nincsen mit koszonod
szolok,koszi,
udv,

Combofixet unistalláltam, Ccleanerrel tisztítottam... Újraindítás után no problemo, csendes és gyors!
Thx Stell!
Ilyen önzetlenül segítőkész emberrel, mint te ritkán találkozni (főleg a számítástechnika terén). Én építőipari területen tevékenykedem, ha egyszer szükséged van segítségre ezen a téren, csak szólj PM-ben...
Köszi mindent!!!

Frank68

de renben van leszedni a combofixet a geprol,kipucolni CCleaneral es ha nincsen problem enyi az egesz,

Már megint valamit nem jól csináltam, ugye nem?

Bocs a kis fennakadásért!
CFScript.txt-t bedobtam combofix-be, C:\AUTOSCAN elindult, majd kis idő múlva felugró ablak > PEV.cfxxe hibát észlelt ezért leáll > hiba üzenet küldése MÉGSE > combofix scan futott tovább (csak én betojtam, hogy ez így nem lesz jó...) > leállítottam > netre nem tudtam felmenni > Start újraindítás...
Ismételtem és úgyanazt csinálta, DE most már hagytam végig futni a scannelést, ime a log report:

ComboFix 09-11-08.03 - nagy 009.11.09. 19:32.3.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.36.1038.18.2047.1540 [GMT 1:00]
Running from: c:\documents and settings\nagy\Asztal\ComboFix.exe
Command switches used :: c:\documents and settings\nagy\Asztal\CFScript.txt
AV: avast! antivirus 4.8.1356 [VPS 091109-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\D56B0E274A3E46C9B5C1D93D580C099C.TMP
c:\windows\D56B0E274A3E46C9B5C1D93D580C099C.TMP\WiseCustomCalla.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_JFDCD
-------\Service_jfdcd


((((((((((((((((((((((((( Files Created from 2009-10-09 to 2009-11-09 )))))))))))))))))))))))))))))))
.

2009-10-30 17:50 . 2009-10-30 17:50 -------- d-----w- c:\program files\DIFX
2009-10-30 16:20 . 2009-10-30 17:49 -------- d-----w- C:\BDS
2009-10-17 14:54 . 2009-10-17 14:56 -------- d-----w- C:\Zenék

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-09 17:59 . 2008-04-10 19:00 -------- d-----w- c:\documents and settings\nagy\Application Data\Skype
2009-11-09 16:59 . 2008-04-10 19:03 -------- d-----w- c:\documents and settings\nagy\Application Data\skypePM
2009-11-07 19:02 . 2006-03-02 12:00 539154 ----a-w- c:\windows\system32\perfh00E.dat
2009-11-07 19:02 . 2006-03-02 12:00 136008 ----a-w- c:\windows\system32\perfc00E.dat
2009-11-06 20:50 . 2008-04-23 18:55 -------- d-----w- c:\documents and settings\nagy\Application Data\uTorrent
2009-10-30 18:12 . 2007-12-04 17:23 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-10-30 17:49 . 2009-06-14 13:43 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-10-13 13:07 . 2009-03-31 19:05 -------- d-----w- c:\program files\iPod
2009-10-13 13:07 . 2009-03-31 19:05 -------- d-----w- c:\program files\iTunes
2009-10-01 08:26 . 2009-10-09 17:13 342599 ----a-w- c:\windows\fifa10_uninstall.exe
2009-09-15 11:59 . 2009-08-24 08:22 1279968 ----a-w- c:\windows\system32\aswBoot.exe
2009-09-15 11:56 . 2009-08-24 08:22 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-09-15 11:56 . 2009-08-24 08:22 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-09-15 11:55 . 2009-08-24 08:22 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-09-15 11:55 . 2009-08-24 08:22 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-09-15 11:54 . 2009-08-24 08:22 52368 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-09-15 11:54 . 2009-08-24 08:22 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-09-15 11:53 . 2009-08-24 08:22 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-09-15 11:53 . 2009-08-24 08:22 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-09-11 19:47 . 2009-06-14 16:21 -------- d-----w- c:\program files\AGEIA Technologies
2009-09-11 14:19 . 2006-03-02 12:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:05 . 2006-03-02 12:00 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 07:59 . 2006-03-02 12:00 916480 ------w- c:\windows\system32\wininet.dll
2009-08-26 08:02 . 2006-03-02 12:00 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-22 12:21 . 2007-12-04 17:42 24104 ----a-w- c:\documents and settings\nagy\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-18 19:17 . 2009-08-18 19:17 52809 ----a-w- c:\windows\UN_CODA.EXE
2009-08-14 11:36 . 2009-08-14 11:36 70936 ----a-w- c:\windows\system32\PhysXLoader.dll
1999-06-22 06:35 . 1999-06-22 06:35 99840 ----a-w- c:\program files\Common Files\IRAABOUT.DLL
1998-12-09 00:53 . 1998-12-09 00:53 70144 ----a-w- c:\program files\Common Files\IRAMDMTR.DLL
1998-12-09 00:53 . 1998-12-09 00:53 48640 ----a-w- c:\program files\Common Files\IRALPTTR.DLL
1998-12-09 00:53 . 1998-12-09 00:53 31744 ----a-w- c:\program files\Common Files\IRAWEBTR.DLL
1998-12-09 00:53 . 1998-12-09 00:53 186368 ----a-w- c:\program files\Common Files\IRAREG.DLL
1998-12-09 00:53 . 1998-12-09 00:53 17920 ----a-w- c:\program files\Common Files\IRASRIAL.DLL
.

((((((((((((((((((((((((((((( SnapShot@2009-11-09_17.19.34 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-11-09 18:37 . 2009-11-09 18:37 16384 c:\windows\Temp\Perflib_Perfdata_7f8.dat
+ 2009-11-09 18:37 . 2009-11-09 18:37 16384 c:\windows\Temp\Perflib_Perfdata_5b8.dat
- 2009-11-03 05:02 . 2009-11-03 05:02 16384 c:\windows\Temp\Perflib_Perfdata_5b8.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-01-03 486856]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-02-06 21898024]
"Jet Screenshot"="c:\program files\Jet Screenshot\jetScreenshot.exe" [2009-08-29 3892736]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"SweetIM"="c:\program files\SweetIM\Messenger\SweetIM.exe" [2009-01-01 111928]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-02-25 61440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-09-15 81000]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-03-21 16126464]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\nagy\Start Menu\Programs\Indˇt˘pult\
MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2008-10-1 575488]

c:\documents and settings\All Users\Start Menu\Programs\Indˇt˘pult\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
Symantec Fax Starter Edition Port.lnk - c:\program files\Microsoft Office\Office\1038\OLFSNT40.EXE [1999-6-22 46080]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Documents and Settings\\nagy\\Asztal\\PES2008.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\VALVe\\Counter-Strike Source\\hl2.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\AOE.II\\empires2.EXE"=
"c:\\Program Files\\TrackMania Nations ESWC\\TmNationsESWC.exe"=
"c:\\Program Files\\TmNationsForever\\TmForever.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\CAPCOM\\LOSTPLANETCOLONIES\\LostPlanetColoniesDX9.exe"=
"c:\\Program Files\\CAPCOM\\LOSTPLANETCOLONIES\\LostPlanetColoniesDX10.exe"=
"e:\\PC GAMES\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"e:\\PC GAMES\\Codemasters\\GRID\\GRID.exe"=
"e:\\PC GAMES\\Activision\\Call of Duty - World at War\\CoDWaWmp.exe"=
"e:\\PC GAMES\\Activision\\Call of Duty - World at War\\CoDWaW.exe"=
"e:\\PC GAMES\\WheelmanGameFiles\\Binaries\\WheelmanGame-Final.exe"=
"e:\\PC GAMES\\Activision\\X-Men Origins - Wolverine(TM)\\Binaries\\Wolverine.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"e:\\PC GAMES\\Codemasters\\FUEL\\FUEL.exe"=
"e:\\PC GAMES\\Ubisoft\\Techland\\Call of Juarez - Bound in Blood\\CoJBiBGame_x86.exe"=
"e:\\PC GAMES\\THQ\\Frontlines-Fuel of War\\Binaries\\FFOW.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"e:\\PC GAMES\\2K Games\\Gearbox Software\\Borderlands\\Binaries\\Borderlands.exe"=
"e:\\PC GAMES\\Activision\\Wolfenstein\\MP\\Wolf2MP.exe"=
"e:\\PC GAMES\\Activision\\Wolfenstein\\MP\\Wolf2MPLite.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
"23520:TCP"= 23520:TCP:.

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009.08.24. 9:22 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009.08.24. 9:22 20560]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;c:\windows\system32\drivers\atl01_xp.sys [2007.12.04. 18:30 38656]

--- Other Services/Drivers In Memory ---

*Deregistered* - mbr
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-09 19:38
Windows 5.1.2600 Szervizcsomag 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys spom.sys >>UNKNOWN [0x8A627944]<<
kernel: MBR read successfully
user & kernel MBR OK
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

atapi.sys @ 0x0 0x0 bytes

\Driver\atapi [ IRP_MJ_CREATE ] 0xA6F2 != 0xB9E24B40 atapi.sys
\Driver\atapi [ IRP_MJ_CLOSE ] 0xA6F2 != 0xB9E24B40 atapi.sys
\Driver\atapi [ IRP_MJ_DEVICE_CONTROL ] 0xA712 != 0xB9E24B40 atapi.sys
\Driver\atapi [ IRP_MJ_INTERNAL_DEVICE_CONTROL ] 0x6852 != 0xB9E24B40 atapi.sys
\Driver\atapi [ IRP_MJ_POWER ] 0xA73C != 0xB9E24B40 atapi.sys
\Driver\atapi [ IRP_MJ_SYSTEM_CONTROL ] 0x11336 != 0xB9E24B40 atapi.sys
\Driver\atapi IRP hooks detected !

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(752)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3756)
c:\windows\system32\WININET.dll
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\UAService7.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Completion time: 2009-11-09 19:45 - machine was rebooted
ComboFix-quarantined-files.txt 2009-11-09 18:44
ComboFix2.txt 2009-11-09 17:21

Pre-Run: 11 628 937 216 bájt szabad
Post-Run: 11 514 388 480 bájt szabad

- - End Of File - - E537FA237CD3EDB4949C10AF97AFEFBC

Kinyitod a Notepadot>Start>futatas>beirod notepad
Es bemasolod a piros textet

Mostan>a notepadon elso full-fajl>ballfelsosarokban>4-sor>lementenni mint....
A txt-hejetfajlnev beteszed eztett>CFScript.txt<alatta bealitod >minden fajl<
legfelull>asztall i<klik gomb letenni.Es mostan megcsinalod eztett:

A combofix maga elindul es lehet hogy restartol es befejezi a scent.Amit majd ad ted ide

Hi, Stell!

Bár nem írtad, hogy a harmadik lurkó gépére is ránéznél, bátorkodnék megkérni, vess légyszíves erre is "egy pillantást"!
Nincs különösebb gond, bár a logot áttekintve, amit a ComboFix törölt, a c:\windows\system32\tmp90.tmp és tmp91.tmp virtual trójai vírusra utal?!
Van nagy gond?

