Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Infected with Win32:Unruy.E trojan


  • This topic is locked This topic is locked
12 replies to this topic

#1 krumpli

krumpli

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Hungary
  • Local time:06:20 AM

Posted 05 December 2009 - 09:51 AM

Hi. It seems my computer is infected with a trojan that Avast identifies as Win32:Unruy-E. Avast sends a warning when it finds an infected file, which appears always in a svchost.exe file. After I remove it to chest, a couple of minutes later it re-appers in another svchost.exe file.

I ran a CounterSpy check, which identified a couple of malewares (Trojan.Win32.Bredolab.Gen1, Trojan.Win32.Generic!Bt, Backdoor.IRC.Zaphast, Paded.Win2.PolyCrypt.b, Backdoor.Bifrose.NQ), which I removed. After that I ran CounterSpy again, this time it found the computer clean, but Avast has been still sending warnings for Win32:Unruy-E.

I made a scan with Kaspersky too, which detected Trojan-Clicker.Win32.Cycler.lsz 1.

Thanks for reading this, I hope you can help me :(

DDS (Ver_09-12-01.01) - NTFSx86
Run by Felhasznalo at 15:22:24,81 on 2009.12.05.
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_16
Microsoft Windows XP Professional 5.1.2600.2.1250.36.1038.18.2046.1099 [GMT 1:00]

AV: avast! antivirus 4.8.1368 [VPS 091205-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Sunbelt Software\CounterSpy\SBAMSvc.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\Sunbelt Software\CounterSpy\SBAMTray.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
E:\Progik\dds.scr

============== Pseudo HJT Report ===============

uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uDefault_Search_URL = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
mCustomizeSearch = hxxp://dnl.crawler.com/support/sa_customize.aspx?TbId=61005
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AskBar BHO: {201f27d4-3704-41d6-89c1-aa35e39143ed} - c:\program files\askbardis\bar\bin\askBar.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - e:\progik\spybot~1\SDHelper.dll
BHO: Windows Live bejelentkezési segítség: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
TB: ZoneAlarm Spy Blocker Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\askbardis\bar\bin\askBar.dll
TB: {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No File
uRun: [msnmsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /background
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe
mRun: [WinPatrol] c:\program files\billp studios\winpatrol\winpatrol.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe"
mRun: [SBAMTray] c:\program files\sunbelt software\counterspy\SBAMTray.exe
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
dRun: [Nokia.PCSync] c:\program files\nokia\nokia pc suite 6\PcSync2.exe /NoDialog
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Download with Xilisoft YouTube Video Converter - c:\program files\xilisoft\youtube video converter\upod_link.HTM
IE: E&xportálás Microsoft Excel formátumba - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - e:\progik\spybot~1\SDHelper.dll
DPF: {00000055-9980-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/fhg.CAB
DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} - hxxp://dl.tvunetworks.com/TVUAx.cab
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} - hxxp://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5149/mcfscan.cab
TCP: {44BD1FB7-77EE-4D3D-91CE-8EE016821A20} = 62.77.203.10 213.163.34.66
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\felhas~1\applic~1\mozilla\firefox\profiles\sfuid17m.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=19&q=
FF - prefs.js: browser.search.selectedEngine - Fast Browser Search
FF - prefs.js: browser.startup.homepage - google.com
FF - prefs.js: keyword.URL - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=19&tid={48C4152F-4625-DE22-8525-3EA6F6EC35F7}&q=
FF - component: c:\documents and settings\felhasznalo\application data\mozilla\firefox\profiles\sfuid17m.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\bdqscan.dll
FF - plugin: c:\documents and settings\felhasznalo\application data\mozilla\firefox\profiles\sfuid17m.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
FF - plugin: c:\program files\opera\program\plugins\np_gp.dll
FF - plugin: c:\program files\opera\program\plugins\npdivx32.dll
FF - plugin: c:\program files\veetle\plugins\npVeetle.dll
FF - plugin: c:\program files\veetle\vlc\npvlc.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref("editor.use_css", true);

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-12-5 64288]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-9-13 114768]
R1 sbaphd;sbaphd;c:\windows\system32\drivers\sbaphd.sys [2009-12-5 13360]
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [2009-8-5 93872]
R1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2007-9-19 353672]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-9-13 20560]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2008-9-13 138680]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-9-24 1184912]
R2 SBAMSvc;CounterSpy Antispyware;c:\program files\sunbelt software\counterspy\SBAMSvc.exe [2009-9-4 1012040]
R2 sbapifs;sbapifs;c:\windows\system32\drivers\sbapifs.sys [2009-12-5 69936]
R2 vsmon;TrueVector Internet Monitor;c:\windows\system32\zonelabs\vsmon.exe -service --> c:\windows\system32\zonelabs\vsmon.exe -service [?]
R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2008-9-13 254040]
R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2008-9-13 352920]
S3 iatmunin;iatmunin;\??\c:\docume~1\felhas~1\locals~1\temp\iatmunin.sys --> c:\docume~1\felhas~1\locals~1\temp\iatmunin.sys [?]
S4 ASKService;ASKService;c:\program files\askbardis\bar\bin\AskService.exe [2009-3-26 464264]

=============== Created Last 30 ================

2009-12-05 11:26:51 0 d-----w- c:\program files\ESET
2009-12-05 10:07:29 15880 ----a-w- c:\windows\system32\lsdelete.exe
2009-12-05 09:30:51 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2009-12-05 09:14:24 0 d-----w- c:\program files\VS Revo Group
2009-12-05 08:53:45 69936 ----a-w- c:\windows\system32\drivers\sbapifs.sys
2009-12-05 08:53:45 13360 ----a-w- c:\windows\system32\drivers\sbaphd.sys
2009-12-05 06:39:07 0 d-----w- c:\docume~1\felhas~1\applic~1\Sunbelt
2009-12-05 06:39:03 0 d-----w- c:\docume~1\alluse~1\applic~1\Sunbelt
2009-12-05 06:38:54 0 d-----w- c:\program files\Sunbelt Software
2009-12-04 22:18:51 0 d-----w- c:\docume~1\felhas~1\applic~1\QuickScan
2009-12-04 18:25:58 0 dc-h--w- c:\docume~1\alluse~1\applic~1\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}
2009-11-14 09:17:49 54156 ---ha-w- c:\windows\QTFont.qfn
2009-11-14 09:17:49 1409 ----a-w- c:\windows\QTFont.for
2009-11-05 23:00:18 0 d-----w- c:\documents and settings\felhasznalo\Tracing
2009-11-05 22:58:15 0 d-----w- c:\program files\Microsoft
2009-11-05 22:58:05 0 d-----w- c:\program files\Windows Live SkyDrive
2009-11-05 16:16:55 0 d-----w- c:\documents and settings\felhasznalo\Praat

==================== Find3M ====================

2009-12-03 14:53:40 95360 ----a-w- c:\windows\system32\drivers\atapi.sys
2009-10-27 08:37:05 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-10-25 08:09:08 449926 ----a-w- c:\windows\system32\perfh00E.dat
2009-10-25 08:09:08 100880 ----a-w- c:\windows\system32\perfc00E.dat
2009-09-11 14:35:45 133632 ----a-w- c:\windows\system32\msv1_0.dll

============= FINISH: 15:25:07,09 ===============



--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Saturday, December 5, 2009
Operating system: Microsoft Windows XP Professional Szervizcsomag 2 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Saturday, December 05, 2009 08:34:18
Records in database: 3332067
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - Critical areas:
C:\Documents and Settings\All Users\Start Menu\Programs\Indítópult
C:\Documents and Settings\Felhasznalo\Start Menu\Programs\Indítópult
C:\Program Files
C:\WINDOWS

Scan statistics:
Objects scanned: 40281
Threats found: 1
Infected objects found: 2
Suspicious objects found: 0
Scan duration: 00:35:13


File name / Threat / Threats count
C:\WINDOWS\Temp\pcxt.tmp\svchost.exe Infected: Trojan-Clicker.Win32.Cycler.lsz 1
C:\WINDOWS\Temp\uyuj.tmp\svchost.exe Infected: Trojan-Clicker.Win32.Cycler.lsz 1

Selected area has been scanned.

Attached Files



BC AdBot (Login to Remove)

 


#2 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:12:20 AM

Posted 05 December 2009 - 03:46 PM

Hello! :(
My name is Sam and I will be helping you.

In order to see what's going on with your computer I will ask for you to post various logs from the tools that we will use to resolve your issue. Please also share with me any information about how your computer is reacting and behaving each step of the way as we work through this process.


Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2
  • Make sure you are connected to the Internet.
  • Double-click on Download_mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
  • MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
  • On the Scanner tab:
    • Make sure the "Perform Quick Scan" option is selected.
    • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
  • Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply and exit MBAM.
Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.




We need to create an OTL Report
  • Please download OTL from here
  • Save it to your desktop.
  • Double click on the icon on your desktop.
  • Click the "Scan All Users" checkbox.
  • Under the Custom Scan box paste this in

    netsvcs
    %SYSTEMDRIVE%\*.exe
    /md5start
    eventlog.dll
    scecli.dll
    netlogon.dll
    cngaudit.dll
    sceclt.dll
    ntelogon.dll
    logevent.dll
    iaStor.sys
    nvstor.sys
    atapi.sys
    IdeChnDr.sys
    viasraid.sys
    AGP440.sys
    vaxscsi.sys
    nvatabus.sys
    viamraid.sys
    nvata.sys
    nvgts.sys
    iastorv.sys
    ViPrt.sys
    eNetHook.dll
    ahcix86.sys
    KR10N.sys
    /md5stop
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT



  • Click the "Quick Scan" button.
  • The scan should take just a few minutes.
  • Please copy and paste both logs back here in your next reply.

Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#3 krumpli

krumpli
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Hungary
  • Local time:06:20 AM

Posted 05 December 2009 - 05:05 PM

Hello Sam, thank you for helping me :( I'd like to apologize in advance if my use of English is not correct, as I am not a native speaker. Which unfortunately already caused some problems, because I've downloaded Malwarebytes as you asked, and I managed to install the Hungarian version, so the scan results are also in Hungarian... Yes, I know, i'm an idiot :(

I've tried to translate the parts where the program indicated problems, the rest of the scan is negative.

EDIT: I ran Malwarebytes on another computer to get the English version of the terms, then I edited the original version accordingly. Sorry for the inconvenience :)

Here are the logs:

Malwarebytes' Anti-Malware 1.42
Adatbázis verzió: 3301
Windows 5.1.2600 Szervizcsomag 2
Internet Explorer 7.0.5730.13

2009.12.05. 22:22:15
mbam-log-2009-12-05 (22-22-15).txt

Scan type: Quick Scan
Objects scanned: 105096
Time elapsed: 5 minute(s), 18 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry data items Infected: 0
Folders Infected: 1
Files Infected: 1

Memory processes Infected:
(no malicious items detected)

Memory Modules Infected:
(no malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{08b0e5c0-4fcb-11cf-aax5-00401c608512} (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
(no malicious items detected)

Registry Data Items Infected:
(no malicious items detected)

Folders Infected:
C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013 (Trojan.Agent) -> Quarantined and deleted successfully.

Files Infected:
C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini (Trojan.Agent) -> Quarantined and deleted successfully.


OTL logfile created on: 2009.12.05. 22:31:02 - Run 1
OTL by OldTimer - Version 3.1.11.7 Folder = E:\Progik
Windows XP Professional Edition Szervizcsomag 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 0000040E | Country: Magyarország | Language: HUN | Date Format: yyyy.MM.dd.

