Flash\FlashUtil10x_Plugin.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpwareSE4]
2006-03-21 12:19 69632 ----a-w- c:\program files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
.
R1 1289918drv;1289918drv;c:\windows\system32\DRIVERS\1289918drv.sys [2011-07-12 475736]
R3 ATHFMWDL;NETGEAR WPN111 Bootloader driver;c:\windows\system32\Drivers\athwpn.sys [2004-10-14 43392]
R3 cxbu0wdm;CardMan 3x21;c:\windows\system32\DRIVERS\cxbu0wdm.sys [2009-06-24 114304]
R3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\system32\DNINDIS5.SYS [2003-07-24 17149]
R3 nosGetPlusHelper;getPlus(R) Helper 3004;c:\windows\System32\svchost.exe [2008-04-14 14336]
R3 WPN111;Wireless USB 2.0 Adapter with RangeMax Service;c:\windows\system32\DRIVERS\WPN111.sys [2005-01-07 286720]
R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [2011-01-17 251560]
S2 aswFsBlk;aswFsBlk; [x]
S2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe [2008-04-14 14336]
S2 litsgt;litsgt;c:\windows\system32\DRIVERS\litsgt.sys [2009-03-30 137344]
S2 PCTAppEvent;PCTAppEvent Driver;c:\windows\system32\drivers\PCTAppEvent.sys [2011-03-02 160576]
S2 tansgt;tansgt;c:\windows\system32\DRIVERS\tansgt.sys [2009-03-30 12032]
S3 PCTFW-PacketFilter;PCTools Firewall - Packet filter driver;c:\windows\system32\drivers\pctNdis-PacketFilter.sys [2011-01-12 89472]
S3 pctNDIS;PC Tools Driver;c:\windows\system32\DRIVERS\pctNdis.sys [2010-07-08 57536]
S3 pctplfw;pctplfw;c:\windows\system32\drivers\pctplfw.sys [2011-01-17 125248]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ezSharedSvc
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
IE: E&xportálás Microsoft Excel formátumba - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Easy-WebPrint – Gyors nyomtatás - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
IE: Easy-WebPrint – Hozzáadás a nyomtatási listához - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
IE: Easy-WebPrint – Nyomtatás - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
IE: Easy-WebPrint – Nyomtatási kép - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.0.1
DPF: {226ACC34-3194-40E2-9AE8-834FCFE9E80D} - hxxp://games.bigfishgames.com/en_myster ... .0.0.8.cab
DPF: {4DCA1E08-4147-4A3D-8CA6-E095DF189FAB} - hxxp://games.bigfishgames.com/en_nights ... .0.0.9.cab
FF - ProfilePath - c:\documents and settings\Évi\Application Data\Mozilla\Firefox\Profiles\dtyra91o.default\
FF - prefs.js: browser.search.defaulturl -
FF - prefs.js: browser.startup.homepage - hxxp://www.google.hu/
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-09 12:29
Windows 5.1.2600 Szervizcsomag 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(1000)
c:\windows\system32\Ati2evxx.dll
.
- - - - - - - > 'explorer.exe'(180)
c:\windows\system32\WININET.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\System32\SCardSvr.exe
c:\program files\Windows Live\Family Safety\fsssvc.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\PC Tools Firewall Plus\FWService.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
.
**************************************************************************
.
Completion time: 2011-12-09 12:44:22 - machine was rebooted
ComboFix-quarantined-files.txt 2011-12-09 11:44
ComboFix2.txt 2011-12-09 09:06
ComboFix3.txt 2011-12-08 20:56
.
Pre-Run: 46 140 952 576 bájt szabad
Post-Run: 45 928 218 624 bájt szabad
.
- - End Of File - - AF357E64F50DB0BA72B576F2D4C46F22

A combofixet tedd at az ASZTALRA
Script készítés:
Kinyitunk - Notepadot (Jegyzetfüzetet)igy: Start>futtatás>beírod: notepad
és bemásolod- a Kód: címszó alatt található zöld textet(Kód: szó nélkül), aztán a notepadba beillesztett textet elmentjük scriptnek az asztalra , úgy:- Fájl>Mentés Másként>Fájlnév>CFScript.txt>Fájl típusa>Minden fájl>Mentés.(Ásztálra),.Kész, az astalon lévő CFScript txt húzzunk rá a ComboFix ikonnyara. Es mostan megcsinalod eztett:

A combofix maga elindul es lehet hogy restartol es befejezi a scent.Amit majd ad ted ide.

Sajnos a nevet nem jegyeztem meg,a frászt hozta rám az az ablak csak annyit,hogy rootkit
nagyon veszélyes azonnal töröljem.Utána kerestem az avastban valami naplófélét
ahol megtudnám nézni,hogy mi volt de sehol sem találtam róla semmit.

