C:\Documents and Settings\gigabyte\Asztal\HelpAsst_mebroot_fix.exe
2010.04.25. at 11:35:58,75

No HelpAssistant account in User list


~~ Checking for termsrv32.dll ~~

termsrv32.dll not found

~~ Checking firewall ports ~~


HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\globallyopenports\list

~~ Checking profile list ~~

No HelpAssistant profile in registry

~~ Checking mbr ~~

user & kernel MBR OK

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Status check on 2010.04.25. at 11:52:44,62

No HelpAssistant account in User list

~~ Checking mbr ~~

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A7F88E0]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\atapi -> 0x8a7f88e0
Warning: possible MBR rootkit infection !
user & kernel MBR OK
Use "Recovery Console" command "fixmbr" to clear infection !

~~ Checking for termsrv32.dll ~~

termsrv32.dll not found


HKEY_LOCAL_MACHINE\system\currentcontrolset\services\termservice\parameters
ServiceDll REG_EXPAND_SZ %SystemRoot%\System32\termsrv.dll

~~ Checking profile list ~~

No HelpAssistant profile in registry

~~ Checking for HelpAssistant directories ~~

none found

~~ Checking firewall ports ~~

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\domainprofile\GloballyOpenPorts\List]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]


~~ EOF ~~

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Status check on 2010.04.25. at 12:43:20,59

No HelpAssistant account in User list

~~ Checking mbr ~~

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A7F88E0]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\atapi -> 0x8a7f88e0
Warning: possible MBR rootkit infection !
user & kernel MBR OK
Use "Recovery Console" command "fixmbr" to clear infection !

~~ Checking for termsrv32.dll ~~

termsrv32.dll not found


HKEY_LOCAL_MACHINE\system\currentcontrolset\services\termservice\parameters
ServiceDll REG_EXPAND_SZ %SystemRoot%\System32\termsrv.dll

~~ Checking profile list ~~

No HelpAssistant profile in registry

~~ Checking for HelpAssistant directories ~~

none found

~~ Checking firewall ports ~~

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\domainprofile\GloballyOpenPorts\List]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]


~~ EOF ~~

ok,akkor folytasad inen,a parancsokat masold be inen,,ne irjad mivel a mbr es a -F- kozot hezaknak kell lenie
Start> Futtatás, és masolja be a

következő parancsot
mbr -f [enter]

Most, kérem, tegye a Start> Futtatás> mbr -f parancsot-másodszor.[enter]


Most állítsa le[kapcsolja ki] a számítógépet (nem indítja

újra, hanem állítsa le), várjon néhány percet[5-percet], majd indítsa

el .
A körülbelül 5 perc,mulva, majd kattintson a Start> Futtatás,

és masolja be a következő parancsot.
helpasst -mbrt [enter]

Amikor ez befejeződik, a log fog megnyílni.
Kérjük, tegye ide a tartalmát,

Végigcsináltam elöször is. Megcsináltam a leállítást is -kb 10 percet vártam- mert nekem úgy tünt nem talált semmit és restartot se csinált. Ezt csak még1x meg kell csinálnom vagy valamit elrontottam volna?

folytasad innen

C:\Documents and Settings\gigabyte\Asztal\HelpAsst_mebroot_fix.exe
2010.04.25. at 11:35:58,75

No HelpAssistant account in User list


~~ Checking for termsrv32.dll ~~

termsrv32.dll not found

~~ Checking firewall ports ~~


HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\globallyopenports\list

~~ Checking profile list ~~

No HelpAssistant profile in registry

~~ Checking mbr ~~

user & kernel MBR OK

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Status check on 2010.04.25. at 11:52:44,62

No HelpAssistant account in User list

~~ Checking mbr ~~

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A7F88E0]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\atapi -> 0x8a7f88e0
Warning: possible MBR rootkit infection !
user & kernel MBR OK
Use "Recovery Console" command "fixmbr" to clear infection !

~~ Checking for termsrv32.dll ~~

termsrv32.dll not found


HKEY_LOCAL_MACHINE\system\currentcontrolset\services\termservice\parameters
ServiceDll REG_EXPAND_SZ %SystemRoot%\System32\termsrv.dll

~~ Checking profile list ~~

No HelpAssistant profile in registry

~~ Checking for HelpAssistant directories ~~

none found

~~ Checking firewall ports ~~

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\domainprofile\GloballyOpenPorts\List]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]


~~ EOF ~~

csak nyugodtan,van ido ha valmi nemmegy irjal,

Rendben, csak a kérdésedből, hogyan viselkedik a gép azt hittem kész.
Azt hiszem leírom a lépéseket, mert a nyomtatómból kifogyott a patron.

na varjal egy kicsit,meg nincsen renben a gep,,meg van ot fertozes es a vegen rendet csinalunk a gepen

folytatodd pontosan igy

töltse le és mentse HelpAsst_mebroot_fix

az asztalra.
Zárja be az összes többi megnyitott programok és ablakok.
Duplán kattintva indítsa el a fájlt, és kövesse minden

utasításokat.
Ha az eszköz érzékeli az mbr-fertőzés, kérjük, hagyja, hogy

fusson az mbr-f és restartolja a számítógép.
Újraindítása után, kérem várjon körülbelül 5 percet,

kattintson a Start> Futtatás, és masolja be a következő

parancsot
helpasst -mbrt [enter]
Amikor ez befejeződik, a log fog megnyílni.
Kérjük, tegye a tartalmát,ide.

Abban az esetben, ha az eszköz nem észleli az mbr-fertőzés és

befejeződik, kattintson a Start> Futtatás, és masolja be a

következő parancsot
mbr -f [enter]

Most, kérem, tegye a Start> Futtatás> mbr -f parancs

másodszor.
Most állítsa le[kapcsolja ki] a számítógépet (nem indítja

újra, hanem állítsa le), várjon néhány percet[5-percet], majd indítsa

el .
A körülbelül 5 perc,mulva, majd kattintson a Start> Futtatás,

és masolja be a következő parancsot.
helpasst -mbrt [enter]

Amikor ez befejeződik, a log fog megnyílni.
Kérjük, tegye ide a tartalmát,

Egyenlőre csak böngészgettem. Nem a gépem nem DELL. Egy PC boltban rakták össze, csináltam egy riport fájlt az Everestel a hardvereimről, de elég terjedelmes lett. Belinkeljem ide?
Mióta helyreraktuk -jobban mondva te raktad én csak a (kétbal)kezed voltam- előjött a windows biztonsági központ amit régen kikapcsoltam már az XP-AntySpy programmal.
Majd délután valamikor írok egy újab választ ide, mit tapasztaltam a géppel, addigra csak előjön valami.
Mindenestre nagyon szépen köszönöm a rámszánt idődet és energiádat. A legtöbb PC guru mond 1-2 okosságot azt annyival elintézi a problémát. Remélem mostmár helyrerázódott a gépem kicsit.
Kérdésem az lenne még, hogy Te milyen védelmet ajánlasz egy átlag felhasználó gépére, milyen/melyik tűzfalat, vírusírtót és Anti Spyware programot. Illetve kikapcsolhatom-e pl az Online Armorban a program control opciót -elég idegesítő néha-, elég-e csak a tűzfal részét használni ami kintről véd? Használjam-e a WinPatrol-t továbbra is?
Egyszer pár éve ellopták az MMORPG játékom accountját, azóta elég paranoiás vagyok. Azért volt ennyi védelmi szemét a gépemen. Egy laikusnak nem könnyű eldönteni a sok okos tanács mellett melyiket fogadja meg, mindenhol mást és mást ajánlanak.

köszönöm
LustaBagoly

ok,az atapi mar renben van,,hogy viselkedik a gep??
A Szamitogep nem DELL-??

09:28:36:171 3240 TDSS rootkit removing tool 2.2.8.1 Mar 22 2010 10:43:04
09:28:36:171 3240 ================================================================================
09:28:36:171 3240 SystemInfo:

09:28:36:171 3240 OS Version: 5.1.2600 ServicePack: 3.0
09:28:36:171 3240 Product type: Workstation
09:28:36:171 3240 ComputerName: GIGABYTE-B9A0E7
09:28:36:171 3240 UserName: gigabyte
09:28:36:171 3240 Windows directory: C:\WINDOWS
09:28:36:171 3240 Processor architecture: Intel x86
09:28:36:171 3240 Number of processors: 2
09:28:36:171 3240 Page size: 0x1000
09:28:36:187 3240 Boot type: Normal boot
09:28:36:187 3240 ================================================================================
09:28:36:187 3240 UnloadDriverW: NtUnloadDriver error 2
09:28:36:187 3240 ForceUnloadDriverW: UnloadDriverW(klmd21) error 2
09:28:36:187 3240 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\system
09:28:36:187 3240 wfopen_ex: MyNtCreateFileW error 32 (C0000043)
09:28:36:187 3240 wfopen_ex: Trying to KLMD file open
09:28:36:187 3240 wfopen_ex: File opened ok (Flags 2)
09:28:36:187 3240 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\software
09:28:36:187 3240 wfopen_ex: MyNtCreateFileW error 32 (C0000043)
09:28:36:187 3240 wfopen_ex: Trying to KLMD file open
09:28:36:187 3240 wfopen_ex: File opened ok (Flags 2)
09:28:36:187 3240 Initialize success
09:28:36:187 3240
09:28:36:187 3240 Scanning Services ...
09:28:36:531 3240 Raw services enum returned 346 services
09:28:36:546 3240
09:28:36:546 3240 Scanning Kernel memory ...
09:28:36:546 3240 Devices to scan: 5
09:28:36:546 3240
09:28:36:546 3240 Driver Name: Disk
09:28:36:546 3240 IRP_MJ_CREATE : BA0EEBB0
09:28:36:546 3240 IRP_MJ_CREATE_NAMED_PIPE : 804F4552
09:28:36:546 3240 IRP_MJ_CLOSE : BA0EEBB0
09:28:36:546 3240 IRP_MJ_READ : BA0E8D1F
09:28:36:546 3240 IRP_MJ_WRITE : BA0E8D1F
09:28:36:546 3240 IRP_MJ_QUERY_INFORMATION : 804F4552
09:28:36:546 3240 IRP_MJ_SET_INFORMATION : 804F4552
09:28:36:546 3240 IRP_MJ_QUERY_EA : 804F4552
09:28:36:546 3240 IRP_MJ_SET_EA : 804F4552
09:28:36:546 3240 IRP_MJ_FLUSH_BUFFERS : BA0E92E2
09:28:36:546 3240 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F4552
09:28:36:546 3240 IRP_MJ_SET_VOLUME_INFORMATION : 804F4552
09:28:36:546 3240 IRP_MJ_DIRECTORY_CONTROL : 804F4552
09:28:36:546 3240 IRP_MJ_FILE_SYSTEM_CONTROL : 804F4552
09:28:36:546 3240 IRP_MJ_DEVICE_CONTROL : BA0E93BB
09:28:36:546 3240 IRP_MJ_INTERNAL_DEVICE_CONTROL : BA0ECF28
09:28:36:546 3240 IRP_MJ_SHUTDOWN : BA0E92E2
09:28:36:546 3240 IRP_MJ_LOCK_CONTROL : 804F4552
09:28:36:546 3240 IRP_MJ_CLEANUP : 804F4552
09:28:36:546 3240 IRP_MJ_CREATE_MAILSLOT : 804F4552
09:28:36:546 3240 IRP_MJ_QUERY_SECURITY : 804F4552
09:28:36:546 3240 IRP_MJ_SET_SECURITY : 804F4552
09:28:36:546 3240 IRP_MJ_POWER : BA0EAC82
09:28:36:546 3240 IRP_MJ_SYSTEM_CONTROL : BA0EF99E
09:28:36:546 3240 IRP_MJ_DEVICE_CHANGE : 804F4552
09:28:36:546 3240 IRP_MJ_QUERY_QUOTA : 804F4552
09:28:36:546 3240 IRP_MJ_SET_QUOTA : 804F4552
09:28:36:562 3240 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1
09:28:36:562 3240
09:28:36:562 3240 Driver Name: Disk
09:28:36:562 3240 IRP_MJ_CREATE : BA0EEBB0
09:28:36:562 3240 IRP_MJ_CREATE_NAMED_PIPE : 804F4552
09:28:36:562 3240 IRP_MJ_CLOSE : BA0EEBB0
09:28:36:562 3240 IRP_MJ_READ : BA0E8D1F
09:28:36:562 3240 IRP_MJ_WRITE : BA0E8D1F
09:28:36:562 3240 IRP_MJ_QUERY_INFORMATION : 804F4552
09:28:36:562 3240 IRP_MJ_SET_INFORMATION : 804F4552
09:28:36:562 3240 IRP_MJ_QUERY_EA : 804F4552
09:28:36:562 3240 IRP_MJ_SET_EA : 804F4552
09:28:36:562 3240 IRP_MJ_FLUSH_BUFFERS : BA0E92E2
09:28:36:562 3240 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F4552
09:28:36:562 3240 IRP_MJ_SET_VOLUME_INFORMATION : 804F4552
09:28:36:562 3240 IRP_MJ_DIRECTORY_CONTROL : 804F4552
09:28:36:562 3240 IRP_MJ_FILE_SYSTEM_CONTROL : 804F4552
09:28:36:562 3240 IRP_MJ_DEVICE_CONTROL : BA0E93BB
09:28:36:562 3240 IRP_MJ_INTERNAL_DEVICE_CONTROL : BA0ECF28
09:28:36:562 3240 IRP_MJ_SHUTDOWN : BA0E92E2
09:28:36:562 3240 IRP_MJ_LOCK_CONTROL : 804F4552
09:28:36:562 3240 IRP_MJ_CLEANUP : 804F4552
09:28:36:562 3240 IRP_MJ_CREATE_MAILSLOT : 804F4552
09:28:36:562 3240 IRP_MJ_QUERY_SECURITY : 804F4552
09:28:36:562 3240 IRP_MJ_SET_SECURITY : 804F4552
09:28:36:562 3240 IRP_MJ_POWER : BA0EAC82
09:28:36:562 3240 IRP_MJ_SYSTEM_CONTROL : BA0EF99E
09:28:36:562 3240 IRP_MJ_DEVICE_CHANGE : 804F4552
09:28:36:562 3240 IRP_MJ_QUERY_QUOTA : 804F4552
09:28:36:562 3240 IRP_MJ_SET_QUOTA : 804F4552
09:28:36:562 3240 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1
09:28:36:562 3240
09:28:36:562 3240 Driver Name: Disk
09:28:36:562 3240 IRP_MJ_CREATE : BA0EEBB0
09:28:36:562 3240 IRP_MJ_CREATE_NAMED_PIPE : 804F4552
09:28:36:562 3240 IRP_MJ_CLOSE : BA0EEBB0
09:28:36:562 3240 IRP_MJ_READ : BA0E8D1F
09:28:36:562 3240 IRP_MJ_WRITE : BA0E8D1F
09:28:36:562 3240 IRP_MJ_QUERY_INFORMATION : 804F4552
09:28:36:562 3240 IRP_MJ_SET_INFORMATION : 804F4552
09:28:36:562 3240 IRP_MJ_QUERY_EA : 804F4552
09:28:36:562 3240 IRP_MJ_SET_EA : 804F4552
09:28:36:562 3240 IRP_MJ_FLUSH_BUFFERS : BA0E92E2
09:28:36:562 3240 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F4552
09:28:36:562 3240 IRP_MJ_SET_VOLUME_INFORMATION : 804F4552
09:28:36:562 3240 IRP_MJ_DIRECTORY_CONTROL : 804F4552
09:28:36:562 3240 IRP_MJ_FILE_SYSTEM_CONTROL : 804F4552
09:28:36:562 3240 IRP_MJ_DEVICE_CONTROL : BA0E93BB
09:28:36:562 3240 IRP_MJ_INTERNAL_DEVICE_CONTROL : BA0ECF28
09:28:36:562 3240 IRP_MJ_SHUTDOWN : BA0E92E2
09:28:36:562 3240 IRP_MJ_LOCK_CONTROL : 804F4552
09:28:36:562 3240 IRP_MJ_CLEANUP : 804F4552
09:28:36:562 3240 IRP_MJ_CREATE_MAILSLOT : 804F4552
09:28:36:562 3240 IRP_MJ_QUERY_SECURITY : 804F4552
09:28:36:562 3240 IRP_MJ_SET_SECURITY : 804F4552
09:28:36:562 3240 IRP_MJ_POWER : BA0EAC82
09:28:36:562 3240 IRP_MJ_SYSTEM_CONTROL : BA0EF99E
09:28:36:562 3240 IRP_MJ_DEVICE_CHANGE : 804F4552
09:28:36:562 3240 IRP_MJ_QUERY_QUOTA : 804F4552
09:28:36:562 3240 IRP_MJ_SET_QUOTA : 804F4552
09:28:36:562 3240 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1
09:28:36:562 3240
09:28:36:562 3240 Driver Name: atapi
09:28:36:562 3240 IRP_MJ_CREATE : B9F026F2
09:28:36:562 3240 IRP_MJ_CREATE_NAMED_PIPE : 804F4552
09:28:36:562 3240 IRP_MJ_CLOSE : B9F026F2
09:28:36:562 3240 IRP_MJ_READ : 804F4552
09:28:36:562 3240 IRP_MJ_WRITE : 804F4552
09:28:36:562 3240 IRP_MJ_QUERY_INFORMATION : 804F4552
09:28:36:562 3240 IRP_MJ_SET_INFORMATION : 804F4552
09:28:36:562 3240 IRP_MJ_QUERY_EA : 804F4552
09:28:36:562 3240 IRP_MJ_SET_EA : 804F4552
09:28:36:562 3240 IRP_MJ_FLUSH_BUFFERS : 804F4552
09:28:36:562 3240 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F4552
09:28:36:562 3240 IRP_MJ_SET_VOLUME_INFORMATION : 804F4552
09:28:36:562 3240 IRP_MJ_DIRECTORY_CONTROL : 804F4552
09:28:36:562 3240 IRP_MJ_FILE_SYSTEM_CONTROL : 804F4552
09:28:36:562 3240 IRP_MJ_DEVICE_CONTROL : B9F02712
09:28:36:562 3240 IRP_MJ_INTERNAL_DEVICE_CONTROL : 8A7F88E0
09:28:36:562 3240 IRP_MJ_SHUTDOWN : 804F4552
09:28:36:562 3240 IRP_MJ_LOCK_CONTROL : 804F4552
09:28:36:562 3240 IRP_MJ_CLEANUP : 804F4552
09:28:36:562 3240 IRP_MJ_CREATE_MAILSLOT : 804F4552
09:28:36:562 3240 IRP_MJ_QUERY_SECURITY : 804F4552
09:28:36:562 3240 IRP_MJ_SET_SECURITY : 804F4552
09:28:36:562 3240 IRP_MJ_POWER : B9F0273C
09:28:36:562 3240 IRP_MJ_SYSTEM_CONTROL : B9F09336
09:28:36:562 3240 IRP_MJ_DEVICE_CHANGE : 804F4552
09:28:36:562 3240 IRP_MJ_QUERY_QUOTA : 804F4552
09:28:36:562 3240 IRP_MJ_SET_QUOTA : 804F4552
09:28:36:578 3240 C:\WINDOWS\system32\DRIVERS\atapi.sys - Verdict: 1
09:28:36:578 3240
09:28:36:578 3240 Driver Name: atapi
09:28:36:578 3240 IRP_MJ_CREATE : B9F026F2
09:28:36:578 3240 IRP_MJ_CREATE_NAMED_PIPE : 804F4552
09:28:36:578 3240 IRP_MJ_CLOSE : B9F026F2
09:28:36:578 3240 IRP_MJ_READ : 804F4552
09:28:36:578 3240 IRP_MJ_WRITE : 804F4552
09:28:36:578 3240 IRP_MJ_QUERY_INFORMATION : 804F4552
09:28:36:578 3240 IRP_MJ_SET_INFORMATION : 804F4552
09:28:36:578 3240 IRP_MJ_QUERY_EA : 804F4552
09:28:36:578 3240 IRP_MJ_SET_EA : 804F4552
09:28:36:578 3240 IRP_MJ_FLUSH_BUFFERS : 804F4552
09:28:36:578 3240 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F4552
09:28:36:578 3240 IRP_MJ_SET_VOLUME_INFORMATION : 804F4552
09:28:36:578 3240 IRP_MJ_DIRECTORY_CONTROL : 804F4552
09:28:36:578 3240 IRP_MJ_FILE_SYSTEM_CONTROL : 804F4552
09:28:36:578 3240 IRP_MJ_DEVICE_CONTROL : B9F02712
09:28:36:578 3240 IRP_MJ_INTERNAL_DEVICE_CONTROL : 8A7F88E0
09:28:36:578 3240 IRP_MJ_SHUTDOWN : 804F4552
09:28:36:578 3240 IRP_MJ_LOCK_CONTROL : 804F4552
09:28:36:578 3240 IRP_MJ_CLEANUP : 804F4552
09:28:36:578 3240 IRP_MJ_CREATE_MAILSLOT : 804F4552
09:28:36:578 3240 IRP_MJ_QUERY_SECURITY : 804F4552
09:28:36:578 3240 IRP_MJ_SET_SECURITY : 804F4552
09:28:36:578 3240 IRP_MJ_POWER : B9F0273C
09:28:36:578 3240 IRP_MJ_SYSTEM_CONTROL : B9F09336
09:28:36:578 3240 IRP_MJ_DEVICE_CHANGE : 804F4552
09:28:36:578 3240 IRP_MJ_QUERY_QUOTA : 804F4552
09:28:36:578 3240 IRP_MJ_SET_QUOTA : 804F4552
09:28:36:578 3240 C:\WINDOWS\system32\DRIVERS\atapi.sys - Verdict: 1
09:28:36:578 3240
09:28:36:578 3240 Completed
09:28:36:578 3240
09:28:36:578 3240 Results:
09:28:36:578 3240 Memory objects infected / cured / cured on reboot: 0 / 0 / 0
09:28:36:578 3240 Registry objects infected / cured / cured on reboot: 0 / 0 / 0
09:28:36:578 3240 File objects infected / cured / cured on reboot: 0 / 0 / 0
09:28:36:578 3240
09:28:36:578 3240 fclose_ex: Trying to close file C:\WINDOWS\system32\config\system
09:28:36:578 3240 fclose_ex: Trying to close file C:\WINDOWS\system32\config\software
09:28:36:578 3240 KLMD(ARK) unloaded successfully

Letoltod ezt a programot az asztalra-kicsomagolod az asztalra.es ot hagyod.
>>letoltes<<




Kinyitunk - Notepadot (Jegyzetfüzetet)igy: Start>futtatás>beírod: notepad
és bemásolod- a Kód: címszó alatt található zöld textet(Kód: szó nélkül), aztán a notepadba beillesztett textet elmentjük scriptnek az asztalra , úgy:- Fájl>Mentés Másként>Fájlnév>antiTDL3.bat>Fájl típusa>Minden fájl>Mentés.(Ásztálra),.Kész

Futtasd-a skan vegen mikor megal-benyomol akarmijen bilentyut,,kinyilik a log a notepadban,a tartalmat tedd ide.