2,00 Gb Total Physical Memory | 1,29 Gb Available Physical Memory | 64,67% Memory free
3,85 Gb Paging File | 3,32 Gb Available in Paging File | 86,22% Paging File free
Paging file location(s): E:\pagefile.sys 2046 2046 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 29,29 Gb Total Space | 19,13 Gb Free Space | 65,31% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 119,75 Gb Total Space | 52,06 Gb Free Space | 43,48% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
Drive H: | 1,87 Gb Total Space | 0,60 Gb Free Space | 32,26% Space Free | Partition Type: FAT
I: Drive not present or media not loaded

Computer Name: OTTHON-PC
Current User Name: Felhasznalo
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2009.12.05 22:29:37 | 00,536,576 | ---- | M] (OldTimer Tools) -- E:\Progik\OTL.exe
PRC - [2009.12.05 10:29:15 | 00,788,880 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
PRC - [2009.12.05 10:29:13 | 01,184,912 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
PRC - [2009.11.25 00:51:40 | 00,081,000 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashDisp.exe
PRC - [2009.11.25 00:51:35 | 00,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe
PRC - [2009.11.25 00:51:21 | 00,254,040 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
PRC - [2009.11.25 00:48:48 | 00,352,920 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
PRC - [2009.11.25 00:43:56 | 00,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
PRC - [2009.10.27 09:37:06 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe
PRC - [2009.09.04 11:29:18 | 00,685,352 | ---- | M] (Sunbelt Software) -- C:\Program Files\Sunbelt Software\CounterSpy\SBAMTray.exe
PRC - [2009.09.04 11:10:08 | 01,012,040 | ---- | M] (Sunbelt Software) -- C:\Program Files\Sunbelt Software\CounterSpy\SBAMSvc.exe
PRC - [2009.02.16 00:10:22 | 02,402,184 | ---- | M] (Check Point Software Technologies LTD) -- C:\WINDOWS\system32\ZoneLabs\vsmon.exe
PRC - [2009.02.16 00:10:22 | 00,981,384 | ---- | M] (Check Point Software Technologies LTD) -- C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
PRC - [2008.12.10 22:32:46 | 00,098,816 | ---- | M] (Opera Software) -- C:\Program Files\Opera\opera.exe
PRC - [2008.04.26 11:09:36 | 00,214,560 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Real\RealPlayer\realplay.exe
PRC - [2008.04.26 11:09:30 | 00,185,896 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe
PRC - [2008.04.19 16:23:39 | 00,126,976 | ---- | M] () -- C:\WINDOWS\system32\UAService7.exe
PRC - [2007.11.16 12:11:40 | 00,098,304 | ---- | M] (Apple Computer, Inc.) -- C:\Program Files\QuickTime\qttask.exe
PRC - [2007.10.26 17:06:47 | 00,292,152 | ---- | M] (BillP Studios) -- C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
PRC - [2007.09.06 12:28:18 | 00,110,592 | ---- | M] (Apple, Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
PRC - [2007.06.13 14:23:54 | 01,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007.04.19 23:05:00 | 00,163,908 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe
PRC - [2007.04.12 10:33:10 | 16,132,608 | R--- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\RTHDCPL.exe
PRC - [2001.10.26 13:00:00 | 00,016,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\unsecapp.exe


========== Modules (SafeList) ==========

MOD - [2009.12.05 22:29:37 | 00,536,576 | ---- | M] (OldTimer Tools) -- E:\Progik\OTL.exe
MOD - [2007.10.26 17:06:56 | 00,062,768 | ---- | M] (BillP Studios) -- C:\Program Files\BillP Studios\WinPatrol\patrolpro.dll
MOD - [2006.08.25 16:53:57 | 01,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
MOD - [2004.08.17 16:47:26 | 00,065,536 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\shimeng.dll
MOD - [2004.08.17 16:47:10 | 00,071,680 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msacm32.dll
MOD - [2004.08.17 16:46:36 | 01,852,416 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\AppPatch\AcGenral.dll


========== Win32 Services (SafeList) ==========

SRV - [2009.12.05 10:29:13 | 01,184,912 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)
SRV - [2009.11.25 00:51:35 | 00,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus)
SRV - [2009.11.25 00:51:21 | 00,254,040 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner)
SRV - [2009.11.25 00:48:48 | 00,352,920 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner)
SRV - [2009.11.25 00:43:56 | 00,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv)
SRV - [2009.10.27 09:37:06 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2009.09.04 11:10:08 | 01,012,040 | ---- | M] (Sunbelt Software) -- C:\Program Files\Sunbelt Software\CounterSpy\SBAMSvc.exe -- (SBAMSvc)
SRV - [2009.09.03 10:53:00 | 00,048,368 | ---- | M] (NOS Microsystems Ltd.) -- C:\Program Files\NOS\bin\getPlus_Helper.dll -- (getPlusHelper) getPlus®
SRV - [2009.08.13 16:07:40 | 00,190,448 | ---- | M] (Google) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc)
SRV - [2009.02.16 00:10:22 | 02,402,184 | ---- | M] (Check Point Software Technologies LTD) -- C:\WINDOWS\System32\ZoneLabs\vsmon.exe -- (vsmon)
SRV - [2008.10.16 18:22:20 | 00,464,264 | ---- | M] () -- C:\Program Files\AskBardis\bar\bin\AskService.exe -- (ASKService)
SRV - [2008.04.19 16:23:39 | 00,126,976 | ---- | M] () -- C:\WINDOWS\system32\UAService7.exe -- (UserAccess7) SecuROM User Access Service (V7)
SRV - [2007.09.06 12:28:18 | 00,110,592 | ---- | M] (Apple, Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2007.06.15 16:55:00 | 00,300,544 | ---- | M] (Nokia.) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2007.04.19 23:05:00 | 00,163,908 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe -- (NVSvc)
SRV - [2007.03.12 12:49:46 | 00,271,920 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService)
SRV - [2007.01.15 16:14:38 | 00,774,144 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe -- (NBService)
SRV - [2005.11.14 00:06:04 | 00,069,632 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2003.07.28 19:28:22 | 00,089,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=61005
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie


IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-57989841-1767777339-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKU\S-1-5-21-57989841-1767777339-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKU\S-1-5-21-57989841-1767777339-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKU\S-1-5-21-57989841-1767777339-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm...tf8&oe=utf8
IE - HKU\S-1-5-21-57989841-1767777339-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKU\S-1-5-21-57989841-1767777339-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKU\S-1-5-21-57989841-1767777339-839522115-1003\S-1-5-21-57989841-1767777339-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Fast Browser Search"
FF - prefs.js..browser.search.defaulturl: "http://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=19&q="
FF - prefs.js..browser.search.order.1: "Fast Browser Search"
FF - prefs.js..browser.search.selectedEngine: "Fast Browser Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "google.com"
FF - prefs.js..extensions.enabledItems: {e001c731-5e37-4538-a5cb-8168736a2360}:0.9.8.2
FF - prefs.js..extensions.enabledItems: hu@dictionaries.addons.mozilla.org:1.4
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: en-US@dictionaries.addons.mozilla.org:3.0.3
FF - prefs.js..extensions.enabledItems: {E9A1DEE0-C623-4439-8932-001E7D17607D}:2.1.0.5
FF - prefs.js..keyword.URL: "http://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=19&tid={48C4152F-4625-DE22-8525-3EA6F6EC35F7}&q="

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2008.04.26 11:12:24 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.15\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009.11.28 21:33:21 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.15\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009.12.05 12:39:17 | 00,000,000 | ---D | M]

[2008.12.15 09:36:52 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Felhasznalo\Application Data\Mozilla\Extensions
[2009.12.05 12:21:38 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Felhasznalo\Application Data\Mozilla\Firefox\Profiles\sfuid17m.default\extensions
[2009.12.04 23:18:44 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Felhasznalo\Application Data\Mozilla\Firefox\Profiles\sfuid17m.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2009.03.26 23:09:24 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Felhasznalo\Application Data\Mozilla\Firefox\Profiles\sfuid17m.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
[2008.12.15 09:46:07 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Felhasznalo\Application Data\Mozilla\Firefox\Profiles\sfuid17m.default\extensions\en-US@dictionaries.addons.mozilla.org
[2008.12.15 09:46:07 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Felhasznalo\Application Data\Mozilla\Firefox\Profiles\sfuid17m.default\extensions\hu@dictionaries.addons.mozilla.org
[2009.12.02 22:28:25 | 00,002,441 | ---- | M] () -- C:\Documents and Settings\Felhasznalo\Application Data\Mozilla\Firefox\Profiles\sfuid17m.default\searchplugins\dealio.xml
[2009.12.05 12:22:00 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2008.11.29 15:01:34 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com
[2009.10.27 10:01:01 | 00,003,700 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fast.png
[2009.10.27 10:01:00 | 00,001,963 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fast.xml
[2009.09.20 10:53:14 | 00,001,189 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-hu.xml

O1 HOSTS File: (258352 bytes) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 1001-search.info
O1 - Hosts: 127.0.0.1 www.1001-search.info
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 123topsearch.com
O1 - Hosts: 127.0.0.1 www.123topsearch.com
O1 - Hosts: 127.0.0.1 132.com
O1 - Hosts: 127.0.0.1 www.132.com
O1 - Hosts: 127.0.0.1 136136.net
O1 - Hosts: 127.0.0.1 www.136136.net
O1 - Hosts: 8979 more lines...
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBardis\bar\bin\askBar.dll (Ask.com)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Progik\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O3 - HKLM\..\Toolbar: (ZoneAlarm Spy Blocker Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBardis\bar\bin\askBar.dll (Ask.com)
O3 - HKU\S-1-5-21-57989841-1767777339-839522115-1003\..\Toolbar\WebBrowser: (no name) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No CLSID value found.
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe (Apple Computer, Inc.)
O4 - HKLM..\Run: [RTHDCPL] C:\WINDOWS\RTHDCPL.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SBAMTray] C:\Program Files\Sunbelt Software\CounterSpy\SBAMTray.exe (Sunbelt Software)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe (BillP Studios)
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKU\.DEFAULT..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe (Time Information Services Ltd.)
O4 - HKU\S-1-5-18..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe (Time Information Services Ltd.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-57989841-1767777339-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Download with Xilisoft YouTube Video Converter - C:\Program Files\Xilisoft\YouTube Video Converter\upod_link.HTM ()
O9 - Extra 'Tools' menuitem : Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe ()
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\Progik\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O15 - HKLM\..Trusted Domains: 44 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKU\.DEFAULT\..Trusted Domains: 43 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKU\S-1-5-18\..Trusted Domains: 43 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKU\S-1-5-19\..Trusted Domains: 32 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKU\S-1-5-20\..Trusted Domains: 32 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKU\S-1-5-21-57989841-1767777339-839522115-1003\..Trusted Domains: internet ([]about in Internet)
O15 - HKU\S-1-5-21-57989841-1767777339-839522115-1003\..Trusted Domains: 43 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {00000055-9980-0010-8000-00AA00389B71} http://codecs.microsoft.com/codecs/i386/fhg.CAB (Reg Error: Key error.)
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} http://dl.tvunetworks.com/TVUAx.cab (Reg Error: Key error.)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} http://download.bitdefender.com/resources/...can8/oscan8.cab (BDSCANONLINE Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash...r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shock...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} http://download.mcafee.com/molbin/iss-loc/...149/mcfscan.cab (McFreeScan Class)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Jelenlegi saját honlap) - About:Home
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007.09.14 07:20:51 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{86cd78cf-6297-11dc-9e1c-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{86cd78cf-6297-11dc-9e1c-806d6172696f}\Shell\AutoRun\command - "" = D:\setup.exe -- File not found
O33 - MountPoints2\{b3d7d496-66c1-11dc-af42-001a4d4c46ed}\Shell - "" = AutoRun
O33 - MountPoints2\{b3d7d496-66c1-11dc-af42-001a4d4c46ed}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - comfile [open] -- "%1" %*
O35 - exefile [open] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2007.09.14 09:03:53 | 00,000,000 | ---D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Sharedaccess - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (32373071180464128)