A combo fix lehet hogy nem azt adta amit kellett volna ,mert amikor ráhúztam elindult ugyan
de kérte, hogy frissítsem és újra el kellett fogadnom a licencet is.
ComboFix 11-12-09.02 - Évi 011.12.09. 9:37.41.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1250.36.1038.18.511.321 [GMT 1:00]
Running from: c:\combofix\ComboFix.exe
Command switches used :: c:\documents and settings\-vi\Asztal\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: PC Tools Firewall Plus *Disabled* {ABBD5028-5A95-4B6D-996E-98D64AE88D52}
.
.
((((((((((((((((((((((((( Files Created from 2011-11-09 to 2011-12-09 )))))))))))))))))))))))))))))))
.
.
2011-12-09 06:18 . 2011-12-09 06:20 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2011-12-08 17:53 . 2011-12-08 17:53 -------- d-----w- c:\documents and settings\Évi\Application Data\FriendsGamesNetwork
2011-12-03 18:02 . 2011-12-03 18:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Christmasville
2011-11-30 11:12 . 2011-11-30 11:12 -------- d-----w- c:\documents and settings\Évi\Local Settings\Application Data\STARGAZE_IMAGE_CACHE
2011-11-24 19:22 . 2011-11-25 10:43 -------- d-----w- c:\documents and settings\All Users\Application Data\RescueFrenzy
2011-11-23 17:12 . 2011-11-23 17:12 -------- d-----w- c:\documents and settings\Évi\Application Data\Big Fish Games
2011-11-22 18:39 . 2011-11-22 18:39 -------- d-----w- c:\documents and settings\Évi\Application Data\IronCode
2011-11-22 13:37 . 2011-11-22 13:37 -------- d-----w- c:\documents and settings\Évi\Application Data\GameCards
2011-11-18 19:42 . 2011-11-18 19:42 -------- d-----w- c:\documents and settings\Évi\Local Settings\Application Data\tabagames
2011-11-17 10:30 . 2011-11-17 10:30 -------- d-----w- c:\documents and settings\Évi\Application Data\Fanda Games
2011-11-11 10:45 . 2011-11-11 10:45 19416 ----a-w- c:\program files\Mozilla Firefox\AccessibleMarshal.dll
2011-11-11 10:45 . 2011-11-11 10:45 2106216 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2011-11-11 10:45 . 2011-11-11 10:45 134104 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2011-11-11 10:45 . 2011-11-11 10:45 125912 ----a-w- c:\program files\Mozilla Firefox\crashreporter.exe
2011-11-11 10:45 . 2011-11-11 10:45 1998168 ----a-w- c:\program files\Mozilla Firefox\d3dx9_43.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-28 18:01 . 2011-04-28 09:39 41184 ----a-w- c:\windows\avastSS.scr
2011-11-28 18:01 . 2011-04-28 09:39 199816 ----a-w- c:\windows\system32\aswBoot.exe
2011-11-28 17:53 . 2011-04-28 09:40 435032 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-11-28 17:53 . 2011-04-28 09:40 314456 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-11-28 17:52 . 2011-04-28 09:40 34392 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-11-28 17:52 . 2011-04-28 09:40 52952 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-11-28 17:52 . 2011-04-28 09:40 111320 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-11-28 17:51 . 2011-04-28 09:40 105176 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-11-28 17:51 . 2011-04-28 09:40 20568 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-11-28 17:48 . 2011-04-28 09:40 30808 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-10-10 14:22 . 2009-08-08 12:50 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-10-06 05:20 . 2011-10-06 05:35 475736 ------w- c:\windows\system32\drivers\7795807drv.sys
2011-10-02 14:36 . 2011-05-20 07:41 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-09-28 07:06 . 2009-08-08 12:50 602624 ----a-w- c:\windows\system32\crypt32.dll
2011-09-26 09:41 . 2008-07-29 17:59 613888 ----a-w- c:\windows\system32\uiautomationcore.dll
2011-09-26 09:41 . 2001-10-26 12:00 22016 ----a-w- c:\windows\system32\oleaccrc.dll
2011-09-26 09:41 . 2001-10-26 12:00 220160 ----a-w- c:\windows\system32\oleacc.dll
2011-09-16 19:07 . 2011-09-16 17:45 133208 ----a-w- c:\windows\system32\drivers\54188230.sys
2011-09-16 19:07 . 2011-09-16 17:44 475736 ----a-w- c:\windows\system32\drivers\0356777drv.sys
1998-06-26 18:18 . 2008-09-24 13:50 126 -c--a-w- c:\program files\Mk4.reg
2011-11-11 10:45 . 2011-11-11 10:45 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2004-08-17 . 93F75FF033BAA186D08115D73BFE3D32 . 13824 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\wscntfy.exe
[-] 2004-08-17 . 93F75FF033BAA186D08115D73BFE3D32 . 13824 . . [5.1.2600.2180] . . c:\windows\ServicePackFiles\i386\wscntfy.exe
[-] 2004-08-17 . 93F75FF033BAA186D08115D73BFE3D32 . 13824 . . [5.1.2600.2180] . . c:\windows\system32\wscntfy.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-11-28 18:01 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"00PCTFW"="c:\program files\PC Tools Firewall Plus\FirewallGUI.exe" [2011-04-07 2672600]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-11-28 3744552]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2009-03-08 128512]
.
c:\documents and settings\Évi\Start Menu\Programs\Indítópult\
_uninst_96306396.lnk - c:\documents and settings\Évi\Local Settings\temp\_uninst_96306396.bat [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"HideFastUserSwitching"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyDocs"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoSMMyDocs"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\aswAhAScr.dll]
2011-04-18 16:51 22016 ----a-w- c:\program files\AVAST Software\Avast\aswRegSvr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
2006-01-02 14:41 45056 ----a-w- c:\program files\ATI Technologies\ATI.ACE\CLI.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 16:02 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FlashPlayerUpdate]
2011-10-02 14:36 243360 ----a-w- c:\windows\system32\Macromed\Flash\FlashUtil10x_Plugin.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpwareSE4]
2006-03-21 12:19 69632 ----a-w- c:\program files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
.
R0 36098572;36098572 Boot Guard Driver;c:\windows\system32\drivers\36098572.sys [2011.06.21. 8:29 37392]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011.04.28. 10:40 435032]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2011.04.28. 10:40 314456]
R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [2010.11.23. 11:04 251560]
R1 setup_9.0.0.722_21.06.2011_11-00drv;setup_9.0.0.722_21.06.2011_11-00drv;c:\windows\system32\drivers\3609857.sys [2011.06.21. 8:29 315408]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2011.04.28. 10:40 20568]
R2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe -k netsvcs [2009.08.08. 13:50 14336]
R2 litsgt;litsgt;c:\windows\system32\drivers\litsgt.sys [2009.03.30. 15:01 137344]
R2 PCTAppEvent;PCTAppEvent Driver;c:\windows\system32\drivers\PCTAppEvent.sys [2010.11.23. 11:04 160576]
R2 tansgt;tansgt;c:\windows\system32\drivers\tansgt.sys [2009.03.30. 15:01 12032]
R3 PCTFW-PacketFilter;PCTools Firewall - Packet filter driver;c:\windows\system32\drivers\pctNdis-PacketFilter.sys [2010.11.23. 11:03 89472]
R3 pctNDIS;PC Tools Driver;c:\windows\system32\drivers\pctNdis.sys [2010.11.23. 11:03 57536]
R3 pctplfw;pctplfw;c:\windows\system32\drivers\pctplfw.sys [2010.11.23. 11:03 125248]
S1 1289918drv;1289918drv;c:\windows\system32\drivers\1289918drv.sys [2011.07.12. 21:04 475736]
S3 ATHFMWDL;NETGEAR WPN111 Bootloader driver;c:\windows\system32\drivers\athwpn.sys [2010.02.20. 14:08 43392]
S3 cxbu0wdm;CardMan 3x21;c:\windows\system32\drivers\cxbu0wdm.sys [2009.06.24. 11:16 114304]
S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\system32\DNINDIS5.sys [2009.10.09. 18:00 17149]
S3 nosGetPlusHelper;getPlus(R) Helper 3004;c:\windows\System32\svchost.exe -k nosGetPlusHelper [2009.08.08. 13:50 14336]
S3 WPN111;Wireless USB 2.0 Adapter with RangeMax Service;c:\windows\system32\drivers\WPN111.sys [2010.02.20. 14:08 286720]
S4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys --> c:\windows\system32\Drivers\sptd.sys [?]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ezSharedSvc
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
IE: E&xportálás Microsoft Excel formátumba - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Easy-WebPrint – Gyors nyomtatás - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
IE: Easy-WebPrint – Hozzáadás a nyomtatási listához - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
IE: Easy-WebPrint – Nyomtatás - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
IE: Easy-WebPrint – Nyomtatási kép - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.0.1
DPF: {226ACC34-3194-40E2-9AE8-834FCFE9E80D} - hxxp://games.bigfishgames.com/en_myster ... .0.0.8.cab
DPF: {4DCA1E08-4147-4A3D-8CA6-E095DF189FAB} - hxxp://games.bigfishgames.com/en_nights ... .0.0.9.cab
FF - ProfilePath - c:\documents and settings\Évi\Application Data\Mozilla\Firefox\Profiles\dtyra91o.default\
FF - prefs.js: browser.search.defaulturl -
FF - prefs.js: browser.startup.homepage - hxxp://www.google.hu/
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-09 09:58
Windows 5.1.2600 Szervizcsomag 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(1004)
c:\windows\system32\Ati2evxx.dll
.
- - - - - - - > 'explorer.exe'(3904)
c:\windows\system32\WININET.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
Completion time: 2011-12-09 10:06:08
ComboFix-quarantined-files.txt 2011-12-09 09:06
ComboFix2.txt 2011-12-08 20:56
.
Pre-Run: 46 160 470 016 bájt szabad
Post-Run: 46 131 572 736 bájt szabad
.
- - End Of File - - 7B123A0DF4460744ED0DF2A24F75BA54

Szia.
Evi

Rootkit, tudnom kell hogy mijen rootkitet toroltel a nevet, mert az Avastnak, most eppen volt hamis Rootkit riasztasa.

De ezen felul csinald meg eztet.
Script készítés:
Kinyitunk - Notepadot (Jegyzetfüzetet)igy: Start>futtatás>beírod: notepad
és bemásolod- a Kód: címszó alatt található zöld textet(Kód: szó nélkül), aztán a notepadba beillesztett textet elmentjük scriptnek az asztalra , úgy:- Fájl>Mentés Másként>Fájlnév>CFScript.txt>Fájl típusa>Minden fájl>Mentés.(Ásztálra),.Kész, az astalon lévő CFScript txt húzzunk rá a ComboFix ikonnyara. Es mostan megcsinalod eztett:

A combofix maga elindul es lehet hogy restartol es befejezi a scent.Amit majd ad ted ide.

Szia.
amcsi
Nyisal uj topicot es tedd oda az RSIT logjat.
http://www.virus-stell.com/2010/04/rsit.html

Szia Stell!

Látom akad munkád bőven,és most még én is segítséget kérnék.
Sajnos nekem a Télapó egy Avast piros riasztást hozott,hogy valami rotkit vírus van és azonnal töröljem,
mindezt úgy, hogy rögtön a gép betöltése után tehát még semmilyen programot vagy böngészőt nem indítottam.
Azonnal a törlésre mentem akkor azt írta,hogy indítsam újra a gépet és iktassam be a rendszerbetöltés előtti vizsgálatot.
Ezt is megtettem,akkor már nem jelzett semmit,viszont a net nagyon lassú maradt,tegnap este kikapcsolás előtt
lefuttattam a Combo fixet (ma már jóval gyorsabb,szinte minden rendesen működik) .
Szeretném ha megnéznéd a logot,hogy valóban minden rendben van e.
Természetesen ha lesz rá időd,előre is köszönöm!