Íme a log:

ComboFix 09-11-08.03 - nagy 009.11.09. 18:11.1.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.36.1038.18.2047.1487 [GMT 1:00]
Running from: c:\documents and settings\nagy\Asztal\ComboFix.exe
AV: avast! antivirus 4.8.1356 [VPS 091109-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\tmp90.tmp
c:\windows\system32\tmp91.tmp

.
((((((((((((((((((((((((( Files Created from 2009-10-09 to 2009-11-09 )))))))))))))))))))))))))))))))
.

2009-10-30 17:50 . 2009-10-30 17:50 -------- d-----w- c:\program files\DIFX
2009-10-30 17:50 . 2009-10-30 17:50 -------- d-----w- c:\windows\D56B0E274A3E46C9B5C1D93D580C099C.TMP
2009-10-30 16:20 . 2009-10-30 17:49 -------- d-----w- C:\BDS
2009-10-17 14:54 . 2009-10-17 14:56 -------- d-----w- C:\Zenék

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-09 16:59 . 2008-04-10 19:03 -------- d-----w- c:\documents and settings\nagy\Application Data\skypePM
2009-11-08 19:37 . 2008-04-10 19:00 -------- d-----w- c:\documents and settings\nagy\Application Data\Skype
2009-11-07 19:02 . 2006-03-02 12:00 539154 ----a-w- c:\windows\system32\perfh00E.dat
2009-11-07 19:02 . 2006-03-02 12:00 136008 ----a-w- c:\windows\system32\perfc00E.dat
2009-11-06 20:50 . 2008-04-23 18:55 -------- d-----w- c:\documents and settings\nagy\Application Data\uTorrent
2009-10-30 18:12 . 2007-12-04 17:23 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-10-30 17:49 . 2009-06-14 13:43 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-10-13 13:07 . 2009-03-31 19:05 -------- d-----w- c:\program files\iPod
2009-10-13 13:07 . 2009-03-31 19:05 -------- d-----w- c:\program files\iTunes
2009-10-01 08:26 . 2009-10-09 17:13 342599 ----a-w- c:\windows\fifa10_uninstall.exe
2009-09-15 11:59 . 2009-08-24 08:22 1279968 ----a-w- c:\windows\system32\aswBoot.exe
2009-09-15 11:56 . 2009-08-24 08:22 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-09-15 11:56 . 2009-08-24 08:22 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-09-15 11:55 . 2009-08-24 08:22 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-09-15 11:55 . 2009-08-24 08:22 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-09-15 11:54 . 2009-08-24 08:22 52368 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-09-15 11:54 . 2009-08-24 08:22 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-09-15 11:53 . 2009-08-24 08:22 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-09-15 11:53 . 2009-08-24 08:22 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-09-11 19:47 . 2009-06-14 16:21 -------- d-----w- c:\program files\AGEIA Technologies
2009-09-11 14:19 . 2006-03-02 12:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:05 . 2006-03-02 12:00 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 07:59 . 2006-03-02 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2009-08-26 08:02 . 2006-03-02 12:00 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-22 12:21 . 2007-12-04 17:42 24104 ----a-w- c:\documents and settings\nagy\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-18 19:17 . 2009-08-18 19:17 52809 ----a-w- c:\windows\UN_CODA.EXE
2009-08-14 11:36 . 2009-08-14 11:36 70936 ----a-w- c:\windows\system32\PhysXLoader.dll
1999-06-22 06:35 . 1999-06-22 06:35 99840 ----a-w- c:\program files\Common Files\IRAABOUT.DLL
1998-12-09 00:53 . 1998-12-09 00:53 70144 ----a-w- c:\program files\Common Files\IRAMDMTR.DLL
1998-12-09 00:53 . 1998-12-09 00:53 48640 ----a-w- c:\program files\Common Files\IRALPTTR.DLL
1998-12-09 00:53 . 1998-12-09 00:53 31744 ----a-w- c:\program files\Common Files\IRAWEBTR.DLL
1998-12-09 00:53 . 1998-12-09 00:53 186368 ----a-w- c:\program files\Common Files\IRAREG.DLL
1998-12-09 00:53 . 1998-12-09 00:53 17920 ----a-w- c:\program files\Common Files\IRASRIAL.DLL
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-01-03 486856]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-02-06 21898024]
"Jet Screenshot"="c:\program files\Jet Screenshot\jetScreenshot.exe" [2009-08-29 3892736]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"SweetIM"="c:\program files\SweetIM\Messenger\SweetIM.exe" [2009-01-01 111928]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-02-25 61440]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-12 148888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-09-15 81000]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-03-21 16126464]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\nagy\Start Menu\Programs\Indˇt˘pult\
MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2008-10-1 575488]

c:\documents and settings\All Users\Start Menu\Programs\Indˇt˘pult\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
Symantec Fax Starter Edition Port.lnk - c:\program files\Microsoft Office\Office\1038\OLFSNT40.EXE [1999-6-22 46080]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Documents and Settings\\nagy\\Asztal\\PES2008.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\VALVe\\Counter-Strike Source\\hl2.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\AOE.II\\empires2.EXE"=
"c:\\Program Files\\TrackMania Nations ESWC\\TmNationsESWC.exe"=
"c:\\Program Files\\TmNationsForever\\TmForever.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\CAPCOM\\LOSTPLANETCOLONIES\\LostPlanetColoniesDX9.exe"=
"c:\\Program Files\\CAPCOM\\LOSTPLANETCOLONIES\\LostPlanetColoniesDX10.exe"=
"e:\\PC GAMES\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"e:\\PC GAMES\\Codemasters\\GRID\\GRID.exe"=
"e:\\PC GAMES\\Activision\\Call of Duty - World at War\\CoDWaWmp.exe"=
"e:\\PC GAMES\\Activision\\Call of Duty - World at War\\CoDWaW.exe"=
"e:\\PC GAMES\\WheelmanGameFiles\\Binaries\\WheelmanGame-Final.exe"=
"e:\\PC GAMES\\Activision\\X-Men Origins - Wolverine(TM)\\Binaries\\Wolverine.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"e:\\PC GAMES\\Codemasters\\FUEL\\FUEL.exe"=
"e:\\PC GAMES\\Ubisoft\\Techland\\Call of Juarez - Bound in Blood\\CoJBiBGame_x86.exe"=
"e:\\PC GAMES\\THQ\\Frontlines-Fuel of War\\Binaries\\FFOW.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"e:\\PC GAMES\\2K Games\\Gearbox Software\\Borderlands\\Binaries\\Borderlands.exe"=
"e:\\PC GAMES\\Activision\\Wolfenstein\\MP\\Wolf2MP.exe"=
"e:\\PC GAMES\\Activision\\Wolfenstein\\MP\\Wolf2MPLite.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
"23520:TCP"= 23520:TCP:.

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009.08.24. 9:22 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009.08.24. 9:22 20560]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;c:\windows\system32\drivers\atl01_xp.sys [2007.12.04. 18:30 38656]
S3 jfdcd;jfdcd;\??\c:\docume~1\nagy\LOCALS~1\Temp\jfdcd.sys --> c:\docume~1\nagy\LOCALS~1\Temp\jfdcd.sys [?]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - MBR
*Deregistered* - mbr
*Deregistered* - PROCEXP113
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
HKCU-Run-EA Core - c:\program files\Electronic Arts\EADM\Core.exe
AddRemove-Al´s Home - c:\program files\Dani\click-pool\al´s home\Uninstal.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-09 18:19
Windows 5.1.2600 Szervizcsomag 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys sprq.sys >>UNKNOWN [0x8A644944]<<
kernel: MBR read successfully
user & kernel MBR OK
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

atapi.sys @ 0x0 0x0 bytes

\Driver\atapi [ IRP_MJ_CREATE ] 0xA6F2 != 0xB9E24B40 atapi.sys
\Driver\atapi [ IRP_MJ_CLOSE ] 0xA6F2 != 0xB9E24B40 atapi.sys
\Driver\atapi [ IRP_MJ_DEVICE_CONTROL ] 0xA712 != 0xB9E24B40 atapi.sys
\Driver\atapi [ IRP_MJ_INTERNAL_DEVICE_CONTROL ] 0x6852 != 0xB9E24B40 atapi.sys
\Driver\atapi [ IRP_MJ_POWER ] 0xA73C != 0xB9E24B40 atapi.sys
\Driver\atapi [ IRP_MJ_SYSTEM_CONTROL ] 0x11336 != 0xB9E24B40 atapi.sys
\Driver\atapi IRP hooks detected !

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(752)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-11-09 18:21
ComboFix-quarantined-files.txt 2009-11-09 17:21

Pre-Run: 10 365 505 536 bájt szabad
Post-Run: 11 647 393 792 bájt szabad

- - End Of File - - D77D57AD8E807AB69100012852027C05

a combofix 10 nap utan mar nemukszik rendesen ezert kell leszedned
talald meg es torold le:
c:\documents and settings\Rendszergazda.KOVACS-CSALAD\Start Menu\Programs\Indito pult\
Registration RAYMAN
nincsen mit koszonod
udv

Hi Stell!

Megcsináltam mindent, amit írtál. Gyorsabb lett ez a gép is, jobban fut, nem akadozik semmi.
Egy kis probléma, hogy minden bekapcsolás után fel dob egy ablakot, amiben Rayman Registration-hoz Társitást keres...
Volt, de már nincs Rayman nevű program a gépen...

Egyébként ezt a CCleaner-es tisztítást időszakosan megcsinálhatom a géppel máskor is (most már értem, hogy kell, míg üres nem lesz...)?

A ComboFix-et miért kellett uninstallálni? Leszedjem a másik gépről is, amit pénteken tisztítottál?

Nagyon hálás vagyok a segítségedért!!!
A harmadik lurkó gépéről holnap délután elküldhetem a combofix log-ot, megnéznéd azt is?

Jó éjt, kösz mindent!

nem latok semi veszejeset ami volt a combofix kitorolte
szed le a geprol a combofixet start-futatas beirod combofix /uninstall ok
fut neked egy csomo felesleges dolog a startupba,,
tolds le ezt a programot-futasd a program kiirlya a feleslegesen futo programokat-tegy pipat es klik disabled es klik continue>.restart
http://www.malwarebytes.org/StartUpLite.exe

pucold ki a gepet CCleaneral
es ird le mia helyzet

Thx

majd este megnezem
udv

Szia Stell!

Tegnap családi proram volt, azért nem tudtam jelentkezni. Vasárnap is gyógyitasz gépeket? Ez a legrégebbi gép a házban, még az első fiam kapta 6 őáűéves szülinapjűra. Elég lassú volt a programok futása és az internet is rajta. Leszedtem erről is az AVG-t és lefuttatam a ComboFix-et...

Üdv,
Ime a log:


ComboFix 09-11-07.02 - Rendszergazda 009.11.08. 11:35.1.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1250.36.1038.18.511.202 [GMT 1:00]
Running from: c:\documents and settings\Rendszergazda.KOVACS-CSALAD\Asztal\ComboFix.exe
AV: avast! antivirus 4.8.1356 [VPS 091107-1] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
c:\program files\Microsoft Security Adviser
c:\recycler\NPROTECT
c:\recycler\S-1-5-21-343818398-861567501-725345543-1003
c:\recycler\S-1-5-21-343818398-861567501-725345543-1004
C:\setup.exe

.
((((((((((((((((((((((((( Files Created from 2009-10-08 to 2009-11-08 )))))))))))))))))))))))))))))))
.