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-04-25 00:05:40
Windows 5.1.2600 Szervizcsomag 3
Running: Hugo.exe; Driver: C:\DOCUME~1\gigabyte\LOCALS~1\Temp\kwpyrpob.sys


---- System - GMER 1.0.15 ----

SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwAllocateVirtualMemory [0xACF73870]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwAssignProcessToJobObject [0xACF740F0]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwClose [0xACE28C08]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwConnectPort [0xACF71E30]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwCreateFile [0xACF81250]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateKey [0xACE28AC4]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwCreatePort [0xACF71AE0]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwCreateProcess [0xACF6E740]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwCreateProcessEx [0xACF6EB50]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwCreateSection [0xACF6E220]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwCreateThread [0xACF70070]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwDebugActiveProcess [0xACF70D50]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteKey [0xACE29078]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteValueKey [0xACE28FA2]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDuplicateObject [0xACE2869A]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwLoadDriver [0xACF72F50]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwOpenFile [0xACF819F0]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenKey [0xACE28B9E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenProcess [0xACE285DA]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwOpenSection [0xACF6E490]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenThread [0xACE2863E]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwProtectVirtualMemory [0xACF73D10]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwQueryDirectoryFile [0xACF73400]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwQueryValueKey [0xACE28CBE]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwQueueApcThread [0xACF742A0]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRenameKey [0xACE29146]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwRequestWaitReplyPort [0xACF72A90]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRestoreKey [0xACE28C7E]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwResumeThread [0xACF71510]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwSecureConnectPort [0xACF72240]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwSetContextThread [0xACF70B10]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwSetSystemInformation [0xACF70F00]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwSetValueKey [0xACE28DFE]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwShutdownSystem [0xACF72E20]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwSuspendProcess [0xACF71700]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwSuspendThread [0xACF712F0]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwSystemDebugControl [0xACF710F0]
SSDT \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SASKUTIL.SYS/SUPERAdBlocker.com and SUPERAntiSpyware.com) ZwTerminateProcess [0xACFD6320]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwTerminateThread [0xACF708E0]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwUnloadDriver [0xACF73180]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwWriteVirtualMemory [0xACF73EF0]

Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ObInsertObject
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ObMakeTemporaryObject

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!ZwCallbackReturn + 2C7C 80504508 12 Bytes [E0, 1A, F7, AC, 40, E7, F6, ...] {LOOPNZ 0x1c; IMUL DWORD [EAX+EAX*2+0x50acf6e7]; JMP 0x1; LODSB }
.text ntkrnlpa.exe!ZwCallbackReturn + 2FB8 80504844 12 Bytes [00, 17, F7, AC, F0, 12, F7, ...] {ADD [EDI], DL; IMUL DWORD [EAX+ESI*8-0xf5308ee]; ADC BH, DH; LODSB }
PAGE ntkrnlpa.exe!ObMakeTemporaryObject 805BC512 5 Bytes JMP ACE314AA \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
PAGE ntkrnlpa.exe!ObInsertObject 805C2F96 5 Bytes JMP ACE3297E \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
.xreloc C:\WINDOWS\system32\drivers\sfsync04.sys unknown last section [0xB9F67000, 0xC58, 0x40000040]
? Combo-Fix.sys A rendszer nem találja a megadott fájlt. !
.text C:\WINDOWS\system32\DRIVERS\ati2mtag.sys section is writeable [0xB98C3000, 0x238E77, 0xE8000020]
.text C:\WINDOWS\system32\DRIVERS\atksgt.sys section is writeable [0xA9CBC300, 0x3AF78, 0xE8000020]
.text C:\WINDOWS\system32\DRIVERS\lirsgt.sys section is writeable [0xBA4A8300, 0x1BCE, 0xE8000020]
? C:\macska.com26791m\catchme.sys A rendszer nem találja a megadott fájlt. !
? C:\WINDOWS\system32\Drivers\PROCEXP113.SYS A rendszer nem találja a megadott fájlt. !

---- User code sections - GMER 1.0.15 ----

.text C:\WINDOWS\system32\csrss.exe[448] KERNEL32.dll!FreeLibrary + 15 7C80AC83 4 Bytes CALL 71AF003D
.text C:\WINDOWS\system32\winlogon.exe[480] kernel32.dll!FreeLibrary + 15 7C80AC83 4 Bytes CALL 71AF003D
.text C:\WINDOWS\system32\services.exe[524] kernel32.dll!FreeLibrary + 15 7C80AC83 4 Bytes CALL 71AF003D
.text C:\WINDOWS\system32\lsass.exe[536] kernel32.dll!FreeLibrary + 15 7C80AC83 4 Bytes CALL 71AF003D
.text C:\WINDOWS\system32\Ati2evxx.exe[692] kernel32.dll!FreeLibrary + 15 7C80AC83 4 Bytes CALL 71AF003D
.text ...
.text C:\WINDOWS\RTHDCPL.EXE[1584] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 01E10001
.text C:\WINDOWS\RTHDCPL.EXE[1584] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\RTHDCPL.EXE[1584] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\RTHDCPL.EXE[1584] kernel32.dll!FreeLibrary + 15 7C80AC83 4 Bytes CALL 71B0003D
.text C:\WINDOWS\RTHDCPL.EXE[1584] ADVAPI32.dll!CreateServiceA 77E271E9 6 Bytes JMP 5F130F5A
.text C:\WINDOWS\RTHDCPL.EXE[1584] ADVAPI32.dll!CreateServiceW 77E27381 6 Bytes JMP 5F160F5A
.text C:\WINDOWS\RTHDCPL.EXE[1584] USER32.dll!ExitWindowsEx 7E3AA275 6 Bytes JMP 5F0D0F5A
.text C:\WINDOWS\RTHDCPL.EXE[1584] IPHLPAPI.DLL!IcmpSendEcho2 76D5B73C 6 Bytes JMP 5F100F5A
.text C:\WINDOWS\system32\CTHELPER.EXE[1656] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00D20001
.text C:\WINDOWS\system32\CTHELPER.EXE[1656] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\system32\CTHELPER.EXE[1656] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\CTHELPER.EXE[1656] kernel32.dll!FreeLibrary + 15 7C80AC83 4 Bytes CALL 71B0003D
.text C:\WINDOWS\system32\CTHELPER.EXE[1656] ADVAPI32.dll!CreateServiceA 77E271E9 6 Bytes JMP 5F190F5A
.text C:\WINDOWS\system32\CTHELPER.EXE[1656] ADVAPI32.dll!CreateServiceW 77E27381 6 Bytes JMP 5F1C0F5A
.text C:\WINDOWS\system32\CTHELPER.EXE[1656] ole32.dll!CoCreateInstanceEx 774F0526 6 Bytes JMP 5F160F5A
.text C:\WINDOWS\system32\CTHELPER.EXE[1656] ole32.dll!CoCreateInstance 774F057E 6 Bytes JMP 5F130F5A
.text C:\WINDOWS\system32\CTHELPER.EXE[1656] USER32.dll!ExitWindowsEx 7E3AA275 6 Bytes JMP 5F0D0F5A
.text C:\WINDOWS\system32\CTHELPER.EXE[1656] IPHLPAPI.DLL!IcmpSendEcho2 76D5B73C 6 Bytes JMP 5F100F5A
.text C:\WINDOWS\System32\alg.exe[1668] kernel32.dll!FreeLibrary + 15 7C80AC83 4 Bytes CALL 71B0003D
.text C:\PROGRA~1\Avast5\avastUI.exe[1676] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 01290001
.text C:\PROGRA~1\Avast5\avastUI.exe[1676] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 5F0A0F5A
.text C:\PROGRA~1\Avast5\avastUI.exe[1676] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 5F040F5A
.text C:\PROGRA~1\Avast5\avastUI.exe[1676] kernel32.dll!FreeLibrary + 15 7C80AC83 4 Bytes CALL 71B0003D
.text C:\PROGRA~1\Avast5\avastUI.exe[1676] ADVAPI32.dll!CreateServiceA 77E271E9 6 Bytes JMP 5F190F5A
.text C:\PROGRA~1\Avast5\avastUI.exe[1676] ADVAPI32.dll!CreateServiceW 77E27381 6 Bytes JMP 5F1C0F5A
.text C:\PROGRA~1\Avast5\avastUI.exe[1676] USER32.dll!ExitWindowsEx 7E3AA275 6 Bytes JMP 5F0D0F5A
.text C:\PROGRA~1\Avast5\avastUI.exe[1676] ole32.dll!CoCreateInstanceEx 774F0526 6 Bytes JMP 5F160F5A
.text C:\PROGRA~1\Avast5\avastUI.exe[1676] ole32.dll!CoCreateInstance 774F057E 6 Bytes JMP 5F130F5A
.text C:\PROGRA~1\Avast5\avastUI.exe[1676] IPHLPAPI.DLL!IcmpSendEcho2 76D5B73C 6 Bytes JMP 5F100F5A
.text C:\WINDOWS\system32\wscntfy.exe[2216] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00BB0001
.text C:\WINDOWS\system32\wscntfy.exe[2216] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\system32\wscntfy.exe[2216] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\wscntfy.exe[2216] kernel32.dll!FreeLibrary + 15 7C80AC83 4 Bytes CALL 71B0003D
.text C:\WINDOWS\system32\wscntfy.exe[2216] USER32.dll!ExitWindowsEx 7E3AA275 6 Bytes JMP 5F0D0F5A
.text C:\WINDOWS\system32\wscntfy.exe[2216] ADVAPI32.dll!CreateServiceA 77E271E9 6 Bytes JMP 5F130F5A
.text C:\WINDOWS\system32\wscntfy.exe[2216] ADVAPI32.dll!CreateServiceW 77E27381 6 Bytes JMP 5F160F5A
.text C:\WINDOWS\system32\wscntfy.exe[2216] IPHLPAPI.DLL!IcmpSendEcho2 76D5B73C 6 Bytes JMP 5F100F5A
.text C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2256] KERNEL32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00D10001
.text C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2256] KERNEL32.dll!CreateProcessW 7C802336 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2256] KERNEL32.dll!CreateProcessA 7C80236B 6 Bytes JMP 5F040F5A
.text C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2256] KERNEL32.dll!FreeLibrary + 15 7C80AC83 4 Bytes CALL 71B0003D
.text C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2256] user32.dll!ExitWindowsEx 7E3AA275 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2256] advapi32.dll!CreateServiceA 77E271E9 6 Bytes JMP 5F190F5A
.text C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2256] advapi32.dll!CreateServiceW 77E27381 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2256] ole32.dll!CoCreateInstanceEx 774F0526 6 Bytes JMP 5F160F5A
.text C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2256] ole32.dll!CoCreateInstance 774F057E 6 Bytes JMP 5F130F5A
.text C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2256] IPHLPAPI.DLL!IcmpSendEcho2 76D5B73C 6 Bytes JMP 5F100F5A
.text C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe[2544] KERNEL32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00D10001
.text C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe[2544] KERNEL32.dll!CreateProcessW 7C802336 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe[2544] KERNEL32.dll!CreateProcessA 7C80236B 6 Bytes JMP 5F040F5A
.text C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe[2544] KERNEL32.dll!FreeLibrary + 15 7C80AC83 4 Bytes CALL 71B0003D
.text C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe[2544] user32.dll!ExitWindowsEx 7E3AA275 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe[2544] advapi32.dll!CreateServiceA 77E271E9 6 Bytes JMP 5F190F5A
.text C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe[2544] advapi32.dll!CreateServiceW 77E27381 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe[2544] ole32.dll!CoCreateInstanceEx 774F0526 6 Bytes JMP 5F160F5A
.text C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe[2544] ole32.dll!CoCreateInstance 774F057E 6 Bytes JMP 5F130F5A
.text C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe[2544] IPHLPAPI.DLL!IcmpSendEcho2 76D5B73C 6 Bytes JMP 5F100F5A
.text C:\WINDOWS\system32\ctfmon.exe[2596] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00CA0001
.text C:\WINDOWS\system32\ctfmon.exe[2596] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\system32\ctfmon.exe[2596] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\ctfmon.exe[2596] kernel32.dll!FreeLibrary + 15 7C80AC83 4 Bytes CALL 71B0003D
.text C:\WINDOWS\system32\ctfmon.exe[2596] ADVAPI32.dll!CreateServiceA 77E271E9 6 Bytes JMP 5F130F5A
.text C:\WINDOWS\system32\ctfmon.exe[2596] ADVAPI32.dll!CreateServiceW 77E27381 6 Bytes JMP 5F160F5A
.text C:\WINDOWS\system32\ctfmon.exe[2596] USER32.dll!ExitWindowsEx 7E3AA275 6 Bytes JMP 5F0D0F5A
.text C:\WINDOWS\system32\ctfmon.exe[2596] IPHLPAPI.DLL!IcmpSendEcho2 76D5B73C 6 Bytes JMP 5F100F5A
.text C:\WINDOWS\explorer.exe[3416] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00F30001
.text C:\WINDOWS\explorer.exe[3416] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\explorer.exe[3416] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\explorer.exe[3416] kernel32.dll!FreeLibrary + 15 7C80AC83 4 Bytes CALL 71B0003D
.text C:\WINDOWS\explorer.exe[3416] ADVAPI32.dll!CreateServiceA 77E271E9 6 Bytes JMP 5F130F5A
.text C:\WINDOWS\explorer.exe[3416] ADVAPI32.dll!CreateServiceW 77E27381 6 Bytes JMP 5F160F5A
.text C:\WINDOWS\explorer.exe[3416] USER32.dll!ExitWindowsEx 7E3AA275 6 Bytes JMP 5F0D0F5A
.text C:\WINDOWS\explorer.exe[3416] IPHLPAPI.DLL!IcmpSendEcho2 76D5B73C 6 Bytes JMP 5F100F5A

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisCloseAdapter] [BA17B300] \??\C:\WINDOWS\system32\drivers\OAnet.sys (OA Helper Driver/Tall Emu Pty Ltd)
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisOpenAdapter] [BA17B360] \??\C:\WINDOWS\system32\drivers\OAnet.sys (OA Helper Driver/Tall Emu Pty Ltd)
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol] [BA17B610] \??\C:\WINDOWS\system32\drivers\OAnet.sys (OA Helper Driver/Tall Emu Pty Ltd)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisDeregisterProtocol] [BA17B650] \??\C:\WINDOWS\system32\drivers\OAnet.sys (OA Helper Driver/Tall Emu Pty Ltd)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol] [BA17B610] \??\C:\WINDOWS\system32\drivers\OAnet.sys (OA Helper Driver/Tall Emu Pty Ltd)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisOpenAdapter] [BA17B360] \??\C:\WINDOWS\system32\drivers\OAnet.sys (OA Helper Driver/Tall Emu Pty Ltd)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisCloseAdapter] [BA17B300] \??\C:\WINDOWS\system32\drivers\OAnet.sys (OA Helper Driver/Tall Emu Pty Ltd)
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisRegisterProtocol] [BA17B610] \??\C:\WINDOWS\system32\drivers\OAnet.sys (OA Helper Driver/Tall Emu Pty Ltd)
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisDeregisterProtocol] [BA17B650] \??\C:\WINDOWS\system32\drivers\OAnet.sys (OA Helper Driver/Tall Emu Pty Ltd)
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisCloseAdapter] [BA17B300] \??\C:\WINDOWS\system32\drivers\OAnet.sys (OA Helper Driver/Tall Emu Pty Ltd)
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisOpenAdapter] [BA17B360] \??\C:\WINDOWS\system32\drivers\OAnet.sys (OA Helper Driver/Tall Emu Pty Ltd)

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\WINDOWS\system32\services.exe[524] @ C:\WINDOWS\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 003D0002
IAT C:\WINDOWS\system32\services.exe[524] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!CreateProcessW] 003D0000

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs aswSP.SYS (avast! self protection module/ALWIL Software)

AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)

Device \FileSystem\Fastfat \FatCdrom aswSP.SYS (avast! self protection module/ALWIL Software)
Device \Driver\Tcpip \Device\Ip OAmon.sys (TDI Helper Driver/Tall Emu)

AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device \Driver\Tcpip \Device\Tcp OAmon.sys (TDI Helper Driver/Tall Emu)

AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 8A88E8E8
Device \Driver\atapi \Device\Ide\IdePort0 8A88E8E8
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 8A88E8E8
Device \Driver\atapi \Device\Ide\IdePort1 8A88E8E8
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c 8A88E8E8
Device \Driver\Tcpip \Device\Udp OAmon.sys (TDI Helper Driver/Tall Emu)

AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device \Driver\Tcpip \Device\RawIp OAmon.sys (TDI Helper Driver/Tall Emu)

AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device \Driver\Tcpip \Device\IPMULTICAST OAmon.sys (TDI Helper Driver/Tall Emu)
Device \FileSystem\Fastfat \Fat aswSP.SYS (avast! self protection module/ALWIL Software)

AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xE1 0xCD 0x9E 0x27 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x56 0x4B 0xE0 0x65 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x09 0x4E 0xB5 0x04 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xE1 0xCD 0x9E 0x27 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x56 0x4B 0xE0 0x65 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x09 0x4E 0xB5 0x04 ...

---- EOF - GMER 1.0.15 ----

ComboFix 10-04-21.01 - gigabyte 010.04.24. 22:26:16.3.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1250.36.1038.18.3582.3193 [GMT 2:00]
Running from: c:\documents and settings\gigabyte\Asztal\macska.com.exe
Command switches used :: c:\documents and settings\gigabyte\Asztal\CFScript.txt
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: Online Armor Firewall *enabled* {B797DAA0-7E2E-4711-8BB3-D12744F1922A}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

Infected copy of c:\windows\System32\drivers\atapi.sys was found and disinfected
Restored copy from - c:\windows\system32\ReinstallBackups\0005\DriverFiles\i386\atapi.sys

.
((((((((((((((((((((((((( Files Created from 2010-03-24 to 2010-04-24 )))))))))))))))))))))))))))))))
.