ComboFix 11-12-08.01 - Évi 011.12.08. 21:30:31.40.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1250.36.1038.18.511.250 [GMT 1:00]
Running from: c:\documents and settings\-vi\Asztal\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: PC Tools Firewall Plus *Disabled* {ABBD5028-5A95-4B6D-996E-98D64AE88D52}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\TEMP
c:\windows\CSC\d6
c:\windows\system32\msssc.dll
.
.
((((((((((((((((((((((((( Files Created from 2011-11-08 to 2011-12-08 )))))))))))))))))))))))))))))))
.
.
2011-12-08 17:53 . 2011-12-08 17:53 -------- d-----w- c:\documents and settings\Évi\Application Data\FriendsGamesNetwork
2011-12-03 18:02 . 2011-12-03 18:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Christmasville
2011-11-30 11:12 . 2011-11-30 11:12 -------- d-----w- c:\documents and settings\Évi\Local Settings\Application Data\STARGAZE_IMAGE_CACHE
2011-11-24 19:22 . 2011-11-25 10:43 -------- d-----w- c:\documents and settings\All Users\Application Data\RescueFrenzy
2011-11-23 17:12 . 2011-11-23 17:12 -------- d-----w- c:\documents and settings\Évi\Application Data\Big Fish Games
2011-11-22 18:39 . 2011-11-22 18:39 -------- d-----w- c:\documents and settings\Évi\Application Data\IronCode
2011-11-22 13:37 . 2011-11-22 13:37 -------- d-----w- c:\documents and settings\Évi\Application Data\GameCards
2011-11-18 19:42 . 2011-11-18 19:42 -------- d-----w- c:\documents and settings\Évi\Local Settings\Application Data\tabagames
2011-11-17 10:30 . 2011-11-17 10:30 -------- d-----w- c:\documents and settings\Évi\Application Data\Fanda Games
2011-11-11 10:45 . 2011-11-11 10:45 19416 ----a-w- c:\program files\Mozilla Firefox\AccessibleMarshal.dll
2011-11-11 10:45 . 2011-11-11 10:45 2106216 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2011-11-11 10:45 . 2011-11-11 10:45 134104 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2011-11-11 10:45 . 2011-11-11 10:45 125912 ----a-w- c:\program files\Mozilla Firefox\crashreporter.exe
2011-11-11 10:45 . 2011-11-11 10:45 1998168 ----a-w- c:\program files\Mozilla Firefox\d3dx9_43.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-28 18:01 . 2011-04-28 09:39 41184 ----a-w- c:\windows\avastSS.scr
2011-11-28 18:01 . 2011-04-28 09:39 199816 ----a-w- c:\windows\system32\aswBoot.exe
2011-11-28 17:53 . 2011-04-28 09:40 435032 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-11-28 17:53 . 2011-04-28 09:40 314456 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-11-28 17:52 . 2011-04-28 09:40 34392 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-11-28 17:52 . 2011-04-28 09:40 52952 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-11-28 17:52 . 2011-04-28 09:40 111320 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-11-28 17:51 . 2011-04-28 09:40 105176 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-11-28 17:51 . 2011-04-28 09:40 20568 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-11-28 17:48 . 2011-04-28 09:40 30808 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-10-10 14:22 . 2009-08-08 12:50 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-10-06 05:20 . 2011-10-06 05:35 475736 ------w- c:\windows\system32\drivers\7795807drv.sys
2011-10-02 14:36 . 2011-05-20 07:41 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-09-28 07:06 . 2009-08-08 12:50 602624 ----a-w- c:\windows\system32\crypt32.dll
2011-09-26 09:41 . 2008-07-29 17:59 613888 ----a-w- c:\windows\system32\uiautomationcore.dll
2011-09-26 09:41 . 2001-10-26 12:00 22016 ----a-w- c:\windows\system32\oleaccrc.dll
2011-09-26 09:41 . 2001-10-26 12:00 220160 ----a-w- c:\windows\system32\oleacc.dll
2011-09-16 19:07 . 2011-09-16 17:45 133208 ----a-w- c:\windows\system32\drivers\54188230.sys
2011-09-16 19:07 . 2011-09-16 17:44 475736 ----a-w- c:\windows\system32\drivers\0356777drv.sys
1998-06-26 18:18 . 2008-09-24 13:50 126 -c--a-w- c:\program files\Mk4.reg
2011-11-11 10:45 . 2011-11-11 10:45 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2004-08-17 . 93F75FF033BAA186D08115D73BFE3D32 . 13824 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\wscntfy.exe
[-] 2004-08-17 . 93F75FF033BAA186D08115D73BFE3D32 . 13824 . . [5.1.2600.2180] . . c:\windows\ServicePackFiles\i386\wscntfy.exe
[-] 2004-08-17 . 93F75FF033BAA186D08115D73BFE3D32 . 13824 . . [5.1.2600.2180] . . c:\windows\system32\wscntfy.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-11-28 18:01 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"00PCTFW"="c:\program files\PC Tools Firewall Plus\FirewallGUI.exe" [2011-04-07 2672600]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-11-28 3744552]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2009-03-08 128512]
.
c:\documents and settings\Évi\Start Menu\Programs\Indítópult\
_uninst_96306396.lnk - c:\documents and settings\Évi\Local Settings\temp\_uninst_96306396.bat [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"HideFastUserSwitching"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyDocs"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoSMMyDocs"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\aswAhAScr.dll]
2011-04-18 16:51 22016 ----a-w- c:\program files\AVAST Software\Avast\aswRegSvr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
2006-01-02 14:41 45056 ----a-w- c:\program files\ATI Technologies\ATI.ACE\CLI.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 16:02 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FlashPlayerUpdate]
2011-10-02 14:36 243360 ----a-w- c:\windows\system32\Macromed\Flash\FlashUtil10x_Plugin.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpwareSE4]
2006-03-21 12:19 69632 ----a-w- c:\program files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
.
R1 1289918drv;1289918drv;c:\windows\system32\DRIVERS\1289918drv.sys [2011-07-12 475736]
R3 ATHFMWDL;NETGEAR WPN111 Bootloader driver;c:\windows\system32\Drivers\athwpn.sys [2004-10-14 43392]
R3 cxbu0wdm;CardMan 3x21;c:\windows\system32\DRIVERS\cxbu0wdm.sys [2009-06-24 114304]
R3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\system32\DNINDIS5.SYS [2003-07-24 17149]
R3 nosGetPlusHelper;getPlus(R) Helper 3004;c:\windows\System32\svchost.exe [2008-04-14 14336]
R3 WPN111;Wireless USB 2.0 Adapter with RangeMax Service;c:\windows\system32\DRIVERS\WPN111.sys [2005-01-07 286720]
R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S0 36098572;36098572 Boot Guard Driver;c:\windows\system32\DRIVERS\36098572.sys [2009-10-22 37392]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [2011-01-17 251560]
S1 setup_9.0.0.722_21.06.2011_11-00drv;setup_9.0.0.722_21.06.2011_11-00drv;c:\windows\system32\DRIVERS\3609857.sys [2009-10-09 315408]
S2 aswFsBlk;aswFsBlk; [x]
S2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe [2008-04-14 14336]
S2 litsgt;litsgt;c:\windows\system32\DRIVERS\litsgt.sys [2009-03-30 137344]
S2 PCTAppEvent;PCTAppEvent Driver;c:\windows\system32\drivers\PCTAppEvent.sys [2011-03-02 160576]
S2 tansgt;tansgt;c:\windows\system32\DRIVERS\tansgt.sys [2009-03-30 12032]
S3 PCTFW-PacketFilter;PCTools Firewall - Packet filter driver;c:\windows\system32\drivers\pctNdis-PacketFilter.sys [2011-01-12 89472]
S3 pctNDIS;PC Tools Driver;c:\windows\system32\DRIVERS\pctNdis.sys [2010-07-08 57536]
S3 pctplfw;pctplfw;c:\windows\system32\drivers\pctplfw.sys [2011-01-17 125248]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ezSharedSvc
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
IE: E&xportálás Microsoft Excel formátumba - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Easy-WebPrint – Gyors nyomtatás - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
IE: Easy-WebPrint – Hozzáadás a nyomtatási listához - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
IE: Easy-WebPrint – Nyomtatás - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
IE: Easy-WebPrint – Nyomtatási kép - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.0.1
DPF: {226ACC34-3194-40E2-9AE8-834FCFE9E80D} - hxxp://games.bigfishgames.com/en_myster ... .0.0.8.cab
DPF: {4DCA1E08-4147-4A3D-8CA6-E095DF189FAB} - hxxp://games.bigfishgames.com/en_nights ... .0.0.9.cab
FF - ProfilePath - c:\documents and settings\Évi\Application Data\Mozilla\Firefox\Profiles\dtyra91o.default\
FF - prefs.js: browser.search.defaulturl -
FF - prefs.js: browser.startup.homepage - hxxp://www.google.hu/
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-08 21:48
Windows 5.1.2600 Szervizcsomag 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(1004)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2011-12-08 21:56:17
ComboFix-quarantined-files.txt 2011-12-08 20:56
.
Pre-Run: 46 276 890 624 bájt szabad
Post-Run: 46 212 435 968 bájt szabad
.
- - End Of File - - EE49F5B494ED28BE0FA1559EDECF080E

2011-12-08 20:42:37 . 2011-12-08 20:42:37 8,872 ----a-w- C:\Qoobox\Quarantine\Registry_backups\tcpip.reg
2011-12-08 20:25:43 . 2011-12-08 20:25:43 51 ----a-w- C:\Qoobox\Quarantine\catchme.log
2008-08-19 09:16:33 . 2008-08-19 09:16:33 44 -c--a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\msssc.dll.vir

Szia Stell!

Rég jártam erre, de most ismét szükségem lenne a segítségedre. )

Egy hete kb nagyon belassult a gép. Drága fiam töltött le valami játékot, nem volt jó, le is töröltük. De azóta nagyon lassú lett.
Újra telepítettem a Firefoxot is, gondoltam megoldódik, de sajnos nem. Azóta eltűntek a könyvjelzők is, amit most elmentek, újraindítás után nincsenek meg.
Lefuttattam reggel az eset online scannert, kíváncsi voltam. 18 fertőzött fájlt talált, ebből 16-ot tudott is törölni elvileg. A maradék kettőt nem.
Több, mint egy éve lett újratelepítve a gép, eddig jól ment. Avastot feltettem akkor, de le is töröltem, mert nagyon belassította a gépet.
Tudom, hogy kellene, de nem bírja el a rendszer. Még mindig nem vettem jobb gépet.. Fene tudja, netezésre nekem jó ez is. Szóval tudnál nekem segíteni megint?