========== Files/Folders - Created Within 14 Days ==========

[2009.12.05 22:12:18 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Felhasznalo\Application Data\Malwarebytes
[2009.12.05 22:12:12 | 00,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009.12.05 22:12:11 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009.12.05 22:12:10 | 00,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2009.12.05 22:12:10 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2009.12.05 22:11:00 | 04,844,264 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Felhasznalo\Asztal\mbam-setup.exe
[2009.12.05 14:21:25 | 00,000,000 | ---D | C] -- C:\WINDOWS\BDOSCAN8
[2009.12.05 13:07:07 | 00,532,480 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Felhasznalo\Asztal\OTS.exe
[2009.12.05 12:26:51 | 00,000,000 | ---D | C] -- C:\Program Files\ESET
[2009.12.05 11:14:08 | 00,343,040 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Felhasznalo\Asztal\TFC.exe
[2009.12.05 10:30:51 | 00,064,288 | ---- | C] (Lavasoft AB) -- C:\WINDOWS\System32\drivers\Lbd.sys
[2009.12.05 10:14:24 | 00,000,000 | ---D | C] -- C:\Program Files\VS Revo Group
[2009.12.05 09:53:45 | 00,069,936 | ---- | C] (Sunbelt Software) -- C:\WINDOWS\System32\drivers\sbapifs.sys
[2009.12.05 09:53:45 | 00,013,360 | ---- | C] (Sunbelt Software) -- C:\WINDOWS\System32\drivers\sbaphd.sys
[2009.12.05 09:44:19 | 00,000,000 | RH-D | C] -- C:\Documents and Settings\Felhasznalo\Recent
[2009.12.05 07:39:07 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Felhasznalo\Application Data\Sunbelt
[2009.12.05 07:39:03 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sunbelt
[2009.12.05 07:38:54 | 00,000,000 | ---D | C] -- C:\Program Files\Sunbelt Software
[2009.12.04 23:18:51 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Felhasznalo\Application Data\QuickScan
[2009.12.04 19:25:58 | 00,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}
[2009.11.30 23:03:54 | 00,000,000 | -HSD | C] -- C:\Documents and Settings\All Users\Dokumentumok\Settings
[2009.11.29 19:01:16 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Google
[16 C:\Documents and Settings\All Users\Application Data\*.tmp files -> C:\Documents and Settings\All Users\Application Data\*.tmp -> ]

========== Files - Modified Within 14 Days ==========

[2009.12.05 22:24:16 | 00,350,196 | ---- | M] () -- C:\WINDOWS\System32\vsconfig.xml
[2009.12.05 22:23:57 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009.12.05 22:23:48 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009.12.05 22:23:01 | 11,272,192 | -H-- | M] () -- C:\Documents and Settings\Felhasznalo\NTUSER.DAT
[2009.12.05 22:14:19 | 00,002,487 | ---- | M] () -- C:\Documents and Settings\Felhasznalo\Asztal\Microsoft Office Word 2003.lnk
[2009.12.05 22:12:15 | 00,000,704 | ---- | M] () -- C:\Documents and Settings\All Users\Asztal\Malwarebytes' Anti-Malware.lnk
[2009.12.05 22:11:26 | 04,844,264 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Felhasznalo\Asztal\mbam-setup.exe
[2009.12.05 13:07:09 | 00,532,480 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Felhasznalo\Asztal\OTS.exe
[2009.12.05 12:26:45 | 02,672,312 | ---- | M] () -- C:\Documents and Settings\Felhasznalo\Asztal\esetsmartinstaller_enu.exe
[2009.12.05 11:14:09 | 00,343,040 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Felhasznalo\Asztal\TFC.exe
[2009.12.05 10:32:55 | 00,000,458 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2009.12.05 10:30:33 | 00,015,880 | ---- | M] () -- C:\WINDOWS\System32\lsdelete.exe
[2009.12.05 10:27:21 | 00,000,875 | ---- | M] () -- C:\Documents and Settings\All Users\Asztal\Ad-Aware.lnk
[2009.12.05 10:14:25 | 00,000,925 | ---- | M] () -- C:\Documents and Settings\Felhasznalo\Asztal\Revo Uninstaller.lnk
[2009.12.05 10:14:11 | 01,079,272 | ---- | M] () -- C:\Documents and Settings\Felhasznalo\Asztal\revosetup.exe
[2009.12.05 08:24:44 | 00,054,156 | -H-- | M] () -- C:\WINDOWS\QTFont.qfn
[2009.12.05 07:38:58 | 00,001,777 | ---- | M] () -- C:\Documents and Settings\All Users\Asztal\CounterSpy.lnk
[2009.12.04 22:33:18 | 00,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2009.12.03 20:56:11 | 00,001,439 | ---- | M] () -- C:\WINDOWS\pstudio.ini
[2009.12.03 16:14:06 | 00,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009.12.03 16:13:56 | 00,019,160 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2009.12.01 18:19:37 | 00,008,975 | ---- | M] () -- C:\WINDOWS\System32\QuickTime.qtp
[2009.12.01 08:37:23 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009.11.30 20:33:49 | 00,002,904 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2009.11.30 18:34:11 | 00,051,200 | ---- | M] () -- C:\Documents and Settings\Felhasznalo\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.11.30 12:16:53 | 00,002,283 | ---- | M] () -- C:\Documents and Settings\All Users\Asztal\Skype.lnk
[2009.11.28 21:33:17 | 00,278,528 | ---- | M] (Real Networks, Inc) -- C:\WINDOWS\System32\pncrt.dll
[2009.11.25 00:54:29 | 01,280,480 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\aswBoot.exe
[2009.11.25 00:51:09 | 00,093,424 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2009.11.25 00:50:59 | 00,094,160 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2009.11.25 00:50:12 | 00,114,768 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2009.11.25 00:50:00 | 00,020,560 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2009.11.25 00:49:07 | 00,048,560 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2009.11.25 00:48:57 | 00,023,120 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2009.11.25 00:47:54 | 00,027,408 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2009.11.25 00:47:28 | 00,097,480 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\AvastSS.scr
[16 C:\Documents and Settings\All Users\Application Data\*.tmp files -> C:\Documents and Settings\All Users\Application Data\*.tmp -> ]

========== Files Created - No Company Name ==========

[2009.12.05 22:12:15 | 00,000,704 | ---- | C] () -- C:\Documents and Settings\All Users\Asztal\Malwarebytes' Anti-Malware.lnk
[2009.12.05 12:26:28 | 02,672,312 | ---- | C] () -- C:\Documents and Settings\Felhasznalo\Asztal\esetsmartinstaller_enu.exe
[2009.12.05 11:07:29 | 00,015,880 | ---- | C] () -- C:\WINDOWS\System32\lsdelete.exe
[2009.12.05 10:27:21 | 00,000,875 | ---- | C] () -- C:\Documents and Settings\All Users\Asztal\Ad-Aware.lnk
[2009.12.05 10:14:25 | 00,000,925 | ---- | C] () -- C:\Documents and Settings\Felhasznalo\Asztal\Revo Uninstaller.lnk
[2009.12.05 10:14:03 | 01,079,272 | ---- | C] () -- C:\Documents and Settings\Felhasznalo\Asztal\revosetup.exe
[2009.12.05 07:38:58 | 00,001,777 | ---- | C] () -- C:\Documents and Settings\All Users\Asztal\CounterSpy.lnk
[2009.07.22 19:58:47 | 00,000,000 | ---- | C] () -- C:\WINDOWS\iplayer.INI
[2009.06.07 16:08:34 | 00,001,755 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\tmp4FA.log
[2009.06.06 15:56:23 | 00,001,755 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\tmp713.log
[2009.06.06 15:55:37 | 00,001,755 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\tmp70E.log
[2009.06.06 15:54:49 | 00,001,755 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\tmp709.log
[2009.06.06 15:52:24 | 00,002,138 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\tmp704.log
[2009.06.06 15:45:24 | 00,002,138 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\tmp6F2.log
[2009.06.06 15:41:59 | 00,002,138 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\tmp6ED.log
[2009.06.06 15:40:29 | 00,002,138 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\tmp6E8.log
[2009.06.06 13:18:06 | 00,002,138 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\tmp577.log
[2009.06.06 13:17:02 | 00,002,138 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\tmp572.log
[2009.06.06 13:08:09 | 00,002,138 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\tmp55C.log
[2009.06.06 13:06:56 | 00,002,138 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\tmp553.log
[2009.05.21 11:11:03 | 00,001,196 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\tmp2B2.log
[2009.05.15 14:33:51 | 00,001,962 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\tmp334.log
[2009.05.15 14:29:28 | 00,001,962 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\tmp32F.log
[2009.05.15 14:28:39 | 00,001,962 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\tmp327.log
[2009.04.29 22:43:19 | 00,006,472 | ---- | C] () -- C:\Documents and Settings\Felhasznalo\Application Data\PrimoPDFSet.xml
[2009.04.26 21:24:46 | 00,176,235 | ---- | C] () -- C:\WINDOWS\System32\Primomonnt.dll
[2009.03.09 22:59:05 | 00,000,347 | ---- | C] () -- C:\WINDOWS\SoftWriting.ini
[2009.03.03 18:44:37 | 00,290,816 | ---- | C] () -- C:\WINDOWS\System32\decdll.dll
[2009.01.05 15:44:10 | 00,000,453 | ---- | C] () -- C:\WINDOWS\bdoscandellang.ini
[2008.12.01 19:07:41 | 00,000,054 | ---- | C] () -- C:\WINDOWS\wcx_ftp.ini
[2008.10.30 19:31:05 | 00,000,000 | ---- | C] () -- C:\WINDOWS\mngui.INI
[2008.08.01 14:21:59 | 00,000,134 | ---- | C] () -- C:\Documents and Settings\Felhasznalo\Local Settings\Application Data\fusioncache.dat
[2008.04.28 17:13:33 | 00,000,310 | ---- | C] () -- C:\WINDOWS\primopdf.ini
[2008.03.04 18:52:34 | 00,286,720 | ---- | C] () -- C:\WINDOWS\System32\libcurl.dll
[2007.12.21 12:02:42 | 00,000,377 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2007.11.06 16:39:39 | 00,004,096 | -H-- | C] () -- C:\Documents and Settings\Felhasznalo\Local Settings\Application Data\keyfile3.drm
[2007.10.31 09:39:54 | 00,059,904 | ---- | C] () -- C:\WINDOWS\System32\zlib1.dll
[2007.10.23 16:06:06 | 00,004,081 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2007.09.29 15:50:27 | 00,000,000 | ---- | C] () -- C:\WINDOWS\graphedit.INI
[2007.09.19 16:02:02 | 00,796,048 | ---- | C] () -- C:\WINDOWS\System32\libeay32_0.9.6l.dll
[2007.09.16 15:57:05 | 00,090,112 | ---- | C] () -- C:\WINDOWS\System32\CmdLineExt.dll
[2007.09.16 15:41:26 | 00,000,151 | ---- | C] () -- C:\WINDOWS\GIB30_32.INI
[2007.09.16 13:11:00 | 00,001,439 | ---- | C] () -- C:\WINDOWS\pstudio.ini
[2007.09.16 13:11:00 | 00,000,028 | ---- | C] () -- C:\WINDOWS\album.ini
[2007.09.16 13:10:59 | 00,000,021 | ---- | C] () -- C:\WINDOWS\Ps_setup.ini
[2007.09.16 09:31:51 | 00,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2007.09.16 09:31:45 | 00,051,200 | ---- | C] () -- C:\Documents and Settings\Felhasznalo\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007.09.14 09:28:47 | 00,000,388 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2007.09.14 08:35:34 | 00,001,043 | ---- | C] () -- C:\WINDOWS\WINCMD.INI
[2007.05.17 13:58:10 | 00,143,360 | ---- | C] () -- C:\WINDOWS\System32\libexpatw.dll
[2007.04.19 23:05:00 | 01,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2007.04.19 23:05:00 | 01,474,560 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2007.04.19 23:05:00 | 01,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2007.04.19 23:05:00 | 00,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2007.04.19 23:05:00 | 00,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2007.03.29 22:00:40 | 00,203,264 | R--- | C] () -- C:\WINDOWS\System32\CddbCdda.dll
[2004.08.31 10:32:48 | 00,327,680 | ---- | C] () -- C:\WINDOWS\System32\QFClient2.dll
[2003.04.10 12:01:36 | 00,005,581 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