2009-10-28 17:43 . 2009-11-02 15:17 -------- d-----w- C:\hegames
2009-10-09 19:00 . 2009-10-09 19:00 -------- d-----w- C:\GYEREKDALOK_ES_MONDOKAK
2009-10-09 17:53 . 2009-10-09 17:54 -------- d-----w- c:\documents and settings\All Users\Ovis dalok

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-07 10:52 . 2009-05-08 22:33 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\avg8
2009-11-04 23:25 . 2008-04-05 21:20 -------- d-----w- c:\documents and settings\Rendszergazda.KOVACS-CSALAD\Application Data\uTorrent
2009-11-04 23:12 . 2008-04-19 18:18 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft Help
2009-11-04 23:07 . 2008-04-19 18:27 -------- d-----w- c:\program files\Microsoft Works
2009-11-04 22:45 . 2007-11-03 15:20 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-10-28 07:55 . 2007-11-02 08:50 95276 ----a-w- c:\windows\system32\perfc00E.dat
2009-10-28 07:55 . 2007-11-02 08:50 439394 ----a-w- c:\windows\system32\perfh00E.dat
2009-09-15 11:59 . 2007-11-03 13:13 1279968 ----a-w- c:\windows\system32\aswBoot.exe
2009-09-15 11:56 . 2007-11-03 13:13 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-09-15 11:56 . 2007-11-03 13:13 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-09-15 11:55 . 2008-03-30 20:10 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-09-15 11:55 . 2008-03-30 20:10 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-09-15 11:54 . 2007-11-03 13:13 52368 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-09-15 11:54 . 2007-11-03 13:13 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-09-15 11:53 . 2007-11-03 13:13 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-09-15 11:53 . 2007-11-03 13:13 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-09-11 14:19 . 2007-11-02 08:48 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:05 . 2007-11-02 08:48 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 07:59 . 2007-11-02 08:49 916480 ----a-w- c:\windows\system32\wininet.dll
2009-08-27 20:33 . 2009-08-27 20:33 52809 ----a-w- c:\windows\UN_CODA.EXE
2009-08-27 20:17 . 2007-11-02 10:56 77664 -c--a-w- c:\documents and settings\Rendszergazda.KOVACS-CSALAD\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-26 08:02 . 2007-11-02 08:49 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-17 21:33 . 2009-08-17 21:33 1193832 ----a-w- c:\windows\system32\FM20.DLL
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2007-12-13 1688872]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-01-03 486856]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-14 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 208952]
"PHIME2002ASync"="c:\windows\System32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"PHIME2002A"="c:\windows\System32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-09-15 81000]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 63712]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-12-03 2213160]
"SNPSTD2"="c:\windows\vsnpstd2.exe" [2004-08-30 286720]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-05-27 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\soundman.exe [2007-04-16 577536]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Rendszergazda.KOVACS-CSALAD\Start Menu\Programs\Indˇt˘pult\
Registration RAYMAN [2009-11-1 0]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\Nero\\Nero8\\Nero Home\\NeroHome.exe"=
"c:\\Program Files\\Common Files\\Nero\\Nero Web\\SetupX.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"35220:TCP"= 35220:TCP:.

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008.03.30. 21:10 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008.03.30. 21:10 20560]
S3 netr73;D-Link DWA-111 Wireless G USB Adapter Driver;c:\windows\system32\drivers\netr73.sys [2008.10.28. 18:51 256000]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - MBR
*NewlyCreated* - PROCEXP113
*Deregistered* - mbr
*Deregistered* - PROCEXP113
.
Contents of the 'Scheduled Tasks' folder

2009-09-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 15:57]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.hirkereso.hu/
IE: E&xportálás a Microsoft Excel programba - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
FF - ProfilePath - c:\documents and settings\Rendszergazda.KOVACS-CSALAD\Application Data\Mozilla\Firefox\Profiles\o8wkr87a.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Yahoo! Search
FF - prefs.js: browser.startup.homepage -
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

AddRemove-Adobe Flash Player Plugin - c:\windows\system32\Macromed\Flash\uninstall_plugin.exe
AddRemove-{2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\Google\Google Toolbar\Component\GoogleToolbarManager_9DE96A29E721D90A.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-08 11:51
Windows 5.1.2600 Szervizcsomag 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys spyb.sys >>UNKNOWN [0x82391944]<<
kernel: MBR read successfully
user & kernel MBR OK
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

atapi.sys @ 0x0 0x0 bytes

\Driver\atapi [ IRP_MJ_CREATE ] 0xA6F2 != 0xF836BB40 atapi.sys
\Driver\atapi [ IRP_MJ_CLOSE ] 0xA6F2 != 0xF836BB40 atapi.sys
\Driver\atapi [ IRP_MJ_DEVICE_CONTROL ] 0xA712 != 0xF836BB40 atapi.sys
\Driver\atapi [ IRP_MJ_INTERNAL_DEVICE_CONTROL ] 0x6852 != 0xF836BB40 atapi.sys
\Driver\atapi [ IRP_MJ_POWER ] 0xA73C != 0xF836BB40 atapi.sys
\Driver\atapi [ IRP_MJ_SYSTEM_CONTROL ] 0x11336 != 0xF836BB40 atapi.sys
\Driver\atapi IRP hooks detected !

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-583907252-329068152-682003330-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,7a,c4,a3,43,03,00,d4,4e,9a,f8,fe,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,7a,c4,a3,43,03,00,d4,4e,9a,f8,fe,\
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,bb,b0,b1,81,4e,e4,70,40,8a,d3,13,\
.
Completion time: 2009-11-08 11:59
ComboFix-quarantined-files.txt 2009-11-08 10:58

Pre-Run: 21 827 567 616 bájt szabad
Post-Run: 25 342 730 240 bájt szabad

- - End Of File - - 8E1FBC502591C4A6E418E5F9786D05E8

Hat igen,,de tudom hogy eleg nehez megfelyteni amit irok,,de egy kis fantaziaval megyen,,ha megcsinaltad aztat is a fix.reg el akor enyi az egesz,]
udv

Hát nem tudom, hogy akkor ezzel végeztünk-e,
DE KÖSZNÖM neked a segítséget, nekem fantasztikus élmény volt (neked gondolom nem annyira)!!!
Sok új dolgot láttam, ahogy végig vezettél... Továbbra se lettem egy informatikai zseni, de azt látom, hogy a C könyvtárban több mint 40 GB szabad hellyel gazdagabb lettem, és ez a log? Hát mit mondjak... THX
Két kérdés még:
Végül is az volt a cél, hogy az avast megfogja ezt a Win32:Trojan-gen féreg vírust? Tehát most minden OK?
Holnap lehet szó, hogy a hálózaton lévő másik két saját gépről is beszéljünk?

Bye

Itt vagymég Stell?
Ime a log:

Malwarebytes' Anti-Malware 1.41
Adatbázis verzió: 3112
Windows 5.1.2600 Szervizcsomag 3

2009.11.06. 22:48:15
mbam-log-2009-11-06 (22-48-15).txt

Vizsgálat típusa: Teljes vizsgálat (C:\|D:\|E:\|)
Átvizsgált objektumok: 333691
Eltelt idő: 52 minute(s), 23 second(s)

Fertőzött memóriafolyamatok: 0
Fertőzött memória modulok: 0
Fertőzött rendszerleíró kulcsok: 0
Fertőzött rendszerleíró értékek: 0
Fertőzött rednszerleíró elemek: 0
Fertőzött mappák: 0
Fertőzött fájlok: 0

Fertőzött memóriafolyamatok:
(Nem észleltem rosszindulatú elemeket)

Fertőzött memória modulok:
(Nem észleltem rosszindulatú elemeket)

Fertőzött rendszerleíró kulcsok:
(Nem észleltem rosszindulatú elemeket)

Fertőzött rendszerleíró értékek:
(Nem észleltem rosszindulatú elemeket)

Fertőzött rednszerleíró elemek:
(Nem észleltem rosszindulatú elemeket)

Fertőzött mappák:
(Nem észleltem rosszindulatú elemeket)

Fertőzött fájlok:
(Nem észleltem rosszindulatú elemeket)

Scannalés közben avast figyelmeztetés
C:\System Volume Information\restore{......}
win32.féreg vírus
karanténba tettem...scannelés fut tovább (itt viszont fertőzött objektumok: 0 ), nem írja, caek az avast-nál a standard védelemnél.
Ha végez a scannelés küldöm a logot.

SORRY, mondtam, hogy nem lesz könnyű velem...
Te nagyon nagy vagy, értékelem a türelmedet, már fut a teljes scan, mindjárt ide teszem a logot.

azt irja hogy ved meg mert tobet nnemjavit,,

En nemirtam az Advanced Registry Optimizert,,hanema a MALWAREBYTES programot,,rogton ot van a link
Download Now (3.86MB)
Tehat evel a programal kel csinalnod komplet skant

Jaj... De nem akarok beledumálni.

Advanced Registry Optimizer, nem ezt kellet volna?

eztet nemertem mit futatal milyen programot,,??

Sorry, hogy ilyen sokáig voltam távol, de a notepados futtatást mégegyszer megcsináltam amíg nem jelentkeztél (mert láttam az Asztalon lévő CFSscript.txt file van)... ennek eredménye a C\Qooboxx\ComboFix4.txt, itt már úgy láttam törölte *.TMP fájlokat, aztán lehet, hogy türelmetlen voltam, DE nem történt semmi > Ctrl+Alt+Del > feladat nem futott > RESET

Aztán olvastam, amit legutoljára küldtél..... teljes scan meg van > talált 1359 hibát > klikk Fix all errors > 20-at javított 1359-hez buy and download??? Nyitva az ablak, most mit csináljak?
Hol a log, amit kérsz, a C\ARO-ban nincs *txt file ?
Segíts kérlek...

masold be a piros textet a notepadba
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

ted le az asztalra mint >>minden falylo>> a neve fix.reg
2x klik es futasd-restart,,
letolteni a malwarebytes programot >>futatni_frisiteni>.es csinalni tellyes skant
a loglyat ide tenni
http://www.download.com/Malwarebytes-An ... tag=button

Megcsináltam a CFScript.txt fájl, kinnt van az Asztalon és ráhúztam a ComboFix-re. Lefutott a scannalés, ime (ugye jól csináltam?... el kell mondanom mennyire tisztelem a türelmedet, hogy bírod még egy ilyen biginnerrel mint én):

ComboFix 09-11-05.05 - hello 009.11.06. 19:10.3.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1250.36.1038.18.2047.1341 [GMT 1:00]
Running from: c:\documents and settings\hello\Asztal\ComboFix.exe
AV: avast! antivirus 4.8.1356 [VPS 091106-1] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2009-10-06 to 2009-11-06 )))))))))))))))))))))))))))))))
.