2010-04-24 19:35 . 2010-04-24 19:35 -------- d-----w- C:\_OTL
2010-04-24 16:48 . 2010-04-24 16:48 3262 ----a-r- c:\documents and settings\gigabyte\Application Data\Microsoft\Installer\{10209B87-55D6-493E-A30A-12A265AA324E}\_5b0b29e7.exe
2010-04-24 16:47 . 2010-04-24 17:12 -------- d-----w- C:\macska.com18181m
2010-04-24 14:38 . 2010-04-24 14:38 -------- d-----w- c:\windows\system32\xircom
2010-04-24 14:38 . 2010-04-24 14:38 -------- d-----w- c:\windows\system32\wbem\snmp
2010-04-24 14:38 . 2010-04-24 14:38 -------- d-----w- c:\program files\microsoft frontpage
2010-04-24 14:24 . 2010-04-24 14:43 -------- d-----w- C:\macska.com
2010-04-24 10:17 . 2010-04-24 14:16 -------- d-----w- C:\ComboFix
2010-04-23 09:50 . 2010-04-23 09:50 -------- d-----w- c:\documents and settings\gigabyte\Application Data\Malwarebytes
2010-04-23 09:50 . 2010-03-29 22:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-23 09:50 . 2010-04-23 09:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-04-23 09:50 . 2010-04-23 09:50 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-23 09:50 . 2010-03-29 22:45 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-23 09:19 . 2010-04-23 09:19 52224 ----a-w- c:\documents and settings\gigabyte\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-04-23 09:19 . 2010-04-23 09:19 117760 ----a-w- c:\documents and settings\gigabyte\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-04-23 09:18 . 2010-04-23 09:18 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-04-23 09:17 . 2010-04-23 09:17 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-04-23 09:17 . 2010-04-23 09:17 -------- d-----w- c:\documents and settings\gigabyte\Application Data\SUPERAntiSpyware.com
2010-04-19 11:26 . 2010-04-19 12:00 -------- d-----w- c:\documents and settings\gigabyte\Application Data\Red Alert 3
2010-04-11 00:19 . 2010-04-11 00:19 -------- d-----w- c:\windows\Sun
2010-04-11 00:10 . 2010-04-11 00:10 503808 ----a-w- c:\documents and settings\gigabyte\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-599c82d8-n\msvcp71.dll
2010-04-11 00:10 . 2010-04-11 00:10 499712 ----a-w- c:\documents and settings\gigabyte\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-599c82d8-n\jmc.dll
2010-04-11 00:10 . 2010-04-11 00:10 348160 ----a-w- c:\documents and settings\gigabyte\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-599c82d8-n\msvcr71.dll
2010-04-11 00:10 . 2010-04-11 00:10 61440 ----a-w- c:\documents and settings\gigabyte\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-18a5809d-n\decora-sse.dll
2010-04-11 00:10 . 2010-04-11 00:10 12800 ----a-w- c:\documents and settings\gigabyte\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-18a5809d-n\decora-d3d.dll
2010-04-11 00:10 . 2010-04-11 19:24 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-04-08 02:25 . 2010-04-21 08:30 -------- d-----w- c:\program files\PeerBlock
2010-04-07 17:23 . 2010-04-10 22:50 -------- d-----w- c:\program files\WinPatrol
2010-04-07 16:32 . 2010-04-14 16:35 162768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-04-07 16:32 . 2010-04-14 16:31 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-04-07 16:32 . 2010-04-14 16:31 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-04-07 16:32 . 2010-04-14 16:35 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-04-07 16:32 . 2010-04-14 16:31 100432 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-04-07 16:32 . 2010-04-14 16:31 94800 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-04-07 16:32 . 2010-04-14 16:30 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-04-07 16:32 . 2010-04-14 16:47 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-04-07 16:32 . 2010-04-14 16:47 153184 ----a-w- c:\windows\system32\aswBoot.exe
2010-04-07 16:32 . 2010-04-16 00:34 -------- d-----w- c:\program files\Avast5
2010-04-07 16:32 . 2010-04-07 16:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-04-07 15:59 . 2010-04-07 16:28 -------- d-----w- c:\documents and settings\All Users\Application Data\OnlineArmor
2010-04-07 15:59 . 2010-04-07 15:59 -------- d-----w- c:\documents and settings\gigabyte\Application Data\OnlineArmor
2010-04-07 15:58 . 2010-03-13 03:39 24440 ----a-w- c:\windows\system32\drivers\OAmon.sys
2010-04-07 15:58 . 2010-03-13 03:38 29560 ----a-w- c:\windows\system32\drivers\OAnet.sys
2010-04-07 15:58 . 2010-03-13 03:38 226680 ----a-w- c:\windows\system32\drivers\OADriver.sys
2010-04-07 15:58 . 2010-04-24 14:21 -------- d-----w- c:\program files\Online Armor
2010-04-05 23:08 . 2010-04-05 23:08 -------- d-----w- c:\program files\Ubi Soft
2010-04-05 23:05 . 2010-04-05 23:05 53248 ----a-r- c:\documents and settings\gigabyte\Application Data\Microsoft\Installer\{9AA761E6-CA51-4FF2-A552-D51638BF0595}\_F522ED7EA612_4117_B86D_78467DE01E30.exe
2010-04-05 18:08 . 2010-04-05 18:08 0 ----a-w- c:\windows\PowerReg.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-24 20:32 . 2008-06-28 17:36 24 ----a-w- c:\windows\system32\DVCStateBkp-{00000004-00000000-00000001-00001102-00000002-00201102}.dat
2010-04-24 20:32 . 2008-06-28 17:36 24 ----a-w- c:\windows\system32\DVCState-{00000004-00000000-00000001-00001102-00000002-00201102}.dat
2010-04-24 18:21 . 2008-06-27 22:02 -------- d-----w- c:\documents and settings\gigabyte\Application Data\foobar2000
2010-04-24 16:48 . 2008-09-28 23:45 -------- d-----w- c:\program files\TQ Defiler
2010-04-24 16:40 . 2008-07-07 02:34 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-04-24 16:39 . 2009-06-22 04:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-04-24 16:39 . 2008-06-28 00:39 -------- d-----w- c:\documents and settings\gigabyte\Application Data\Lavasoft
2010-04-24 14:44 . 2004-08-18 11:00 97174 ----a-w- c:\windows\system32\perfc00E.dat
2010-04-24 14:44 . 2004-08-18 11:00 440598 ----a-w- c:\windows\system32\perfh00E.dat
2010-04-23 20:24 . 2008-07-02 14:09 -------- d-----w- c:\documents and settings\gigabyte\Application Data\Skype
2010-04-23 19:21 . 2008-07-02 14:10 -------- d-----w- c:\documents and settings\gigabyte\Application Data\skypePM
2010-04-23 10:44 . 2008-08-01 04:03 -------- d-----w- c:\documents and settings\gigabyte\Application Data\uTorrent
2010-04-23 09:17 . 2008-12-02 21:08 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-04-19 16:21 . 2008-12-19 14:13 98304 ----a-w- c:\windows\system32CmdLineExt.dll
2010-04-19 10:36 . 2008-06-26 07:47 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-04-14 03:34 . 2008-06-26 08:14 29216 ----a-w- c:\documents and settings\gigabyte\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-04-11 03:56 . 2008-09-29 01:30 -------- d-----w- c:\program files\Common Files\Adobe
2010-04-08 02:23 . 2009-01-18 08:48 -------- d-----w- c:\program files\PeerGuardian2
2010-03-02 16:07 . 2009-06-22 04:28 15880 ----a-w- c:\windows\system32\lsdelete.exe
2010-02-14 21:30 . 2010-02-14 21:30 6812 ----a-w- c:\windows\system32\ealregsnapshot1.reg
2010-02-04 09:01 . 2010-02-14 20:42 74072 ----a-w- c:\windows\system32\XAPOFX1_4.dll
2010-02-04 09:01 . 2010-02-14 20:42 528216 ----a-w- c:\windows\system32\XAudio2_6.dll
2010-02-04 09:01 . 2010-02-14 20:42 238936 ----a-w- c:\windows\system32\xactengine3_6.dll
2010-02-04 09:01 . 2010-02-14 20:42 22360 ----a-w- c:\windows\system32\X3DAudio1_7.dll
2009-01-28 22:47 . 2009-01-28 22:47 23 --sha-w- c:\windows\system32\efdeaade7_z.dll
.

------- Sigcheck -------

[-] 2008-05-19 . 2993C2DF98A2D6D9896E0AB24946F972 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot@2010-04-24_14.38.45 )))))))))))))))))))))))))))))))))))))))))
.
- 2004-08-18 11:00 . 2010-04-07 15:58 69018 c:\windows\system32\perfc009.dat
+ 2004-08-18 11:00 . 2010-04-24 14:44 69018 c:\windows\system32\perfc009.dat
- 2008-04-13 06:10 . 2008-04-13 09:40 96512 c:\windows\system32\drivers\atapi.sys
+ 2008-04-13 06:10 . 2008-04-13 11:40 96512 c:\windows\system32\drivers\atapi.sys
+ 2004-08-18 11:00 . 2010-04-24 14:44 434898 c:\windows\system32\perfh009.dat
- 2004-08-18 11:00 . 2010-04-07 15:58 434898 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2010-04-01 2010864]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-09-19 16844800]
"WINDVDPatch"="CTHELPER.EXE" [2002-07-02 24576]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-08-13 98304]
"@OnlineArmor GUI"="c:\program files\Online Armor\oaui.exe" [2010-03-13 6658552]
"avast5"="c:\progra~1\Avast5\avastUI.exe" [2010-04-14 2790472]
"WinPatrol"="c:\program files\WinPatrol\winpatrol.exe" [2009-07-27 341312]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{4F07DA45-8170-4859-9B5F-037EF2970034}"= "c:\progra~1\ONLINE~2\oaevent.dll" [2010-03-13 925688]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 13:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKLM\~\startupfolder\C:^Documents and Settings^gigabyte^Start Menu^Programs^Indítópult^WinFlip.lnk]
backup=c:\windows\pss\WinFlip.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-12-21 23:57 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2005-05-11 21:12 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Jet Detection]
2001-11-28 23:00 28672 ----a-w- c:\program files\Creative\SBLive\Program\ADGJDet.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2009-07-26 14:43 3883840 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-01 14:57 153136 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2008-09-06 13:09 413696 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2004-11-02 18:24 32768 ----a-w- c:\program files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2008-11-07 13:31 21633320 ----a-r- c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2010-04-07 17:57 1217872 ----a-w- c:\games\Steam\steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
2000-05-10 23:00 90112 ------w- c:\windows\Updreg.EXE

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009.06.22. 6:16 64288]
R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\system32\drivers\sfdrv01a.sys [2006.07.05. 14:46 63352]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2010.04.07. 18:32 162768]
R1 OADevice;OADriver;c:\windows\system32\drivers\OADriver.sys [2010.04.07. 17:58 226680]
R1 OAmon;OAmon;c:\windows\system32\drivers\OAmon.sys [2010.04.07. 17:58 24440]
R1 OAnet;OAnet;c:\windows\system32\drivers\OAnet.sys [2010.04.07. 17:58 29560]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2010.02.17. 11:25 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010.02.17. 11:15 66632]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010.04.07. 18:32 19024]
R2 OAcat;Online Armor Helper Service;c:\program files\Online Armor\oacat.exe [2010.04.07. 17:58 1284600]
R2 SvcOnlineArmor;Online Armor;c:\program files\Online Armor\oasrv.exe [2010.04.07. 17:58 3360760]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2010.02.17. 11:15 12872]
S3 rkhdrv40;Rootkit Unhooker Driver; [x]
S3 VL807a;VL807a Filter;c:\windows\system32\drivers\VL807a.sys [2009.11.04. 9:44 23680]
S4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys --> c:\windows\system32\Drivers\sptd.sys [?]
.
Contents of the 'Scheduled Tasks' folder

2008-12-18 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mStart Page = hxxp://www.yahoo.com
FF - ProfilePath - c:\documents and settings\gigabyte\Application Data\Mozilla\Firefox\Profiles\dvvuwvlj.default\
FF - prefs.js: browser.startup.homepage -

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-24 22:36
Windows 5.1.2600 Szervizcsomag 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A88E8E8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xba0ecf28
\Driver\ACPI -> ACPI.sys @ 0xb9f7fcb8
\Driver\atapi -> 0x8a88e8e8
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1004336348-1425521274-682003330-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:44,55,d0,ad,07,c1,2f,a1,79,13,e4,b4,4a,d0,7e,64,2d,98,e1,04,29,18,34,
69,3f,01,26,b6,6f,ad,43,f8,16,04,1c,a7,43,53,dc,d0,03,f1,9d,6f,26,67,db,a6,\
"??"=hex:5d,2e,bc,00,9b,07,bc,9c,34,34,87,88,c9,ab,ca,0d

[HKEY_USERS\S-1-5-21-1004336348-1425521274-682003330-1003\Software\SecuROM\License information*]
"datasecu"=hex:4f,eb,20,27,db,f9,5f,08,e8,e0,e6,04,cf,38,d9,50,38,cb,5d,68,84,
95,4b,79,b0,ad,4a,d8,c3,96,81,81,ee,21,43,93,f9,24,01,c1,6f,43,d5,6c,a1,93,\
"rkeysecu"=hex:dd,bc,ad,1e,30,35,24,4f,1a,47,c7,1e,c5,3b,48,c4
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(480)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3416)
c:\program files\Online Armor\OAwatch.dll
c:\program files\WinPatrol\PATROLPRO.DLL
c:\windows\system32\ctagent.dll
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Avast5\AvastSvc.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\CTHELPER.EXE
c:\windows\system32\wscntfy.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
c:\program files\Online Armor\OAhlp.exe
.
**************************************************************************
.
Completion time: 2010-04-24 22:39:30 - machine was rebooted
ComboFix-quarantined-files.txt 2010-04-24 20:39
ComboFix2.txt 2010-04-24 17:12
ComboFix3.txt 2010-04-24 14:43

Pre-Run: 10 027 159 552 bájt szabad
Post-Run: 9 992 695 808 bájt szabad

- - End Of File - - BE16653F4F91761DAE76B543A67B3A92

Rendben. Köszönöm az eddigieket!

ok,uj script a combofixnek



2:

A logokat csak holnap nezem meg..ma vegzek,,
udv

Az előző hozzászólásom nem ment el szóval még1x.
Tuti, hogy a piros RUNFIX-re klikkeltem elöször is, viszont folyamat közben bejött egy figyelmeztető ablak, hogy vmi leállt újra fog indulni és minden eddigi munkám elveszik. Visszaszámolt 1 percről.
Most viszont a program rebootolt miután végzett.

All processes killed
========== OTL ==========
Error: No service named AVG Anti-Rootkit was found to stop!
Service\Driver key AVG Anti-Rootkit not found.
File C:\WINDOWS\System32\DRIVERS\avgarkt.sys not found.
Service AvgArCln stopped successfully!
Service AvgArCln deleted successfully!
C:\WINDOWS\system32\drivers\AvgArCln.sys moved successfully.
Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce\\nltide_2 deleted successfully.
Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce\\nltide_2 not found.
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Trymedia\licenses folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Trymedia\data folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Trymedia folder moved successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:05EE1EEF deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:AC680CD1 deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: gigabyte
->Temp folder emptied: 158960 bytes
->Temporary Internet Files folder emptied: 582739 bytes
->Java cache emptied: 100080 bytes
->FireFox cache emptied: 40756269 bytes
->Flash cache emptied: 1920185 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Rendszergazda
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Rendszergazda.GIGABYTE-B9A0E7
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->FireFox cache emptied: 3253254 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2573260 bytes
%systemroot%\System32 .tmp files removed: 3172631 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 50,00 mb


[EMPTYFLASH]

User: All Users

User: Default User

User: gigabyte
->Flash cache emptied: 0 bytes

User: LocalService

User: NetworkService

User: Rendszergazda

User: Rendszergazda.GIGABYTE-B9A0E7

Total Flash Files Cleaned = 0,00 mb


OTL by OldTimer - Version 3.2.2.0 log created on 04242010_215849

Files\Folders moved on Reboot...
File move failed. C:\WINDOWS\temp\_avast5_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...

na most mit csinaltal??bekelet masolni a scriptet es klika RUNFIX
Gombra,nem a RunScan gombra.tehat csinald megegyszer

Most kicsit meg vagyok keveredve mert ez most az extras.txt amit beraktam, de a dátum benne még az előző OTL scanneléses dátum és az OTL.txt dátuma is ugyanez.

OTL Extras logfile created on: 2010.04.24. 20:28:55 - Run 1
OTL by OldTimer - Version 3.2.2.0 Folder = C:\Documents and Settings\gigabyte\Asztal
Windows XP Professional Edition Szervizcsomag 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 0000040E | Country: Magyarország | Language: HUN | Date Format: yyyy.MM.dd.

3,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 84,00% Memory free
6,00 Gb Paging File | 6,00 Gb Available in Paging File | 92,00% Paging File free
Paging file location(s): C:\pagefile.sys 3069 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 66,86 Gb Total Space | 9,34 Gb Free Space | 13,96% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 166,02 Gb Total Space | 25,09 Gb Free Space | 15,11% Space Free | Partition Type: NTFS
Drive F: | 74,51 Gb Total Space | 5,99 Gb Free Space | 8,04% Space Free | Partition Type: FAT32
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: GIGABYTE-B9A0E7
Current User Name: gigabyte
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 7 Days
Output = Standard