Igen, sokk hozza nem erto ajnlja ezt a Kinai szemetet, ez hasonloan mukszik mint a hamis kem program, ha lefuttatod talal olyanokat is ami nincsen is a gepen, ez taktika, sok talalat es sok hozza nem erto azt hisszi hogy ez igen jo program, es ez kozben csak at veres, es az adat bazisat osze lopkodtak, tehat ez olyan mint minden kinai, ,,

Amugy az AVG, se a legjobb valasztas.,
De ha jol megy akkor mar nem bantscsuk a gepet.
Udv.

Köszönöm stell javult a helyzet....
Amúgy ajánlották az ad avancedet kipróbáltam nem jött be.
Mégegyszer köszi...

Udv
A privát üzenetbe írtam mit csinálj,az-az, nyis uj Temat, es tedd Oda a TDSSKILLER naplojat, amit a Laci cimbora irt kiprobalhatod, de ha ujra rakod a gepet, miert nem raksz uj particiot is??

sunez
Na mia helyzet mostan??

Pedig le van írva a honlapon mit kell csinálni.

De itt van amit magamnak elmentettem:

0. letölteni: http://www.esagelab.com/files/bootkit_remover.rar
1. Kibontani egy mappába a remover.exe-t (ha kell, a readme_en.txt-t is)
2. Futtatni a remover.exe-t (Rendszergazda-ként). Újabban más néven is lehet letölteni (pl: boot_cleaner.exe), átnevezhető remover.exe -re.
3. Ha az ablakban a zöld színü "OK (DOS/Win32 Boot code found)" látható, akkor a gép tiszta. Ha a piros "Unknown boot code" látható, a gép fertőzött.
4. Ha fertőzött lenne, a fix.bat-ot futtatni (előtte bezárni a remover.exe ablakot).
5. A gépet újraindítani, a tűzfal hibajelezést fog adni, mivel nem tud betöltődni. A felbukkanó ablakkal megint újraindítani a gépet.
6. Újra futtatni a remover.exe-t.
7. Ekkor már az "OK (DOS/Win32 Boot code found)"-nak kell látszani.
8. Evvel kész a vizsgálat/tisztítás.
9. A futtatás alatt a remover.exe készít (ha van felülírja) egy bootkit_remover_debug_log.txt fájlt, amiben minden művelet látható.

A fix.bat három merevlemezre van megírva, ha kevesebb van, törölhető(k) az(ok) a sor(ok), ami nem kell(enek), de ha marad(nak) az sem baj. Ilyenkor a futtatáskor ezekre a sorokra hibát jelez, de ez nem érdekes, át kell lépni.

fix.bat tartalma (Notepad-dal létrehozni, és ánevezni)