========== LOP Check ==========

[2009.02.14 18:36:47 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DriverScanner
[2008.01.19 19:24:18 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\HighAndes
[2008.11.29 12:57:50 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Installations
[2007.09.19 16:02:35 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MailFrontier
[2008.11.29 13:02:34 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PC Suite
[2008.08.01 14:10:44 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Teleca
[2008.03.26 10:23:34 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Uniblue
[2009.03.14 16:06:18 | 00,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{92E7A367-8E12-4830-AA70-29C32E331A81}
[2009.12.05 10:27:23 | 00,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}
[2008.04.05 11:39:00 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Felhasznalo\Application Data\BSplayer
[2007.10.27 11:44:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Felhasznalo\Application Data\BSplayer Pro
[2009.10.17 15:50:55 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Felhasznalo\Application Data\Canon
[2009.02.23 17:52:56 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Felhasznalo\Application Data\DeepBurner
[2009.02.23 17:21:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Felhasznalo\Application Data\HighAndes
[2007.09.16 15:58:01 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Felhasznalo\Application Data\ldoce4
[2009.05.20 20:48:17 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Felhasznalo\Application Data\Nokia
[2009.05.20 20:53:00 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Felhasznalo\Application Data\Nokia Multimedia Player
[2009.10.01 17:49:44 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Felhasznalo\Application Data\OpenOffice.org
[2008.03.02 15:19:12 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Felhasznalo\Application Data\Opera
[2009.05.20 20:47:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Felhasznalo\Application Data\PC Suite
[2009.12.04 23:21:05 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Felhasznalo\Application Data\QuickScan
[2008.03.26 09:21:31 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Felhasznalo\Application Data\Registry Booster
[2008.11.29 15:11:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Felhasznalo\Application Data\Search Settings
[2008.08.01 14:38:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Felhasznalo\Application Data\Teleca
[2009.03.14 16:56:39 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Felhasznalo\Application Data\Uniblue
[2009.12.03 10:48:34 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Felhasznalo\Application Data\uTorrent
[2007.11.11 13:19:45 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Felhasznalo\Application Data\WinPatrol
[2009.10.01 15:13:33 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Felhasznalo\Application Data\Xilisoft
[2009.12.05 10:32:55 | 00,000,458 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
[2009.11.16 18:40:05 | 00,000,282 | ---- | M] () -- C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job
[2008.03.26 10:12:17 | 00,000,404 | ---- | M] () -- C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job
[2008.03.26 10:28:08 | 00,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\Uniblue SpyEraser.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >


< MD5 for: ATAPI.SYS >
[2009.12.03 15:53:40 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\dllcache\atapi.sys
[2009.12.03 15:53:40 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004.08.03 22:59:44 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0007\DriverFiles\i386\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2004.08.17 16:46:56 | 00,055,808 | ---- | M] (Microsoft Corporation) MD5=9BF16BF2A92E9946C034947E45C6FB4E -- C:\WINDOWS\system32\dllcache\eventlog.dll
[2004.08.17 16:46:56 | 00,055,808 | ---- | M] (Microsoft Corporation) MD5=9BF16BF2A92E9946C034947E45C6FB4E -- C:\WINDOWS\system32\eventlog.dll

< MD5 for: NETLOGON.DLL >
[2004.08.17 16:47:20 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=38A4E873DEBBA38F1E7E8D9D6AF593D8 -- C:\WINDOWS\system32\dllcache\netlogon.dll
[2004.08.17 16:47:20 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=38A4E873DEBBA38F1E7E8D9D6AF593D8 -- C:\WINDOWS\system32\netlogon.dll
[2009.02.06 19:47:21 | 00,408,064 | ---- | M] (Microsoft Corporation) MD5=EDA679C0437291C5E283466E91F86F8D -- C:\WINDOWS\$hf_mig$\KB968389\SP2QFE\netlogon.dll
[2009.02.06 19:47:21 | 00,408,064 | ---- | M] (Microsoft Corporation) MD5=EDA679C0437291C5E283466E91F86F8D -- C:\WINDOWS\$hf_mig$\KB975467\SP2QFE\netlogon.dll

< MD5 for: SCECLI.DLL >
[2004.08.17 16:47:26 | 00,185,856 | ---- | M] (Microsoft Corporation) MD5=DE117DA3508ECAAECEA21901DBA31DAB -- C:\WINDOWS\system32\dllcache\scecli.dll
[2004.08.17 16:47:26 | 00,185,856 | ---- | M] (Microsoft Corporation) MD5=DE117DA3508ECAAECEA21901DBA31DAB -- C:\WINDOWS\system32\scecli.dll

< %systemroot%\*. /mp /s >

========== Files - Unicode (All) ==========
[2007.11.25 17:25:32 | 00,000,000 | ---D | M](C:\?) -- C:\Đ”
[2007.11.25 17:25:32 | 00,000,000 | ---D | C](C:\?) -- C:\Đ”
[2007.11.15 08:29:00 | 00,000,000 | ---D | M](C:\m?) -- C:\m҉
[2007.11.15 08:29:00 | 00,000,000 | ---D | C](C:\m?) -- C:\m҉
< End of report >

Unfortunately Avast is still sending warnings.

Edited by Buckeye_Sam, 06 December 2009 - 09:22 AM.


#4 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:12:20 AM

Posted 06 December 2009 - 09:38 AM

I don't think we'll have any problem communicating. :(

Run OTL.exe
  • Under the Custom Scans/Fixes box at the bottom, paste in the following

    :OTL
    FF - prefs.js..browser.search.defaultenginename: "Fast Browser Search"
    FF - prefs.js..browser.search.defaulturl: "http://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=19&q="
    FF - prefs.js..browser.search.order.1: "Fast Browser Search"
    FF - prefs.js..browser.search.selectedEngine: "Fast Browser Search"
    [2008.11.29 15:01:34 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com
    O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
    [16 C:\Documents and Settings\All Users\Application Data\*.tmp files -> C:\Documents and Settings\All Users\Application Data\*.tmp -> ]
    
    :Commands
    [purity]
    [emptytemp]
    [Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • You will get a log that shows the results of the fix. Please post it.
  • Then also run and post a new OTL log.

====================


Please run a free online scan with the ESET Online Scanner
Note: You will need to use Internet Explorer for this scan
  • Tick the box next to YES, I accept the Terms of Use
  • Click Start
  • When asked, allow the ActiveX control to install
  • Click Start
  • Make sure that the options Remove found threats and the option Scan unwanted applications is checked
  • Click Scan (This scan can take several hours, so please be patient)
  • Once the scan is completed, you may close the window
  • Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  • Copy and paste that log as a reply to this topic

Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#5 krumpli

krumpli
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Hungary
  • Local time:06:20 AM

Posted 06 December 2009 - 11:47 AM

I ran OTL with the fixing you gave, here are the logs.
Then I ran the ESET scan, and it didn't find any problems. However, Avast is still sending the warning message about Win32:Unruy.E trojan in approximately every five minutes. :(

OTL log No.1:

All processes killed
========== OTL ==========
Prefs.js: "Fast Browser Search" removed from browser.search.defaultenginename
Prefs.js: "http://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=19&q=" removed from browser.search.defaulturl
Prefs.js: "Fast Browser Search" removed from browser.search.order.1
Prefs.js: "Fast Browser Search" removed from browser.search.selectedEngine
C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com\COMPONENTS folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com\CHROME\SKIN folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com\CHROME\LOCALE\EN-US folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com\CHROME\LOCALE folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com\CHROME\CONTENT folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com\CHROME folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com folder moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Alcmtr deleted successfully.
C:\WINDOWS\Alcmtr.exe moved successfully.
C:\Documents and Settings\All Users\Application Data\tmp2B2.tmp deleted successfully.
C:\Documents and Settings\All Users\Application Data\tmp327.tmp deleted successfully.
C:\Documents and Settings\All Users\Application Data\tmp32F.tmp deleted successfully.
C:\Documents and Settings\All Users\Application Data\tmp334.tmp deleted successfully.
C:\Documents and Settings\All Users\Application Data\tmp4FA.tmp deleted successfully.
C:\Documents and Settings\All Users\Application Data\tmp553.tmp deleted successfully.
C:\Documents and Settings\All Users\Application Data\tmp55C.tmp deleted successfully.
C:\Documents and Settings\All Users\Application Data\tmp572.tmp deleted successfully.
C:\Documents and Settings\All Users\Application Data\tmp577.tmp deleted successfully.
C:\Documents and Settings\All Users\Application Data\tmp6E8.tmp deleted successfully.
C:\Documents and Settings\All Users\Application Data\tmp6ED.tmp deleted successfully.
C:\Documents and Settings\All Users\Application Data\tmp6F2.tmp deleted successfully.
C:\Documents and Settings\All Users\Application Data\tmp704.tmp deleted successfully.
C:\Documents and Settings\All Users\Application Data\tmp709.tmp deleted successfully.
C:\Documents and Settings\All Users\Application Data\tmp70E.tmp deleted successfully.
C:\Documents and Settings\All Users\Application Data\tmp713.tmp deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Felhasznalo
->Temp folder emptied: 103145305 bytes
->Temporary Internet Files folder emptied: 7344757 bytes
->Java cache emptied: 136008 bytes
->FireFox cache emptied: 47801754 bytes
->Google Chrome cache emptied: 0 bytes
->Opera cache emptied: 252768258 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 257542 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 177928 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 88702 bytes

Total Files Cleaned = 392,80 mb


OTL by OldTimer - Version 3.1.11.7 log created on 12062009_161251

Files\Folders moved on Reboot...
C:\Documents and Settings\Felhasznalo\Local Settings\Temp\~DF4E90.tmp moved successfully.
File\Folder C:\WINDOWS\temp\_avast4_\Webshlock.txt not found!
C:\WINDOWS\temp\Perflib_Perfdata_a8.dat moved successfully.
File\Folder C:\WINDOWS\temp\ZLT03b6f.TMP not found!

Registry entries deleted on Reboot...


OTL log No.2:

OTL logfile created on: 2009.12.06. 16:22:33 - Run 2
OTL by OldTimer - Version 3.1.11.7 Folder = E:\Progik
Windows XP Professional Edition Szervizcsomag 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 0000040E | Country: Magyarország | Language: HUN | Date Format: yyyy.MM.dd.