2009-11-06 17:01 . 2009-11-06 17:01 -------- d-----w- c:\program files\CCleaner
2009-11-05 20:01 . 2009-10-21 15:49 2064152 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcorex.dll
2009-11-04 17:11 . 2009-10-17 06:44 2025752 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgtray.exe
2009-11-04 17:06 . 2009-11-04 17:06 -------- d-----w- c:\windows\system32\wbem\Repository
2009-11-04 17:06 . 2009-11-04 17:06 -------- d-----w- c:\program files\Alien Shooter
2009-11-04 17:06 . 2009-11-04 17:06 -------- d-----w- C:\BDS
2009-11-02 00:20 . 2009-11-02 00:20 -------- d-----w- c:\documents and settings\hello\Local Settings\Application Data\Aspyr
2009-10-29 22:54 . 2009-10-29 22:54 -------- d-----w- c:\program files\DIFX
2009-10-27 01:33 . 2009-09-15 11:54 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-10-27 01:33 . 2009-09-15 11:54 52368 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-10-27 01:33 . 2009-09-15 11:53 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-10-27 01:33 . 2009-09-15 11:56 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-10-27 01:33 . 2009-09-15 11:56 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-10-27 01:33 . 2009-09-15 11:55 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-10-27 01:33 . 2009-09-15 11:55 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-10-27 01:33 . 2009-09-15 11:53 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-10-27 01:33 . 2009-09-15 11:59 1279968 ----a-w- c:\windows\system32\aswBoot.exe
2009-10-27 01:33 . 2003-03-18 21:20 1060864 ----a-w- c:\windows\system32\MFC71.dll
2009-10-27 01:33 . 2003-03-18 20:14 499712 ----a-w- c:\windows\system32\MSVCP71.dll
2009-10-27 01:33 . 2009-10-27 01:33 -------- d-----w- c:\program files\Alwil Software
2009-10-17 07:50 . 2009-10-17 07:50 22328 ----a-w- c:\documents and settings\hello\Application Data\PnkBstrK.sys
2009-10-17 07:50 . 2009-10-17 07:50 669184 ----a-w- c:\windows\system32\pbsvc.exe
2009-10-10 09:46 . 2009-10-17 16:50 -------- d-----w- c:\documents and settings\hello\Local Settings\Application Data\Lucasarts
2009-10-10 00:33 . 2009-10-10 11:49 -------- d-----w- c:\documents and settings\All Users\Application Data\SWTCWRH
2009-10-10 00:31 . 2009-10-10 00:31 -------- d-----w- c:\windows\11AE680750D24F5982B32C3E695E94C2.TMP

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-06 17:28 . 2009-09-24 15:37 -------- d-----w- c:\documents and settings\hello\Application Data\Skype
2009-11-06 17:25 . 2009-02-06 18:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-11-06 16:25 . 2009-01-10 17:52 -------- d-----w- c:\documents and settings\hello\Application Data\uTorrent
2009-11-06 16:24 . 2009-02-06 20:24 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-11-06 15:47 . 2009-09-24 15:43 -------- d-----w- c:\documents and settings\hello\Application Data\skypePM
2009-11-04 17:33 . 2008-12-16 21:16 196608 ----a-w- c:\windows\system32\drivers\nStandard.bin
2009-11-02 17:04 . 2008-12-17 17:56 14576 ----a-w- c:\documents and settings\hello\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-01 22:57 . 2008-12-15 21:39 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-11-01 10:12 . 2009-02-25 22:30 444952 ----a-w- c:\windows\system32\wrap_oal.dll
2009-11-01 10:12 . 2009-02-25 22:30 109080 ----a-w- c:\windows\system32\OpenAL32.dll
2009-10-19 06:11 . 2008-04-15 12:00 130686 ----a-w- c:\windows\system32\perfc00E.dat
2009-10-19 06:11 . 2008-04-15 12:00 124000 ----a-w- c:\windows\system32\perfh00E.dat
2009-10-19 00:05 . 2008-12-16 21:45 -------- d-----w- c:\program files\Common Files\Adobe
2009-10-17 21:59 . 2008-12-26 18:08 -------- d-----w- c:\program files\Electronic Arts
2009-10-17 07:50 . 2009-01-27 15:32 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-10-17 07:50 . 2009-01-27 15:32 103736 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-10-17 07:50 . 2009-01-27 15:32 66872 ----a-w- c:\windows\system32\PnkBstrA.exe
2009-10-10 00:31 . 2009-06-01 08:29 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-10-06 04:52 . 2009-10-06 04:52 -------- d-----w- c:\program files\FIFA 10
2009-10-03 23:52 . 2009-02-06 18:39 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-10-01 08:26 . 2009-10-06 05:05 342599 ----a-w- c:\windows\fifa10_uninstall.exe
2009-09-29 12:14 . 2009-09-28 19:26 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-28 19:26 . 2009-09-28 19:23 -------- d-----w- c:\program files\Windows Live
2009-09-28 19:25 . 2009-09-28 19:25 -------- d-----w- c:\program files\Microsoft Sync Framework
2009-09-28 19:24 . 2009-09-28 19:24 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2009-09-28 19:23 . 2009-09-28 19:23 -------- d-----w- c:\program files\Microsoft
2009-09-28 19:23 . 2009-09-28 19:23 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-09-28 19:17 . 2009-09-28 19:17 -------- d-----w- c:\program files\Common Files\Windows Live
2009-09-24 15:43 . 2009-09-24 15:43 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-09-24 15:38 . 2009-01-16 14:03 -------- d-----w- c:\program files\Google
2009-09-24 15:37 . 2009-09-24 15:36 -------- d-----r- c:\program files\Skype
2009-09-24 15:36 . 2009-09-24 15:36 -------- d-----w- c:\program files\Common Files\Skype
2009-09-24 15:36 . 2009-09-24 15:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2009-09-21 18:04 . 2009-09-21 18:03 -------- d-----w- c:\program files\3DO
2009-09-21 18:04 . 2009-09-21 18:03 -------- d-----w- c:\program files\Common Files\3DO Shared
2009-09-19 21:53 . 2009-08-19 20:09 -------- d-----w- c:\program files\AGEIA Technologies
2009-09-19 20:06 . 2009-09-19 20:06 -------- d-----w- c:\program files\Common Files\DirectX
2009-09-11 14:19 . 2008-04-15 12:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:05 . 2008-04-15 12:00 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 07:59 . 2008-04-15 12:00 916480 ------w- c:\windows\system32\wininet.dll
2009-08-26 08:02 . 2008-04-15 12:00 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-14 11:36 . 2009-08-14 11:36 70936 ----a-w- c:\windows\system32\PhysXLoader.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-11-04_18.45.30 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-11-06 16:26 . 2009-11-06 16:26 16384 c:\windows\Temp\Perflib_Perfdata_758.dat
+ 2009-11-06 16:26 . 2009-11-06 16:26 16384 c:\windows\Temp\Perflib_Perfdata_654.dat
+ 2009-11-06 16:26 . 2009-11-06 16:26 16384 c:\windows\Temp\Perflib_Perfdata_280.dat
+ 2008-12-16 20:35 . 2009-08-06 18:24 44768 c:\windows\system32\wups2.dll
+ 2008-12-15 21:10 . 2009-08-06 18:24 35552 c:\windows\system32\wups.dll
+ 2008-12-15 21:10 . 2009-08-06 18:24 53472 c:\windows\system32\wuauclt.exe
+ 2009-11-04 19:24 . 2009-08-06 18:24 44768 c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll\7.4.7600.226\wups2.dll
+ 2009-11-04 19:24 . 2009-08-06 18:24 35552 c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.4.7600.226\wups.dll
+ 2008-12-15 21:10 . 2009-08-06 18:24 35552 c:\windows\system32\dllcache\wups.dll
+ 2008-12-15 21:10 . 2009-08-06 18:24 53472 c:\windows\system32\dllcache\wuauclt.exe
+ 2008-04-15 12:00 . 2009-08-06 18:24 96480 c:\windows\system32\dllcache\cdm.dll
+ 2008-04-15 12:00 . 2009-08-06 18:24 96480 c:\windows\system32\cdm.dll
+ 2008-12-15 21:10 . 2009-08-06 18:24 209632 c:\windows\system32\wuweb.dll
+ 2008-12-15 21:10 . 2009-08-06 18:24 327896 c:\windows\system32\wucltui.dll
+ 2008-12-15 21:10 . 2009-08-06 18:23 575704 c:\windows\system32\wuapi.dll
+ 2009-11-04 19:24 . 2009-08-06 18:23 575704 c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wuapi.dll\7.4.7600.226\wuapi.dll
+ 2008-10-16 13:07 . 2009-08-06 18:23 215920 c:\windows\system32\muweb.dll
+ 2008-12-17 17:12 . 2009-08-06 18:23 274288 c:\windows\system32\mucltui.dll
+ 2009-11-03 17:24 . 2009-11-06 16:30 224631 c:\windows\system32\inetsrv\MetaBase.bin
+ 2008-12-15 21:10 . 2009-08-06 18:24 209632 c:\windows\system32\dllcache\wuweb.dll
+ 2008-12-15 21:10 . 2009-08-06 18:24 327896 c:\windows\system32\dllcache\wucltui.dll
+ 2008-12-15 21:10 . 2009-08-06 18:23 575704 c:\windows\system32\dllcache\wuapi.dll
+ 2009-11-04 19:26 . 2008-07-08 13:05 398200 c:\windows\ie8updates\KB976749-IE8\spuninst\updspapi.dll
+ 2009-11-04 19:26 . 2008-07-08 13:05 233848 c:\windows\ie8updates\KB976749-IE8\spuninst\spuninst.exe
+ 2008-12-15 21:10 . 2009-08-06 18:23 1929952 c:\windows\system32\wuaueng.dll
+ 2008-04-15 12:00 . 2009-10-22 09:18 5939712 c:\windows\system32\mshtml.dll
+ 2008-12-15 21:10 . 2009-08-06 18:23 1929952 c:\windows\system32\dllcache\wuaueng.dll
+ 2008-04-15 12:00 . 2009-10-22 09:18 5939712 c:\windows\system32\dllcache\mshtml.dll
+ 2009-11-04 19:26 . 2009-08-29 07:59 5940224 c:\windows\ie8updates\KB976749-IE8\mshtml.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM"="c:\documents and settings\All Users\Application Data\Macrovision\FLEXnet Connect\6\isuspm.exe" [2007-03-29 222128]
"ASUS SmartDoctor"="c:\program files\ASUS\SmartDoctor\SmartDoctor.exe" [2008-03-25 1130496]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-02-26 2289664]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-18 39408]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856]
"Jet Screenshot"="c:\program files\Jet Screenshot\jetScreenshot.exe" [2009-05-10 3804160]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-09-02 25623336]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Six Engine"="c:\program files\ASUS\Six Engine\SixEngine.exe" [2008-07-04 5968384]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]
"36X Raid Configurer"="c:\windows\system32\xRaidSetup.exe" [2007-11-19 1970176]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-04-11 13524992]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-04-11 86016]
"ASUSGamerOSD"="c:\program files\ASUS\GamerOSD\GamerOSD.exe" [2008-03-25 380928]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-08-03 36352]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2008-11-02 167936]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-09-15 81000]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2008-06-13 16871936]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-04-11 1630208]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-15 15360]