ComboFix 11-12-05.02 - sunez 011.12.05. 19:58:50.1.2 - x86
Microsoft Windows 7 Professional 6.1.7601.1.1250.36.1038.18.3328.2041 [GMT 1:00]
Running from: c:\users\sunez\Desktop\ComboFix.exe
AV: AVG Internet Security 2012 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
FW: AVG Firewall *Enabled* {621CC794-9486-F902-D092-0484E8EA828B}
SP: AVG Internet Security 2012 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\sunez\AppData\Local\Temp\b3ac04aa-9413-4ecb-ac45-ed44495e62a6\CliSecureRT.dll
c:\users\sunez\AppData\Local\TempDIR
c:\users\sunez\AppData\Local\TempDIR\BetterInstaller.exe
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
c:\windows\system32\muzapp.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-11-05 to 2011-12-05 )))))))))))))))))))))))))))))))
.
.
2011-12-05 19:03 . 2011-12-05 19:03 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-12-05 19:03 . 2011-12-05 19:12 -------- d-----w- c:\users\sunez\AppData\Local\temp
2011-12-05 18:50 . 2011-12-05 18:50 -------- d-----w- c:\program files\CCleaner
2011-12-05 14:20 . 2011-12-05 14:20 -------- d-----w- C:\rsit
2011-12-05 14:20 . 2011-12-05 14:20 -------- d-----w- c:\program files\trend micro
2011-11-27 11:07 . 2011-11-27 11:07 -------- d-----w- C:\Temp
2011-11-27 10:53 . 2011-11-27 10:53 -------- d-----w- c:\program files\MyFree Codec
2011-11-27 10:39 . 2011-10-27 01:25 10344 ----a-w- c:\windows\system32\drivers\ssadwhnt.sys
2011-11-27 10:39 . 2011-10-27 01:25 30312 ----a-w- c:\windows\system32\drivers\ssadadb.sys
2011-11-27 10:39 . 2011-10-27 01:25 136808 ----a-w- c:\windows\system32\drivers\ssadmdm.sys
2011-11-27 10:39 . 2011-10-27 01:25 12776 ----a-w- c:\windows\system32\drivers\ssadmdfl.sys
2011-11-27 10:39 . 2011-10-27 01:25 121064 ----a-w- c:\windows\system32\drivers\ssadbus.sys
2011-11-27 10:39 . 2011-10-27 01:25 114280 ----a-w- c:\windows\system32\drivers\ssadserd.sys
2011-11-27 10:39 . 2011-10-27 01:25 10472 ----a-w- c:\windows\system32\drivers\ssadcmnt.sys
2011-11-20 20:05 . 2011-11-20 20:05 -------- d-----w- c:\program files\MarkAny
2011-11-20 20:04 . 2011-11-27 09:56 -------- d-----w- c:\program files\Samsung
2011-11-20 20:03 . 2011-11-27 09:55 -------- d-----w- c:\users\sunez\AppData\Local\Downloaded Installations
2011-11-19 16:13 . 2011-11-19 16:13 -------- d-----w- c:\program files\Franzis
2011-11-13 20:05 . 2011-11-13 20:08 -------- d-----w- c:\users\sunez\AppData\Roaming\vlc
2011-11-13 20:00 . 2011-11-13 20:00 -------- d-----w- c:\program files\VideoLAN
2011-11-13 07:50 . 2011-11-13 07:50 -------- d--h--w- c:\programdata\CanonBJ
2011-11-13 07:50 . 2009-07-14 01:15 71168 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\CNBPP4.DLL
2011-11-11 19:11 . 2011-11-11 19:11 -------- d-----w- c:\users\sunez\AppData\Roaming\Unity
2011-11-09 16:03 . 2011-09-29 16:03 1290608 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-11-09 16:03 . 2011-10-01 04:37 708608 ----a-w- c:\program files\Common Files\System\wab32.dll
2011-11-09 16:03 . 2011-09-29 03:37 2341888 ----a-w- c:\windows\system32\win32k.sys
2011-11-06 10:42 . 2011-11-06 10:42 -------- d-----w- c:\users\sunez\AppData\Local\ElevatedDiagnostics
2011-11-06 05:41 . 2011-11-06 05:41 -------- d-----w- c:\users\sunez\AppData\Local\Unity
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-17 06:43 . 2011-10-16 10:19 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-31 10:22 . 2011-10-31 10:22 90112 ----a-w- c:\windows\MAMCityDownload.ocx
2011-10-31 10:22 . 2011-10-31 10:22 325552 ----a-w- c:\windows\MASetupCaller.dll
2011-10-31 10:22 . 2011-10-31 10:22 30568 ----a-w- c:\windows\MusiccityDownload.exe
2011-10-31 10:22 . 2011-10-31 10:22 81920 ----a-w- c:\windows\system32\issacapi_bs-2.3.dll
2011-10-31 10:22 . 2011-10-31 10:22 65536 ----a-w- c:\windows\system32\issacapi_pe-2.3.dll
2011-10-31 10:22 . 2011-10-31 10:22 57344 ----a-w- c:\windows\system32\issacapi_se-2.3.dll
2011-10-31 10:22 . 2011-10-31 10:22 49152 ----a-w- c:\windows\system32\MaJGUILib.dll
2011-10-31 10:22 . 2011-10-31 10:22 45056 ----a-w- c:\windows\system32\MaXMLProto.dll
2011-10-31 10:22 . 2011-10-31 10:22 40960 ----a-w- c:\windows\system32\MTTELECHIP.dll
2011-10-31 10:22 . 2011-10-31 10:22 200704 ----a-w- c:\windows\system32\muzwmts.dll
2011-10-31 10:22 . 2011-10-31 10:22 143360 ----a-w- c:\windows\system32\3DAudio.ax
2011-10-31 10:22 . 2011-10-31 10:22 135168 ----a-w- c:\windows\system32\muzaf1.dll
2011-10-31 10:22 . 2011-10-31 10:22 122880 ----a-w- c:\windows\system32\muzeffect.ax
2011-10-31 10:22 . 2011-10-31 10:22 118784 ----a-w- c:\windows\system32\MaDRM.dll
2011-10-31 10:22 . 2011-10-31 10:22 110592 ----a-w- c:\windows\system32\muzmp4sp.ax
2011-10-31 10:22 . 2011-10-31 10:22 974848 ----a-w- c:\windows\system32\cis-2.4.dll
2011-10-31 10:22 . 2011-10-31 10:22 57344 ----a-w- c:\windows\system32\MTXSYNCICON.dll
2011-10-31 10:22 . 2011-10-31 10:22 57344 ----a-w- c:\windows\system32\MK_Lyric.dll
2011-10-31 10:22 . 2011-10-31 10:22 569344 ----a-w- c:\windows\system32\muzdecode.ax
2011-10-31 10:22 . 2011-10-31 10:22 491520 ----a-w- c:\windows\system32\muzapp.dll
2011-10-31 10:22 . 2011-10-31 10:22 45056 ----a-w- c:\windows\system32\MACXMLProto.dll
2011-10-31 10:22 . 2011-10-31 10:22 40960 ----a-w- c:\windows\system32\MAMACExtract.dll
2011-10-31 10:22 . 2011-10-31 10:22 352256 ----a-w- c:\windows\system32\MSLUR71.dll
2011-10-31 10:22 . 2011-10-31 10:22 258048 ----a-w- c:\windows\system32\muzoggsp.ax
2011-10-31 10:22 . 2011-10-31 10:22 245760 ----a-w- c:\windows\system32\MSCLib.dll
2011-10-31 10:22 . 2011-10-31 10:22 24576 ----a-w- c:\windows\system32\MASetupCleaner.exe
2011-10-31 10:22 . 2011-10-31 10:22 155648 ----a-w- c:\windows\system32\MSFLib.dll
2011-10-31 10:22 . 2011-10-31 10:22 131072 ----a-w- c:\windows\system32\muzmpgsp.ax
2011-10-18 18:13 . 2009-07-14 02:05 152576 ----a-w- c:\windows\system32\msclmd.dll
2011-10-16 11:15 . 2011-10-16 11:15 74240 ----a-w- c:\windows\system32\fsutil.exe
2011-10-16 11:15 . 2011-10-16 11:15 1699328 ----a-w- c:\windows\system32\esent.dll
2011-10-16 11:15 . 2011-10-16 11:15 148864 ----a-w- c:\windows\system32\drivers\storport.sys
2011-10-16 11:15 . 2011-10-16 11:15 1211264 ----a-w- c:\windows\system32\drivers\ntfs.sys
2011-10-16 11:15 . 2011-10-16 11:15 80256 ----a-w- c:\windows\system32\drivers\amdsata.sys
2011-10-16 11:15 . 2011-10-16 11:15 332160 ----a-w- c:\windows\system32\drivers\iaStorV.sys
2011-10-16 11:15 . 2011-10-16 11:15 22400 ----a-w- c:\windows\system32\drivers\amdxata.sys
2011-10-16 11:15 . 2011-10-16 11:15 143744 ----a-w- c:\windows\system32\drivers\nvstor.sys
2011-10-16 11:15 . 2011-10-16 11:15 117120 ----a-w- c:\windows\system32\drivers\nvraid.sys
2011-10-16 11:14 . 2011-10-16 11:14 75776 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2011-10-16 11:14 . 2011-10-16 11:14 5888 ----a-w- c:\windows\system32\drivers\usbd.sys
2011-10-16 11:14 . 2011-10-16 11:14 43008 ----a-w- c:\windows\system32\drivers\usbehci.sys
2011-10-16 11:14 . 2011-10-16 11:14 284672 ----a-w- c:\windows\system32\drivers\usbport.sys
2011-10-16 11:14 . 2011-10-16 11:14 258560 ----a-w- c:\windows\system32\drivers\usbhub.sys
2011-10-16 11:14 . 2011-10-16 11:14 24064 ----a-w- c:\windows\system32\drivers\usbuhci.sys
2011-10-16 11:14 . 2011-10-16 11:14 20480 ----a-w- c:\windows\system32\drivers\usbohci.sys
2011-10-16 11:14 . 2011-10-16 11:14 739840 ----a-w- c:\windows\system32\d2d1.dll
2011-10-16 11:14 . 2011-10-16 11:14 1076736 ----a-w- c:\windows\system32\DWrite.dll
2011-10-16 11:14 . 2011-10-16 11:14 805376 ----a-w- c:\windows\system32\FntCache.dll
2011-10-16 07:39 . 2011-10-16 07:39 86528 ----a-w- c:\windows\system32\iesysprep.dll
2011-10-16 07:39 . 2011-10-16 07:39 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2011-10-16 07:39 . 2011-10-16 07:39 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2011-10-16 07:39 . 2011-10-16 07:39 63488 ----a-w- c:\windows\system32\tdc.ocx