2,00 Gb Total Physical Memory | 1,31 Gb Available Physical Memory | 65,73% Memory free
3,85 Gb Paging File | 3,28 Gb Available in Paging File | 85,23% Paging File free
Paging file location(s): E:\pagefile.sys 2046 2046 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 29,29 Gb Total Space | 18,86 Gb Free Space | 64,38% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 119,75 Gb Total Space | 52,06 Gb Free Space | 43,47% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: OTTHON-PC
Current User Name: Felhasznalo
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2009.12.05 22:29:37 | 00,536,576 | ---- | M] (OldTimer Tools) -- E:\Progik\OTL.exe
PRC - [2009.12.05 10:29:15 | 00,788,880 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
PRC - [2009.12.05 10:29:13 | 01,184,912 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
PRC - [2009.11.25 00:51:40 | 00,081,000 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashDisp.exe
PRC - [2009.11.25 00:51:35 | 00,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe
PRC - [2009.11.25 00:51:21 | 00,254,040 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
PRC - [2009.11.25 00:48:48 | 00,352,920 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
PRC - [2009.11.25 00:43:56 | 00,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
PRC - [2009.10.27 09:37:06 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe
PRC - [2009.09.04 11:29:18 | 00,685,352 | ---- | M] (Sunbelt Software) -- C:\Program Files\Sunbelt Software\CounterSpy\SBAMTray.exe
PRC - [2009.09.04 11:10:08 | 01,012,040 | ---- | M] (Sunbelt Software) -- C:\Program Files\Sunbelt Software\CounterSpy\SBAMSvc.exe
PRC - [2009.02.16 00:10:22 | 02,402,184 | ---- | M] (Check Point Software Technologies LTD) -- C:\WINDOWS\system32\ZoneLabs\vsmon.exe
PRC - [2009.02.16 00:10:22 | 00,981,384 | ---- | M] (Check Point Software Technologies LTD) -- C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
PRC - [2008.12.10 22:32:46 | 00,098,816 | ---- | M] (Opera Software) -- C:\Program Files\Opera\opera.exe
PRC - [2008.04.26 11:09:30 | 00,185,896 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe
PRC - [2008.04.19 16:23:39 | 00,126,976 | ---- | M] () -- C:\WINDOWS\system32\UAService7.exe
PRC - [2007.11.16 12:11:40 | 00,098,304 | ---- | M] (Apple Computer, Inc.) -- C:\Program Files\QuickTime\qttask.exe
PRC - [2007.10.26 17:06:47 | 00,292,152 | ---- | M] (BillP Studios) -- C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
PRC - [2007.09.06 12:28:18 | 00,110,592 | ---- | M] (Apple, Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
PRC - [2007.06.13 14:23:54 | 01,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007.04.19 23:05:00 | 00,163,908 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe
PRC - [2007.04.12 10:33:10 | 16,132,608 | R--- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\RTHDCPL.exe
PRC - [2001.10.26 13:00:00 | 00,016,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\unsecapp.exe


========== Modules (SafeList) ==========

MOD - [2009.12.05 22:29:37 | 00,536,576 | ---- | M] (OldTimer Tools) -- E:\Progik\OTL.exe
MOD - [2007.10.26 17:06:56 | 00,062,768 | ---- | M] (BillP Studios) -- C:\Program Files\BillP Studios\WinPatrol\patrolpro.dll
MOD - [2006.08.25 16:53:57 | 01,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
MOD - [2004.08.17 16:47:26 | 00,065,536 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\shimeng.dll
MOD - [2004.08.17 16:47:10 | 00,071,680 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msacm32.dll
MOD - [2004.08.17 16:46:36 | 01,852,416 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\AppPatch\AcGenral.dll


========== Win32 Services (SafeList) ==========

SRV - [2009.12.05 10:29:13 | 01,184,912 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)
SRV - [2009.11.25 00:51:35 | 00,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus)
SRV - [2009.11.25 00:51:21 | 00,254,040 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner)
SRV - [2009.11.25 00:48:48 | 00,352,920 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner)
SRV - [2009.11.25 00:43:56 | 00,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv)
SRV - [2009.10.27 09:37:06 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2009.09.04 11:10:08 | 01,012,040 | ---- | M] (Sunbelt Software) -- C:\Program Files\Sunbelt Software\CounterSpy\SBAMSvc.exe -- (SBAMSvc)
SRV - [2009.09.03 10:53:00 | 00,048,368 | ---- | M] (NOS Microsystems Ltd.) -- C:\Program Files\NOS\bin\getPlus_Helper.dll -- (getPlusHelper) getPlus®
SRV - [2009.08.13 16:07:40 | 00,190,448 | ---- | M] (Google) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc)
SRV - [2009.02.16 00:10:22 | 02,402,184 | ---- | M] (Check Point Software Technologies LTD) -- C:\WINDOWS\System32\ZoneLabs\vsmon.exe -- (vsmon)
SRV - [2008.10.16 18:22:20 | 00,464,264 | ---- | M] () -- C:\Program Files\AskBardis\bar\bin\AskService.exe -- (ASKService)
SRV - [2008.04.19 16:23:39 | 00,126,976 | ---- | M] () -- C:\WINDOWS\system32\UAService7.exe -- (UserAccess7) SecuROM User Access Service (V7)
SRV - [2007.09.06 12:28:18 | 00,110,592 | ---- | M] (Apple, Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2007.06.15 16:55:00 | 00,300,544 | ---- | M] (Nokia.) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2007.04.19 23:05:00 | 00,163,908 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe -- (NVSvc)
SRV - [2007.03.12 12:49:46 | 00,271,920 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService)
SRV - [2007.01.15 16:14:38 | 00,774,144 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe -- (NBService)
SRV - [2005.11.14 00:06:04 | 00,069,632 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2003.07.28 19:28:22 | 00,089,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose)


========== Driver Services (SafeList) ==========

DRV - [2009.11.25 00:50:59 | 00,094,160 | ---- | M] (ALWIL Software) -- C:\WINDOWS\system32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2009.11.25 00:50:12 | 00,114,768 | ---- | M] (ALWIL Software) -- C:\WINDOWS\system32\drivers\aswSP.sys -- (aswSP)
DRV - [2009.11.25 00:50:00 | 00,020,560 | ---- | M] (ALWIL Software) -- C:\WINDOWS\system32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2009.11.25 00:49:07 | 00,048,560 | ---- | M] (ALWIL Software) -- C:\WINDOWS\system32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2009.11.25 00:48:57 | 00,023,120 | ---- | M] (ALWIL Software) -- C:\WINDOWS\system32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2009.11.25 00:47:54 | 00,027,408 | ---- | M] (ALWIL Software) -- C:\WINDOWS\system32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2009.09.23 13:55:23 | 00,064,288 | ---- | M] (Lavasoft AB) -- C:\WINDOWS\system32\DRIVERS\Lbd.sys -- (Lbd)
DRV - [2009.08.10 20:06:28 | 00,069,936 | ---- | M] (Sunbelt Software) -- C:\WINDOWS\system32\drivers\sbapifs.sys -- (sbapifs)
DRV - [2009.08.05 15:58:40 | 00,093,872 | ---- | M] (Sunbelt Software) -- C:\WINDOWS\system32\drivers\SBREDrv.sys -- (SBRE)
DRV - [2009.05.13 17:30:46 | 00,013,360 | ---- | M] (Sunbelt Software) -- C:\WINDOWS\system32\drivers\sbaphd.sys -- (sbaphd)
DRV - [2009.02.16 00:10:26 | 00,353,672 | ---- | M] (Check Point Software Technologies LTD) -- C:\WINDOWS\system32\vsdatant.sys -- (vsdatant)
DRV - [2009.02.14 18:18:15 | 00,023,600 | ---- | M] (EnTech Taiwan) -- C:\WINDOWS\system32\drivers\TVICHW32.SYS -- (TVICHW32)
DRV - [2008.11.20 20:19:06 | 00,043,872 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20)
DRV - [2008.11.17 02:24:00 | 00,051,688 | ---- | M] (Check Point Software Technologies LTD) -- C:\WINDOWS\system32\ZoneLabs\srescan.sys -- (srescan)
DRV - [2007.11.13 11:25:54 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv)
DRV - [2007.09.14 07:35:00 | 00,014,656 | ---- | M] (Windows ® Codename Longhorn DDK provider) -- C:\WINDOWS\gdrv.sys -- (gdrv)
DRV - [2007.04.23 11:12:28 | 04,402,176 | R--- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2007.04.19 23:05:00 | 06,739,168 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2007.03.24 11:20:24 | 00,046,208 | ---- | M] (JMicron Technology Corp.) -- C:\WINDOWS\system32\DRIVERS\jraid.sys -- (JRAID)
DRV - [2007.02.22 11:15:56 | 00,137,216 | ---- | M] (Nokia) -- C:\WINDOWS\system32\drivers\nmwcd.sys -- (nmwcd)
DRV - [2007.02.22 11:15:14 | 00,012,288 | ---- | M] (Nokia) -- C:\WINDOWS\system32\drivers\nmwcdcm.sys -- (nmwcdcm)
DRV - [2007.02.22 11:15:14 | 00,012,288 | ---- | M] (Nokia) -- C:\WINDOWS\system32\drivers\nmwcdcj.sys -- (nmwcdcj)
DRV - [2007.02.22 11:15:14 | 00,008,320 | ---- | M] (Nokia) -- C:\WINDOWS\system32\drivers\nmwcdc.sys -- (nmwcdc)
DRV - [2006.11.22 07:01:00 | 00,250,496 | ---- | M] (Marvell) -- C:\WINDOWS\system32\drivers\yk51x86.sys -- (yukonwxp)
DRV - [2006.09.05 19:09:26 | 00,086,432 | R--- | M] (MCCI) -- C:\WINDOWS\system32\drivers\se59obex.sys -- (se59obex)
DRV - [2006.09.05 19:08:40 | 00,088,624 | R--- | M] (MCCI) -- C:\WINDOWS\system32\drivers\se59mgmt.sys -- (se59mgmt) Sony Ericsson Device 089 USB WMC Device Management Drivers (WDM)
DRV - [2006.09.05 19:07:52 | 00,097,088 | R--- | M] (MCCI) -- C:\WINDOWS\system32\drivers\se59mdm.sys -- (se59mdm)
DRV - [2006.09.05 19:07:48 | 00,009,360 | R--- | M] (MCCI) -- C:\WINDOWS\system32\drivers\se59mdfl.sys -- (se59mdfl)
DRV - [2006.09.05 19:07:00 | 00,061,536 | R--- | M] (MCCI) -- C:\WINDOWS\system32\drivers\se59bus.sys -- (se59bus) Sony Ericsson Device 089 driver (WDM)
DRV - [2006.09.05 19:06:28 | 00,018,704 | R--- | M] (MCCI) -- C:\WINDOWS\system32\drivers\se59nd5.sys -- (se59nd5) Sony Ericsson Device 089 USB Ethernet Emulation SEMC59 (NDIS)
DRV - [2006.09.05 19:06:22 | 00,090,800 | R--- | M] (MCCI) -- C:\WINDOWS\system32\drivers\se59unic.sys -- (se59unic) Sony Ericsson Device 089 USB Ethernet Emulation SEMC59 (WDM)
DRV - [2006.02.07 19:52:58 | 00,006,912 | ---- | M] (JMicron ) -- C:\WINDOWS\system32\DRIVERS\JGOGO.sys -- (JGOGO)
DRV - [2005.01.07 16:07:18 | 00,138,752 | ---- | M] (Windows ® Server 2003 DDK provider) -- C:\WINDOWS\system32\drivers\Hdaudbus.sys -- (HDAudBus)
DRV - [2001.10.26 13:00:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=61005
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm...tf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.order.1: ""
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "google.com"
FF - prefs.js..extensions.enabledItems: {e001c731-5e37-4538-a5cb-8168736a2360}:0.9.8.2
FF - prefs.js..extensions.enabledItems: hu@dictionaries.addons.mozilla.org:1.4
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: en-US@dictionaries.addons.mozilla.org:3.0.3
FF - prefs.js..extensions.enabledItems: {E9A1DEE0-C623-4439-8932-001E7D17607D}:2.1.0.5
FF - prefs.js..keyword.URL: "http://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=19&tid={48C4152F-4625-DE22-8525-3EA6F6EC35F7}&q="