c:\documents and settings\hello\Start Menu\Programs\Indˇt˘pult\
MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2009-1-18 575488]
Registration Ghost Recon Advanced WarfighterR 2.LNK - d:\games\Ubisoft\Ghost Recon Advanced Warfighter 2\Support\Register\RegistrationReminder.exe [2009-10-30 874000]
Registration Heroes of Might & Magic 5 - Hammers of Fate.LNK - d:\games\Ubisoft\Heroes of Might and Magic V\registrationa1\RegistrationReminder.exe [2009-9-28 868352]
Registration Heroes of Might & Magic 5 - Tribes of the East.LNK - d:\games\Ubisoft\Heroes of Might and Magic V\Tribes of the East\Heroes of Might and Magic V - Tribes of the East\registration\RegistrationReminder.exe [2009-10-1 868352]
Registration Heroes of Might & Magic 5.LNK - d:\games\Ubisoft\Heroes of Might and Magic V\registration\RegistrationReminder.exe [2009-9-28 868352]

c:\documents and settings\All Users\Start Menu\Programs\Indˇt˘pult\
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, digest32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\TmNationsForever\\TmForever.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\AgeOfEmpiresII\\empires2.exe"=
"c:\\Program Files\\VALVe\\Counter-Strike Source\\hl2.exe"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaWmp.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaW.exe"=
"c:\\Call of Duty 2\\CoD2MP_s.exe"=
"c:\\Program Files\\CAPCOM\\LOSTPLANETCOLONIES\\LostPlanetColoniesDX9.exe"=
"c:\\Program Files\\CAPCOM\\LOSTPLANETCOLONIES\\LostPlanetColoniesDX10.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Codemasters\\GRID\\GRID.exe"=
"d:\\GAMES\\Valve\\Condition Zero\\czero.exe"=
"d:\\GAMES\\Ubisoft\\Techland\\Call of Juarez - Bound in Blood\\CoJBiBGame_x86.exe"=
"c:\\WINDOWS\\system32\\wbem\\wmiprvse.exe"=
"c:\\WINDOWS\\system32\\nvsvc32.exe"=
"c:\\WINDOWS\\system32\\svchost.exe"=
"d:\\GAMES\\TimeGate Studios\\section 8\\Binaries\\S8Game-F.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"d:\\GAMES\\LucasArts\\Republic Heroes\\Republic Heroes.exe"=
"d:\\GAMES\\Codemasters\\OF Dragon Rising\\OFDR.exe"=
"d:\\GAMES\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"d:\\GAMES\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"d:\\GAMES\\2K Games\\Gearbox Software\\Borderlands\\Binaries\\Borderlands.exe"=
"d:\\GAMES\\Ubisoft\\Ghost Recon Advanced Warfighter 2\\graw2.exe"=
"d:\\GAMES\\Ubisoft\\Ghost Recon Advanced Warfighter 2\\graw2_dedicated.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"3587:TCP"= 3587:TCP:Windows társ-társ csoportosítás
"3540:UDP"= 3540:UDP:Peer Name Resolution Protocol (PNRP)
"4719:TCP"= 4719:TCP:4719

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009.10.27. 2:33 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009.10.27. 2:33 20560]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2009.09.28. 20:26 54752]
R3 L1e;Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1e51x86.sys [2008.12.15. 22:40 36864]
S2 gupdate1ca3d2ceec936e0;Google frissítési szolgáltatás (gupdate1ca3d2ceec936e0);c:\program files\Google\Update\GoogleUpdate.exe [2009.09.24. 16:37 133104]
S3 fsssvc;Windows Live Családbiztonság szolgáltatás;c:\program files\Windows Live\Family Safety\fsssvc.exe [2009.08.05. 21:48 704864]

--- Other Services/Drivers In Memory ---

*Deregistered* - mbr
*Deregistered* - PROCEXP113

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder

2009-10-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2009-11-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-24 15:37]

2009-11-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-24 15:37]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-06 19:14
Windows 5.1.2600 Szervizcsomag 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll sfsync02.sys atapi.sys sphe.sys >>UNKNOWN [0x89E03938]<<
kernel: MBR read successfully
user & kernel MBR OK
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

atapi.sys @ 0x0 0x0 bytes

\Driver\atapi [ IRP_MJ_CREATE ] 0xA6F2 != 0xBA5FCB40 atapi.sys
\Driver\atapi [ IRP_MJ_CLOSE ] 0xA6F2 != 0xBA5FCB40 atapi.sys
\Driver\atapi [ IRP_MJ_DEVICE_CONTROL ] 0xA712 != 0xBA5FCB40 atapi.sys
\Driver\atapi [ IRP_MJ_INTERNAL_DEVICE_CONTROL ] 0x6852 != 0xBA8E98B4 sfsync02.sys
\Driver\atapi [ IRP_MJ_POWER ] 0xA73C != 0xBA5FCB40 atapi.sys
\Driver\atapi [ IRP_MJ_SYSTEM_CONTROL ] 0x11336 != 0xBA5FCB40 atapi.sys
\Driver\atapi IRP hooks detected !

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1757981266-2000478354-682003330-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-1757981266-2000478354-682003330-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:af,d0,f5,a2,88,07,fb,7d,8d,3d,84,8e,a6,b6,fb,b0,95,ee,d5,b3,43,f9,f4,
17,dd,14,12,62,a5,f3,3a,3e,83,33,55,9e,7b,d6,f2,7e,1f,0d,04,87,9c,e4,80,ca,\
"??"=hex:2e,5f,b1,3a,8e,74,11,82,c5,eb,9b,58,27,56,e8,01

[HKEY_USERS\S-1-5-21-1757981266-2000478354-682003330-1003\Software\SecuROM\License information*]
"datasecu"=hex:ef,54,e1,8c,6f,bc,fb,d6,59,18,d3,77,c2,6f,ad,d6,70,9a,75,e8,da,
0a,c0,a4,4e,f6,dc,c6,21,74,e7,00,bb,f0,ad,a8,2a,e1,e5,f5,0e,7a,24,38,c8,75,\
"rkeysecu"=hex:9f,ca,16,75,83,0a,d6,fd,d2,a5,ab,cb,c1,0d,12,f7
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(5816)
c:\windows\system32\WININET.dll
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-11-06 19:15
ComboFix-quarantined-files.txt 2009-11-06 18:15
ComboFix2.txt 2009-11-06 17:37
ComboFix3.txt 2009-11-04 18:49

Pre-Run: 52 544 319 488 bájt szabad
Post-Run: 52 524 961 792 bájt szabad

- - End Of File - - 59FBD5CDCE977F8EFE45DC893678F050

na nem csinaltal CFS criptet csak futatad a combofixet
olvasd figyelmesen amit irok
Kinyitod a Notepadot>Start>futatas>beirod notepad
Es bemasolod a piros textet
KILLALL::
Folder::
c:\windows\11AE680750D24F5982B32C3E695E94C2.TMP
Registry::
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll,schannel.dll,digest.dll,msnsspc.dll"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000000
Mostan>a notepadon elso full-fajl>ballfelsosarokban>4-sor>lementenni mint....
A txt-hejetfajlnev beteszed eztett>CFScript.txt<alatta bealitod >minden fajl<
legfelull>asztall i<klik gomb letenni.Es mostan megcsinalod eztett:

A combofix maga elindul es lehet hogy restartol es befejezi a scent.Amit majd ad ted ide

Notepad>Start>Futtatás>beírom notepad és bemásolom az álltalad beillesztett KILLALL kezdetű piros text-tel mi legyen?

CCleaner-t futtattam - analizálás nélkül -, aztán ComboFix-t futtattam, végzett. Itt a a log txt.file, gondolom kéred... Eddig Ok minden?

ComboFix 09-11-05.05 - hello 009.11.06. 18:30.2.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1250.36.1038.18.2047.1376 [GMT 1:00]
Running from: c:\documents and settings\hello\Asztal\ComboFix.exe
AV: avast! antivirus 4.8.1356 [VPS 091106-1] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2009-10-06 to 2009-11-06 )))))))))))))))))))))))))))))))
.

2009-11-06 17:01 . 2009-11-06 17:01 -------- d-----w- c:\program files\CCleaner
2009-11-05 20:01 . 2009-10-21 15:49 2064152 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcorex.dll
2009-11-04 17:11 . 2009-10-17 06:44 2025752 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgtray.exe
2009-11-04 17:06 . 2009-11-04 17:06 -------- d-----w- c:\windows\system32\wbem\Repository
2009-11-04 17:06 . 2009-11-04 17:06 -------- d-----w- c:\program files\Alien Shooter
2009-11-04 17:06 . 2009-11-04 17:06 -------- d-----w- C:\BDS
2009-11-02 00:20 . 2009-11-02 00:20 -------- d-----w- c:\documents and settings\hello\Local Settings\Application Data\Aspyr
2009-10-29 22:54 . 2009-10-29 22:54 -------- d-----w- c:\program files\DIFX
2009-10-27 01:33 . 2009-09-15 11:54 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-10-27 01:33 . 2009-09-15 11:54 52368 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-10-27 01:33 . 2009-09-15 11:53 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-10-27 01:33 . 2009-09-15 11:56 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-10-27 01:33 . 2009-09-15 11:56 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-10-27 01:33 . 2009-09-15 11:55 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-10-27 01:33 . 2009-09-15 11:55 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-10-27 01:33 . 2009-09-15 11:53 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-10-27 01:33 . 2009-09-15 11:59 1279968 ----a-w- c:\windows\system32\aswBoot.exe
2009-10-27 01:33 . 2003-03-18 21:20 1060864 ----a-w- c:\windows\system32\MFC71.dll
2009-10-27 01:33 . 2003-03-18 20:14 499712 ----a-w- c:\windows\system32\MSVCP71.dll
2009-10-27 01:33 . 2009-10-27 01:33 -------- d-----w- c:\program files\Alwil Software
2009-10-17 07:50 . 2009-10-17 07:50 22328 ----a-w- c:\documents and settings\hello\Application Data\PnkBstrK.sys
2009-10-17 07:50 . 2009-10-17 07:50 669184 ----a-w- c:\windows\system32\pbsvc.exe
2009-10-10 09:46 . 2009-10-17 16:50 -------- d-----w- c:\documents and settings\hello\Local Settings\Application Data\Lucasarts
2009-10-10 00:33 . 2009-10-10 11:49 -------- d-----w- c:\documents and settings\All Users\Application Data\SWTCWRH
2009-10-10 00:31 . 2009-10-10 00:31 -------- d-----w- c:\windows\11AE680750D24F5982B32C3E695E94C2.TMP