2011-10-16 07:39 . 2011-10-16 07:39 48640 ----a-w- c:\windows\system32\mshtmler.dll
2011-10-16 07:39 . 2011-10-16 07:39 161792 ----a-w- c:\windows\system32\msls31.dll
2011-10-16 07:39 . 2011-10-16 07:39 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
2011-10-16 07:39 . 2011-10-16 07:39 74752 ----a-w- c:\windows\system32\iesetup.dll
2011-10-16 07:39 . 2011-10-16 07:39 420864 ----a-w- c:\windows\system32\vbscript.dll
2011-10-16 07:39 . 2011-10-16 07:39 367104 ----a-w- c:\windows\system32\html.iec
2011-10-16 07:39 . 2011-10-16 07:39 35840 ----a-w- c:\windows\system32\imgutil.dll
2011-10-16 07:39 . 2011-10-16 07:39 23552 ----a-w- c:\windows\system32\licmgr10.dll
2011-10-16 07:39 . 2011-10-16 07:39 152064 ----a-w- c:\windows\system32\wextract.exe
2011-10-16 07:39 . 2011-10-16 07:39 150528 ----a-w- c:\windows\system32\iexpress.exe
2011-10-16 07:39 . 2011-10-16 07:39 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2011-10-16 07:39 . 2011-10-16 07:39 1427456 ----a-w- c:\windows\system32\inetcpl.cpl
2011-10-16 07:39 . 2011-10-16 07:39 11776 ----a-w- c:\windows\system32\mshta.exe
2011-10-16 07:39 . 2011-10-16 07:39 101888 ----a-w- c:\windows\system32\admparse.dll
2011-10-15 19:01 . 2011-10-15 19:01 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2011-10-07 05:23 . 2011-10-07 05:23 230608 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2011-10-04 05:21 . 2011-10-04 05:21 16720 ----a-w- c:\windows\system32\drivers\AVGIDSShim.sys
2011-09-21 07:00 . 2011-10-15 19:51 7269712 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{39C4DE1D-E0BA-4055-85C8-6E478C1B438C}\mpengine.dll
2011-09-13 04:30 . 2011-09-13 04:30 32592 ----a-w- c:\windows\system32\drivers\avgrkx86.sys
2011-11-13 19:43 . 2011-11-02 18:54 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files\uTorrentBar\prxtbuTor.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
2011-11-12 16:08 1451336 ----a-w- c:\program files\AVG Secure Search\8.0.0.40\AVG Secure Search_toolbar.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
2011-05-09 09:49 176936 ----a-w- c:\program files\uTorrentBar\prxtbuTor.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files\uTorrentBar\prxtbuTor.dll" [2011-05-09 176936]
"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\8.0.0.40\AVG Secure Search_toolbar.dll" [2011-11-12 1451336]
.
[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
.
[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC}"= "c:\program files\uTorrentBar\prxtbuTor.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2011-10-21 641400]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2009-09-18 205976]
"AutoStartNPSAgent"="c:\program files\Samsung\Samsung New PC Studio\NPSAgent.exe" [2010-07-04 95576]
"KiesPDLR"="c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2011-11-02 21392]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2011-10-24 2415456]
"vProt"="c:\program files\AVG Secure Search\vprot.exe" [2011-10-16 218440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"KiesHelper"="c:\program files\Samsung\Kies\KiesHelper.exe" [2011-11-02 928656]
"KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2011-11-02 3508624]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"="start http://www.avg.com/ww.special-uninstall ... c4555eba59" [?]
.
c:\users\sunez\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 – Képernyőrész kivágása és gyorsindítás.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [2011-10-27 30312]
R3 netr28u;RT2870 USB vezeték nélküli helyi hálózati kártya Vista rendszerhez;c:\windows\system32\DRIVERS\netr28u.sys [2009-07-13 657408]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [2011-10-27 121064]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [2011-10-27 12776]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [2011-10-27 136808]
R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys [2011-10-27 114280]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 WatAdminSvc;Windows aktiválási technológiák szolgáltatás;c:\windows\system32\Wat\WatAdminSvc.exe [2011-10-16 1343400]
S0 AVGIDSEH;AVGIDSEH;c:\windows\system32\DRIVERS\AVGIDSEH.Sys [2011-07-10 23120]
S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [2011-09-13 32592]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2011-10-15 691696]
S1 Avgfwfd;AVG network filter service;c:\windows\system32\DRIVERS\avgfwd6x.sys [2011-05-22 47968]
S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [2011-10-07 230608]
S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [2011-07-10 295248]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 avgfws;AVG tűzfal;c:\program files\AVG\AVG2012\avgfws.exe [2011-10-24 2398512]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\AVGIDSAgent.exe [2011-10-12 4433248]
S2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [2011-08-02 192776]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2010-07-04 238952]
S2 vToolbarUpdater;vToolbarUpdater;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\8.0.1\ToolbarUpdater.exe [2011-10-16 246600]
S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\AVGIDSDriver.Sys [2011-07-10 134736]
S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\AVGIDSFilter.Sys [2011-07-10 24272]
S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\AVGIDSShim.Sys [2011-10-04 16720]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2010-06-14 36608]
S3 rt61x86;RT61 Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr61.sys [2009-06-02 368128]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - FSUSBEXDISK
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.bigseekpro.com/burn4free/{F9FCAC1D-7905-4F24-A6C8-22EFAC96AFCD}
mStart Page = hxxp://www.bigseekpro.com/burn4free/{F9FCAC1D-7905-4F24-A6C8-22EFAC96AFCD}
IE: E&xportálás a Microsoft Excel programba - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 84.2.46.1 84.2.44.1
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\8.0.1\ViProtocol.dll
FF - ProfilePath - c:\users\sunez\AppData\Roaming\Mozilla\Firefox\Profiles\wcvwvkgc.default\
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
HKLM-Run-NPSStartup - (no file)
AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-05_Sloan - c:\program files\Samsung\USB Drivers\05_Sloan\Uninstall.exe
AddRemove-06_Spencer - c:\program files\Samsung\USB Drivers\06_Spencer\Uninstall.exe
AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-08_EMPChipset - c:\program files\Samsung\USB Drivers\08_EMPChipset\Uninstall.exe
AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe
AddRemove-17_EMP_Chipset2 - c:\program files\Samsung\USB Drivers\17_EMP_Chipset2\Uninstall.exe
AddRemove-18_Zinia_Serial_Driver - c:\program files\Samsung\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe
AddRemove-19_VIA_driver - c:\program files\Samsung\USB Drivers\19_VIA_driver\Uninstall.exe
AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe
AddRemove-21_Searsburg - c:\program files\Samsung\USB Drivers\21_Searsburg\Uninstall.exe
AddRemove-22_WiBro_WiMAX - c:\program files\Samsung\USB Drivers\22_WiBro_WiMAX\Uninstall.exe
AddRemove-24_flashusbdriver - c:\program files\Samsung\USB Drivers\24_flashusbdriver\Uninstall.exe
AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\progra~1\AVG\AVG2012\avgrsx.exe
c:\program files\AVG\AVG2012\avgcsrvx.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\program files\AVG\AVG2012\avgnsx.exe
c:\program files\AVG\AVG2012\avgcsrvx.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Completion time: 2011-12-05 20:16:17 - machine was rebooted
ComboFix-quarantined-files.txt 2011-12-05 19:16
.
Pre-Run: 23 572 537 344 bájt szabad
Post-Run: 23 214 301 184 bájt szabad
.
- - End Of File - - 4ABD3EF2F2B044482684AF41EEF7B501