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2008.04.26 11:12:24 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.15\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009.11.28 21:33:21 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.15\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009.12.05 12:39:17 | 00,000,000 | ---D | M]

[2008.12.15 09:36:52 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Felhasznalo\Application Data\Mozilla\Extensions
[2009.12.05 12:21:38 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Felhasznalo\Application Data\Mozilla\Firefox\Profiles\sfuid17m.default\extensions
[2009.12.04 23:18:44 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Felhasznalo\Application Data\Mozilla\Firefox\Profiles\sfuid17m.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2009.03.26 23:09:24 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Felhasznalo\Application Data\Mozilla\Firefox\Profiles\sfuid17m.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
[2008.12.15 09:46:07 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Felhasznalo\Application Data\Mozilla\Firefox\Profiles\sfuid17m.default\extensions\en-US@dictionaries.addons.mozilla.org
[2008.12.15 09:46:07 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Felhasznalo\Application Data\Mozilla\Firefox\Profiles\sfuid17m.default\extensions\hu@dictionaries.addons.mozilla.org
[2009.12.02 22:28:25 | 00,002,441 | ---- | M] () -- C:\Documents and Settings\Felhasznalo\Application Data\Mozilla\Firefox\Profiles\sfuid17m.default\searchplugins\dealio.xml
[2009.12.05 12:22:00 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2009.10.27 10:01:01 | 00,003,700 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fast.png
[2009.10.27 10:01:00 | 00,001,963 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fast.xml
[2009.09.20 10:53:14 | 00,001,189 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-hu.xml

O1 HOSTS File: (258352 bytes) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 1001-search.info
O1 - Hosts: 127.0.0.1 www.1001-search.info
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 123topsearch.com
O1 - Hosts: 127.0.0.1 www.123topsearch.com
O1 - Hosts: 127.0.0.1 132.com
O1 - Hosts: 127.0.0.1 www.132.com
O1 - Hosts: 127.0.0.1 136136.net
O1 - Hosts: 127.0.0.1 www.136136.net
O1 - Hosts: 8979 more lines...
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBardis\bar\bin\askBar.dll (Ask.com)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Progik\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O3 - HKLM\..\Toolbar: (ZoneAlarm Spy Blocker Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBardis\bar\bin\askBar.dll (Ask.com)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No CLSID value found.
O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe (Apple Computer, Inc.)
O4 - HKLM..\Run: [RTHDCPL] C:\WINDOWS\RTHDCPL.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SBAMTray] C:\Program Files\Sunbelt Software\CounterSpy\SBAMTray.exe (Sunbelt Software)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe (BillP Studios)
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Download with Xilisoft YouTube Video Converter - C:\Program Files\Xilisoft\YouTube Video Converter\upod_link.HTM ()
O9 - Extra 'Tools' menuitem : Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe ()
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\Progik\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O15 - HKLM\..Trusted Domains: 44 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Domains: internet ([]about in Internet)
O15 - HKCU\..Trusted Domains: 43 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {00000055-9980-0010-8000-00AA00389B71} http://codecs.microsoft.com/codecs/i386/fhg.CAB (Reg Error: Key error.)
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} http://dl.tvunetworks.com/TVUAx.cab (Reg Error: Key error.)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} http://download.bitdefender.com/resources/...can8/oscan8.cab (BDSCANONLINE Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash...r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shock...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} http://download.mcafee.com/molbin/iss-loc/...149/mcfscan.cab (McFreeScan Class)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Jelenlegi saját honlap) - About:Home
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007.09.14 07:20:51 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{86cd78cf-6297-11dc-9e1c-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{86cd78cf-6297-11dc-9e1c-806d6172696f}\Shell\AutoRun\command - "" = D:\setup.exe -- File not found
O33 - MountPoints2\{b3d7d496-66c1-11dc-af42-001a4d4c46ed}\Shell - "" = AutoRun
O33 - MountPoints2\{b3d7d496-66c1-11dc-af42-001a4d4c46ed}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - comfile [open] -- "%1" %*
O35 - exefile [open] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2009.12.05 22:12:18 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Felhasznalo\Application Data\Malwarebytes
[2009.12.05 22:12:12 | 00,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009.12.05 22:12:11 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009.12.05 22:12:10 | 00,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2009.12.05 22:12:10 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2009.12.05 22:11:00 | 04,844,264 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Felhasznalo\Asztal\mbam-setup.exe
[2009.12.05 14:21:25 | 00,000,000 | ---D | C] -- C:\WINDOWS\BDOSCAN8
[2009.12.05 13:07:07 | 00,532,480 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Felhasznalo\Asztal\OTS.exe
[2009.12.05 12:26:51 | 00,000,000 | ---D | C] -- C:\Program Files\ESET
[2009.12.05 11:14:08 | 00,343,040 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Felhasznalo\Asztal\TFC.exe
[2009.12.05 10:30:51 | 00,064,288 | ---- | C] (Lavasoft AB) -- C:\WINDOWS\System32\drivers\Lbd.sys
[2009.12.05 10:14:24 | 00,000,000 | ---D | C] -- C:\Program Files\VS Revo Group
[2009.12.05 09:53:45 | 00,069,936 | ---- | C] (Sunbelt Software) -- C:\WINDOWS\System32\drivers\sbapifs.sys
[2009.12.05 09:53:45 | 00,013,360 | ---- | C] (Sunbelt Software) -- C:\WINDOWS\System32\drivers\sbaphd.sys
[2009.12.05 09:44:19 | 00,000,000 | RH-D | C] -- C:\Documents and Settings\Felhasznalo\Recent
[2009.12.05 07:39:07 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Felhasznalo\Application Data\Sunbelt
[2009.12.05 07:39:03 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sunbelt
[2009.12.05 07:38:54 | 00,000,000 | ---D | C] -- C:\Program Files\Sunbelt Software
[2009.12.04 23:18:51 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Felhasznalo\Application Data\QuickScan
[2009.12.04 19:25:58 | 00,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}
[2009.11.30 23:03:54 | 00,000,000 | -HSD | C] -- C:\Documents and Settings\All Users\Dokumentumok\Settings
[2009.11.29 19:01:16 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Google

========== Files - Modified Within 30 Days ==========

[2009.12.06 16:15:34 | 00,350,196 | ---- | M] () -- C:\WINDOWS\System32\vsconfig.xml
[2009.12.06 16:15:13 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009.12.06 16:15:03 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009.12.06 16:14:14 | 11,272,192 | -H-- | M] () -- C:\Documents and Settings\Felhasznalo\NTUSER.DAT
[2009.12.06 16:12:59 | 00,000,282 | ---- | M] () -- C:\WINDOWS\tasks\Uniblue SpeedUpMyPC Nag.job
[2009.12.05 22:14:19 | 00,002,487 | ---- | M] () -- C:\Documents and Settings\Felhasznalo\Asztal\Microsoft Office Word 2003.lnk
[2009.12.05 22:12:15 | 00,000,704 | ---- | M] () -- C:\Documents and Settings\All Users\Asztal\Malwarebytes' Anti-Malware.lnk
[2009.12.05 22:11:26 | 04,844,264 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Felhasznalo\Asztal\mbam-setup.exe
[2009.12.05 13:07:09 | 00,532,480 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Felhasznalo\Asztal\OTS.exe
[2009.12.05 12:26:45 | 02,672,312 | ---- | M] () -- C:\Documents and Settings\Felhasznalo\Asztal\esetsmartinstaller_enu.exe
[2009.12.05 11:14:09 | 00,343,040 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Felhasznalo\Asztal\TFC.exe
[2009.12.05 10:32:55 | 00,000,458 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2009.12.05 10:30:33 | 00,015,880 | ---- | M] () -- C:\WINDOWS\System32\lsdelete.exe
[2009.12.05 10:27:21 | 00,000,875 | ---- | M] () -- C:\Documents and Settings\All Users\Asztal\Ad-Aware.lnk
[2009.12.05 10:14:25 | 00,000,925 | ---- | M] () -- C:\Documents and Settings\Felhasznalo\Asztal\Revo Uninstaller.lnk
[2009.12.05 10:14:11 | 01,079,272 | ---- | M] () -- C:\Documents and Settings\Felhasznalo\Asztal\revosetup.exe
[2009.12.05 07:38:58 | 00,001,777 | ---- | M] () -- C:\Documents and Settings\All Users\Asztal\CounterSpy.lnk
[2009.12.04 22:33:18 | 00,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2009.12.03 20:56:11 | 00,001,439 | ---- | M] () -- C:\WINDOWS\pstudio.ini
[2009.12.03 16:14:06 | 00,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009.12.03 16:13:56 | 00,019,160 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2009.12.03 15:53:40 | 00,095,360 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\atapi.sys
[2009.12.01 18:19:37 | 00,008,975 | ---- | M] () -- C:\WINDOWS\System32\QuickTime.qtp
[2009.12.01 08:37:23 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009.11.30 20:33:49 | 00,002,904 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2009.11.30 18:34:11 | 00,051,200 | ---- | M] () -- C:\Documents and Settings\Felhasznalo\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.11.30 12:16:53 | 00,002,283 | ---- | M] () -- C:\Documents and Settings\All Users\Asztal\Skype.lnk
[2009.11.28 21:33:18 | 00,006,656 | ---- | M] (RealNetworks, Inc.) -- C:\WINDOWS\System32\pndx5016.dll
[2009.11.28 21:33:18 | 00,005,632 | ---- | M] (RealNetworks, Inc.) -- C:\WINDOWS\System32\pndx5032.dll
[2009.11.28 21:33:17 | 00,278,528 | ---- | M] (Real Networks, Inc) -- C:\WINDOWS\System32\pncrt.dll
[2009.11.25 00:54:29 | 01,280,480 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\aswBoot.exe
[2009.11.25 00:51:09 | 00,093,424 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2009.11.25 00:50:59 | 00,094,160 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2009.11.25 00:50:12 | 00,114,768 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2009.11.25 00:50:00 | 00,020,560 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2009.11.25 00:49:07 | 00,048,560 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2009.11.25 00:48:57 | 00,023,120 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2009.11.25 00:47:54 | 00,027,408 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2009.11.25 00:47:28 | 00,097,480 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\AvastSS.scr
[2009.11.19 08:27:35 | 00,006,472 | ---- | M] () -- C:\Documents and Settings\Felhasznalo\Application Data\PrimoPDFSet.xml
[2009.11.17 10:47:52 | 00,052,968 | ---- | M] () -- C:\Documents and Settings\Felhasznalo\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2009.11.12 10:56:26 | 01,513,136 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009.11.11 08:43:28 | 00,026,560 | ---- | M] () -- C:\WINDOWS\gib00001.hst
[2009.11.11 08:43:28 | 00,000,151 | ---- | M] () -- C:\WINDOWS\GIB30_32.INI