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-06 17:28 . 2009-09-24 15:37 -------- d-----w- c:\documents and settings\hello\Application Data\Skype
2009-11-06 17:25 . 2009-02-06 18:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-11-06 16:25 . 2009-01-10 17:52 -------- d-----w- c:\documents and settings\hello\Application Data\uTorrent
2009-11-06 16:24 . 2009-02-06 20:24 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-11-06 15:47 . 2009-09-24 15:43 -------- d-----w- c:\documents and settings\hello\Application Data\skypePM
2009-11-04 17:33 . 2008-12-16 21:16 196608 ----a-w- c:\windows\system32\drivers\nStandard.bin
2009-11-02 17:04 . 2008-12-17 17:56 14576 ----a-w- c:\documents and settings\hello\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-01 22:57 . 2008-12-15 21:39 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-11-01 10:12 . 2009-02-25 22:30 444952 ----a-w- c:\windows\system32\wrap_oal.dll
2009-11-01 10:12 . 2009-02-25 22:30 109080 ----a-w- c:\windows\system32\OpenAL32.dll
2009-10-19 06:11 . 2008-04-15 12:00 130686 ----a-w- c:\windows\system32\perfc00E.dat
2009-10-19 06:11 . 2008-04-15 12:00 124000 ----a-w- c:\windows\system32\perfh00E.dat
2009-10-19 00:05 . 2008-12-16 21:45 -------- d-----w- c:\program files\Common Files\Adobe
2009-10-17 21:59 . 2008-12-26 18:08 -------- d-----w- c:\program files\Electronic Arts
2009-10-17 07:50 . 2009-01-27 15:32 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-10-17 07:50 . 2009-01-27 15:32 103736 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-10-17 07:50 . 2009-01-27 15:32 66872 ----a-w- c:\windows\system32\PnkBstrA.exe
2009-10-10 00:31 . 2009-06-01 08:29 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-10-06 04:52 . 2009-10-06 04:52 -------- d-----w- c:\program files\FIFA 10
2009-10-03 23:52 . 2009-02-06 18:39 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-10-01 08:26 . 2009-10-06 05:05 342599 ----a-w- c:\windows\fifa10_uninstall.exe
2009-09-29 12:14 . 2009-09-28 19:26 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-28 19:26 . 2009-09-28 19:23 -------- d-----w- c:\program files\Windows Live
2009-09-28 19:25 . 2009-09-28 19:25 -------- d-----w- c:\program files\Microsoft Sync Framework
2009-09-28 19:24 . 2009-09-28 19:24 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2009-09-28 19:23 . 2009-09-28 19:23 -------- d-----w- c:\program files\Microsoft
2009-09-28 19:23 . 2009-09-28 19:23 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-09-28 19:17 . 2009-09-28 19:17 -------- d-----w- c:\program files\Common Files\Windows Live
2009-09-24 15:43 . 2009-09-24 15:43 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-09-24 15:38 . 2009-01-16 14:03 -------- d-----w- c:\program files\Google
2009-09-24 15:37 . 2009-09-24 15:36 -------- d-----r- c:\program files\Skype
2009-09-24 15:36 . 2009-09-24 15:36 -------- d-----w- c:\program files\Common Files\Skype
2009-09-24 15:36 . 2009-09-24 15:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2009-09-21 18:04 . 2009-09-21 18:03 -------- d-----w- c:\program files\3DO
2009-09-21 18:04 . 2009-09-21 18:03 -------- d-----w- c:\program files\Common Files\3DO Shared
2009-09-19 21:53 . 2009-08-19 20:09 -------- d-----w- c:\program files\AGEIA Technologies
2009-09-19 20:06 . 2009-09-19 20:06 -------- d-----w- c:\program files\Common Files\DirectX
2009-09-11 14:19 . 2008-04-15 12:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:05 . 2008-04-15 12:00 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 07:59 . 2008-04-15 12:00 916480 ------w- c:\windows\system32\wininet.dll
2009-08-26 08:02 . 2008-04-15 12:00 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-14 11:36 . 2009-08-14 11:36 70936 ----a-w- c:\windows\system32\PhysXLoader.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-11-04_18.45.30 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-11-06 16:26 . 2009-11-06 16:26 16384 c:\windows\Temp\Perflib_Perfdata_758.dat
+ 2009-11-06 16:26 . 2009-11-06 16:26 16384 c:\windows\Temp\Perflib_Perfdata_654.dat
+ 2009-11-06 16:26 . 2009-11-06 16:26 16384 c:\windows\Temp\Perflib_Perfdata_280.dat
+ 2008-12-16 20:35 . 2009-08-06 18:24 44768 c:\windows\system32\wups2.dll
+ 2008-12-15 21:10 . 2009-08-06 18:24 35552 c:\windows\system32\wups.dll
+ 2008-12-15 21:10 . 2009-08-06 18:24 53472 c:\windows\system32\wuauclt.exe
+ 2009-11-04 19:24 . 2009-08-06 18:24 44768 c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll\7.4.7600.226\wups2.dll
+ 2009-11-04 19:24 . 2009-08-06 18:24 35552 c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.4.7600.226\wups.dll
+ 2008-12-15 21:10 . 2009-08-06 18:24 35552 c:\windows\system32\dllcache\wups.dll
+ 2008-12-15 21:10 . 2009-08-06 18:24 53472 c:\windows\system32\dllcache\wuauclt.exe
+ 2008-04-15 12:00 . 2009-08-06 18:24 96480 c:\windows\system32\dllcache\cdm.dll
+ 2008-04-15 12:00 . 2009-08-06 18:24 96480 c:\windows\system32\cdm.dll
+ 2008-12-15 21:10 . 2009-08-06 18:24 209632 c:\windows\system32\wuweb.dll
+ 2008-12-15 21:10 . 2009-08-06 18:24 327896 c:\windows\system32\wucltui.dll
+ 2008-12-15 21:10 . 2009-08-06 18:23 575704 c:\windows\system32\wuapi.dll
+ 2009-11-04 19:24 . 2009-08-06 18:23 575704 c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wuapi.dll\7.4.7600.226\wuapi.dll
+ 2008-10-16 13:07 . 2009-08-06 18:23 215920 c:\windows\system32\muweb.dll
+ 2008-12-17 17:12 . 2009-08-06 18:23 274288 c:\windows\system32\mucltui.dll
+ 2009-11-03 17:24 . 2009-11-06 16:30 224631 c:\windows\system32\inetsrv\MetaBase.bin
+ 2008-12-15 21:10 . 2009-08-06 18:24 209632 c:\windows\system32\dllcache\wuweb.dll
+ 2008-12-15 21:10 . 2009-08-06 18:24 327896 c:\windows\system32\dllcache\wucltui.dll
+ 2008-12-15 21:10 . 2009-08-06 18:23 575704 c:\windows\system32\dllcache\wuapi.dll
+ 2009-11-04 19:26 . 2008-07-08 13:05 398200 c:\windows\ie8updates\KB976749-IE8\spuninst\updspapi.dll
+ 2009-11-04 19:26 . 2008-07-08 13:05 233848 c:\windows\ie8updates\KB976749-IE8\spuninst\spuninst.exe
+ 2008-12-15 21:10 . 2009-08-06 18:23 1929952 c:\windows\system32\wuaueng.dll
+ 2008-04-15 12:00 . 2009-10-22 09:18 5939712 c:\windows\system32\mshtml.dll
+ 2008-12-15 21:10 . 2009-08-06 18:23 1929952 c:\windows\system32\dllcache\wuaueng.dll
+ 2008-04-15 12:00 . 2009-10-22 09:18 5939712 c:\windows\system32\dllcache\mshtml.dll
+ 2009-11-04 19:26 . 2009-08-29 07:59 5940224 c:\windows\ie8updates\KB976749-IE8\mshtml.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM"="c:\documents and settings\All Users\Application Data\Macrovision\FLEXnet Connect\6\isuspm.exe" [2007-03-29 222128]
"ASUS SmartDoctor"="c:\program files\ASUS\SmartDoctor\SmartDoctor.exe" [2008-03-25 1130496]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-02-26 2289664]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-18 39408]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856]
"Jet Screenshot"="c:\program files\Jet Screenshot\jetScreenshot.exe" [2009-05-10 3804160]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-09-02 25623336]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-15 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Six Engine"="c:\program files\ASUS\Six Engine\SixEngine.exe" [2008-07-04 5968384]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]
"36X Raid Configurer"="c:\windows\system32\xRaidSetup.exe" [2007-11-19 1970176]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-04-11 13524992]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-04-11 86016]
"ASUSGamerOSD"="c:\program files\ASUS\GamerOSD\GamerOSD.exe" [2008-03-25 380928]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-08-03 36352]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2008-11-02 167936]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-09-15 81000]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2008-06-13 16871936]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-04-11 1630208]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-15 15360]

c:\documents and settings\hello\Start Menu\Programs\Indˇt˘pult\
MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2009-1-18 575488]
Registration Ghost Recon Advanced WarfighterR 2.LNK - d:\games\Ubisoft\Ghost Recon Advanced Warfighter 2\Support\Register\RegistrationReminder.exe [2009-10-30 874000]
Registration Heroes of Might & Magic 5 - Hammers of Fate.LNK - d:\games\Ubisoft\Heroes of Might and Magic V\registrationa1\RegistrationReminder.exe [2009-9-28 868352]
Registration Heroes of Might & Magic 5 - Tribes of the East.LNK - d:\games\Ubisoft\Heroes of Might and Magic V\Tribes of the East\Heroes of Might and Magic V - Tribes of the East\registration\RegistrationReminder.exe [2009-10-1 868352]
Registration Heroes of Might & Magic 5.LNK - d:\games\Ubisoft\Heroes of Might and Magic V\registration\RegistrationReminder.exe [2009-9-28 868352]

c:\documents and settings\All Users\Start Menu\Programs\Indˇt˘pult\
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, digest32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\TmNationsForever\\TmForever.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\AgeOfEmpiresII\\empires2.exe"=
"c:\\Program Files\\VALVe\\Counter-Strike Source\\hl2.exe"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaWmp.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaW.exe"=
"c:\\Call of Duty 2\\CoD2MP_s.exe"=
"c:\\Program Files\\CAPCOM\\LOSTPLANETCOLONIES\\LostPlanetColoniesDX9.exe"=
"c:\\Program Files\\CAPCOM\\LOSTPLANETCOLONIES\\LostPlanetColoniesDX10.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Codemasters\\GRID\\GRID.exe"=
"d:\\GAMES\\Valve\\Condition Zero\\czero.exe"=
"d:\\GAMES\\Ubisoft\\Techland\\Call of Juarez - Bound in Blood\\CoJBiBGame_x86.exe"=
"c:\\WINDOWS\\system32\\wbem\\wmiprvse.exe"=
"c:\\WINDOWS\\system32\\nvsvc32.exe"=
"c:\\WINDOWS\\system32\\svchost.exe"=
"d:\\GAMES\\TimeGate Studios\\section 8\\Binaries\\S8Game-F.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"d:\\GAMES\\LucasArts\\Republic Heroes\\Republic Heroes.exe"=
"d:\\GAMES\\Codemasters\\OF Dragon Rising\\OFDR.exe"=
"d:\\GAMES\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"d:\\GAMES\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"d:\\GAMES\\2K Games\\Gearbox Software\\Borderlands\\Binaries\\Borderlands.exe"=
"d:\\GAMES\\Ubisoft\\Ghost Recon Advanced Warfighter 2\\graw2.exe"=
"d:\\GAMES\\Ubisoft\\Ghost Recon Advanced Warfighter 2\\graw2_dedicated.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"3587:TCP"= 3587:TCP:Windows társ-társ csoportosítás
"3540:UDP"= 3540:UDP:Peer Name Resolution Protocol (PNRP)
"4719:TCP"= 4719:TCP:4719