Stell a segítségedet kérném ha lehetséges lenne A rendszerem win7 Hom Premium x64 /Eredeti dobozos verzió/Már legalább 40x telepítettem
újra,ugyanis nem indul a windows, Post lefut a balfelső sarokban a kurzor villog.Csak ctrl+alt+del többszöri lenyomására indul a windows.Esage Labs
BootkitRemover programja Mbr infekciót jelzett.Tanácstalan vagyok,kérném szépen egy hozzáértő szakember segítségét

sunez
Te minden szemetet amit az interneten talalsz felrakol,
1:Szed le ezt a Kinai szemetet az IOBIT-tol
C:\Program Files\IObit\Advanced SystemCare 4
http://www.systemlookup.com/search.php? ... SCTray.exe

Futtasd a Combofixet.
http://www.virus-stell.com/2010/04/combofix.html
logjat tedd ide.

Logfile of random's system information tool 1.09 (written by random/random)
Run by sunez at 2011-12-05 15:20:01
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 17 GB (22%) free of 78 GB
Total RAM: 3328 MB (62% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:20:21, on 2011.12.05.
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskhost.exe
C:\Users\sunez\AppData\Local\Temp\RarSFX0\HDSentinel.exe
C:\Program Files\IObit\Advanced SystemCare 4\PMonitor.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\AVG\AVG2012\avgtray.exe
C:\Program Files\AVG Secure Search\vprot.exe
C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\IObit\Advanced SystemCare 4\ASCTray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\SearchFilterHost.exe
C:\Users\sunez\Downloads\RSIT.exe
C:\Program Files\trend micro\sunez.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bigseekpro.com/burn4free/{F9FCAC1D-7905-4F24-A6C8-22EFAC96AFCD}
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bigseekpro.com/burn4free/{F9FCAC1D-7905-4F24-A6C8-22EFAC96AFCD}
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: uTorrentBar Toolbar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\prxtbuTor.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\8.0.0.40\AVG Secure Search_toolbar.dll
O2 - BHO: uTorrentBar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\prxtbuTor.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O3 - Toolbar: uTorrentBar Toolbar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\prxtbuTor.dll
O3 - Toolbar: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\8.0.0.40\AVG Secure Search_toolbar.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [AVG_TRAY] "C:\Program Files\AVG\AVG2012\avgtray.exe"
O4 - HKLM\..\Run: [vProt] "C:\Program Files\AVG Secure Search\vprot.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [KiesHelper] C:\Program Files\Samsung\Kies\KiesHelper.exe /s
O4 - HKLM\..\Run: [KiesTrayAgent] C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
O4 - HKLM\..\RunOnce: [AvgUninstallURL] cmd.exe /c start http://www.avg.com/ww.special-uninstall ... Wi1ERU1CUg"&"inst=NzYtOTQ3NDMxNzU4LUQzODFMKzctRERUKzAtSTkwKzEtTjFEKzEtU1Q5MEFQUCsxLVBMKzktRVVMQSsxLUkxMisxLVNUMTJBUFArMQ"&"prod=94"&"ver=2012.0.1796"&"mid=ff89ecd029c947d1b45bd15696d677a9-05927f6cc083260624c3ff7d5bbf17c4555eba59
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" /MINIMIZED
O4 - HKCU\..\Run: [Advanced SystemCare 4] "C:\Program Files\IObit\Advanced SystemCare 4\ASCTray.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [AutoStartNPSAgent] C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
O4 - HKCU\..\Run: [KiesPDLR] C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'HELYI SZOLGÁLTATÁS')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'HELYI SZOLGÁLTATÁS')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'HÁLÓZATI SZOLGÁLTATÁS')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'HÁLÓZATI SZOLGÁLTATÁS')
O4 - Startup: OneNote 2007 – Képernyőrész kivágása és gyorsindítás.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: E&xportálás a Microsoft Excel programba - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Küldés a OneNote programba - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Kül&dés a OneNote programba - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll
O18 - Protocol: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\8.0.1\ViProtocol.dll
O23 - Service: Advanced SystemCare Service (AdvancedSystemCareService) - IObit - C:\Program Files\IObit\Advanced SystemCare 4\ASCService.exe
O23 - Service: @%SystemRoot%\system32\aelupsvc.dll,-1 (AeLookupSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe
O23 - Service: @%systemroot%\system32\appidsvc.dll,-100 (AppIDSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\appinfo.dll,-100 (Appinfo) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @appmgmts.dll,-3250 (AppMgmt) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\audiosrv.dll,-204 (AudioEndpointBuilder) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\audiosrv.dll,-200 (Audiosrv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: AVG tűzfal (avgfws) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2012\avgfws.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2012\avgwdsvc.exe
O23 - Service: @%SystemRoot%\system32\AxInstSV.dll,-103 (AxInstSV) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\bdesvc.dll,-100 (BDESVC) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\bfe.dll,-1001 (BFE) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\qmgr.dll,-1000 (BITS) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\browser.dll,-100 (Browser) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\bthserv.dll,-101 (bthserv) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\cryptsvc.dll,-1001 (CryptSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @oleres.dll,-5012 (DcomLaunch) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\defragsvc.dll,-101 (defragsvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\dhcpcore.dll,-100 (Dhcp) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\dnsapi.dll,-101 (Dnscache) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\dot3svc.dll,-1102 (dot3svc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\dps.dll,-500 (DPS) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\eapsvc.dll,-1 (EapHost) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\ehome\ehrecvr.exe,-101 (ehRecvr) - Unknown owner - C:\Windows\ehome\ehRecvr.exe
O23 - Service: @%SystemRoot%\ehome\ehsched.exe,-101 (ehSched) - Unknown owner - C:\Windows\ehome\ehsched.exe
O23 - Service: @%SystemRoot%\system32\wevtsvc.dll,-200 (eventlog) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @comres.dll,-2450 (EventSystem) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\fdPHost.dll,-100 (fdPHost) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\fdrespub.dll,-100 (FDResPub) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: @%systemroot%\system32\FntCache.dll,-100 (FontCache) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: FsUsbExService - Teruten - C:\Windows\system32\FsUsbExService.Exe
O23 - Service: @gpapi.dll,-112 (gpsvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\hidserv.dll,-101 (hidserv) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\kmsvc.dll,-6 (hkmsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\ListSvc.dll,-100 (HomeGroupListener) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\provsvc.dll,-100 (HomeGroupProvider) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\ikeext.dll,-501 (IKEEXT) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\IPBusEnum.dll,-102 (IPBusEnum) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @comres.dll,-2946 (KtmRm) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\srvsvc.dll,-100 (LanmanServer) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\wkssvc.dll,-100 (LanmanWorkstation) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\lltdres.dll,-1 (lltdsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\lmhsvc.dll,-101 (lmhosts) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\mmcss.dll,-100 (MMCSS) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\FirewallAPI.dll,-23090 (MpsSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe
O23 - Service: @%SystemRoot%\system32\msimsg.dll,-27 (msiserver) - Unknown owner - C:\Windows\system32\msiexec.exe
O23 - Service: @%SystemRoot%\system32\netman.dll,-109 (Netman) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\netprofm.dll,-202 (netprofm) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\nlasvc.dll,-1 (NlaSvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\nsisvc.dll,-200 (nsi) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\pnrpsvc.dll,-8004 (p2pimsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\p2psvc.dll,-8006 (p2psvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\pcasvc.dll,-1 (PcaSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\pla.dll,-500 (pla) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\umpnpmgr.dll,-100 (PlugPlay) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\pnrpauto.dll,-8002 (PNRPAutoReg) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\pnrpsvc.dll,-8000 (PNRPsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\polstore.dll,-5010 (PolicyAgent) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\umpo.dll,-100 (Power) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\profsvc.dll,-300 (ProfSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32\rasauto.dll,-200 (RasAuto) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%Systemroot%\system32\rasmans.dll,-200 (RasMan) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @regsvc.dll,-1 (RemoteRegistry) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%windir%\system32\RpcEpMap.dll,-1001 (RpcEptMapper) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe
O23 - Service: @oleres.dll,-5010 (RpcSs) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\SCardSvr.dll,-1 (SCardSvr) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\schedsvc.dll,-100 (Schedule) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\certprop.dll,-13 (SCPolicySvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\sdrsvc.dll,-107 (SDRSVC) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\Sens.dll,-200 (SENS) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\sensrsvc.dll,-1000 (SensrSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\SessEnv.dll,-1026 (SessionEnv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\shsvcs.dll,-12288 (ShellHWDetection) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe
O23 - Service: @%SystemRoot%\system32\sppuinotify.dll,-103 (sppuinotify) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\ssdpsrv.dll,-100 (SSDPSRV) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\sstpsvc.dll,-200 (SstpSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: @%SystemRoot%\system32\wiaservc.dll,-9 (StiSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\StorSvc.dll,-100 (StorSvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\swprv.dll,-103 (swprv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\sysmain.dll,-1000 (SysMain) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\TabSvc.dll,-100 (TabletInputService) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\tapisrv.dll,-10100 (TapiSrv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\tbssvc.dll,-100 (TBS) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\termsrv.dll,-268 (TermService) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\themeservice.dll,-8192 (Themes) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\mmcss.dll,-102 (THREADORDER) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\trkwks.dll,-1 (TrkWks) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\servicing\TrustedInstaller.exe,-100 (TrustedInstaller) - Unknown owner - C:\Windows\servicing\TrustedInstaller.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe
O23 - Service: @%SystemRoot%\system32\umrdp.dll,-1000 (UmRdpService) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\upnphost.dll,-213 (upnphost) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\dwm.exe,-2000 (UxSms) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe
O23 - Service: vToolbarUpdater - Unknown owner - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\8.0.1\ToolbarUpdater.exe
O23 - Service: @%SystemRoot%\system32\w32time.dll,-200 (W32Time) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe
O23 - Service: @%systemroot%\system32\wbiosrvc.dll,-100 (WbioSrvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wcncsvc.dll,-3 (wcncsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\WcsPlugInService.dll,-200 (WcsPlugInService) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\wdi.dll,-502 (WdiServiceHost) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\wdi.dll,-500 (WdiSystemHost) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\webclnt.dll,-100 (WebClient) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wecsvc.dll,-200 (Wecsvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wercplsupport.dll,-101 (wercplsupport) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wersvc.dll,-100 (WerSvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%ProgramFiles%\Windows Defender\MsMpRes.dll,-103 (WinDefend) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\winhttp.dll,-100 (WinHttpAutoProxySvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32\wbem\wmisvc.dll,-205 (Winmgmt) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32\wsmsvc.dll,-101 (WinRM) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wlansvc.dll,-257 (Wlansvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\wmpnetwk.exe
O23 - Service: @%SystemRoot%\system32\wpcsvc.dll,-100 (WPCSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wpdbusenum.dll,-100 (WPDBusEnum) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wscsvc.dll,-200 (wscsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\SearchIndexer.exe,-103 (WSearch) - Unknown owner - C:\Windows\system32\SearchIndexer.exe
O23 - Service: @%systemroot%\system32\wuaueng.dll,-105 (wuauserv) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wudfsvc.dll,-1000 (wudfsvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wwansvc.dll,-257 (WwanSvc) - Unknown owner - C:\Windows\system32\svchost.exe

--
End of file - 21912 bytes

=========Mozilla firefox=========

ProfilePath - C:\Users\sunez\AppData\Roaming\Mozilla\Firefox\Profiles\wcvwvkgc.default

"{1E73965B-8B48-48be-9C8D-68B920ABC1C4}"=C:\Program Files\AVG\AVG2012\Firefox4\


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files\Mozilla Firefox\searchplugins\
bluu.xml
creativecommons.xml
eBay-hu.xml
google.xml
sztaki-en-hu.xml
vatera.xml
wikipedia-hu.xml

C:\Users\sunez\AppData\Roaming\Mozilla\Firefox\Profiles\wcvwvkgc.default\extensions\
foxmarks@kei.com

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files\AVG\AVG2012\avgssie.dll [2011-11-11 1378144]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
AVG Security Toolbar - C:\Program Files\AVG Secure Search\8.0.0.40\AVG Secure Search_toolbar.dll [2011-11-12 1451336]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
uTorrentBar Toolbar - C:\Program Files\uTorrentBar\prxtbuTor.dll [2011-05-09 176936]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{CCC7A320-B3CA-4199-B1A6-9F516DD69829}
{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - uTorrentBar Toolbar - C:\Program Files\uTorrentBar\prxtbuTor.dll [2011-05-09 176936]
{95B7759C-8C7F-4BF1-B163-73684A933233} - AVG Security Toolbar - C:\Program Files\AVG Secure Search\8.0.0.40\AVG Secure Search_toolbar.dll [2011-11-12 1451336]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]
"AdobeCS4ServiceManager"=C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe [2008-08-14 611712]
"AVG_TRAY"=C:\Program Files\AVG\AVG2012\avgtray.exe [2011-10-24 2415456]
"vProt"=C:\Program Files\AVG Secure Search\vprot.exe [2011-10-16 218440]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2011-09-07 37296]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-03-30 937920]
"NPSStartup"= []
"KiesHelper"=C:\Program Files\Samsung\Kies\KiesHelper.exe [2011-11-02 928656]
"KiesTrayAgent"=C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [2011-11-02 3508624]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"=cmd.exe /c start http://www.avg.com/ww.special-uninstall ... c4555eba59 []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"=C:\Program Files\uTorrent\uTorrent.exe [2011-10-21 641400]
"Advanced SystemCare 4"=C:\Program Files\IObit\Advanced SystemCare 4\ASCTray.exe [2011-08-09 417112]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-20 1174016]
"AlcoholAutomount"=C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe [2009-09-18 205976]
"AutoStartNPSAgent"=C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe [2010-07-04 95576]
"KiesPDLR"=C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [2011-11-02 21392]