========== Files Created - No Company Name ==========

[2009.12.05 22:12:15 | 00,000,704 | ---- | C] () -- C:\Documents and Settings\All Users\Asztal\Malwarebytes' Anti-Malware.lnk
[2009.12.05 12:26:28 | 02,672,312 | ---- | C] () -- C:\Documents and Settings\Felhasznalo\Asztal\esetsmartinstaller_enu.exe
[2009.12.05 11:07:29 | 00,015,880 | ---- | C] () -- C:\WINDOWS\System32\lsdelete.exe
[2009.12.05 10:27:21 | 00,000,875 | ---- | C] () -- C:\Documents and Settings\All Users\Asztal\Ad-Aware.lnk
[2009.12.05 10:14:25 | 00,000,925 | ---- | C] () -- C:\Documents and Settings\Felhasznalo\Asztal\Revo Uninstaller.lnk
[2009.12.05 10:14:03 | 01,079,272 | ---- | C] () -- C:\Documents and Settings\Felhasznalo\Asztal\revosetup.exe
[2009.12.05 07:38:58 | 00,001,777 | ---- | C] () -- C:\Documents and Settings\All Users\Asztal\CounterSpy.lnk
[2009.07.22 19:58:47 | 00,000,000 | ---- | C] () -- C:\WINDOWS\iplayer.INI
[2009.06.07 16:08:34 | 00,001,755 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\tmp4FA.log
[2009.06.06 15:56:23 | 00,001,755 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\tmp713.log
[2009.06.06 15:55:37 | 00,001,755 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\tmp70E.log
[2009.06.06 15:54:49 | 00,001,755 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\tmp709.log
[2009.06.06 15:52:24 | 00,002,138 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\tmp704.log
[2009.06.06 15:45:24 | 00,002,138 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\tmp6F2.log
[2009.06.06 15:41:59 | 00,002,138 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\tmp6ED.log
[2009.06.06 15:40:29 | 00,002,138 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\tmp6E8.log
[2009.06.06 13:18:06 | 00,002,138 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\tmp577.log
[2009.06.06 13:17:02 | 00,002,138 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\tmp572.log
[2009.06.06 13:08:09 | 00,002,138 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\tmp55C.log
[2009.06.06 13:06:56 | 00,002,138 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\tmp553.log
[2009.05.21 11:11:03 | 00,001,196 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\tmp2B2.log
[2009.05.15 14:33:51 | 00,001,962 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\tmp334.log
[2009.05.15 14:29:28 | 00,001,962 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\tmp32F.log
[2009.05.15 14:28:39 | 00,001,962 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\tmp327.log
[2009.04.29 22:43:19 | 00,006,472 | ---- | C] () -- C:\Documents and Settings\Felhasznalo\Application Data\PrimoPDFSet.xml
[2009.04.26 21:24:46 | 00,176,235 | ---- | C] () -- C:\WINDOWS\System32\Primomonnt.dll
[2009.03.09 22:59:05 | 00,000,347 | ---- | C] () -- C:\WINDOWS\SoftWriting.ini
[2009.03.03 18:44:37 | 00,290,816 | ---- | C] () -- C:\WINDOWS\System32\decdll.dll
[2009.01.05 15:44:10 | 00,000,453 | ---- | C] () -- C:\WINDOWS\bdoscandellang.ini
[2008.12.01 19:07:41 | 00,000,054 | ---- | C] () -- C:\WINDOWS\wcx_ftp.ini
[2008.10.30 19:31:05 | 00,000,000 | ---- | C] () -- C:\WINDOWS\mngui.INI
[2008.08.01 14:21:59 | 00,000,134 | ---- | C] () -- C:\Documents and Settings\Felhasznalo\Local Settings\Application Data\fusioncache.dat
[2008.04.28 17:13:33 | 00,000,310 | ---- | C] () -- C:\WINDOWS\primopdf.ini
[2008.03.04 18:52:34 | 00,286,720 | ---- | C] () -- C:\WINDOWS\System32\libcurl.dll
[2007.12.21 12:02:42 | 00,000,377 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2007.11.06 16:39:39 | 00,004,096 | -H-- | C] () -- C:\Documents and Settings\Felhasznalo\Local Settings\Application Data\keyfile3.drm
[2007.10.31 09:39:54 | 00,059,904 | ---- | C] () -- C:\WINDOWS\System32\zlib1.dll
[2007.10.23 16:06:06 | 00,004,081 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2007.09.29 15:50:27 | 00,000,000 | ---- | C] () -- C:\WINDOWS\graphedit.INI
[2007.09.19 16:02:02 | 00,796,048 | ---- | C] () -- C:\WINDOWS\System32\libeay32_0.9.6l.dll
[2007.09.16 15:57:05 | 00,090,112 | ---- | C] () -- C:\WINDOWS\System32\CmdLineExt.dll
[2007.09.16 15:41:26 | 00,000,151 | ---- | C] () -- C:\WINDOWS\GIB30_32.INI
[2007.09.16 13:11:00 | 00,001,439 | ---- | C] () -- C:\WINDOWS\pstudio.ini
[2007.09.16 13:11:00 | 00,000,028 | ---- | C] () -- C:\WINDOWS\album.ini
[2007.09.16 13:10:59 | 00,000,021 | ---- | C] () -- C:\WINDOWS\Ps_setup.ini
[2007.09.16 09:31:51 | 00,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2007.09.16 09:31:45 | 00,051,200 | ---- | C] () -- C:\Documents and Settings\Felhasznalo\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007.09.14 09:28:47 | 00,000,388 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2007.09.14 08:35:34 | 00,001,043 | ---- | C] () -- C:\WINDOWS\WINCMD.INI
[2007.05.17 13:58:10 | 00,143,360 | ---- | C] () -- C:\WINDOWS\System32\libexpatw.dll
[2007.04.19 23:05:00 | 01,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2007.04.19 23:05:00 | 01,474,560 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2007.04.19 23:05:00 | 01,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2007.04.19 23:05:00 | 00,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2007.04.19 23:05:00 | 00,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2007.03.29 22:00:40 | 00,203,264 | R--- | C] () -- C:\WINDOWS\System32\CddbCdda.dll
[2004.08.31 10:32:48 | 00,327,680 | ---- | C] () -- C:\WINDOWS\System32\QFClient2.dll
[2003.04.10 12:01:36 | 00,005,581 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

========== Files - Unicode (All) ==========
[2007.11.25 17:25:32 | 00,000,000 | ---D | M](C:\?) -- C:\Д
[2007.11.25 17:25:32 | 00,000,000 | ---D | C](C:\?) -- C:\Д
[2007.11.15 08:29:00 | 00,000,000 | ---D | M](C:\m?) -- C:\m҉
[2007.11.15 08:29:00 | 00,000,000 | ---D | C](C:\m?) -- C:\m҉
< End of report >


ESET log:

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# IEXPLORE.EXE=7.00.6000.16915 (vista_gdr.090826-0339)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=b3b775a0071762489ad1168ec0340630
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2009-12-06 04:09:45
# local_time=2009-12-06 05:09:45 )
# country="Hungary"
# lang=1033
# osver=5.1.2600 NT Szervizcsomag 2
# compatibility_mode=256 16777215 100 0 122315 122315 0 0
# compatibility_mode=769 16775125 100 98 3720 196402203 5416 0
# compatibility_mode=8192 67108863 100 0 105038 105038 0 0
# compatibility_mode=9217 16777214 100 77 22012059 44526737 0 0
# scanned=58863
# found=0
# cleaned=0
# scan_time=1944



#6 krumpli

krumpli
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Hungary
  • Local time:06:20 AM

Posted 06 December 2009 - 12:27 PM

I forgot to add, Avast sends the warning messages only if I'm connected to the internet. I don't know if this has any relevance :(

Before I got rid of the malwares I mentioned in my first post, the computer was working really slowly, since then it works fine. Well, besides the ongoing warning messages :(

Edited by krumpli, 06 December 2009 - 12:28 PM.


#7 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:12:20 AM

Posted 07 December 2009 - 12:05 AM

Please do not enclose the log files with code/quote tags. It makes them more difficult to read. Just copy and paste them directly into your post.

Can you give more information about what Avast is detecting?
Tell me precisely what it says when the warning messages pop up.
Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#8 krumpli

krumpli
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Hungary
  • Local time:06:20 AM

Posted 07 December 2009 - 06:12 AM

Avast identifies the trojan as Win32:Unruy-E [Trj], always detects in C:\WINDOWS\TEMP, the sub-folder is every time different though.

Here are the gist of the message sent at 8:23 (UTC+1):

File name: C:\WINDOWS\TEMP\vniw.tmp\svchost.exe
Malware name: Win32:Unruy-E [Trj]
Malware type: Trojan Horse
VPS version: 091206-1, 2009.12.06

I monitored the messages over a 30 minute time period, the malware name and type were always the same, the sub-folders in which Avast detected the malware are the following:

8:29
C:\WINDOWS\TEMP\dwqe.tmp\svchost.exe

8:35
C:\WINDOWS\TEMP\xvmt.tmp\svchost.exe

8:41
C:\WINDOWS\TEMP\sxkn.tmp\svchost.exe

8:46
C:\WINDOWS\TEMP\xego.tmp\svchost.exe

8:51
C:\WINDOWS\TEMP\pjul.tmp\svchost.exe

I attached a screenshot of one of the messages.

Sorry for the quote tags :(

Attached Files



#9 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:12:20 AM

Posted 07 December 2009 - 08:13 AM

Please download ComboFix from one of these locations:

Link 1
Link 2
Link 3

Important!
You should NOT use Combofix unless you have been instructed to do so by a Malware Removal Expert.
It is intended by its creator to be used under the guidance and supervision of an Malware Removal Expert, not for private use.
Using this tool incorrectly could lead to disastrous problems with your operating system such as preventing it from ever starting again.



Make sure that you save ComboFix.exe to your Desktop
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


Posted Image


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Posted Image


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please copy and paste the contents of C:\ComboFix.txt in your next reply.
Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#10 krumpli

krumpli
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Hungary
  • Local time:06:20 AM

Posted 07 December 2009 - 01:08 PM

I ran ComboFix, as you requested, the log report is below.

When I started to run ComboFix, after installing Recovery Console, a message showed up saying ComboFix detected rootkit activity, and needs to restart the computer. While trying to reboot, the computer froze, and I needed to restart manually. After restart ComboFix automatically started Autoscan. After finishing with Stage_6A, a message popped up saying PEV.exe registered some kind of problem and needs to shut down. After closing that window, ComboFix continued the scan.

After the scan I had trouble with re-activating Avast resident protection, I had to repair it using Control Panel/Add Remove Programs.

Since the scan and the re-activation, Avast stopped sending the warning messages about Unruy-E.

Here is the ComboFix report:

ComboFix 09-12-06.A3 - Felhasznalo 009.12.07. 17:48.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1250.36.1038.18.2046.1452 [GMT 1:00]
Running from: e:\progik\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 091207-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Search Settings
c:\program files\Search Settings\kb127\SearchSettings.dll
c:\program files\Search Settings\kb127\SearchSettingsRes409.dll
c:\program files\Search Settings\SearchSettings.exe
c:\windows\system32\twain_32.dll

Infected copy of c:\windows\system32\DRIVERS\atapi.sys was found and disinfected
Restored copy from - Kitty ate it :(
.
((((((((((((((((((((((((( Files Created from 2009-11-07 to 2009-12-07 )))))))))))))))))))))))))))))))
.