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

[HKEY_USERS\S-1-5-21-1004336348-1425521274-682003330-1003\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [ACDBrowse] -- "C:\PROGRA~1\ACDSYS~1\ACDSee\ACDSee.exe" "%1" (ACD Systems, Ltd.)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001040E-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 SR-1 Professional
"{000E79B7-E725-4F01-870A-C12942B7F8E4}" = Crysis(R)
"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
"{01501EBA-EC35-4F9F-8889-3BE346E5DA13}" = MSXML4 Parser
"{015C5B35-B678-451C-9AEE-821E8D69621C}_is1" = PeerBlock 1.0.0 (r181)
"{02FB40EA-C8AC-36F7-A546-B083E00AF3AA}" = Catalyst Control Center Core Implementation
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center
"{05B49229-22A2-4F88-842A-BBC2EBE1CCF6}" = Microsoft Games for Windows - LIVE Redistributable
"{09984AEC-6B9F-4ca7-B78D-CB44D4771DA3}" = Destinations
"{10209B87-55D6-493E-A30A-12A265AA324E}" = TQ Defiler
"{1116FD69-3C49-BE9A-C206-E8BA26CCA10F}" = CCC Help English
"{15EE79F4-4ED1-4267-9B0F-351009325D7D}" = HP Software Update
"{16FE2579-06B2-3E32-58F2-4B70B69A3070}" = ccc-core-preinstall
"{18B29862-C3E7-3AFC-831F-039FB8717BC5}" = Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - HUN
"{1EB21F28-E3AF-A317-4658-6C0C455C2F61}" = Catalyst Control Center Core Implementation
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20533183-D42D-4261-A125-956736FBEA8C}" = Dawn of War - Soulstorm
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live feltöltőeszköz
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{27E8FE87-158D-30A8-A385-A68756C1F9D8}" = Microsoft .NET Framework 3.5 Language Pack - hun
"{2BA00471-0328-3743-93BD-FA813353A783}" = Microsoft .NET Framework 3.0 Service Pack 1
"{2C14901F-ED9D-40B5-8FE5-1BAF3D31F73B}" = ColdFear
"{2FC099BD-AC9B-33EB-809C-D332E1B27C40}" = Microsoft .NET Framework 3.5
"{2FD9998F-B3F3-10D6-A31E-8E021337EC0B}" = CCC Help English
"{30C19FF2-7FBA-4d09-B9DE-1659977F64F6}" = TrayApp
"{31D95937-B237-405D-920C-A3EF4E482395}" = Supreme Commander - Forged Alliance
"{32BBD344-47DB-7027-7E1D-13DB78415784}" = ccc-core-preinstall
"{34B9B494-EF4A-4592-87A8-BE40D0442E86}" = Dawn of War - Soulstorm
"{350C940e-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3819891A-030B-4a4e-98ED-B28A649E48AB}" = HP Deskjet 3900 series
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3FCAADB8-EB1B-11D6-AB2D-0090271A23A2}" = Sound Blaster Live! Web 2K/XP
"{412B69AF-C352-4F6F-A318-B92B3CB9ACC6}" = Titan Quest
"{42F6BED9-41DD-40F1-85A8-8E0350493626}" = HPDeskjet3900Series
"{4445BFF0-008A-8F5C-9D68-B0164F7E26FF}" = ccc-core-static
"{46D9C523-FABB-FFF1-321D-F493A68E2C3E}" = Catalyst Control Center Graphics Previews Common
"{4D243BA7-9AC4-46D1-90E5-EEB88974F501}" = Microsoft Games for Windows - LIVE
"{4D87DC92-C328-46EC-A7B4-9C88129DC696}" = Dead Space™
"{4D89AFAD-669B-514A-E150-7DA3208477DC}" = ccc-utility
"{4E47B686-8DFF-1AAD-3264-A537E2FC3833}" = Catalyst Control Center Graphics Previews Common
"{51592501-CFCE-4570-A0B8-8B14E40BF23A}" = TQVault
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{56F8AFC3-FA98-4ff1-9673-8A026CBF85BE}" = WebReg
"{57D32909-FCA8-A78B-2AD2-2A50F5E11858}" = ccc-core-static
"{57EA735B-4F1D-9FC5-6A36-B0C0F1D704FE}" = Catalyst Control Center Graphics Light
"{5A098C87-FA43-E81C-B206-4E0ADF7287B5}" = ccc-utility
"{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}" = Skype™ 3.8
"{5D63D27F-09D7-4420-9479-DD247CC31496}" = Windows Live Essentials
"{5F26311C-B135-4F7F-B11E-8E650F83651E}" = DeviceFunctionQFolder
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{68A35043-C55A-4237-88C9-37EE1C63ED71}" = Microsoft Visual J# 2.0 Redistributable Package
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6D431157-ED9D-4AB1-A2C9-1FAA0A04419F}" = Windows Live Messenger
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{733EB793-0840-4D69-97AA-6934FC79DB16}" = Windows Live bejelentkezési segéd
"{7764393A-A48B-6BB2-28BC-A6B4EF3A95BC}" = Catalyst Control Center Graphics Full Existing
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client
"{7F9783DE-C0E9-4971-AE44-D34A2E03F877}" = Windows Live Writer
"{825DFF04-8FB0-3430-CB22-8725719B1A01}" = Catalyst Control Center Graphics Light
"{84430565-C205-B818-7D13-052F88707F70}" = CCC Help English
"{8CFA9151-6404-409A-AF22-4632D04582FD}" = Assassin's Creed
"{8DC42D05-680B-41B0-8878-6C14D24602DB}" = QuickTime
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{98613C99-1399-416C-A07C-1EE1C585D872}" = SeaTools for Windows
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A2F166A0-F031-4E27-A057-C69733219434}_is1" = Runes of Magic
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3
"{B0889CBC-F889-A895-4EE9-8E0260C7D63F}" = Catalyst Control Center HydraVision Full
"{B10A4ACC-118A-8E9D-2CF3-A19BBC73B9C2}" = Catalyst Control Center Graphics Full Existing
"{B210130E-835C-4581-A695-CE10616B8B55}_is1" = Driver Sweeper 2.0.5
"{B31CBE94-F497-9273-5766-DD4E11AA2D55}" = Catalyst Control Center Graphics Full New
"{B508B3F1-A24A-32C0-B310-85786919EF28}" = Microsoft .NET Framework 2.0 Service Pack 1
"{B5B6C0B5-EC21-4E7C-9B4B-6DD162BE5AEC}" = Rogue Trooper
"{B5C5C17E-FEF6-4062-8151-A427AE8AF9D7}" = Titan Quest Immortal Throne
"{B996AE66-10DB-4ac5-B151-E8B4BFBC42FC}" = BufferChm
"{BA60C8FC-6712-5116-231C-6C5E05060866}" = Catalyst Control Center Graphics Light
"{C43C1415-3DFC-4089-9A32-0BECF28A6046}" = Age of Empires III - The Asian Dynasties
"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver
"{CADDE354-C78C-46CB-A006-E2B178EFC271}" = Rise Of Legends
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CB654885-263B-E696-5690-3B341C22EC17}" = Catalyst Control Center Core Implementation
"{CC2422C9-F7B5-4175-B295-5EC2283AA674}" = Command & Conquer™ 3: Kane's Wrath
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition
"{CF097717-F174-4144-954A-FBC4BF301033}" = Nero 7 Ultra Edition
"{CF929EEB-CE39-4F06-B1BF-F51FC617A2B2}" = Catalyst Control Center - Branding
"{D13EB4BD-8A13-35D1-9850-C29AF6D91CD1}" = Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - HUN
"{D4658131-9D1A-4395-876D-968E38FE8ED5}" = Universe at War Earth Assault
"{D99667FF-4A9B-B278-9014-BEA2896F413F}" = ccc-core-preinstall
"{DBD86EB8-8536-DB02-EC42-31ED143497A8}" = Catalyst Control Center HydraVision Full
"{DDEDAF6C-488E-4CDA-8276-1CCF5F3C5C32}" = Command & Conquer 3
"{DE31F8AA-B12D-3A38-E561-C657EED45465}" = Catalyst Control Center Graphics Full Existing
"{DFAE9340-E8BB-4433-9A08-C8334DAFE1B9}" = Star Wars Republic Commando
"{E0520079-4024-8B23-738F-EC0792AA3502}" = ccc-core-static
"{E3F90083-80D4-4b5a-87C7-E97E12F5516D}" = HPProductAssistant
"{E6EB53D4-5AD0-07F0-2DAC-0A2D624DF39D}" = ccc-utility
"{E74CC47C-28D3-25E1-14D2-68EBC87C31BA}" = Skins
"{E9F882ED-C2B8-2716-0330-7FBA5C9C455B}" = Catalyst Control Center Graphics Full New
"{EA103B64-C0E4-4C0E-A506-751590E1653D}" = SolutionCenter
"{EC2B34FB-7B31-4E99-BD7F-0EDCB8B0137B}" = MPlayer
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F251B61F-9D18-13C4-02EE-71A36343D442}" = Catalyst Control Center Graphics Full New
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F4C2E5F5-2970-45f4-ABD3-C180C4D961C4}" = Status
"{F5346614-B7C4-4E94-826A-E2363155233D}" = EasyCleaner
"{FB62FD97-DAA9-BEE9-1A31-3A47E33F4E24}" = Catalyst Control Center Graphics Previews Common
"8AD51A41BEE6AF46CD7481F4460B914727172F64" = Windows illesztőprogram-csomag - Advanced Micro Devices (AmdK8) Processor (05/27/2006 1.3.2.0)
"ACDSee Trial" = ACDSee Trial
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Alexander" = Alexander
"Alien Shooter - Vengeance" = Alien Shooter - Vengeance
"All ATI Software" = ATI - Software Uninstall Utility
"ATI Display Driver" = ATI Display Driver
"AvantBrowser" = Avant Browser (remove only)
"avast5" = avast! Free Antivirus
"AVGantiRootkit" = AVG Anti-Rootkit Free
"AVI Movie Player" = AVI Movie Player
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"Conquest: Frontier Wars 1.00" = Conquest: Frontier Wars
"Diablo II" = Diablo II
"DVD Decrypter" = DVD Decrypter (Remove Only)
"Earth 2150 - Lost Souls" = Earth 2150 - Lost Souls
"EVEREST Ultimate Edition_is1" = EVEREST Ultimate Edition v5.01
"ffdshow_is1" = ffdshow [rev 3014] [2009-06-20]
"foobar2000" = foobar2000 v0.9.6.9
"Fraps" = Fraps
"Hamachi" = Hamachi 1.0.2.2
"Heart Of Darkness" = Heart Of Darkness
"Heroes of Annihilated Empires_is1" = Heroes of Annihilated Empires
"HP Imaging Device Functions" = HP Imaging Device Functions 5.0
"HP Solution Center & Imaging Support Tools" = HP Solution Center & Imaging Support Tools 5.0
"ImgBurn" = ImgBurn
"Indeo® Software" = Indeo® Software
"InstallShield_{CADDE354-C78C-46CB-A006-E2B178EFC271}" = Rise Of Legends
"InstallShield_{D4658131-9D1A-4395-876D-968E38FE8ED5}" = Universe at War Earth Assault
"IsoBuster_is1" = IsoBuster 2.3
"jv16 PowerTools 2008_is1" = jv16 PowerTools 2008
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Messenger Plus! Live" = Messenger Plus! Live
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5" = Microsoft .NET Framework 3.5
"Microsoft .NET Framework 3.5 Language Pack - hun" = Nyelvi csomag a Microsoft .NET-keretrendszer 3.5-ös verziójához – HUN
"Microsoft Visual J# 2.0 Redistributable Package" = Microsoft Visual J# 2.0 Redistributable Package
"Mozilla Firefox (3.5.9)" = Mozilla Firefox (3.5.9)
"OnlineArmor_is1" = Online Armor 4.0
"OpenAL" = OpenAL
"PeerGuardian_is1" = PeerGuardian 2.0
"RegSupreme Pro_is1" = RegSupreme Pro 1.0
"SM2F91" = USB Gamepad
"Starcraft" = Starcraft
"Steam App 218" = Source SDK Base - Orange Box
"Steam App 220" = Half-Life 2
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"Tomb Raider: Anniversary" = Tomb Raider: Anniversary 1.0
"Tomb Raider: Legend" = Tomb Raider: Legend 1.2
"Tzar" = Tzar
"Video Card Stability Test" = Video Card Stability Test
"War Front_is1" = War Front magyar verzió
"Wincmd" = Windows Commander (Remove or Repair)
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinPatrol" = WinPatrol 2009
"WinRAR archiver" = WinRAR archiver
"World of Warcraft" = World of Warcraft
"xp-AntiSpy" = xp-AntiSpy 3.97-3
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-1004336348-1425521274-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{DFFE2B1F-07E0-45A9-8801-CD8514CAA876}" = Prince of Persia T2T
"uTorrent" = µTorrent

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 2009.04.26. 15:40:36 | Computer Name = GIGABYTE-B9A0E7 | Source = Application Error | ID = 1000
Description = Hibás alkalmazás: codwaw.exe, verzió: 1.0.0.1, hibás modul: codwaw.exe,
verzió: 1.0.0.1, memóriacím: 0x001b1807.

Error - 2009.04.26. 15:40:53 | Computer Name = GIGABYTE-B9A0E7 | Source = Application Error | ID = 1000
Description = Hibás alkalmazás: codwaw.exe, verzió: 1.0.0.1, hibás modul: codwaw.exe,
verzió: 1.0.0.1, memóriacím: 0x001b1807.

Error - 2009.04.26. 15:41:32 | Computer Name = GIGABYTE-B9A0E7 | Source = Application Error | ID = 1000
Description = Hibás alkalmazás: codwaw.exe, verzió: 1.0.0.1, hibás modul: codwaw.exe,
verzió: 1.0.0.1, memóriacím: 0x001b1807.

Error - 2009.04.26. 15:41:53 | Computer Name = GIGABYTE-B9A0E7 | Source = Application Error | ID = 1000
Description = Hibás alkalmazás: codwaw_lanfixed.exe, verzió: 1.4.1144.0, hibás modul:
codwaw_lanfixed.exe, verzió: 1.4.1144.0, memóriacím: 0x001927f8.

Error - 2009.04.26. 15:51:17 | Computer Name = GIGABYTE-B9A0E7 | Source = Application Error | ID = 1000
Description = Hibás alkalmazás: codwaw_lanfixed.exe, verzió: 1.4.1144.0, hibás modul:
codwaw_lanfixed.exe, verzió: 1.4.1144.0, memóriacím: 0x001927f8.

Error - 2009.04.26. 16:13:52 | Computer Name = GIGABYTE-B9A0E7 | Source = Application Error | ID = 1000
Description = Hibás alkalmazás: codwaw_lanfixed.exe, verzió: 1.4.1144.0, hibás modul:
codwaw_lanfixed.exe, verzió: 1.4.1144.0, memóriacím: 0x001927f8.

Error - 2009.06.15. 20:29:48 | Computer Name = GIGABYTE-B9A0E7 | Source = crypt32 | ID = 131083
Description = Nem sikerült kibontani a külső féltől származó legfelső szintű listát
az automatikus frissítési kabinetfájlból: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Hiba: Az aktuális rendszerórához vagy az aláírt fájl időbélyegzőjéhez viszonyítva
a tanúsítvány nincs az érvényességi idején belül.

Error - 2009.06.15. 20:29:48 | Computer Name = GIGABYTE-B9A0E7 | Source = crypt32 | ID = 131083
Description = Nem sikerült kibontani a külső féltől származó legfelső szintű listát
az automatikus frissítési kabinetfájlból: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Hiba: Az aktuális rendszerórához vagy az aláírt fájl időbélyegzőjéhez viszonyítva
a tanúsítvány nincs az érvényességi idején belül.

Error - 2009.06.22. 0:16:02 | Computer Name = GIGABYTE-B9A0E7 | Source = Lavasoft Ad-Aware Service | ID = 0
Description =

Error - 2009.07.23. 18:08:01 | Computer Name = GIGABYTE-B9A0E7 | Source = Application Error | ID = 1000
Description = Hibás alkalmazás: teamspeak.exe, verzió: 2.0.32.60, hibás modul: dinput8.dll,
verzió: 5.3.2600.5512, memóriacím: 0x0000a279.

[ System Events ]
Error - 2010.04.24. 9:22:29 | Computer Name = GIGABYTE-B9A0E7 | Source = sfsync04 | ID = 262145
Description =

Error - 2010.04.24. 9:22:49 | Computer Name = GIGABYTE-B9A0E7 | Source = DCOM | ID = 10005
Description = A DCOM a következő hibát észlelte :"%1084" EventSystem szolgáltatásnak
"" paraméterekkel való indítása közben. Ezért a következő kiszolgálót nem sikerült
futtatni: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 2010.04.24. 9:23:52 | Computer Name = GIGABYTE-B9A0E7 | Source = DCOM | ID = 10005
Description = A DCOM a következő hibát észlelte :"%1084" EventSystem szolgáltatásnak
"" paraméterekkel való indítása közben. Ezért a következő kiszolgálót nem sikerült
futtatni: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 2010.04.24. 10:16:01 | Computer Name = GIGABYTE-B9A0E7 | Source = Service Control Manager | ID = 7034
Description = A(z) Online Armor szolgáltatás váratlanul leállt. Ez a(z) 1. alkalommal
fordult elő.

Error - 2010.04.24. 12:57:50 | Computer Name = GIGABYTE-B9A0E7 | Source = Service Control Manager | ID = 7034
Description = A(z) Ati HotKey Poller szolgáltatás váratlanul leállt. Ez a(z) 1.
alkalommal fordult elő.

Error - 2010.04.24. 12:57:50 | Computer Name = GIGABYTE-B9A0E7 | Source = Service Control Manager | ID = 7034
Description = A(z) Alkalmazási réteg átjárószolgáltatása szolgáltatás váratlanul
leállt. Ez a(z) 1. alkalommal fordult elő.

Error - 2010.04.24. 12:57:50 | Computer Name = GIGABYTE-B9A0E7 | Source = Service Control Manager | ID = 7034
Description = A(z) Nyomtatásisor-kezelő szolgáltatás váratlanul leállt. Ez a(z)
1. alkalommal fordult elő.

Error - 2010.04.24. 13:04:53 | Computer Name = GIGABYTE-B9A0E7 | Source = PlugPlayManager | ID = 11
Description = A(z) Root\LEGACY_CPUZ130\0000 eszköz eltűnt a rendszerből az eltávolításra
való előzetes felkészítés nélkül.

Error - 2010.04.24. 13:04:53 | Computer Name = GIGABYTE-B9A0E7 | Source = PlugPlayManager | ID = 11
Description = A(z) Root\LEGACY_PBFILTER\0000 eszköz eltűnt a rendszerből az eltávolításra
való előzetes felkészítés nélkül.

Error - 2010.04.24. 13:04:53 | Computer Name = GIGABYTE-B9A0E7 | Source = PlugPlayManager | ID = 11
Description = A(z) Root\LEGACY_SBRE\0000 eszköz eltűnt a rendszerből az eltávolításra
való előzetes felkészítés nélkül.


< End of report >

nem csak azt csinald amit irtam

OTL-ben most ne pipálgassag be semmit ne állítsak semmit csak scriptet be és RUNFIX vagy mindent úgy állítsak mint az első esetben?

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A8BB820]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\atapi -> 0x8a8bb820
Warning: possible MBR rootkit infection !
user & kernel MBR OK
Use "Recovery Console" command "fixmbr" to clear infection !

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File move operation "C:\atapi.sys|C:\Windows\System32\drivers\atapi.sys" completed successfully.

Completed script processing.

*******************

Finished! Terminate.

Rendben megtörtént a fájl másolás folytatom az Avengerrel és OTL-el a játékot.

en azt latom a logban csinald amit irtam.

rákerestem ezeken a helyeken van atapi.sys, ha ez segít.
C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\i386\atapi.sys
C:\WINDOWS\system32\driver\atapi.sys
C:\WINDOWS\ERDNT\cache\atapi.sys

bocsanat automatikusan irtam az service packot,,eztet tedd a futtatasba
CMD /K COPY /V C:\WINDOWS\ERDNT\cache\atapi.sys C:\atapi.sys

Már az első pontnál baj van a start->futtatás-nál, azt írja nem találja a megadott elérési utat.

1:start-futtatas-masold be ezt a parancsot;
CMD /K COPY /V C:\WINDOWS\ServicePackFiles\i386\atapi.sys C:\atapi.sys
2:letoltod az AVANGER programot az asztalra
http://swandog46.geekstogo.com/avenger2/download.php
Futtatni -ok-az ablakba bemásolni a sriptet [textet] és klik-Execute-yes-yes-a gep tobbszor is restartolhat,aztan add logot tedd ide.


3:Ujbol start-futtatas masold be
cmd /c mbr.exe -t >log.txt&start log.txt
a logjat tedd ide,,

4:Futtatod az OTL programot az ablakjaba masold be a scriptet es most klik RUNFIX
a restart utan add logot tedd ide.

OTL logfile created on: 2010.04.24. 20:28:55 - Run 1
OTL by OldTimer - Version 3.2.2.0 Folder = C:\Documents and Settings\gigabyte\Asztal
Windows XP Professional Edition Szervizcsomag 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 0000040E | Country: Magyarország | Language: HUN | Date Format: yyyy.MM.dd.