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009.10.27. 2:33 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009.10.27. 2:33 20560]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2009.09.28. 20:26 54752]
R3 L1e;Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1e51x86.sys [2008.12.15. 22:40 36864]
S2 gupdate1ca3d2ceec936e0;Google frissítési szolgáltatás (gupdate1ca3d2ceec936e0);c:\program files\Google\Update\GoogleUpdate.exe [2009.09.24. 16:37 133104]
S3 fsssvc;Windows Live Családbiztonság szolgáltatás;c:\program files\Windows Live\Family Safety\fsssvc.exe [2009.08.05. 21:48 704864]

--- Other Services/Drivers In Memory ---

*Deregistered* - mbr
*Deregistered* - PROCEXP113

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder

2009-10-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2009-11-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-24 15:37]

2009-11-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-24 15:37]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-06 18:35
Windows 5.1.2600 Szervizcsomag 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll sfsync02.sys atapi.sys sphe.sys >>UNKNOWN [0x89E03938]<<
kernel: MBR read successfully
user & kernel MBR OK
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

atapi.sys @ 0x0 0x0 bytes

\Driver\atapi [ IRP_MJ_CREATE ] 0xA6F2 != 0xBA5FCB40 atapi.sys
\Driver\atapi [ IRP_MJ_CLOSE ] 0xA6F2 != 0xBA5FCB40 atapi.sys
\Driver\atapi [ IRP_MJ_DEVICE_CONTROL ] 0xA712 != 0xBA5FCB40 atapi.sys
\Driver\atapi [ IRP_MJ_INTERNAL_DEVICE_CONTROL ] 0x6852 != 0xBA8E98B4 sfsync02.sys
\Driver\atapi [ IRP_MJ_POWER ] 0xA73C != 0xBA5FCB40 atapi.sys
\Driver\atapi [ IRP_MJ_SYSTEM_CONTROL ] 0x11336 != 0xBA5FCB40 atapi.sys
\Driver\atapi IRP hooks detected !

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1757981266-2000478354-682003330-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-1757981266-2000478354-682003330-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:af,d0,f5,a2,88,07,fb,7d,8d,3d,84,8e,a6,b6,fb,b0,95,ee,d5,b3,43,f9,f4,
17,dd,14,12,62,a5,f3,3a,3e,83,33,55,9e,7b,d6,f2,7e,1f,0d,04,87,9c,e4,80,ca,\
"??"=hex:2e,5f,b1,3a,8e,74,11,82,c5,eb,9b,58,27,56,e8,01

[HKEY_USERS\S-1-5-21-1757981266-2000478354-682003330-1003\Software\SecuROM\License information*]
"datasecu"=hex:ef,54,e1,8c,6f,bc,fb,d6,59,18,d3,77,c2,6f,ad,d6,70,9a,75,e8,da,
0a,c0,a4,4e,f6,dc,c6,21,74,e7,00,bb,f0,ad,a8,2a,e1,e5,f5,0e,7a,24,38,c8,75,\
"rkeysecu"=hex:9f,ca,16,75,83,0a,d6,fd,d2,a5,ab,cb,c1,0d,12,f7
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(4696)
c:\windows\system32\WININET.dll
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-11-06 18:37
ComboFix-quarantined-files.txt 2009-11-06 17:37
ComboFix2.txt 2009-11-04 18:49

Pre-Run: 52 571 471 872 bájt szabad
Post-Run: 52 527 468 544 bájt szabad

- - End Of File - - 5E120906B404506B19F07503369ED05B

Haladónál ..Nembantani semmit,
a leglyob ha igy csinalod,,telepitsd fell a CCleanert-job klik a szemet kupara es klik-FUTATNI A CCLEANERT job oldalon lent az oranal meglyelenik a CCleaner ikonja ahogy tisztit,mikor bevegzi futasd a combofixet,

Tudom kicsit lassú vagyok:

AVG-t leszedtem, ComboFix az aztalon, CCleanert futtatom, DE ugye mindent kipipálni (Internet Explorer - Űrlap kitöltési előzmény, és aHaladónál is minden, csak mert feldob figyelmeztető ablakokat pl. "rendszer gyorsítótár - Újra kell imdítani az explorer.exe folyamatot etc...)

igen az AVG szedle a vezerlo pulton keresztul,,,utana hasznalhatod a linket es letoltod az AVG=removert es az op rebdszer szerint lefutatod,,kipucoli a maradekot az AVG-bol,,
a combofixel mit akarsz oda irtam a jedzet tombe bemasolod a zold textet-adsz neki nevet CFScript.txt es beledobod a combofixbe ,,olvasd figyelmesen amit irtam,

Szia, Stell!

Lássunk hozzá!
Az AVG-s linkkel mi ateendő? Ha a Vezérlőpult\Programok telepítése és eltávolításával szedem le az AVG-t az jó?

A C könyvtárban lévő ComboFix.exe-re jobb klikk parancsikon létrehozása és azt kiteszem az Asztalra, így gondoltad?

igen az AVAST nagyon jo,,az AVG,,semmit se er,,

Szia Stell!

Elolvastam az instrukcióidat, köszönöm. Lépésről lépésre fogok haladni, kezdem az AVG leszedésével (az AVAST 4.8-t jónak tartod?)

16.30 után otthon vagyok és ezzel foglalkozom, míg azt nem mondod, hogy OK minden. Remélem mindent meg tudok csinálni...

Köszönöm, üdv:

Frank

Nemlatok,tuzfallat,ha befejezuk ezt a gepet,,majd adol RSIT logot a masik geprol,,es igy tovabb,

leszedni a geprol az AVG-t,,ot van az AVAST,,nemaszabad 2-antivirusnak lenie
Hasznald a letelepitot
http://www.avg.com/download-tools
a combofixnek az asztalon kell lenie,,ted att,

Kinyitod a Notepadot>Start>futatas>beirod notepad
Es bemasolod a piros textet

Mostan>a notepadon elso full-fajl>ballfelsosarokban>4-sor>lementenni mint....
A txt-hejetfajlnev beteszed eztett>CFScript.txt<alatta bealitod >minden fajl<
legfelull>asztall i<klik gomb letenni.Es mostan megcsinalod eztett:

A combofix maga elindul es lehet hogy restartol es befejezi a scent.Amit majd ad ted ide

Hi, Steel!

Itt van a ComboFix.txt fájl, amit kértél. Mint látod avast 4 és AVG 8.5 Free antivírus progim van a gépen. Még annyit, hogy ez egy belső hálózat egyik gépe, a másik3 gépet nem érhette kár? A háromból kettőn ugyanez a kettős fut, a harmadikon NOD 32.
Nem lesz könnyű dolgod velem, de majd igyekszem megérteni amit írsz (itt nem a magyarságodra gondolok, hanem az informatikai tudásomra)
Várom a jelentkezésed, üdv:

Frank

ComboFix 09-11-04.02 - hello 009.11.04. 19:29.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1250.36.1038.18.2047.1128 [GMT 1:00]
Running from: C:\ComboFix.exe
AV: avast! antivirus 4.8.1356 [VPS 091104-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\Cache
c:\windows\system32\tmp68.tmp
c:\windows\system32\tmp69.tmp
D:\install.exe

.
((((((((((((((((((((((((( Files Created from 2009-10-04 to 2009-11-04 )))))))))))))))))))))))))))))))
.

2009-11-04 18:25 . 2009-11-04 18:25 3564524 ----a-r- C:\ComboFix.exe
2009-11-04 17:11 . 2009-10-17 06:44 2025752 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgtray.exe
2009-11-04 17:06 . 2009-11-04 17:06 -------- d-----w- c:\windows\system32\wbem\Repository
2009-11-04 17:06 . 2009-11-04 17:06 -------- d-----w- c:\program files\Alien Shooter
2009-11-04 17:06 . 2009-11-04 17:06 -------- d-----w- C:\BDS
2009-11-02 00:20 . 2009-11-02 00:20 -------- d-----w- c:\documents and settings\hello\Local Settings\Application Data\Aspyr
2009-10-30 00:34 . 2009-11-02 01:30 -------- d-----w- c:\program files\Loaris Trojan Remover
2009-10-29 22:54 . 2009-10-29 22:54 -------- d-----w- c:\program files\DIFX
2009-10-27 01:33 . 2009-09-15 11:54 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-10-27 01:33 . 2009-09-15 11:54 52368 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-10-27 01:33 . 2009-09-15 11:53 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-10-27 01:33 . 2009-09-15 11:56 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-10-27 01:33 . 2009-09-15 11:56 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-10-27 01:33 . 2009-09-15 11:55 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-10-27 01:33 . 2009-09-15 11:55 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-10-27 01:33 . 2009-09-15 11:53 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-10-27 01:33 . 2009-09-15 11:59 1279968 ----a-w- c:\windows\system32\aswBoot.exe
2009-10-27 01:33 . 2003-03-18 21:20 1060864 ----a-w- c:\windows\system32\MFC71.dll
2009-10-27 01:33 . 2003-03-18 20:14 499712 ----a-w- c:\windows\system32\MSVCP71.dll
2009-10-27 01:33 . 2009-10-27 01:33 -------- d-----w- c:\program files\Alwil Software
2009-10-17 07:50 . 2009-10-17 07:50 22328 ----a-w- c:\documents and settings\hello\Application Data\PnkBstrK.sys
2009-10-17 07:50 . 2009-10-17 07:50 669184 ----a-w- c:\windows\system32\pbsvc.exe
2009-10-10 09:46 . 2009-10-17 16:50 -------- d-----w- c:\documents and settings\hello\Local Settings\Application Data\Lucasarts
2009-10-10 00:33 . 2009-10-10 11:49 -------- d-----w- c:\documents and settings\All Users\Application Data\SWTCWRH
2009-10-10 00:31 . 2009-10-10 00:31 -------- d-----w- c:\windows\11AE680750D24F5982B32C3E695E94C2.TMP
2009-10-06 05:05 . 2009-10-01 08:26 342599 ----a-w- c:\windows\fifa10_uninstall.exe
2009-10-06 04:52 . 2009-10-06 04:52 -------- d-----w- c:\program files\FIFA 10