C:\Users\sunez\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
OneNote 2007 – Képernyőrész kivágása és gyorsindítás.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2011-12-05 15:20:01 ----D---- C:\rsit
2011-12-05 15:20:01 ----D---- C:\Program Files\trend micro
2011-11-27 12:07:00 ----D---- C:\Temp
2011-11-27 11:53:05 ----D---- C:\Program Files\MyFree Codec
2011-11-27 11:39:33 ----A---- C:\Windows\system32\drivers\ssadwhnt.sys
2011-11-27 11:39:32 ----A---- C:\Windows\system32\drivers\ssadserd.sys
2011-11-27 11:39:32 ----A---- C:\Windows\system32\drivers\ssadmdm.sys
2011-11-27 11:39:32 ----A---- C:\Windows\system32\drivers\ssadmdfl.sys
2011-11-27 11:39:32 ----A---- C:\Windows\system32\drivers\ssadcmnt.sys
2011-11-27 11:39:32 ----A---- C:\Windows\system32\drivers\ssadbus.sys
2011-11-27 11:39:32 ----A---- C:\Windows\system32\drivers\ssadadb.sys
2011-11-27 10:58:06 ----A---- C:\Windows\system32\drivers\ssadwh.sys
2011-11-27 10:58:06 ----A---- C:\Windows\system32\drivers\ssadcm.sys
2011-11-27 10:57:11 ----A---- C:\Windows\system32\Redemption.dll
2011-11-27 10:57:01 ----A---- C:\Windows\system32\dgderapi.dll
2011-11-21 21:23:04 ----D---- C:\Program Files\MSXML 4.0
2011-11-20 21:08:01 ----A---- C:\Windows\system32\WdfCoInstaller01005.dll
2011-11-20 21:08:01 ----A---- C:\Windows\system32\drivers\WdfCoInstaller01005.dll
2011-11-20 21:07:14 ----D---- C:\ProgramData\Samsung
2011-11-20 21:06:39 ----A---- C:\Windows\system32\FsUsbExService.Exe
2011-11-20 21:06:39 ----A---- C:\Windows\system32\FsUsbExDisk.Sys
2011-11-20 21:06:38 ----A---- C:\Windows\system32\FsUsbExDevice.Dll
2011-11-20 21:06:28 ----D---- C:\Users\sunez\AppData\Roaming\Samsung
2011-11-20 21:05:07 ----D---- C:\Program Files\MarkAny
2011-11-20 21:04:57 ----D---- C:\Program Files\Samsung
2011-11-19 17:13:37 ----D---- C:\Program Files\Franzis
2011-11-13 21:05:38 ----D---- C:\Users\sunez\AppData\Roaming\vlc
2011-11-13 21:00:39 ----D---- C:\Program Files\VideoLAN
2011-11-13 08:50:30 ----HD---- C:\ProgramData\CanonBJ
2011-11-11 20:11:34 ----D---- C:\Users\sunez\AppData\Roaming\Unity
2011-11-09 17:03:28 ----A---- C:\Windows\system32\drivers\tcpip.sys
2011-11-09 17:03:25 ----A---- C:\Windows\system32\win32k.sys

======List of files/folders modified in the last 1 month======

2011-12-05 15:20:21 ----D---- C:\Windows\Prefetch
2011-12-05 15:20:13 ----D---- C:\Windows\Temp
2011-12-05 15:20:01 ----RD---- C:\Program Files
2011-12-05 15:20:00 ----D---- C:\Users\sunez\AppData\Roaming\uTorrent
2011-12-05 12:57:17 ----D---- C:\ProgramData\MFAData
2011-12-05 12:57:16 ----D---- C:\Windows\system32\drivers\AVG
2011-12-05 10:16:06 ----D---- C:\Windows\system32\config
2011-12-05 10:07:10 ----D---- C:\Windows\System32
2011-12-05 10:07:10 ----D---- C:\Windows\inf
2011-12-05 10:07:10 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-12-05 10:06:08 ----D---- C:\Windows\ModemLogs
2011-12-04 13:53:47 ----SHD---- C:\System Volume Information
2011-12-04 11:02:33 ----D---- C:\Windows\system32\NDF
2011-12-01 15:08:30 ----D---- C:\Windows\system32\catroot2
2011-12-01 07:30:39 ----SHD---- C:\Windows\Installer
2011-11-28 18:31:37 ----SD---- C:\Users\sunez\AppData\Roaming\Microsoft
2011-11-28 18:30:47 ----D---- C:\Windows
2011-11-27 21:48:01 ----D---- C:\Windows\system32\catroot
2011-11-27 11:40:56 ----D---- C:\Windows\system32\DriverStore
2011-11-27 11:40:52 ----D---- C:\Windows\system32\drivers
2011-11-27 10:56:58 ----HD---- C:\Program Files\InstallShield Installation Information
2011-11-21 21:23:31 ----D---- C:\Windows\winsxs
2011-11-20 21:07:14 ----HD---- C:\ProgramData
2011-11-20 21:06:24 ----D---- C:\Windows\SoftwareDistribution
2011-11-19 14:12:38 ----D---- C:\Users\sunez\AppData\Roaming\IObit
2011-11-13 22:15:32 ----D---- C:\Windows\system32\Tasks
2011-11-13 20:43:58 ----D---- C:\Program Files\Mozilla Firefox
2011-11-12 17:08:49 ----D---- C:\Program Files\AVG Secure Search
2011-11-10 17:44:15 ----D---- C:\Program Files\Common Files\System
2011-11-10 17:27:56 ----D---- C:\Windows\debug
2011-11-10 17:27:52 ----A---- C:\Windows\system32\MRT.exe
2011-11-06 14:09:32 ----D---- C:\Users\sunez\AppData\Roaming\Adobe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AVGIDSEH;AVGIDSEH; C:\Windows\system32\DRIVERS\AVGIDSEH.Sys [2011-07-11 23120]
R0 Avgrkx86;AVG Anti-Rootkit Driver; C:\Windows\system32\DRIVERS\avgrkx86.sys [2011-09-13 32592]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R0 Si3132r5;SiI-3132 SoftRaid 5 Controller; C:\Windows\system32\DRIVERS\Si3132r5.sys [2006-04-12 201728]
R0 SiFilter;SATALink driver accelerator; C:\Windows\system32\DRIVERS\SiWinAcc.sys [2004-11-01 10368]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2011-10-15 691696]
R0 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 175360]
R1 Avgfwfd;AVG network filter service; C:\Windows\system32\DRIVERS\avgfwd6x.sys [2011-05-23 47968]
R1 Avgldx86;AVG AVI Loader Driver; C:\Windows\system32\DRIVERS\avgldx86.sys [2011-10-07 230608]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield; C:\Windows\system32\DRIVERS\avgmfx86.sys [2011-08-08 40016]
R1 Avgtdix;AVG TDI Driver; C:\Windows\system32\DRIVERS\avgtdix.sys [2011-07-11 295248]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 388096]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R2 adfs;adfs; C:\Windows\system32\drivers\adfs.sys [2008-08-14 74720]
R2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
R3 AVGIDSDriver;AVGIDSDriver; C:\Windows\system32\DRIVERS\AVGIDSDriver.Sys [2011-07-11 134736]
R3 AVGIDSFilter;AVGIDSFilter; C:\Windows\system32\DRIVERS\AVGIDSFilter.Sys [2011-07-11 24272]
R3 AVGIDSShim;AVGIDSShim; C:\Windows\system32\DRIVERS\AVGIDSShim.Sys [2011-10-04 16720]
R3 FsUsbExDisk;FsUsbExDisk; \??\C:\Windows\system32\FsUsbExDisk.SYS [2010-06-14 36608]
R3 NVENETFD;NVIDIA nForce hálózati vezérlő illesztőprogramja; C:\Windows\system32\DRIVERS\nvm62x32.sys [2009-07-13 347264]
R3 rt61x86;RT61 Extensible Wireless Driver; C:\Windows\system32\DRIVERS\netr61.sys [2009-06-02 368128]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 aid8esww;aid8esww; C:\Windows\system32\drivers\aid8esww.sys []
S3 amdagp;AMD AGP-buszszűrő illesztőprogramja; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 androidusb;SAMSUNG Android Composite ADB Interface Driver; C:\Windows\System32\Drivers\ssadadb.sys [2011-10-27 30312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 netr28u;RT2870 USB vezeték nélküli helyi hálózati kártya Vista rendszerhez; C:\Windows\system32\DRIVERS\netr28u.sys [2009-07-13 657408]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 133632]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 5632]
S3 sisagp;SIS AGP-buszszűrő; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM); C:\Windows\system32\DRIVERS\ssadbus.sys [2011-10-27 121064]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter); C:\Windows\system32\DRIVERS\ssadmdfl.sys [2011-10-27 12776]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers; C:\Windows\system32\DRIVERS\ssadmdm.sys [2011-10-27 136808]
S3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM); C:\Windows\system32\DRIVERS\ssadserd.sys [2011-10-27 114280]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 28032]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 52224]
S3 usbscan;USB képolvasó-illesztőprogram; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 35840]
S3 viaagp;VIA AGP buszszűrő; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 17920]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdvancedSystemCareService;Advanced SystemCare Service; C:\Program Files\IObit\Advanced SystemCare 4\ASCService.exe [2011-08-09 328536]
R2 avgfws;AVG tűzfal; C:\Program Files\AVG\AVG2012\avgfws.exe [2011-10-24 2398512]
R2 AVGIDSAgent;AVGIDSAgent; C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe [2011-10-12 4433248]
R2 avgwd;AVG WatchDog; C:\Program Files\AVG\AVG2012\avgwdsvc.exe [2011-08-02 192776]
R2 FsUsbExService;FsUsbExService; C:\Windows\system32\FsUsbExService.Exe [2010-07-04 238952]
R2 StarWindServiceAE;StarWind AE Service; C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2007-05-28 275968]
R2 vToolbarUpdater;vToolbarUpdater; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\8.0.1\ToolbarUpdater.exe [2011-10-16 246600]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2011-10-16 655624]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-10-16 1343400]
S4 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S4 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]

-----------------EOF-----------------