3,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 84,00% Memory free
6,00 Gb Paging File | 6,00 Gb Available in Paging File | 92,00% Paging File free
Paging file location(s): C:\pagefile.sys 3069 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 66,86 Gb Total Space | 9,34 Gb Free Space | 13,96% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 166,02 Gb Total Space | 25,09 Gb Free Space | 15,11% Space Free | Partition Type: NTFS
Drive F: | 74,51 Gb Total Space | 5,99 Gb Free Space | 8,04% Space Free | Partition Type: FAT32
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: GIGABYTE-B9A0E7
Current User Name: gigabyte
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 7 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010.04.24 20:25:03 | 000,562,688 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\gigabyte\Asztal\OTL.exe
PRC - [2010.04.14 18:47:08 | 002,790,472 | ---- | M] (ALWIL Software) -- C:\Program Files\Avast5\AvastUI.exe
PRC - [2010.04.14 18:47:05 | 000,040,384 | ---- | M] (ALWIL Software) -- C:\Program Files\Avast5\AvastSvc.exe
PRC - [2010.04.04 19:52:45 | 000,908,248 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010.04.01 12:28:36 | 002,010,864 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
PRC - [2010.03.13 06:10:20 | 003,064,824 | ---- | M] (Tall Emu) -- C:\Program Files\Online Armor\oahlp.exe
PRC - [2010.03.13 06:10:16 | 006,658,552 | ---- | M] (Tall Emu) -- C:\Program Files\Online Armor\oaui.exe
PRC - [2010.03.13 06:10:16 | 003,360,760 | ---- | M] (Tall Emu) -- C:\Program Files\Online Armor\oasrv.exe
PRC - [2010.03.13 06:10:16 | 001,284,600 | ---- | M] (Tall Emu) -- C:\Program Files\Online Armor\oacat.exe
PRC - [2009.07.27 17:33:28 | 000,341,312 | ---- | M] (BillP Studios) -- C:\Program Files\WinPatrol\WinPatrol.exe
PRC - [2008.04.14 05:32:18 | 001,035,776 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2002.07.02 17:56:00 | 000,024,576 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\system32\CTHELPER.EXE


========== Modules (SafeList) ==========

MOD - [2010.04.24 20:25:03 | 000,562,688 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\gigabyte\Asztal\OTL.exe
MOD - [2010.03.13 06:10:20 | 000,948,728 | ---- | M] (Tall Emu) -- C:\Program Files\Online Armor\oawatch.dll
MOD - [2009.07.20 00:03:54 | 000,062,776 | ---- | M] (BillP Studios) -- C:\Program Files\WinPatrol\patrolpro.dll
MOD - [2008.04.14 05:32:08 | 000,024,064 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wsock32.dll
MOD - [2008.04.14 05:32:08 | 000,018,432 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wtsapi32.dll
MOD - [2008.04.14 05:32:06 | 000,053,760 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\winsta.dll
MOD - [2008.04.14 05:31:54 | 000,095,232 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\iphlpapi.dll


========== Win32 Services (SafeList) ==========

SRV - [2010.04.14 18:47:05 | 000,040,384 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Avast5\AvastSvc.exe -- (avast! Web Scanner)
SRV - [2010.04.14 18:47:05 | 000,040,384 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Avast5\AvastSvc.exe -- (avast! Mail Scanner)
SRV - [2010.04.14 18:47:05 | 000,040,384 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2010.03.13 06:10:16 | 003,360,760 | ---- | M] (Tall Emu) [Auto | Running] -- C:\Program Files\Online Armor\oasrv.exe -- (SvcOnlineArmor)
SRV - [2010.03.13 06:10:16 | 001,284,600 | ---- | M] (Tall Emu) [Auto | Running] -- C:\Program Files\Online Armor\OAcat.exe -- (OAcat)
SRV - [2007.10.25 15:27:54 | 000,266,240 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Live\installer\WLSetupSvc.exe -- (WLSetupSvc)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Running] -- -- (catchme)
DRV - [2010.04.14 18:35:47 | 000,046,672 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2010.04.14 18:35:25 | 000,162,768 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aswSP.sys -- (aswSP)
DRV - [2010.04.14 18:31:39 | 000,023,376 | ---- | M] (ALWIL Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2010.04.14 18:31:12 | 000,100,432 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2010.04.14 18:31:01 | 000,019,024 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2010.04.14 18:30:45 | 000,028,880 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2010.03.13 05:39:10 | 000,024,440 | ---- | M] (Tall Emu) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\OAmon.sys -- (OAmon)
DRV - [2010.03.13 05:38:58 | 000,029,560 | ---- | M] (Tall Emu Pty Ltd) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\OAnet.sys -- (OAnet)
DRV - [2010.03.13 05:38:54 | 000,226,680 | ---- | M] (Tall Emu) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\OADriver.sys -- (OADevice)
DRV - [2010.02.17 11:25:50 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2010.02.17 11:15:58 | 000,066,632 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2010.02.17 11:15:58 | 000,012,872 | R--- | M] ( SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | On_Demand | Running] -- C:\Program Files\SUPERAntiSpyware\SASENUM.SYS -- (SASENUM)
DRV - [2009.12.12 06:01:55 | 000,279,712 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\atksgt.sys -- (atksgt)
DRV - [2009.12.12 06:01:55 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2009.09.23 14:55:23 | 000,064,288 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\Lbd.sys -- (Lbd)
DRV - [2009.08.14 06:27:00 | 004,485,632 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2008.09.17 17:18:35 | 000,025,544 | ---- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hamachi.sys -- (hamachi)
DRV - [2008.06.26 09:48:50 | 000,016,376 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\gdrv.sys -- (gdrv)
DRV - [2008.04.13 11:45:30 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2008.04.13 06:06:06 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2007.09.19 15:44:46 | 000,101,504 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2007.09.19 11:16:32 | 004,617,728 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2007.06.28 04:40:06 | 000,023,680 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\VL807a.sys -- (VL807a)
DRV - [2007.01.31 15:33:46 | 000,005,632 | ---- | M] (GRISOFT, s.r.o.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\avgarkt.sys -- (AVG Anti-Rootkit)
DRV - [2007.01.18 14:00:28 | 000,003,968 | ---- | M] (GRISOFT, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AvgArCln.sys -- (AvgArCln)
DRV - [2006.12.28 18:44:44 | 000,084,992 | R--- | M] (ATI Research Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\AtiHdAud.sys -- (HdAudAddService)
DRV - [2006.11.10 15:08:50 | 000,024,064 | ---- | M] () [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\ATITool.sys -- (ATITool)
DRV - [2006.07.13 09:56:47 | 000,059,776 | ---- | M] (Protection Technology (StarForce)) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfsync04.sys -- (sfsync04) StarForce Protection Synchronization Driver (version 4.x)
DRV - [2006.07.05 14:46:06 | 000,063,352 | ---- | M] (Protection Technology (StarForce)) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfdrv01a.sys -- (sfdrv01a) StarForce Protection Environment Driver (version 1.x.a)
DRV - [2006.06.14 16:56:56 | 000,013,680 | ---- | M] (Protection Technology (StarForce)) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfhlp02.sys -- (sfhlp02) StarForce Protection Helper Driver (version 2.x)
DRV - [2005.09.29 19:01:51 | 000,066,048 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfvfs02.sys -- (sfvfs02) StarForce Protection VFS Driver (version 2.x)
DRV - [2005.08.10 14:44:04 | 000,050,688 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfdrv01.sys -- (sfdrv01) StarForce Protection Environment Driver (version 1.x)
DRV - [2002.07.24 13:52:26 | 000,998,004 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ha10kx2k.sys -- (ha10kx2k)
DRV - [2002.07.19 10:48:32 | 000,156,604 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\emupia2k.sys -- (emupia)
DRV - [2002.07.19 10:48:22 | 000,213,860 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctsfm2k.sys -- (ctsfm2k)
DRV - [2002.07.19 10:48:08 | 000,011,068 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctprxy2k.sys -- (ctprxy2k)
DRV - [2002.07.19 10:48:04 | 000,195,432 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctoss2k.sys -- (ossrv)
DRV - [2002.07.19 10:47:52 | 000,837,548 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctaud2k.sys -- (ctaud2k) Creative Audio Driver (WDM)
DRV - [2002.07.19 10:46:28 | 000,127,948 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctac32k.sys -- (ctac32k)
DRV - [2001.08.17 20:19:34 | 000,036,480 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\sfmanm.sys -- (sfman) Creative SoundFont Manager illesztőprogram (WDM)
DRV - [2001.08.17 20:19:28 | 000,006,912 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ctlfacem.sys -- (emu10k1) Creative Interface Manager illesztőprogram (WDM)
DRV - [2001.08.17 20:19:26 | 000,283,904 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\emu10k1m.sys -- (emu10k) Creative SB Live! (WDM)
DRV - [2001.08.17 20:19:20 | 000,003,712 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ctljystk.sys -- (ctljystk)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1004336348-1425521274-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKU\S-1-5-21-1004336348-1425521274-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
IE - HKU\S-1-5-21-1004336348-1425521274-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\S-1-5-21-1004336348-1425521274-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: ""
FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:1.1.9
FF - prefs.js..extensions.enabledItems: {5b35cb30-16b4-11de-8c30-0800200c9a66}:3.6.19.02.10
FF - prefs.js..extensions.enabledItems: {5A170DD3-63CA-4c58-93B7-DE9FF536C2FF}:1.8.59
FF - prefs.js..extensions.enabledItems: {080955ad-b8bb-4500-806f-d2b9ad73d72e}:1.8.59

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.9\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.04.04 19:52:51 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.9\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.04.11 22:31:43 | 000,000,000 | ---D | M]

[2008.06.27 21:55:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\Mozilla\Extensions
[2010.04.23 21:38:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\Mozilla\Firefox\Profiles\dvvuwvlj.default\extensions
[2010.04.06 00:17:16 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\gigabyte\Application Data\Mozilla\Firefox\Profiles\dvvuwvlj.default\extensions\{080955ad-b8bb-4500-806f-d2b9ad73d72e}
[2010.04.06 00:17:20 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\gigabyte\Application Data\Mozilla\Firefox\Profiles\dvvuwvlj.default\extensions\{5A170DD3-63CA-4c58-93B7-DE9FF536C2FF}
[2010.03.13 03:48:55 | 000,000,000 | ---D | M] (Orange Fox) -- C:\Documents and Settings\gigabyte\Application Data\Mozilla\Firefox\Profiles\dvvuwvlj.default\extensions\{5b35cb30-16b4-11de-8c30-0800200c9a66}
[2010.04.06 00:17:21 | 000,000,000 | ---D | M] (DownThemAll!) -- C:\Documents and Settings\gigabyte\Application Data\Mozilla\Firefox\Profiles\dvvuwvlj.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}
[2010.04.23 11:08:19 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2009.07.11 10:20:13 | 000,000,760 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2009.07.11 10:20:13 | 000,001,426 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\polymeta.xml
[2009.07.11 10:20:13 | 000,001,628 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\sztaki-en-hu.xml
[2009.07.11 10:20:13 | 000,000,974 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\vatera.xml
[2009.07.11 10:20:13 | 000,001,189 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-hu.xml

O1 HOSTS File: ([2010.04.24 19:07:33 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O4 - HKLM..\Run: [@OnlineArmor GUI] C:\Program Files\Online Armor\oaui.exe (Tall Emu)
O4 - HKLM..\Run: [avast5] C:\Program Files\Avast5\AvastUI.exe (ALWIL Software)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [WINDVDPatch] C:\WINDOWS\System32\CTHELPER.EXE (Creative Technology Ltd)
O4 - HKLM..\Run: [WinPatrol] C:\Program Files\WinPatrol\winpatrol.exe (BillP Studios)
O4 - HKU\S-1-5-21-1004336348-1425521274-682003330-1003..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - HKU\.DEFAULT..\RunOnce: [nltide_2] File not found
O4 - HKU\S-1-5-18..\RunOnce: [nltide_2] File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutorunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1004336348-1425521274-682003330-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1004336348-1425521274-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-1004336348-1425521274-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-1004336348-1425521274-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutorunSetting = 1
O7 - HKU\S-1-5-21-1004336348-1425521274-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Küldés blogba - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Küldés blogba a Windows Live Writer programmal - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Jelenlegi saját honlap) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Lanka.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Lanka.bmp
O28 - HKLM ShellExecuteHooks: {4F07DA45-8170-4859-9B5F-037EF2970034} - C:\Program Files\Online Armor\oaevent.dll (Tall Emu)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008.06.26 09:40:17 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2008.06.26 09:39:49 | 000,000,000 | ---D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Ligos Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lhacm - C:\WINDOWS\System32\lhacm.acm (Microsoft Corporation)
Drivers32: msacm.siren - C:\WINDOWS\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FFDS - C:\WINDOWS\System32\ff_vfw.dll ()
Drivers32: VIDC.FPS1 - C:\WINDOWS\System32\frapsvid.dll (Beepa P/L)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll (Ligos Corporation)
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll (Ligos Corporation)
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Ligos Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Ligos Corporation)
Drivers32: vidc.yvu9 - C:\WINDOWS\System32\iyvu9_32.dll ()

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16620634377289728)

========== Files/Folders - Created Within 7 Days ==========

[2010.04.24 20:25:01 | 000,562,688 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\gigabyte\Asztal\OTL.exe
[2010.04.24 19:12:21 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
[2010.04.24 19:05:20 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\gigabyte\Recent
[2010.04.24 18:47:42 | 000,000,000 | ---D | C] -- C:\macska.com18181m
[2010.04.24 16:38:28 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\xircom
[2010.04.24 16:38:28 | 000,000,000 | ---D | C] -- C:\Program Files\xerox
[2010.04.24 16:38:27 | 000,000,000 | ---D | C] -- C:\Program Files\microsoft frontpage
[2010.04.24 16:24:26 | 000,000,000 | ---D | C] -- C:\macska.com
[2010.04.24 16:16:53 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010.04.24 16:16:53 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010.04.24 16:16:53 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010.04.24 16:16:53 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010.04.24 16:16:44 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010.04.24 12:17:10 | 000,000,000 | ---D | C] -- C:\ComboFix
[2010.04.23 23:33:27 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010.04.23 23:33:04 | 000,000,000 | ---D | C] -- C:\WINDOWS\setupupd
[2010.04.23 23:32:54 | 000,000,000 | ---D | C] -- C:\WINDOWS\setup.pss
[2010.04.23 19:10:59 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010.04.23 14:52:21 | 000,000,000 | ---D | C] -- C:\Program Files\HijackThis
[2010.04.23 11:50:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\gigabyte\Application Data\Malwarebytes
[2010.04.23 11:50:24 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.04.23 11:50:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010.04.23 11:50:21 | 000,020,824 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.04.23 11:50:21 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010.04.23 11:18:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2010.04.23 11:17:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\gigabyte\Application Data\SUPERAntiSpyware.com
[2010.04.23 11:17:23 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2010.04.19 13:46:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\gigabyte\Dokumentumok\Red Alert 3
[2010.04.19 13:26:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\gigabyte\Application Data\Red Alert 3
[2008.06.28 10:58:31 | 000,065,536 | ---- | C] ( ) -- C:\WINDOWS\System32\a3d.dll
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 7 Days ==========

[2010.04.24 20:25:03 | 000,562,688 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\gigabyte\Asztal\OTL.exe
[2010.04.24 19:24:11 | 000,000,739 | ---- | M] () -- C:\Documents and Settings\All Users\Asztal\World of Warcraft.lnk
[2010.04.24 19:24:05 | 000,002,646 | ---- | M] () -- C:\WINDOWS\wincmd.ini
[2010.04.24 19:08:57 | 003,373,917 | ---- | M] () -- C:\WINDOWS\{00000004-00000000-00000001-00001102-00000002-00201102}.CDF
[2010.04.24 19:08:57 | 003,373,917 | ---- | M] () -- C:\WINDOWS\{00000004-00000000-00000001-00001102-00000002-00201102}.BAK
[2010.04.24 19:07:40 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010.04.24 19:07:33 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010.04.24 19:07:22 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.04.24 19:05:28 | 000,024,672 | ---- | M] () -- C:\WINDOWS\System32\BMXCtrlState-{00000004-00000000-00000001-00001102-00000002-00201102}.rfx
[2010.04.24 19:05:28 | 000,024,672 | ---- | M] () -- C:\WINDOWS\System32\BMXBkpCtrlState-{00000004-00000000-00000001-00001102-00000002-00201102}.rfx
[2010.04.24 19:05:28 | 000,016,420 | ---- | M] () -- C:\WINDOWS\System32\BMXStateBkp-{00000004-00000000-00000001-00001102-00000002-00201102}.rfx
[2010.04.24 19:05:28 | 000,016,420 | ---- | M] () -- C:\WINDOWS\System32\BMXState-{00000004-00000000-00000001-00001102-00000002-00201102}.rfx
[2010.04.24 19:05:28 | 000,001,080 | ---- | M] () -- C:\WINDOWS\System32\settingsbkup.sfm
[2010.04.24 19:05:28 | 000,001,080 | ---- | M] () -- C:\WINDOWS\System32\settings.sfm
[2010.04.24 19:05:28 | 000,000,024 | ---- | M] () -- C:\WINDOWS\System32\DVCStateBkp-{00000004-00000000-00000001-00001102-00000002-00201102}.dat
[2010.04.24 19:05:28 | 000,000,024 | ---- | M] () -- C:\WINDOWS\System32\DVCState-{00000004-00000000-00000001-00001102-00000002-00201102}.dat
[2010.04.24 19:05:22 | 008,388,608 | ---- | M] () -- C:\Documents and Settings\gigabyte\ntuser.dat
[2010.04.24 19:05:22 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\gigabyte\ntuser.ini
[2010.04.24 19:05:20 | 003,770,134 | -H-- | M] () -- C:\Documents and Settings\gigabyte\Local Settings\Application Data\IconCache.db
[2010.04.24 16:44:00 | 000,440,598 | ---- | M] () -- C:\WINDOWS\System32\perfh00E.dat
[2010.04.24 16:44:00 | 000,434,898 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010.04.24 16:44:00 | 000,097,174 | ---- | M] () -- C:\WINDOWS\System32\perfc00E.dat
[2010.04.24 16:44:00 | 000,069,018 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010.04.24 16:43:59 | 001,055,944 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010.04.24 16:13:33 | 000,000,345 | ---- | M] () -- C:\Documents and Settings\gigabyte\Asztal\rkill.pif.htm
[2010.04.24 16:11:53 | 000,363,520 | ---- | M] () -- C:\Documents and Settings\gigabyte\Asztal\rkill.scr
[2010.04.24 16:11:50 | 000,363,520 | ---- | M] () -- C:\Documents and Settings\gigabyte\Asztal\rkill.com
[2010.04.24 16:11:47 | 000,363,520 | ---- | M] () -- C:\Documents and Settings\gigabyte\Asztal\rkill.exe
[2010.04.24 16:08:36 | 003,923,062 | R--- | M] () -- C:\Documents and Settings\gigabyte\Asztal\macska.com.exe
[2010.04.23 23:33:45 | 000,000,311 | RHS- | M] () -- C:\boot.ini
[2010.04.23 21:19:50 | 000,000,714 | ---- | M] () -- C:\WINDOWS\win.ini
[2010.04.23 21:19:50 | 000,000,232 | RHS- | M] () -- C:\BOOT.BAK
[2010.04.19 18:21:18 | 000,098,304 | ---- | M] (Sony DADC Austria AG.) -- C:\WINDOWS\system32CmdLineExt.dll
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010.04.24 20:22:06 | 000,000,453 | ---- | C] () -- C:\Documents and Settings\gigabyte\mbr.log
[2010.04.24 20:22:06 | 000,000,453 | ---- | C] () -- C:\Documents and Settings\gigabyte\log.txt
[2010.04.24 16:16:53 | 000,261,632 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010.04.24 16:16:53 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010.04.24 16:16:53 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010.04.24 16:16:53 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010.04.24 16:16:53 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010.04.24 16:13:33 | 000,000,345 | ---- | C] () -- C:\Documents and Settings\gigabyte\Asztal\rkill.pif.htm
[2010.04.24 16:11:53 | 000,363,520 | ---- | C] () -- C:\Documents and Settings\gigabyte\Asztal\rkill.scr
[2010.04.24 16:11:50 | 000,363,520 | ---- | C] () -- C:\Documents and Settings\gigabyte\Asztal\rkill.com
[2010.04.24 16:11:46 | 000,363,520 | ---- | C] () -- C:\Documents and Settings\gigabyte\Asztal\rkill.exe
[2010.04.24 16:08:17 | 003,923,062 | R--- | C] () -- C:\Documents and Settings\gigabyte\Asztal\macska.com.exe
[2010.04.23 23:33:45 | 000,000,232 | RHS- | C] () -- C:\BOOT.BAK
[2010.04.23 23:33:42 | 000,261,392 | RHS- | C] () -- C:\cmldr
[2009.11.04 09:44:34 | 000,023,680 | ---- | C] () -- C:\WINDOWS\System32\drivers\VL807a.sys
[2009.11.04 09:44:33 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\Hidhlp.dll
[2009.11.04 09:44:33 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\iSM2F91.dll
[2009.10.28 04:58:50 | 000,279,712 | ---- | C] () -- C:\WINDOWS\System32\drivers\atksgt.sys
[2009.10.28 04:58:49 | 000,025,888 | ---- | C] () -- C:\WINDOWS\System32\drivers\lirsgt.sys
[2009.10.19 01:28:19 | 000,000,056 | ---- | C] () -- C:\WINDOWS\WDIRECT.INI
[2009.09.19 12:21:26 | 000,003,972 | ---- | C] () -- C:\WINDOWS\System32\drivers\PciBus.sys
[2009.06.24 16:46:52 | 000,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
[2009.06.24 16:46:51 | 000,085,504 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2009.04.22 00:19:06 | 000,172,173 | ---- | C] () -- C:\WINDOWS\System32\xlive.dll.cat
[2009.01.29 00:47:57 | 000,000,023 | -HS- | C] () -- C:\WINDOWS\System32\efdeaade7_z.dll
[2009.01.26 14:26:26 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2009.01.21 13:18:12 | 000,056,320 | ---- | C] () -- C:\WINDOWS\System32\iyvu9_32.dll
[2008.12.20 00:40:57 | 000,069,632 | R--- | C] () -- C:\WINDOWS\System32\xmltok.dll
[2008.12.20 00:40:57 | 000,036,864 | R--- | C] () -- C:\WINDOWS\System32\xmlparse.dll
[2008.12.02 23:08:10 | 000,000,262 | ---- | C] () -- C:\WINDOWS\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2008.08.25 17:12:20 | 000,040,960 | R--- | C] () -- C:\WINDOWS\System32\psfind.dll
[2008.07.27 03:41:09 | 000,000,388 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2008.07.16 02:29:41 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\TransportUSB.dll
[2008.07.16 02:29:41 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\TransportSerial.dll
[2008.07.16 02:29:41 | 000,006,688 | ---- | C] () -- C:\WINDOWS\System32\Digita.sys
[2008.07.16 02:29:40 | 000,335,872 | ---- | C] () -- C:\WINDOWS\System32\ldf252.dll
[2008.07.12 17:45:32 | 000,021,840 | ---- | C] () -- C:\WINDOWS\System32\SIntfNT.dll
[2008.07.12 17:45:32 | 000,017,212 | ---- | C] () -- C:\WINDOWS\System32\SIntf32.dll
[2008.07.12 17:45:32 | 000,012,067 | ---- | C] () -- C:\WINDOWS\System32\SIntf16.dll
[2008.06.28 10:58:56 | 000,000,128 | ---- | C] () -- C:\WINDOWS\SBWIN.INI
[2008.06.28 10:58:55 | 000,000,231 | ---- | C] () -- C:\WINDOWS\AC3API.INI
[2008.06.28 10:58:34 | 000,037,727 | ---- | C] () -- C:\WINDOWS\System32\Emu10kx.ini
[2008.06.28 10:58:34 | 000,000,029 | ---- | C] () -- C:\WINDOWS\System32\ctzapxx.ini
[2008.06.28 10:58:31 | 000,000,180 | ---- | C] () -- C:\WINDOWS\System32\KILL.INI
[2008.06.27 22:45:56 | 000,000,010 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2008.06.27 22:32:28 | 000,002,646 | ---- | C] () -- C:\WINDOWS\wincmd.ini
[2008.06.26 10:05:13 | 000,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2007.02.20 15:59:08 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll
[2007.02.20 15:59:06 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2007.02.20 15:59:06 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll
[2007.02.20 15:59:06 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2007.02.20 15:59:06 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll
[2007.02.20 15:59:06 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll
[2007.02.20 15:59:06 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll
[2007.02.20 15:59:06 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll
[2007.02.20 15:59:04 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll
[2006.11.27 20:52:32 | 000,372,736 | ---- | C] () -- C:\WINDOWS\System32\hpzidi01.dll
[2006.11.27 20:52:32 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\hpzids01.dll
[2006.11.10 15:08:50 | 000,024,064 | ---- | C] () -- C:\WINDOWS\System32\drivers\ATITool.sys
[2004.12.19 15:29:40 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2004.12.19 15:17:10 | 000,614,400 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2002.10.06 20:42:56 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\OggDS.dll
[2002.10.05 01:04:24 | 000,921,600 | ---- | C] () -- C:\WINDOWS\System32\VorbisEnc.dll
[2002.10.05 01:04:24 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\vorbis.dll
[2002.10.05 01:04:16 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\ogg.dll
[2002.05.16 01:38:40 | 000,091,136 | ---- | C] () -- C:\WINDOWS\System32\mp4fil32.dll
[1999.01.22 19:46:58 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\MSRTEDIT.DLL