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-04 18:46 . 2009-01-10 17:52 -------- d-----w- c:\documents and settings\hello\Application Data\uTorrent
2009-11-04 18:14 . 2009-09-24 15:37 -------- d-----w- c:\documents and settings\hello\Application Data\Skype
2009-11-04 17:33 . 2008-12-16 21:16 196608 ----a-w- c:\windows\system32\drivers\nStandard.bin
2009-11-04 16:10 . 2009-09-24 15:43 -------- d-----w- c:\documents and settings\hello\Application Data\skypePM
2009-11-02 17:04 . 2008-12-17 17:56 14576 ----a-w- c:\documents and settings\hello\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-01 22:57 . 2008-12-15 21:39 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-11-01 10:12 . 2009-02-25 22:30 444952 ----a-w- c:\windows\system32\wrap_oal.dll
2009-11-01 10:12 . 2009-02-25 22:30 109080 ----a-w- c:\windows\system32\OpenAL32.dll
2009-10-19 06:11 . 2008-04-15 12:00 130686 ----a-w- c:\windows\system32\perfc00E.dat
2009-10-19 06:11 . 2008-04-15 12:00 124000 ----a-w- c:\windows\system32\perfh00E.dat
2009-10-19 00:05 . 2008-12-16 21:45 -------- d-----w- c:\program files\Common Files\Adobe
2009-10-17 21:59 . 2008-12-26 18:08 -------- d-----w- c:\program files\Electronic Arts
2009-10-17 07:50 . 2009-01-27 15:32 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-10-17 07:50 . 2009-01-27 15:32 103736 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-10-17 07:50 . 2009-01-27 15:32 66872 ----a-w- c:\windows\system32\PnkBstrA.exe
2009-10-12 13:39 . 2009-02-06 20:24 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-10-10 00:31 . 2009-06-01 08:29 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-10-03 23:52 . 2009-02-06 18:39 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-09-29 12:14 . 2009-09-28 19:26 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-28 19:26 . 2009-09-28 19:23 -------- d-----w- c:\program files\Windows Live
2009-09-28 19:25 . 2009-09-28 19:25 -------- d-----w- c:\program files\Microsoft Sync Framework
2009-09-28 19:24 . 2009-09-28 19:24 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2009-09-28 19:23 . 2009-09-28 19:23 -------- d-----w- c:\program files\Microsoft
2009-09-28 19:23 . 2009-09-28 19:23 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-09-28 19:17 . 2009-09-28 19:17 -------- d-----w- c:\program files\Common Files\Windows Live
2009-09-24 15:43 . 2009-09-24 15:43 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-09-24 15:38 . 2009-01-16 14:03 -------- d-----w- c:\program files\Google
2009-09-24 15:37 . 2009-09-24 15:36 -------- d-----r- c:\program files\Skype
2009-09-24 15:36 . 2009-09-24 15:36 -------- d-----w- c:\program files\Common Files\Skype
2009-09-24 15:36 . 2009-09-24 15:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2009-09-21 18:04 . 2009-09-21 18:03 -------- d-----w- c:\program files\3DO
2009-09-21 18:04 . 2009-09-21 18:03 -------- d-----w- c:\program files\Common Files\3DO Shared
2009-09-19 21:53 . 2009-08-19 20:09 -------- d-----w- c:\program files\AGEIA Technologies
2009-09-19 20:06 . 2009-09-19 20:06 -------- d-----w- c:\program files\Common Files\DirectX
2009-09-11 14:19 . 2008-04-15 12:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:05 . 2008-04-15 12:00 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 07:59 . 2008-04-15 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2009-08-26 08:02 . 2008-04-15 12:00 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-18 07:33 . 2009-02-06 20:24 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-08-18 07:33 . 2009-02-06 20:24 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-08-18 07:33 . 2009-02-06 20:24 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-08-14 11:36 . 2009-08-14 11:36 70936 ----a-w- c:\windows\system32\PhysXLoader.dll
2009-08-07 18:51 . 2009-08-07 18:51 15308424 ----a-w- c:\windows\system32\xlive.dll
2009-08-07 18:51 . 2009-08-07 18:51 13642888 ----a-w- c:\windows\system32\xlivefnt.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM"="c:\documents and settings\All Users\Application Data\Macrovision\FLEXnet Connect\6\isuspm.exe" [2007-03-29 222128]
"ASUS SmartDoctor"="c:\program files\ASUS\SmartDoctor\SmartDoctor.exe" [2008-03-25 1130496]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-02-26 2289664]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-18 39408]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856]
"Jet Screenshot"="c:\program files\Jet Screenshot\jetScreenshot.exe" [2009-05-10 3804160]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-09-02 25623336]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Six Engine"="c:\program files\ASUS\Six Engine\SixEngine.exe" [2008-07-04 5968384]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]
"36X Raid Configurer"="c:\windows\system32\xRaidSetup.exe" [2007-11-19 1970176]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-04-11 13524992]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-04-11 86016]
"ASUSGamerOSD"="c:\program files\ASUS\GamerOSD\GamerOSD.exe" [2008-03-25 380928]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-08-03 36352]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-11-04 2028312]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2008-11-02 167936]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-09-15 81000]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2008-06-13 16871936]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-04-11 1630208]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-15 15360]

c:\documents and settings\All Users\Start Menu\Programs\Indˇt˘pult\
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-08-18 07:33 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, digest32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\TmNationsForever\\TmForever.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\AgeOfEmpiresII\\empires2.exe"=
"c:\\Program Files\\VALVe\\Counter-Strike Source\\hl2.exe"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaWmp.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaW.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Call of Duty 2\\CoD2MP_s.exe"=
"c:\\Program Files\\CAPCOM\\LOSTPLANETCOLONIES\\LostPlanetColoniesDX9.exe"=
"c:\\Program Files\\CAPCOM\\LOSTPLANETCOLONIES\\LostPlanetColoniesDX10.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Codemasters\\GRID\\GRID.exe"=
"d:\\GAMES\\Valve\\Condition Zero\\czero.exe"=
"d:\\GAMES\\Ubisoft\\Techland\\Call of Juarez - Bound in Blood\\CoJBiBGame_x86.exe"=
"c:\\WINDOWS\\system32\\wbem\\wmiprvse.exe"=
"c:\\WINDOWS\\system32\\nvsvc32.exe"=
"c:\\WINDOWS\\system32\\svchost.exe"=
"d:\\GAMES\\TimeGate Studios\\section 8\\Binaries\\S8Game-F.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"d:\\GAMES\\LucasArts\\Republic Heroes\\Republic Heroes.exe"=
"d:\\GAMES\\Codemasters\\OF Dragon Rising\\OFDR.exe"=
"d:\\GAMES\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"d:\\GAMES\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"d:\\GAMES\\2K Games\\Gearbox Software\\Borderlands\\Binaries\\Borderlands.exe"=
"d:\\GAMES\\Ubisoft\\Ghost Recon Advanced Warfighter 2\\graw2.exe"=
"d:\\GAMES\\Ubisoft\\Ghost Recon Advanced Warfighter 2\\graw2_dedicated.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"3587:TCP"= 3587:TCP:Windows társ-társ csoportosítás
"3540:UDP"= 3540:UDP:Peer Name Resolution Protocol (PNRP)
"4719:TCP"= 4719:TCP:4719

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009.10.27. 2:33 114768]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009.02.06. 21:24 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009.02.06. 21:24 108552]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009.10.27. 2:33 20560]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009.02.06. 21:24 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009.02.06. 21:24 297752]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2009.09.28. 20:26 54752]
R3 L1e;Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1e51x86.sys [2008.12.15. 22:40 36864]
S2 gupdate1ca3d2ceec936e0;Google frissítési szolgáltatás (gupdate1ca3d2ceec936e0);c:\program files\Google\Update\GoogleUpdate.exe [2009.09.24. 16:37 133104]
S3 fsssvc;Windows Live Családbiztonság szolgáltatás;c:\program files\Windows Live\Family Safety\fsssvc.exe [2009.08.05. 21:48 704864]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - MBR
*NewlyCreated* - PROCEXP113
*Deregistered* - mbr
*Deregistered* - PROCEXP113

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder

2009-10-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2009-11-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-24 15:37]

2009-11-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-24 15:37]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-MsnMsgr - c:\program files\MSN Messenger\MsnMsgr.Exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-04 19:45
Windows 5.1.2600 Szervizcsomag 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll sfsync02.sys atapi.sys spxs.sys >>UNKNOWN [0x89E03938]<<
kernel: MBR read successfully
user & kernel MBR OK
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

atapi.sys @ 0x0 0x0 bytes

\Driver\atapi [ IRP_MJ_CREATE ] 0xA6F2 != 0xBA5FCB40 atapi.sys
\Driver\atapi [ IRP_MJ_CLOSE ] 0xA6F2 != 0xBA5FCB40 atapi.sys
\Driver\atapi [ IRP_MJ_DEVICE_CONTROL ] 0xA712 != 0xBA5FCB40 atapi.sys
\Driver\atapi [ IRP_MJ_INTERNAL_DEVICE_CONTROL ] 0x6852 != 0xBA8E98B4 sfsync02.sys
\Driver\atapi [ IRP_MJ_POWER ] 0xA73C != 0xBA5FCB40 atapi.sys
\Driver\atapi [ IRP_MJ_SYSTEM_CONTROL ] 0x11336 != 0xBA5FCB40 atapi.sys
\Driver\atapi IRP hooks detected !

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1757981266-2000478354-682003330-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-1757981266-2000478354-682003330-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:af,d0,f5,a2,88,07,fb,7d,8d,3d,84,8e,a6,b6,fb,b0,95,ee,d5,b3,43,f9,f4,
17,dd,14,12,62,a5,f3,3a,3e,83,33,55,9e,7b,d6,f2,7e,1f,0d,04,87,9c,e4,80,ca,\
"??"=hex:2e,5f,b1,3a,8e,74,11,82,c5,eb,9b,58,27,56,e8,01

[HKEY_USERS\S-1-5-21-1757981266-2000478354-682003330-1003\Software\SecuROM\License information*]
"datasecu"=hex:ef,54,e1,8c,6f,bc,fb,d6,59,18,d3,77,c2,6f,ad,d6,70,9a,75,e8,da,
0a,c0,a4,4e,f6,dc,c6,21,74,e7,00,bb,f0,ad,a8,2a,e1,e5,f5,0e,7a,24,38,c8,75,\
"rkeysecu"=hex:9f,ca,16,75,83,0a,d6,fd,d2,a5,ab,cb,c1,0d,12,f7
.
Completion time: 2009-11-04 19:49
ComboFix-quarantined-files.txt 2009-11-04 18:49

Pre-Run: 11 815 997 440 bájt szabad
Post-Run: 52 618 842 112 bájt szabad

ok
eleg holnap
egyszruen kinyitod a combofix.txt es a tartalmat bemasolod ide,

Szia Steel!

Kösz, hogy jelentkeztél! Most melóhelyemen vagyok, inne írtam. megpróbáltam egy e-mailem mellékletéből bemásolni, de nem sok sikerrel...Őszintén szólva nem igazán vágom hogykéne "ide tennem"?Most megyek angolra, 22.00 után otthoni gépemről jelentkezem, ha tudunk még beszélni...Ha nem, akkor holnap.
Üdv:

Frank

udv,,
ted ide a c:\combofix.txt

Sziasztok!
Tegnap bekapcsolás után jobb alsó sarokban piros pajzs, benne fehér x figyelmeztető ikon, lehet, hogy veszélynek van kitéve...Nem tudtam elindítani az Automatikus frissítéseketek a Vezérlőpult\Rendszer\Automatikus frissítésekben. :cry:
Letöltöttem a Combo.Fix.exe-t, és elindítottam. Hála Istennek probléma megoldódott, DE a jelentést végig böngészve - mivel nem sokat értek hozzá - nem vagyok biztos, hogy ezzel minden rendben lesz?! :?:
Mivel láttam régebbről, hogy e témában vannak szakértők, kivel vehetném fel a kapcsolatot a ComboFix.txt jelentéssel kapcsolatban?
Thx

Frank