========== LOP Check ==========

[2009.01.07 04:13:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Age of Empires 3
[2010.04.07 18:32:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
[2008.08.06 22:25:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Axis Readme Second Bat
[2009.04.03 17:30:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\BCR
[2008.07.12 16:47:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Messenger Plus!
[2010.04.07 18:28:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\OnlineArmor
[2008.08.31 18:42:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
[2009.02.08 05:19:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\POPWWPROFILES
[2008.07.09 03:41:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SpieleEntwicklungsKombinat
[2009.10.07 20:51:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2009.01.29 15:57:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ubisoft
[2009.01.28 16:21:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
[2008.07.16 02:29:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\ACD Systems
[2008.07.16 02:29:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\ACDInTouch
[2009.02.13 16:22:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\Blah rdr support
[2009.05.27 11:41:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\Command & Conquer 3 Kane's Wrath
[2008.12.19 17:06:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\Command & Conquer 3 Tiberium Wars
[2009.05.18 18:59:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\FOG Downloader
[2010.04.24 20:21:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\foobar2000
[2009.09.20 14:28:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\FreeStone Group
[2009.11.06 21:49:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\ImgBurn
[2010.04.07 17:59:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\OnlineArmor
[2009.12.19 22:08:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\Petroglyph
[2010.04.19 14:00:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\Red Alert 3
[2009.01.11 21:48:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\SpieleEntwicklungsKombinat
[2009.05.14 22:44:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\Turbine
[2009.01.29 15:58:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\Ubisoft
[2010.04.23 12:44:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\uTorrent
[2009.06.24 16:05:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\WinPatrol
[2009.12.13 09:02:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\XRay Engine

========== Purity Check ==========



========== Custom Scans ==========


< HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s >
"SUPERAntiSpyware" = C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe -- [2010.04.01 12:28:36 | 002,010,864 | ---- | M] (SUPERAntiSpyware.com)

< c:\windows\*.* /U >
[5 c:\windows\*.tmp files -> c:\windows\*.tmp -> ]

< %SYSTEMDRIVE%\*.exe >
[2009.09.07 14:30:36 | 041,592,704 | ---- | M] (Advanced Micro Devices, Inc.) -- C:\9-8_xp32_dd_ccc_wdm_enu.exe
[2009.11.25 19:02:12 | 000,458,064 | ---- | M] (techPowerUp (www.techpowerup.com)) -- C:\GPU-Z.0.3.7.exe

< %ALLUSERSPROFILE%\Application Data\*. >
[2010.04.11 06:00:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Adobe
[2009.01.07 04:13:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Age of Empires 3
[2009.11.06 22:55:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ahead
[2010.04.07 18:32:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
[2008.10.15 05:52:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Apple
[2008.10.15 05:52:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Apple Computer
[2009.09.21 14:48:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ATI
[2008.12.22 10:53:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ATI(2)
[2008.12.29 22:08:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ATI(3)
[2008.08.06 22:25:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Axis Readme Second Bat
[2009.04.03 17:30:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\BCR
[2008.10.15 16:12:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Blizzard
[2009.08.20 16:33:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Blizzard Entertainment
[2008.07.08 16:06:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\CyberLink
[2008.09.17 20:33:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\HP
[2008.12.29 18:07:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\InstallShield
[2010.04.24 18:39:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Lavasoft
[2010.04.23 11:50:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009.01.17 20:33:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Media Center Programs
[2008.07.12 16:47:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Messenger Plus!
[2009.09.19 08:47:26 | 000,000,000 | --SD | M] -- C:\Documents and Settings\All Users\Application Data\Microsoft
[2009.11.06 22:53:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Nero
[2010.04.07 18:28:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\OnlineArmor
[2008.08.31 18:42:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
[2009.02.08 05:19:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\POPWWPROFILES
[2008.07.02 16:09:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Skype
[2008.07.09 03:41:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SpieleEntwicklungsKombinat
[2010.04.24 18:40:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2010.04.11 02:10:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Sun
[2010.04.23 11:18:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2009.10.07 20:51:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2008.12.25 22:01:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Trymedia
[2009.01.29 15:57:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ubisoft
[2008.07.07 01:34:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WLInstaller
[2009.01.28 16:21:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}

< %ALLUSERSPROFILE%\Application Data\*.exe /s >

< %APPDATA%\*. >
[2008.07.16 02:29:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\ACD Systems
[2008.07.16 02:29:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\ACDInTouch
[2008.09.29 03:32:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\Adobe
[2009.11.06 22:58:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\Ahead
[2009.01.03 02:19:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\Apple Computer
[2009.09.21 14:48:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\ATI
[2008.07.16 04:41:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\Avant Profiles
[2009.02.13 16:22:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\Blah rdr support
[2009.05.27 11:41:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\Command & Conquer 3 Kane's Wrath
[2008.12.19 17:06:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\Command & Conquer 3 Tiberium Wars
[2008.07.17 14:50:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\CyberLink
[2009.05.18 18:59:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\FOG Downloader
[2010.04.24 20:21:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\foobar2000
[2009.09.20 14:28:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\FreeStone Group
[2010.01.18 21:00:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\Hamachi
[2008.09.17 20:37:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\HP
[2008.06.26 09:43:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\Identities
[2009.11.06 21:49:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\ImgBurn
[2009.01.14 15:40:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\InstallShield
[2010.04.24 18:39:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\Lavasoft
[2008.06.28 09:33:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\Macromedia
[2010.04.23 11:50:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\Malwarebytes
[2009.06.24 16:47:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\Media Player Classic
[2010.04.13 10:06:20 | 000,000,000 | --SD | M] -- C:\Documents and Settings\gigabyte\Application Data\Microsoft
[2008.07.27 03:38:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\Microsoft Web Folders
[2009.05.16 15:13:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\Mozilla
[2010.04.07 17:59:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\OnlineArmor
[2009.12.19 22:08:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\Petroglyph
[2010.04.19 14:00:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\Red Alert 3
[2008.07.20 03:42:22 | 000,000,000 | RH-D | M] -- C:\Documents and Settings\gigabyte\Application Data\SecuROM
[2010.04.23 22:24:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\Skype
[2010.04.23 21:21:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\skypePM
[2009.01.11 21:48:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\SpieleEntwicklungsKombinat
[2010.04.11 02:08:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\Sun
[2010.04.23 11:17:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\SUPERAntiSpyware.com
[2008.09.24 16:23:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\teamspeak2
[2009.05.14 22:44:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\Turbine
[2009.01.29 15:58:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\Ubisoft
[2010.04.23 12:44:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\uTorrent
[2009.05.10 03:27:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\Ventrilo
[2009.06.24 16:05:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\WinPatrol
[2008.08.01 06:42:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\WinRAR
[2009.12.13 09:02:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gigabyte\Application Data\XRay Engine

< %APPDATA%\*.exe /s >
[2009.02.25 21:32:42 | 001,878,984 | ---- | M] (Adobe Systems Incorporated) -- C:\Documents and Settings\gigabyte\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe
[2010.04.24 18:48:08 | 000,003,262 | R--- | M] () -- C:\Documents and Settings\gigabyte\Application Data\Microsoft\Installer\{10209B87-55D6-493E-A30A-12A265AA324E}\_5b0b29e7.exe
[2010.04.06 01:05:06 | 000,053,248 | R--- | M] () -- C:\Documents and Settings\gigabyte\Application Data\Microsoft\Installer\{9AA761E6-CA51-4FF2-A552-D51638BF0595}\_F522ED7EA612_4117_B86D_78467DE01E30.exe


< MD5 for: AGP440.SYS >
[2008.04.14 05:43:16 | 020,107,774 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys

< MD5 for: ATAPI.SYS >
[2008.04.14 05:43:16 | 020,107,774 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008.04.13 11:40:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ERDNT\cache\atapi.sys
[2008.04.13 11:40:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2008.04.13 13:40:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\i386\atapi.sys

< MD5 for: CHANGER.SYS >
[2008.04.14 05:43:16 | 020,107,774 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:Changer.sys

< MD5 for: CRYPTSVC.DLL >
[2008.04.14 05:31:50 | 000,062,464 | ---- | M] (Microsoft Corporation) MD5=13CB7FC794D005D60712FDD9F1362235 -- C:\WINDOWS\ERDNT\cache\cryptsvc.dll
[2008.04.14 05:31:50 | 000,062,464 | ---- | M] (Microsoft Corporation) MD5=13CB7FC794D005D60712FDD9F1362235 -- C:\WINDOWS\system32\cryptsvc.dll

< MD5 for: EVENTLOG.DLL >
[2008.04.14 05:31:52 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=4BFA2DC223A814CCD1D07C6A0E26C72B -- C:\WINDOWS\ERDNT\cache\eventlog.dll
[2008.04.14 05:31:52 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=4BFA2DC223A814CCD1D07C6A0E26C72B -- C:\WINDOWS\system32\eventlog.dll

< MD5 for: EXPLORER.EXE >
[2008.04.14 05:32:18 | 001,035,776 | ---- | M] (Microsoft Corporation) MD5=AD3A8A9E8914439852A98CE48015E237 -- C:\WINDOWS\ERDNT\cache\explorer.exe
[2008.04.14 05:32:18 | 001,035,776 | ---- | M] (Microsoft Corporation) MD5=AD3A8A9E8914439852A98CE48015E237 -- C:\WINDOWS\explorer.exe

< MD5 for: HAL.DLL >
[2008.04.14 05:43:16 | 020,107,774 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:hal.dll
[2008.04.13 08:01:30 | 000,134,400 | ---- | M] (Microsoft Corporation) MD5=4329EE7D502C9113EBA0F9570392F5EE -- C:\WINDOWS\system32\hal.dll

< MD5 for: IASTOR.SYS >
[2008.05.20 12:17:58 | 000,304,920 | ---- | M] (Intel Corporation) MD5=997E8F5939F2D12CD9F2E6B395724C16 -- C:\WINDOWS\NLDRV\001\iastor.sys

< MD5 for: LSASS.EXE >
[2008.04.14 05:32:22 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=21844F6DA13ECE4737D0B7524EDEB6EC -- C:\WINDOWS\ERDNT\cache\lsass.exe
[2008.04.14 05:32:22 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=21844F6DA13ECE4737D0B7524EDEB6EC -- C:\WINDOWS\system32\lsass.exe

< MD5 for: NDIS.SYS >
[2008.04.13 08:50:38 | 000,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\ERDNT\cache\ndis.sys
[2008.04.13 08:50:38 | 000,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\system32\drivers\ndis.sys

< MD5 for: NETLOGON.DLL >
[2008.04.14 05:31:58 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=A792F49B07A36D7F64D236C45BAC4A50 -- C:\WINDOWS\ERDNT\cache\netlogon.dll
[2008.04.14 05:31:58 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=A792F49B07A36D7F64D236C45BAC4A50 -- C:\WINDOWS\system32\netlogon.dll

< MD5 for: SCECLI.DLL >
[2008.04.14 05:32:00 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=4F6A0B812BD286E97E26DF3E225ABCFB -- C:\WINDOWS\ERDNT\cache\scecli.dll
[2008.04.14 05:32:00 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=4F6A0B812BD286E97E26DF3E225ABCFB -- C:\WINDOWS\system32\scecli.dll

< MD5 for: SMSS.EXE >
[2008.04.14 05:32:30 | 000,050,688 | ---- | M] (Microsoft Corporation) MD5=A03C3BF7E45ECC9775D3CE653086FAA1 -- C:\WINDOWS\system32\smss.exe
[2004.08.18 13:00:00 | 000,487,424 | R--- | M] (Microsoft Corporation) MD5=CB5E2E971B5873A5158336E1B7FE582E -- C:\cmdcons\system32\smss.exe

< MD5 for: SVCHOST.EXE >
[2008.04.14 05:32:32 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=05194D8A92CF7E559C1A38FC134C966A -- C:\WINDOWS\ERDNT\cache\svchost.exe
[2008.04.14 05:32:32 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=05194D8A92CF7E559C1A38FC134C966A -- C:\WINDOWS\system32\svchost.exe

< MD5 for: TCPIP.SYS >
[2008.04.13 08:50:18 | 000,361,344 | ---- | M] (Microsoft Corporation) MD5=93EA8D04EC73A85DB02EB8805988F733 -- C:\WINDOWS\ERDNT\cache\tcpip.sys
[2008.04.13 08:50:18 | 000,361,344 | ---- | M] (Microsoft Corporation) MD5=93EA8D04EC73A85DB02EB8805988F733 -- C:\WINDOWS\system32\drivers\tcpip.sys

< MD5 for: USERINIT.EXE >
[2008.04.14 05:32:32 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=B0DDDFC8361952B956EF9475244F40BD -- C:\WINDOWS\ERDNT\cache\userinit.exe
[2008.04.14 05:32:32 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=B0DDDFC8361952B956EF9475244F40BD -- C:\WINDOWS\system32\userinit.exe

< MD5 for: WINLOGON.EXE >
[2008.04.14 05:32:34 | 000,509,952 | ---- | M] (Microsoft Corporation) MD5=15D1D956D9F01E51E6623EDB31EA43B6 -- C:\WINDOWS\ERDNT\cache\winlogon.exe
[2008.04.14 05:32:34 | 000,509,952 | ---- | M] (Microsoft Corporation) MD5=15D1D956D9F01E51E6623EDB31EA43B6 -- C:\WINDOWS\system32\winlogon.exe

< MD5 for: WS2_32.DLL >
[2008.04.14 05:32:08 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=EA551E1AB5BA99DA3397517BDD278E94 -- C:\WINDOWS\ERDNT\cache\ws2_32.dll
[2008.04.14 05:32:08 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=EA551E1AB5BA99DA3397517BDD278E94 -- C:\WINDOWS\system32\ws2_32.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2009.08.14 04:28:26 | 000,446,464 | ---- | M] (Advanced Micro Devices, Inc.) Unable to obtain MD5 -- C:\WINDOWS\system32\ATIDEMGX.dll
[5 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2008.06.26 17:28:06 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2008.06.26 17:28:06 | 001,089,536 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2008.06.26 17:28:06 | 000,442,368 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\*.dll /lockedfiles >
[2009.08.14 04:28:26 | 000,446,464 | ---- | M] (Advanced Micro Devices, Inc.) Unable to obtain MD5 -- C:\WINDOWS\system32\ATIDEMGX.dll
[5 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon" /v GinaDLL /c >
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON

========== Alternate Data Streams ==========

@Alternate Data Stream - 500 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:05EE1EEF
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:AC680CD1
< End of report >

Ok,majd tedd ide ot van a TDL-rootkit az atapi.sys megvan fertozve.

Itt a log fáj egyenlöre, most csinálom majd az OTL bizgentyűzést.

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A8C8AC8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\atapi -> 0x8a8c8ac8
Warning: possible MBR rootkit infection !
user & kernel MBR OK
Use "Recovery Console" command "fixmbr" to clear infection !

Nem mondod komolyan, hogy 4 perc alatt írtál egy ilyen script izét az én gépemre plusz guide-ot nekem?!
Nah kalandra fel. Fegyver a kézben rettegjetek mockosz kisz viruszkák!

letoltod ezt a programot az asztalra es ott hagyod.
http://www2.gmer.net/mbr/mbr.exe

start-futtatas-bemasolod ezt a parancsot es klik ok
cmd /c mbr.exe -t >log.txt&start log.txt
kinyilik a log.txt-tedd ide.

letoltod ezt a programot az asztalra
Letölteni az asztalra>OTListIt2>> http://oldtimer.geekstogo.com/OTL.exe
-Futtatni
-file age át változtatni 30 > 7day rá.
-bepipázni:
*Scan all users.
*Lop check.
*Purity check.
-v szekcióba Extra Registry>bepöttyözni>Use SafeList
-az alol az ablakba customscan/fixes-masold be a zold textet;
-KLIKK>Run Scan-a log.txt-tedd ide

A Spybot-al nem tudom mi volt a gond, de bízom stell szaktudásában. Eddig messze a legjobb és legsegítőkészebb PC-s szakember akivel összefutottam. A türelmét velem pedig külön köszönöm neki.
Egyenlőre válom a válaszát mi a következő teendő, utána még lesz kérdésem hozzá.

ComboFix 10-04-21.01 - gigabyte 010.04.24. 18:58:16.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1250.36.1038.18.3582.3195 [GMT 2:00]
Running from: c:\documents and settings\gigabyte\Asztal\macska.com.exe
Command switches used :: c:\documents and settings\gigabyte\Asztal\CFScript.txt
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: Online Armor Firewall *enabled* {B797DAA0-7E2E-4711-8BB3-D12744F1922A}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_CPUZ130
-------\Legacy_LAVASOFT_AD-AWARE_SERVICE
-------\Legacy_PBFILTER
-------\Legacy_SBRE
-------\Service_cpuz130
-------\Service_Lavasoft Ad-Aware Service
-------\Service_npggsvc
-------\Service_pbfilter
-------\Service_SBRE


((((((((((((((((((((((((( Files Created from 2010-03-24 to 2010-04-24 )))))))))))))))))))))))))))))))
.

2010-04-24 16:48 . 2010-04-24 16:48 3262 ----a-r- c:\documents and settings\gigabyte\Application Data\Microsoft\Installer\{10209B87-55D6-493E-A30A-12A265AA324E}\_5b0b29e7.exe
2010-04-24 14:38 . 2010-04-24 14:38 -------- d-----w- c:\windows\system32\xircom
2010-04-24 14:38 . 2010-04-24 14:38 -------- d-----w- c:\windows\system32\wbem\snmp
2010-04-24 14:38 . 2010-04-24 14:38 -------- d-----w- c:\program files\microsoft frontpage
2010-04-24 14:24 . 2010-04-24 14:43 -------- d-----w- C:\macska.com
2010-04-24 10:17 . 2010-04-24 14:16 -------- d-----w- C:\ComboFix
2010-04-23 09:50 . 2010-04-23 09:50 -------- d-----w- c:\documents and settings\gigabyte\Application Data\Malwarebytes
2010-04-23 09:50 . 2010-03-29 22:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-23 09:50 . 2010-04-23 09:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-04-23 09:50 . 2010-04-23 09:50 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-23 09:50 . 2010-03-29 22:45 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-23 09:19 . 2010-04-23 09:19 52224 ----a-w- c:\documents and settings\gigabyte\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-04-23 09:19 . 2010-04-23 09:19 117760 ----a-w- c:\documents and settings\gigabyte\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-04-23 09:18 . 2010-04-23 09:18 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-04-23 09:17 . 2010-04-23 09:17 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-04-23 09:17 . 2010-04-23 09:17 -------- d-----w- c:\documents and settings\gigabyte\Application Data\SUPERAntiSpyware.com
2010-04-19 11:26 . 2010-04-19 12:00 -------- d-----w- c:\documents and settings\gigabyte\Application Data\Red Alert 3
2010-04-11 00:19 . 2010-04-11 00:19 -------- d-----w- c:\windows\Sun
2010-04-11 00:10 . 2010-04-11 00:10 503808 ----a-w- c:\documents and settings\gigabyte\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-599c82d8-n\msvcp71.dll
2010-04-11 00:10 . 2010-04-11 00:10 499712 ----a-w- c:\documents and settings\gigabyte\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-599c82d8-n\jmc.dll
2010-04-11 00:10 . 2010-04-11 00:10 348160 ----a-w- c:\documents and settings\gigabyte\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-599c82d8-n\msvcr71.dll
2010-04-11 00:10 . 2010-04-11 00:10 61440 ----a-w- c:\documents and settings\gigabyte\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-18a5809d-n\decora-sse.dll
2010-04-11 00:10 . 2010-04-11 00:10 12800 ----a-w- c:\documents and settings\gigabyte\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-18a5809d-n\decora-d3d.dll
2010-04-11 00:10 . 2010-04-11 19:24 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-04-08 02:25 . 2010-04-21 08:30 -------- d-----w- c:\program files\PeerBlock
2010-04-07 17:23 . 2010-04-10 22:50 -------- d-----w- c:\program files\WinPatrol
2010-04-07 16:32 . 2010-04-14 16:35 162768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-04-07 16:32 . 2010-04-14 16:31 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-04-07 16:32 . 2010-04-14 16:31 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-04-07 16:32 . 2010-04-14 16:35 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-04-07 16:32 . 2010-04-14 16:31 100432 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-04-07 16:32 . 2010-04-14 16:31 94800 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-04-07 16:32 . 2010-04-14 16:30 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-04-07 16:32 . 2010-04-14 16:47 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-04-07 16:32 . 2010-04-14 16:47 153184 ----a-w- c:\windows\system32\aswBoot.exe
2010-04-07 16:32 . 2010-04-16 00:34 -------- d-----w- c:\program files\Avast5
2010-04-07 16:32 . 2010-04-07 16:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-04-07 15:59 . 2010-04-07 16:28 -------- d-----w- c:\documents and settings\All Users\Application Data\OnlineArmor
2010-04-07 15:59 . 2010-04-07 15:59 -------- d-----w- c:\documents and settings\gigabyte\Application Data\OnlineArmor
2010-04-07 15:58 . 2010-03-13 03:39 24440 ----a-w- c:\windows\system32\drivers\OAmon.sys
2010-04-07 15:58 . 2010-03-13 03:38 29560 ----a-w- c:\windows\system32\drivers\OAnet.sys
2010-04-07 15:58 . 2010-03-13 03:38 226680 ----a-w- c:\windows\system32\drivers\OADriver.sys
2010-04-07 15:58 . 2010-04-24 14:21 -------- d-----w- c:\program files\Online Armor
2010-04-05 23:08 . 2010-04-05 23:08 -------- d-----w- c:\program files\Ubi Soft
2010-04-05 23:05 . 2010-04-05 23:05 53248 ----a-r- c:\documents and settings\gigabyte\Application Data\Microsoft\Installer\{9AA761E6-CA51-4FF2-A552-D51638BF0595}\_F522ED7EA612_4117_B86D_78467DE01E30.exe
2010-04-05 18:08 . 2010-04-05 18:08 0 ----a-w- c:\windows\PowerReg.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-24 17:05 . 2008-06-28 17:36 24 ----a-w- c:\windows\system32\DVCStateBkp-{00000004-00000000-00000001-00001102-00000002-00201102}.dat
2010-04-24 17:05 . 2008-06-28 17:36 24 ----a-w- c:\windows\system32\DVCState-{00000004-00000000-00000001-00001102-00000002-00201102}.dat
2010-04-24 16:48 . 2008-09-28 23:45 -------- d-----w- c:\program files\TQ Defiler
2010-04-24 16:40 . 2008-07-07 02:34 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-04-24 16:40 . 2008-06-27 21:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-04-24 16:39 . 2009-06-22 04:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-04-24 16:39 . 2008-06-28 00:39 -------- d-----w- c:\documents and settings\gigabyte\Application Data\Lavasoft
2010-04-24 16:35 . 2008-06-27 22:02 -------- d-----w- c:\documents and settings\gigabyte\Application Data\foobar2000
2010-04-24 14:44 . 2004-08-18 11:00 97174 ----a-w- c:\windows\system32\perfc00E.dat
2010-04-24 14:44 . 2004-08-18 11:00 440598 ----a-w- c:\windows\system32\perfh00E.dat
2010-04-23 20:24 . 2008-07-02 14:09 -------- d-----w- c:\documents and settings\gigabyte\Application Data\Skype
2010-04-23 19:21 . 2008-07-02 14:10 -------- d-----w- c:\documents and settings\gigabyte\Application Data\skypePM
2010-04-23 10:44 . 2008-08-01 04:03 -------- d-----w- c:\documents and settings\gigabyte\Application Data\uTorrent
2010-04-23 09:17 . 2008-12-02 21:08 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-04-19 16:21 . 2008-12-19 14:13 98304 ----a-w- c:\windows\system32CmdLineExt.dll
2010-04-19 10:36 . 2008-06-26 07:47 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-04-14 03:34 . 2008-06-26 08:14 29216 ----a-w- c:\documents and settings\gigabyte\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-04-11 03:56 . 2008-09-29 01:30 -------- d-----w- c:\program files\Common Files\Adobe
2010-04-08 02:23 . 2009-01-18 08:48 -------- d-----w- c:\program files\PeerGuardian2
2010-03-02 16:07 . 2009-06-22 04:28 15880 ----a-w- c:\windows\system32\lsdelete.exe
2010-02-14 21:30 . 2010-02-14 21:30 6812 ----a-w- c:\windows\system32\ealregsnapshot1.reg
2010-02-04 09:01 . 2010-02-14 20:42 74072 ----a-w- c:\windows\system32\XAPOFX1_4.dll
2010-02-04 09:01 . 2010-02-14 20:42 528216 ----a-w- c:\windows\system32\XAudio2_6.dll
2010-02-04 09:01 . 2010-02-14 20:42 238936 ----a-w- c:\windows\system32\xactengine3_6.dll
2010-02-04 09:01 . 2010-02-14 20:42 22360 ----a-w- c:\windows\system32\X3DAudio1_7.dll
2009-01-28 22:47 . 2009-01-28 22:47 23 --sha-w- c:\windows\system32\efdeaade7_z.dll
.

------- Sigcheck -------

[-] 2008-05-19 . 2993C2DF98A2D6D9896E0AB24946F972 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot@2010-04-24_14.38.45 )))))))))))))))))))))))))))))))))))))))))
.
- 2004-08-18 11:00 . 2010-04-07 15:58 69018 c:\windows\system32\perfc009.dat
+ 2004-08-18 11:00 . 2010-04-24 14:44 69018 c:\windows\system32\perfc009.dat
+ 2004-08-18 11:00 . 2010-04-24 14:44 434898 c:\windows\system32\perfh009.dat
- 2004-08-18 11:00 . 2010-04-07 15:58 434898 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2010-04-01 2010864]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-09-19 16844800]
"WINDVDPatch"="CTHELPER.EXE" [2002-07-02 24576]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-08-13 98304]
"@OnlineArmor GUI"="c:\program files\Online Armor\oaui.exe" [2010-03-13 6658552]
"avast5"="c:\progra~1\Avast5\avastUI.exe" [2010-04-14 2790472]
"WinPatrol"="c:\program files\WinPatrol\winpatrol.exe" [2009-07-27 341312]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{4F07DA45-8170-4859-9B5F-037EF2970034}"= "c:\progra~1\ONLINE~2\oaevent.dll" [2010-03-13 925688]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 13:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKLM\~\startupfolder\C:^Documents and Settings^gigabyte^Start Menu^Programs^Indítópult^WinFlip.lnk]
backup=c:\windows\pss\WinFlip.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-12-21 23:57 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2005-05-11 21:12 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Jet Detection]
2001-11-28 23:00 28672 ----a-w- c:\program files\Creative\SBLive\Program\ADGJDet.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2009-07-26 14:43 3883840 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-01 14:57 153136 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2008-09-06 13:09 413696 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2004-11-02 18:24 32768 ----a-w- c:\program files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2008-11-07 13:31 21633320 ----a-r- c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2010-04-07 17:57 1217872 ----a-w- c:\games\Steam\steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
2000-05-10 23:00 90112 ------w- c:\windows\Updreg.EXE

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009.06.22. 6:16 64288]
R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\system32\drivers\sfdrv01a.sys [2006.07.05. 14:46 63352]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2010.04.07. 18:32 162768]
R1 OADevice;OADriver;c:\windows\system32\drivers\OADriver.sys [2010.04.07. 17:58 226680]
R1 OAmon;OAmon;c:\windows\system32\drivers\OAmon.sys [2010.04.07. 17:58 24440]
R1 OAnet;OAnet;c:\windows\system32\drivers\OAnet.sys [2010.04.07. 17:58 29560]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2010.02.17. 11:25 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010.02.17. 11:15 66632]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010.04.07. 18:32 19024]
R2 OAcat;Online Armor Helper Service;c:\program files\Online Armor\oacat.exe [2010.04.07. 17:58 1284600]
R2 SvcOnlineArmor;Online Armor;c:\program files\Online Armor\oasrv.exe [2010.04.07. 17:58 3360760]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2010.02.17. 11:15 12872]
S3 rkhdrv40;Rootkit Unhooker Driver; [x]
S3 VL807a;VL807a Filter;c:\windows\system32\drivers\VL807a.sys [2009.11.04. 9:44 23680]
S4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys --> c:\windows\system32\Drivers\sptd.sys [?]
.
Contents of the 'Scheduled Tasks' folder

2008-12-18 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mStart Page = hxxp://www.yahoo.com
FF - ProfilePath - c:\documents and settings\gigabyte\Application Data\Mozilla\Firefox\Profiles\dvvuwvlj.default\
FF - prefs.js: browser.startup.homepage -

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-Ad-Watch - c:\program files\Lavasoft\Ad-Aware\AAWTray.exe
MSConfigStartUp-DAEMON Tools Lite - c:\program files\DAEMON Tools Lite\daemon.exe
MSConfigStartUp-SpybotSD TeaTimer - c:\program files\Spybot - Search & Destroy\TeaTimer.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-24 19:09
Windows 5.1.2600 Szervizcsomag 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A8C8AC8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xba0ecf28
\Driver\ACPI -> ACPI.sys @ 0xb9f7fcb8
\Driver\atapi -> 0x8a8c8ac8
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1004336348-1425521274-682003330-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:44,55,d0,ad,07,c1,2f,a1,79,13,e4,b4,4a,d0,7e,64,2d,98,e1,04,29,18,34,
69,3f,01,26,b6,6f,ad,43,f8,16,04,1c,a7,43,53,dc,d0,03,f1,9d,6f,26,67,db,a6,\
"??"=hex:5d,2e,bc,00,9b,07,bc,9c,34,34,87,88,c9,ab,ca,0d

[HKEY_USERS\S-1-5-21-1004336348-1425521274-682003330-1003\Software\SecuROM\License information*]
"datasecu"=hex:4f,eb,20,27,db,f9,5f,08,e8,e0,e6,04,cf,38,d9,50,38,cb,5d,68,84,
95,4b,79,b0,ad,4a,d8,c3,96,81,81,ee,21,43,93,f9,24,01,c1,6f,43,d5,6c,a1,93,\
"rkeysecu"=hex:dd,bc,ad,1e,30,35,24,4f,1a,47,c7,1e,c5,3b,48,c4
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(480)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3052)
c:\program files\Online Armor\OAwatch.dll
c:\program files\WinPatrol\PATROLPRO.DLL
c:\windows\system32\ctagent.dll
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Avast5\AvastSvc.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\CTHELPER.EXE
c:\windows\system32\wscntfy.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
c:\program files\Online Armor\OAhlp.exe
.
**************************************************************************
.
Completion time: 2010-04-24 19:12:14 - machine was rebooted
ComboFix-quarantined-files.txt 2010-04-24 17:12
ComboFix2.txt 2010-04-24 14:43

Pre-Run: 10 042 769 408 bájt szabad
Post-Run: 10 008 813 568 bájt szabad

- - End Of File - - 9BDE860B35AAA4E206B2730E0DEC8427

Nálatok nem? Létezik ilyen?

A Spybot-tal mi a probléma?

igen ahogy elnezem a logot ott nalatok magyarorszagon ez van,,minden fele forumokon,blogokban adjak a sokk buta tanacsot,telepitsd ezt ,azt ,ijen virus irtot ojan virus irtot,vedd ki a merev lemezet,,ijen badarsagokat,a geped tele van minden fele virus,meg rootkit irto maradekaval,es meg van ot rootkit,ezert pontosan csinald amit leirok
1:Letelepited a geprol a vezerlo pulton keresztull.
Lavasoft Ad-Aware
SpybotSD
2:ujbol futtasd a DAEMON eltavolitot es vizsgald att ha le van e telepitve,ha igen folytatod a combofixel igy
Kinyitunk - Notepadot (Jegyzetfüzetet)igy: Start>futtatás>beírod: notepad
és bemásolod- a Kód: címszó alatt található zöld textet(Kód: szó nélkül), aztán a notepadba beillesztett textet elmentjük scriptnek az asztalra , úgy:- Fájl>Mentés Másként>Fájlnév>CFScript.txt>Fájl típusa>Minden fájl>Mentés.(Ásztálra),.Kész, az astalon lévő CFScript txt húzzunk rá a ComboFix ikonnyara. Es mostan megcsinalod eztett:

A combofix maga elindul es lehet hogy restartol es befejezi a scent.Amit majd ad ted ide.

ComboFix 10-04-21.01 - gigabyte 010.04.24. 16:29:33.1.2 - x86
Running from: c:\documents and settings\gigabyte\Asztal\macska.com.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\gigabyte\Application Data\ACD Systems\ACDSee\ImageDB.ddf
c:\windows\system32\drivers\npf.sys
c:\windows\system32\Packet.dll
c:\windows\system32\wpcap.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_NPF


((((((((((((((((((((((((( Files Created from 2010-03-24 to 2010-04-24 )))))))))))))))))))))))))))))))
.

2010-04-24 14:38 . 2010-04-24 14:38 -------- d-----w- c:\windows\system32\xircom
2010-04-24 14:38 . 2010-04-24 14:38 -------- d-----w- c:\windows\system32\wbem\snmp
2010-04-24 10:17 . 2010-04-24 14:16 -------- d-----w- C:\ComboFix
2010-04-23 09:50 . 2010-04-23 09:50 -------- d-----w- c:\documents and settings\gigabyte\Application Data\Malwarebytes
2010-04-23 09:50 . 2010-03-29 22:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-23 09:50 . 2010-04-23 09:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-04-23 09:50 . 2010-04-23 09:50 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-23 09:50 . 2010-03-29 22:45 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-23 09:19 . 2010-04-23 09:19 52224 ----a-w- c:\documents and settings\gigabyte\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-04-23 09:19 . 2010-04-23 09:19 117760 ----a-w- c:\documents and settings\gigabyte\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-04-23 09:18 . 2010-04-23 09:18 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-04-23 09:17 . 2010-04-23 09:17 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-04-23 09:17 . 2010-04-23 09:17 -------- d-----w- c:\documents and settings\gigabyte\Application Data\SUPERAntiSpyware.com
2010-04-19 11:26 . 2010-04-19 12:00 -------- d-----w- c:\documents and settings\gigabyte\Application Data\Red Alert 3
2010-04-11 00:19 . 2010-04-11 00:19 -------- d-----w- c:\windows\Sun
2010-04-11 00:10 . 2010-04-11 00:10 503808 ----a-w- c:\documents and settings\gigabyte\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-599c82d8-n\msvcp71.dll
2010-04-11 00:10 . 2010-04-11 00:10 499712 ----a-w- c:\documents and settings\gigabyte\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-599c82d8-n\jmc.dll
2010-04-11 00:10 . 2010-04-11 00:10 348160 ----a-w- c:\documents and settings\gigabyte\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-599c82d8-n\msvcr71.dll
2010-04-11 00:10 . 2010-04-11 00:10 61440 ----a-w- c:\documents and settings\gigabyte\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-18a5809d-n\decora-sse.dll
2010-04-11 00:10 . 2010-04-11 00:10 12800 ----a-w- c:\documents and settings\gigabyte\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-18a5809d-n\decora-d3d.dll
2010-04-11 00:10 . 2010-04-11 19:24 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-04-08 23:25 . 2010-04-08 23:25 3262 ----a-r- c:\documents and settings\gigabyte\Application Data\Microsoft\Installer\{10209B87-55D6-493E-A30A-12A265AA324E}\_5b0b29e7.exe
2010-04-08 02:25 . 2010-04-21 08:30 -------- d-----w- c:\program files\PeerBlock
2010-04-07 17:23 . 2010-04-10 22:50 -------- d-----w- c:\program files\WinPatrol
2010-04-07 16:32 . 2010-04-14 16:35 162768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-04-07 16:32 . 2010-04-14 16:31 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-04-07 16:32 . 2010-04-14 16:31 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-04-07 16:32 . 2010-04-14 16:35 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-04-07 16:32 . 2010-04-14 16:31 100432 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-04-07 16:32 . 2010-04-14 16:31 94800 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-04-07 16:32 . 2010-04-14 16:30 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-04-07 16:32 . 2010-04-14 16:47 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-04-07 16:32 . 2010-04-14 16:47 153184 ----a-w- c:\windows\system32\aswBoot.exe
2010-04-07 16:32 . 2010-04-16 00:34 -------- d-----w- c:\program files\Avast5
2010-04-07 16:32 . 2010-04-07 16:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-04-07 15:59 . 2010-04-07 16:28 -------- d-----w- c:\documents and settings\All Users\Application Data\OnlineArmor
2010-04-07 15:59 . 2010-04-07 15:59 -------- d-----w- c:\documents and settings\gigabyte\Application Data\OnlineArmor
2010-04-07 15:58 . 2010-03-13 03:39 24440 ----a-w- c:\windows\system32\drivers\OAmon.sys
2010-04-07 15:58 . 2010-03-13 03:38 29560 ----a-w- c:\windows\system32\drivers\OAnet.sys
2010-04-07 15:58 . 2010-03-13 03:38 226680 ----a-w- c:\windows\system32\drivers\OADriver.sys
2010-04-07 15:58 . 2010-04-24 14:21 -------- d-----w- c:\program files\Online Armor
2010-04-05 23:08 . 2010-04-05 23:08 -------- d-----w- c:\program files\Ubi Soft
2010-04-05 23:05 . 2010-04-05 23:05 53248 ----a-r- c:\documents and settings\gigabyte\Application Data\Microsoft\Installer\{9AA761E6-CA51-4FF2-A552-D51638BF0595}\_F522ED7EA612_4117_B86D_78467DE01E30.exe
2010-04-05 18:08 . 2010-04-05 18:08 0 ----a-w- c:\windows\PowerReg.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-24 14:38 . 2010-04-24 14:38 -------- d-----w- c:\program files\microsoft frontpage
2010-04-24 14:36 . 2008-06-28 17:36 24 ----a-w- c:\windows\system32\DVCStateBkp-{00000004-00000000-00000001-00001102-00000002-00201102}.dat
2010-04-24 14:36 . 2008-06-28 17:36 24 ----a-w- c:\windows\system32\DVCState-{00000004-00000000-00000001-00001102-00000002-00201102}.dat
2010-04-24 14:15 . 2008-06-27 22:02 -------- d-----w- c:\documents and settings\gigabyte\Application Data\foobar2000
2010-04-23 20:24 . 2008-07-02 14:09 -------- d-----w- c:\documents and settings\gigabyte\Application Data\Skype
2010-04-23 19:21 . 2008-07-02 14:10 -------- d-----w- c:\documents and settings\gigabyte\Application Data\skypePM
2010-04-23 10:44 . 2008-08-01 04:03 -------- d-----w- c:\documents and settings\gigabyte\Application Data\uTorrent
2010-04-23 09:17 . 2008-12-02 21:08 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-04-19 16:21 . 2008-12-19 14:13 98304 ----a-w- c:\windows\system32CmdLineExt.dll
2010-04-19 10:36 . 2008-06-26 07:47 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-04-14 03:34 . 2008-06-26 08:14 29216 ----a-w- c:\documents and settings\gigabyte\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-04-11 03:56 . 2008-09-29 01:30 -------- d-----w- c:\program files\Common Files\Adobe
2010-04-08 23:25 . 2008-09-28 23:45 -------- d-----w- c:\program files\TQ Defiler
2010-04-08 02:23 . 2009-01-18 08:48 -------- d-----w- c:\program files\PeerGuardian2
2010-04-07 15:58 . 2004-08-18 11:00 97174 ----a-w- c:\windows\system32\perfc00E.dat
2010-04-07 15:58 . 2004-08-18 11:00 440598 ----a-w- c:\windows\system32\perfh00E.dat
2010-03-02 16:07 . 2009-06-22 04:21 862040 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\threatwork.exe
2010-03-02 16:07 . 2009-06-22 04:28 15880 ----a-w- c:\windows\system32\lsdelete.exe
2010-03-02 16:07 . 2009-06-22 04:21 15880 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lsdelete.exe
2010-03-02 16:07 . 2009-06-22 04:21 206944 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavamessage.dll
2010-03-02 16:07 . 2009-06-22 04:21 390288 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavalicense.dll
2010-02-14 21:30 . 2010-02-14 21:30 6812 ----a-w- c:\windows\system32\ealregsnapshot1.reg
2010-02-04 09:01 . 2010-02-14 20:42 74072 ----a-w- c:\windows\system32\XAPOFX1_4.dll
2010-02-04 09:01 . 2010-02-14 20:42 528216 ----a-w- c:\windows\system32\XAudio2_6.dll
2010-02-04 09:01 . 2010-02-14 20:42 238936 ----a-w- c:\windows\system32\xactengine3_6.dll
2010-02-04 09:01 . 2010-02-14 20:42 22360 ----a-w- c:\windows\system32\X3DAudio1_7.dll
2009-01-28 22:47 . 2009-01-28 22:47 23 --sha-w- c:\windows\system32\efdeaade7_z.dll
.

------- Sigcheck -------

[-] 2008-05-19 . 2993C2DF98A2D6D9896E0AB24946F972 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2010-04-01 2010864]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-09-19 16844800]
"WINDVDPatch"="CTHELPER.EXE" [2002-07-02 24576]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-08-13 98304]
"@OnlineArmor GUI"="c:\program files\Online Armor\oaui.exe" [2010-03-13 6658552]
"avast5"="c:\progra~1\Avast5\avastUI.exe" [2010-04-14 2790472]
"WinPatrol"="c:\program files\WinPatrol\winpatrol.exe" [2009-07-27 341312]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{4F07DA45-8170-4859-9B5F-037EF2970034}"= "c:\progra~1\ONLINE~2\oaevent.dll" [2010-03-13 925688]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 13:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^gigabyte^Start Menu^Programs^Indítópult^WinFlip.lnk]
backup=c:\windows\pss\WinFlip.lnkStartup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ace new
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SBAMTray
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Second bat creative peak

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ad-Watch]
2010-03-02 16:06 788880 ----a-w- c:\program files\Lavasoft\Ad-Aware\AAWTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-12-21 23:57 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2008-04-01 09:39 486856 ----a-w- c:\program files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2005-05-11 21:12 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Jet Detection]
2001-11-28 23:00 28672 ----a-w- c:\program files\Creative\SBLive\Program\ADGJDet.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2009-07-26 14:43 3883840 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-01 14:57 153136 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2008-09-06 13:09 413696 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2004-11-02 18:24 32768 ----a-w- c:\program files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2008-11-07 13:31 21633320 ----a-r- c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 14:07 2260480 --sha-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2010-04-07 17:57 1217872 ----a-w- c:\games\Steam\steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
2000-05-10 23:00 90112 ------w- c:\windows\Updreg.EXE

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009.06.22. 6:16 64288]
R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\system32\drivers\sfdrv01a.sys [2006.07.05. 14:46 63352]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2010.04.07. 18:32 162768]
R1 OADevice;OADriver;c:\windows\system32\drivers\OADriver.sys [2010.04.07. 17:58 226680]
R1 OAmon;OAmon;c:\windows\system32\drivers\OAmon.sys [2010.04.07. 17:58 24440]
R1 OAnet;OAnet;c:\windows\system32\drivers\OAnet.sys [2010.04.07. 17:58 29560]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2010.02.17. 11:25 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010.02.17. 11:15 66632]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010.04.07. 18:32 19024]
R2 OAcat;Online Armor Helper Service;c:\program files\Online Armor\oacat.exe [2010.04.07. 17:58 1284600]
R2 SvcOnlineArmor;Online Armor;c:\program files\Online Armor\oasrv.exe [2010.04.07. 17:58 3360760]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2010.02.17. 11:15 12872]
S3 cpuz130;cpuz130; [x]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009.09.24. 13:17 1181328]
S3 npggsvc;nProtect GameGuard Service; [x]
S3 pbfilter;pbfilter;c:\program files\PeerBlock\pbfilter.sys [2010.04.08. 4:25 14424]
S3 rkhdrv40;Rootkit Unhooker Driver; [x]
S3 SBRE;SBRE; [x]
S3 VL807a;VL807a Filter;c:\windows\system32\drivers\VL807a.sys [2009.11.04. 9:44 23680]
S4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys --> c:\windows\system32\Drivers\sptd.sys [?]
.
Contents of the 'Scheduled Tasks' folder

2008-12-18 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mStart Page = hxxp://www.yahoo.com
FF - ProfilePath - c:\documents and settings\gigabyte\Application Data\Mozilla\Firefox\Profiles\dvvuwvlj.default\
FF - prefs.js: browser.startup.homepage -

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-Raid Volume - prwhost.exe
ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-24 16:40
Windows 5.1.2600 Szervizcsomag 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A87E4B0]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xba0ecf28
\Driver\ACPI -> ACPI.sys @ 0xb9f7fcb8
\Driver\atapi -> 0x8a87e4b0
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1004336348-1425521274-682003330-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:44,55,d0,ad,07,c1,2f,a1,79,13,e4,b4,4a,d0,7e,64,2d,98,e1,04,29,18,34,
69,3f,01,26,b6,6f,ad,43,f8,16,04,1c,a7,43,53,dc,d0,03,f1,9d,6f,26,67,db,a6,\
"??"=hex:5d,2e,bc,00,9b,07,bc,9c,34,34,87,88,c9,ab,ca,0d

[HKEY_USERS\S-1-5-21-1004336348-1425521274-682003330-1003\Software\SecuROM\License information*]
"datasecu"=hex:4f,eb,20,27,db,f9,5f,08,e8,e0,e6,04,cf,38,d9,50,38,cb,5d,68,84,
95,4b,79,b0,ad,4a,d8,c3,96,81,81,ee,21,43,93,f9,24,01,c1,6f,43,d5,6c,a1,93,\
"rkeysecu"=hex:dd,bc,ad,1e,30,35,24,4f,1a,47,c7,1e,c5,3b,48,c4
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(480)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3680)
c:\program files\Online Armor\OAwatch.dll
c:\program files\WinPatrol\PATROLPRO.DLL
c:\windows\system32\ctagent.dll
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Avast5\AvastSvc.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\CTHELPER.EXE
c:\windows\system32\wscntfy.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
c:\program files\Online Armor\OAhlp.exe
.
**************************************************************************
.
Completion time: 2010-04-24 16:43:32 - machine was rebooted
ComboFix-quarantined-files.txt 2010-04-24 14:43

Pre-Run: 8 501 030 912 bájt szabad
Post-Run: 8 441 380 864 bájt szabad

- - End Of File - - 79DC7BD6B91C371C6EC1A44D26ACE369

1:ok,tolds le a combofixet a rendes windowsba,ugy ahogy leirtam az asztalra..
2:hasznalod az RKILL-programot es utana rogton futtatod a combofixet rendes windowsban
http://virus-stell.blogspot.com/2010/04/rkill.html

Helyzetjelentés: Nem is én lennék, ha minden jól működne. Erre szokták mondani a szakemberek, hogy User Error. Csökkentett módban hálózattal nem tudok az internetre csatlakozni. Háromszor is megpróbáltam a csökkentett mód hálozattal opciót, hátha vmit nem jól csináltam. Kétszer Rendszergazdaként léptem be és egyszer az én saját fiókommal próbáltam hátha úgy megy a net. Külső modemes ADSL internetem van. Sajnálom, hogy ilyen macerás vagyok pedig annnnnyira igyekszem okosan és jól csinálni.
Várom a további ötleteket.

Igen azt tudom, hogy a csökkentett módhoz nem kell az XP lemez.
Azt csak leírtam, hogy még tegnap feltelepítettem a helyreállító konzolt az XP lemezzel. Na most végigcsinálom ezt a csökkentett módban combofix letöltős, átnevezős, elindítós procedúrát és majd jelentkezem, ha még lesz használható gépem.

na egy kicsit osze zavartad,
1:az a Daemon eltavolitasi programal,futtasd-es klik,UNINSTALL-restart.ha nincsen csak cancel vagy install akkor renben van,mert mar le van telepitve
2;Csokentet mod a halozatal,eztet nem az xp lemezel csinalod hanem igy
http://www.virus-stell.com/2010/04/csok ... win-7.html
es a menuben kivalasztodd csokentet mod a halozatal,,es letoltod a combofixet ugy ahogy mar leirtam,es futtatod.a logjat tedd ide.

Szóval vázolom a helyzetet -mivel próbálom lépésről lépésre követni az utasításaid és nem minden történik úgy ahogy leírtad. Combofixet leuninstaláltam ahogy írtad, majd letöltöttem a programot az oldaladról elindítottam bejött egy ablak 3 gombal egy Install egy inaktív nemtudommi meg cancel. Installt választottam laikus fejjel gondoltam telepíteni kell hogy használjam. Kért egy rebootot. Újraindítottam majd megint elindítottam a programot vagyis próbáltam mivel nem akart csak a 3 kérésemre elindulni. Na itt már volt Uninstall Update meg Cancel. Uninstallt nyomtam újra rebootot kért eleget tettem a kérésének.
A "3;Lemegy csokkentet modban a halozatal,es letoltod a..." rész úgy értetted, hogy én indítsam csökkentettben hálózattal?
Extra: Mivel tegnap nem települt a helyreállító konzol így én manuálisan a winXP SP3 CD-ről telepítettem azt vmilyen futtatás parancsal amit a neten néztem még tegnap. Szóval már van egy menü winXP indulás elött hogy XP-t vagy helyreállítást akarok-e. Ezt csak azért írtam, hogy ez baj vagy sem, nehogy mostmeg a combofix rendet akar tenni mivel megvan hozzá az eszköze. Azt hiszem azzal kicsit előreszaladtam, ugyanis te nem írtad annak a telepítését.

ok,a combofix igy mukodik ,hogy eltunteti az ikonokat,,pontosan csinald eztet amit ide irok,mivel ugy nez ki hogy valamijen rootkit blokolja a combofixet
1;Szed le a geprol a combofixet-klik-start-klik-futtatas-masold be ezt a parancsot az ablakba combofix /uninstall ok
2:Leszeded a DAEMONT-aztan majd ha kitisztitsuk a gepet vissza rakod.-hasznald ezt a programot
http://www.virus-stell.com/2010/04/daem ... lator.html
3;Lemegy csokkentet modban a halozatal,es letoltod a combofixet ujbol igy
jobb klik a combofix linkjere-a menuben kivalasztod-lementeni mint...es ide beirod macska.com-es leteszed az asztalra,,futtatod,akarmit majd kiir,akkor mindig beleegyezel-a vegen add logot tedd ide,,ha igy se mene akkor irjal.
http://www.virus-stell.com/2010/04/combofix.html

Ez a Combofix biztos nagyon jó program lenne, ha működne de legalábbis végigcsinálná amit kéne. A helyzet a következő. Letöltöttem a programot a linkről, tüzetesen végigolvastam az ott leírt használati utasítást, letöltöttem hozzá a helyreállító konzolt (mivel írták mindent ki kell kapcsolni a combofix használatakor így nem akartam neten lógni tűzfal és inaktív virusírtóval.) Szóval letöltöttem a konzolt mindkettőt kiraktam az asztalra, ráhúztam az konzolt a combofixre elindult majd windows újraindult. Ezek után kikapcsoltam minden védelmet bezártam minden lehetséges programot és elindítottam a Combofixet. Akarta letölteni és telepíteni a konzolt ott nemet mondtam neki majd folytatta vmit írt a rút kitekről és kérdezte újrainduljon-e, újraindult a windows itt Combofix kérte hogy had lője ki a Daemon Toolst amit engedtem neki. A probléma itt van, ugyanis semmi más nem volt látható csak a háttér, se ikonok se start menü semmi, viszont a HDD led folyamatosan egyenletesen villogott, mondom biztos tart még a scannelés vártam kb 40 percet majd meguntam reset -mivel 10 percet max ennek a duplját írta az oldal az egészre. Mondom nem kezdek el itt sírni, hogy nem működik inkább elindítottam még1x (de már a Daemon Tools automatikus indulását kilőttem majd újraindítottam a gépet, hogy érvényesüljön ez). A helyzet ugyanaz volt, megint rootkitben vmit szimatolt és kérte az újraindulást. Ugyanúgy sikított a Daemon Toolsra majd megint csak a hátteret bámultam, de most 50 percig. Daemon Tools minden nap használom szóval nem szeretném uninstalálni.
Nah megint sikerült jó hosszúra nyújtanom az egészet, dehát szeretek fecsegni.

Nem kell mindent felrakni a gepre amit olvasol,spybot a multe-ugyanugy az Ad-Aware,a SAS eben nem segit,
Udv
Igen van ot valami,,
Futtasd le a combofixet
http://www.virus-stell.com/2010/04/combofix.html
a logjat tedd ide.

Tisztelt stell!

Szeretném kérni a segítséged. Kb egy hónapja váltottam vírusirtót és tűzfalat. Régebben egy nem jogtiszta NOD32 és a ZoneAlam tűzfalam volt meg egy ProcessGuard nevű program ami túl sok gondot okozott (béna/lusta voltam beállítani). Továbbá használom az Ad-aware és a Spybot (ezt csak a böngészőm immunizálására) programokat nem aktív védelemként csak néha scannelni. Most az Avast!-ot és Online Armort használom lecserélve a NOD-ot meg ZoneAlarm-ot plusz feltettem a WinPatrol-t mert azt mondták jó. Telepítettem a Java progit is vmikor a hetekben mert vmihez kellet. Gyanítom rajta keresztül jutott be valami, de már leuninstalláltam amúgy is olykor összeomlott. A problémám, hogy úgy érzem a netem belassult, de ha lefuttatok egy online sebességtesztet ott minden rendben van. 5 éve játszok egy MMORPG játékkal ami szintén belassult olykor "megakad" a kapcsolat, nincs disconnect csak egy nagy lag a latency is folyton változik nagy akár több száz ms ingadozással. Az Avast! egy két hete folyton jelez, hogy DCOM Exploit be akart törni, de blokkolva lett. Egy fórumon olvastam, hogy valószínű a probléma már bent van a gépen ott ajánlottak egy elég béna nevű SUPERAntiSpyware programot amit feltettem és lefuttattam, talált is 8 cookit meg két trójait amit leirtott. Újraindítás után a WinPatrol folyton jelzett, hogy bizonyos program automatikussan akar indulni a rendszerrel engedem-e, de azt nem mutatta mik azok amik indulni akarnak, ha azt mondtam neki ne engedje akkor újabb ablak, hogy ez mélyen a rendszerben van és nem ajánlott a tiltásuk. Késöbb megnéztem a log filet mik voltak amik a rendszerrel akartak indulni és meglepetésemre olyan programik/szolgáltatások amik eddig is futottak videokártya vezérlő, Online Armor, Avast! stb. Szóval nem vagyok meggyőződve arról, hogy mostmár tiszta a gépem. Igyekeztem mindent leírni ami szerintem fontos lehet. Örülök, hogy rátaláltam erre a fórumra. Úgy látom -pár téma elolvasása után- Te nagy mágus vagy ebben. Remélem nekem is tudsz segíteni amit előre is köszönök. Természetesen letöltöttem és futtattam a HijackThis programot itt a log file:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 14:53:01, on 2010.04.23.
Platform: Windows XP Szervizcsomag 3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Online Armor\OAcat.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Online Armor\oasrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avast5\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Online Armor\oaui.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\PROGRA~1\Avast5\avastUI.exe
C:\Program Files\WinPatrol\winpatrol.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Online Armor\OAhlp.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\wincmd\WINCMD32.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\foobar2000\foobar2000.exe
C:\Program Files\HijackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hivatkozások
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live bejelentkezési segítség - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Raid Volume] prwhost.exe
O4 - HKLM\..\Run: [@OnlineArmor GUI] "C:\Program Files\Online Armor\oaui.exe"
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\WinPatrol\winpatrol.exe -expressboot
O4 - HKLM\..\RunServices: [Raid Volume] prwhost.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'HELYI SZOLGÁLTATÁS')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'HELYI SZOLGÁLTATÁS')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'HÁLÓZATI SZOLGÁLTATÁS')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'HÁLÓZATI SZOLGÁLTATÁS')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O9 - Extra button: Küldés blogba - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Küldés blogba a Windows Live Writer programmal - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{429FA8C1-689C-4CAE-8EB6-4DAE8911C054}: NameServer = 84.2.44.1 84.2.46.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O22 - SharedTaskScheduler: Browseui előbetöltője - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Komponenskategóriák gyorsítótárazási szolgáltatása - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Avast5\AvastSvc.exe
O23 - Service: Logikai lemezkezelő felügyeleti szolgáltatás (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Eseménynapló (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: IMAPI CD-égető COM-szolgáltatás (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NetMeeting távoli asztalmegosztás (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - (no file)
O23 - Service: Online Armor Helper Service (OAcat) - Unknown owner - C:\Program Files\Online Armor\OAcat.exe
O23 - Service: Plug and Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Távoli asztal súgó-munkamenetének kezelője (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Intelligens kártya (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Online Armor (SvcOnlineArmor) - Unknown owner - C:\Program Files\Online Armor\oasrv.exe
O23 - Service: Teljesítménynaplók és riasztások (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Kötet árnyékmásolata (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: WMI teljesítményadapter (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe

--
End of file - 8306 bytes