2009-12-05 21:12 . 2009-12-05 21:12 -------- d-----w- c:\documents and settings\Felhasznalo\Application Data\Malwarebytes
2009-12-05 21:12 . 2009-12-03 15:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-05 21:12 . 2009-12-05 21:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-12-05 21:12 . 2009-12-05 21:12 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-12-05 21:12 . 2009-12-03 15:13 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-05 13:21 . 2009-12-05 13:23 -------- d-----w- c:\windows\BDOSCAN8
2009-12-05 11:26 . 2009-12-05 11:26 -------- d-----w- c:\program files\ESET
2009-12-05 10:07 . 2009-12-05 09:30 15880 ----a-w- c:\windows\system32\lsdelete.exe
2009-12-05 09:30 . 2009-09-23 12:55 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2009-12-05 09:30 . 2009-12-05 09:30 862040 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\threatwork.exe
2009-12-05 09:30 . 2009-12-05 09:30 15880 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lsdelete.exe
2009-12-05 09:30 . 2009-12-05 09:30 206944 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavamessage.dll
2009-12-05 09:30 . 2009-12-05 09:30 390288 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavalicense.dll
2009-12-05 09:30 . 2009-12-05 09:30 537576 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\aawapi.dll
2009-12-05 09:30 . 2009-12-05 09:30 370744 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\UpdateManager.dll
2009-12-05 09:30 . 2009-12-05 09:30 163728 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\ShellExt.dll
2009-12-05 09:30 . 2009-12-05 09:30 194104 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Savapibridge.dll
2009-12-05 09:29 . 2009-12-05 09:29 5908024 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Resources.dll
2009-12-05 09:29 . 2009-12-05 09:29 327000 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\RPAPI.dll
2009-12-05 09:29 . 2009-12-05 09:29 87496 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\PrivacyClean.dll
2009-12-05 09:29 . 2009-12-05 09:29 933120 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\CEAPI.dll
2009-12-05 09:29 . 2009-12-05 09:29 641632 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AutoLaunch.exe
2009-12-05 09:29 . 2009-12-05 09:29 816272 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe
2009-12-05 09:29 . 2009-12-05 09:29 822904 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe
2009-12-05 09:29 . 2009-12-05 09:29 1638640 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe
2009-12-05 09:29 . 2009-12-05 09:29 788880 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWTray.exe
2009-12-05 09:29 . 2009-12-05 09:29 1184912 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe
2009-12-05 09:27 . 2009-10-03 08:15 2924848 -c--a-w- c:\documents and settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}\Ad-AwareInstallation.exe
2009-12-05 09:14 . 2009-12-05 09:14 -------- d-----w- c:\program files\VS Revo Group
2009-12-05 08:53 . 2009-08-10 19:06 69936 ----a-w- c:\windows\system32\drivers\sbapifs.sys
2009-12-05 08:53 . 2009-05-13 16:30 13360 ----a-w- c:\windows\system32\drivers\sbaphd.sys
2009-12-05 06:39 . 2009-12-05 06:39 -------- d-----w- c:\documents and settings\Felhasznalo\Application Data\Sunbelt
2009-12-05 06:39 . 2009-12-05 06:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Sunbelt
2009-12-05 06:38 . 2009-12-05 06:38 -------- d-----w- c:\program files\Sunbelt Software
2009-12-04 22:18 . 2009-12-04 22:21 -------- d-----w- c:\documents and settings\Felhasznalo\Application Data\QuickScan
2009-12-04 22:18 . 2009-11-26 16:39 678912 ----a-w- c:\documents and settings\Felhasznalo\Application Data\Mozilla\Firefox\Profiles\sfuid17m.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\bdqscan.dll
2009-12-04 22:18 . 2009-11-26 16:37 768512 ----a-w- c:\documents and settings\Felhasznalo\Application Data\Mozilla\Firefox\Profiles\sfuid17m.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
2009-12-04 18:25 . 2009-12-05 09:27 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-07 11:52 . 2004-08-03 21:59 95360 ----a-w- c:\windows\system32\drivers\atapi.sys
2009-12-05 09:27 . 2007-11-11 12:22 -------- d-----w- c:\program files\Lavasoft
2009-12-05 09:27 . 2007-11-11 12:22 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-12-05 08:08 . 2007-12-16 17:03 25222763 -c--a-w- c:\windows\Internet Logs\tvDebug.zip
2009-12-04 17:42 . 2007-11-11 12:34 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-12-03 09:48 . 2008-01-17 09:32 -------- d-----w- c:\documents and settings\Felhasznalo\Application Data\uTorrent
2009-11-30 22:39 . 2009-10-31 10:26 -------- d-----w- c:\documents and settings\Felhasznalo\Application Data\Skype
2009-11-30 15:07 . 2009-10-31 10:33 -------- d-----w- c:\documents and settings\Felhasznalo\Application Data\skypePM
2009-11-29 18:09 . 2007-10-13 10:12 -------- d-----w- c:\program files\Google
2009-11-29 18:07 . 2007-09-14 06:32 -------- d-----w- c:\program files\Common Files\InstallShield
2009-11-29 18:07 . 2007-09-14 06:33 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-11-29 18:05 . 2009-10-01 16:46 -------- d-----w- c:\program files\OpenOffice.org 3
2009-11-28 20:33 . 2007-10-21 10:48 -------- d-----w- c:\program files\Common Files\Real
2009-11-24 23:54 . 2008-09-13 09:11 1280480 ----a-w- c:\windows\system32\aswBoot.exe
2009-11-24 23:51 . 2008-09-13 09:11 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-11-24 23:50 . 2008-09-13 09:11 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-11-24 23:50 . 2008-09-13 09:11 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-11-24 23:50 . 2008-09-13 09:11 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-11-24 23:49 . 2008-09-13 09:11 48560 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-11-24 23:48 . 2008-09-13 09:11 23120 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-11-24 23:47 . 2008-09-13 09:11 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-11-24 23:47 . 2008-09-13 09:11 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-11-17 09:47 . 2007-09-14 07:32 52968 -c--a-w- c:\documents and settings\Felhasznalo\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-05 22:59 . 2008-02-27 15:50 -------- d-----w- c:\program files\Windows Live
2009-11-05 22:58 . 2009-11-05 22:58 -------- d-----w- c:\program files\Microsoft
2009-11-05 22:58 . 2009-11-05 22:58 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-11-05 15:38 . 2009-10-01 16:50 1 ----a-w- c:\documents and settings\Felhasznalo\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-10-31 10:33 . 2009-10-31 10:33 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-10-31 10:26 . 2009-10-31 10:26 -------- d-----r- c:\program files\Skype
2009-10-31 10:26 . 2009-10-31 10:26 -------- d-----w- c:\program files\Common Files\Skype
2009-10-31 10:26 . 2009-10-31 10:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2009-10-27 08:37 . 2009-10-27 08:37 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-10-27 08:37 . 2007-10-13 10:11 -------- d-----w- c:\program files\Java
2009-10-27 08:36 . 2009-10-27 08:36 152576 ----a-w- c:\documents and settings\Felhasznalo\Application Data\Sun\Java\jre1.6.0_16\lzma.dll
2009-10-25 08:09 . 2001-10-26 12:00 449926 ----a-w- c:\windows\system32\perfh00E.dat
2009-10-25 08:09 . 2001-10-26 12:00 100880 ----a-w- c:\windows\system32\perfc00E.dat
2009-10-17 14:50 . 2007-09-17 19:39 -------- d-----w- c:\documents and settings\Felhasznalo\Application Data\Canon
2009-09-11 14:35 . 2004-08-17 15:47 133632 ----a-w- c:\windows\system32\msv1_0.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-10-16 17:22 333192 ----a-w- c:\program files\AskBardis\bar\bin\askBar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-10-16 333192]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-10-16 333192]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-04-12 16132608]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-04-19 8429568]
"nwiz"="nwiz.exe" [2007-04-19 1626112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-04-19 81920]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-09 153136]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-11-16 98304]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-04-26 185896]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-02-15 981384]
"SBAMTray"="c:\program files\Sunbelt Software\CounterSpy\SBAMTray.exe" [2009-09-04 685352]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-17 15360]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBAMSvc]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009.12.05. 10:30 64288]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008.09.13. 10:11 114768]
R1 sbaphd;sbaphd;c:\windows\system32\drivers\sbaphd.sys [2009.12.05. 9:53 13360]
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [2009.08.05. 15:58 93872]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008.09.13. 10:11 20560]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009.09.24. 12:17 1184912]
R2 SBAMSvc;CounterSpy Antispyware;c:\program files\Sunbelt Software\CounterSpy\SBAMSvc.exe [2009.09.04. 11:10 1012040]
R2 sbapifs;sbapifs;c:\windows\system32\drivers\sbapifs.sys [2009.12.05. 9:53 69936]
S3 iatmunin;iatmunin;\??\c:\docume~1\FELHAS~1\LOCALS~1\Temp\iatmunin.sys --> c:\docume~1\FELHAS~1\LOCALS~1\Temp\iatmunin.sys [?]
S4 ASKService;ASKService;c:\program files\AskBardis\bar\bin\AskService.exe [2009.03.26. 23:09 464264]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Download with Xilisoft YouTube Video Converter - c:\program files\Xilisoft\YouTube Video Converter\upod_link.HTM
IE: E&xportálás Microsoft Excel formátumba - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Felhasznalo\Application Data\Mozilla\Firefox\Profiles\sfuid17m.default\
FF - prefs.js: browser.search.defaulturl -
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - google.com
FF - prefs.js: keyword.URL - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=19&tid={48C4152F-4625-DE22-8525-3EA6F6EC35F7}&q=
FF - component: c:\documents and settings\Felhasznalo\Application Data\Mozilla\Firefox\Profiles\sfuid17m.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\bdqscan.dll
FF - plugin: c:\documents and settings\Felhasznalo\Application Data\Mozilla\Firefox\Profiles\sfuid17m.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Opera\program\plugins\np_gp.dll
FF - plugin: c:\program files\Veetle\plugins\npVeetle.dll
FF - plugin: c:\program files\Veetle\VLC\npvlc.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

AddRemove-Adobe SVG Viewer - c:\program files\Common Files\Adobe\SVG Viewer 3.0\Uninstall\Winstall.exe -u -fc:\program files\Common Files\Adobe\SVG Viewer 3.0\Uninstall\Install.log
AddRemove-ArcSoft PhotoStudio 2000 - c:\windows\IsUninst.exe -fc:\program files\ArcSoft\PhotoStudio 2000\Uninst.isu
AddRemove-{C427E746-4EC9-4E3C-AACB-C6BB1F714D7F} - c:\documents and settings\All Users\Application Data\{66E2F539-12B6-4870-A500-7689CDE75C5E}\DriverScanner_Setup.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-07 18:02
Windows 5.1.2600 Szervizcsomag 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-12-07 18:04
ComboFix-quarantined-files.txt 2009-12-07 17:04

Pre-Run: 20 393 385 984 bájt szabad
Post-Run: 20 357 148 672 bájt szabad

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional - magyar" /fastdetect /NoExecute=OptOut

- - End Of File - - A8127C91DBA08BB0F8DD843F7F5BE732

#11 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:12:20 AM

Posted 07 December 2009 - 07:08 PM

Looks good to me!

It's time to clean up.
  • Double-click OTL.exe to run it.
  • Click on the CleanUp! button
  • You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.


================




Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
  • Disable and Enable System Restore. - You should disable and reenable system restore to make sure there are no infected files found in a restore point left over from what we have just cleaned.

    You can find instructions on how to enable and reenable system restore here:

    Windows XP System Restore Guide

    Renable system restore with instructions from tutorial above

  • Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

    See this link for a listing of some online & their stand-alone antivirus programs:

    Virus, Spyware, and Malware Protection and Removal Resources

  • Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

  • Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.

    For a tutorial on Firewalls and a listing of some available ones see the link below:

    Understanding and Using Firewalls

  • Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

  • Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.

    A tutorial on installing & using this product can be found here:

    Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers

  • Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

    A tutorial on installing & using this product can be found here:

    Using SpywareBlaster to protect your computer from Spyware and Malware

  • Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
Follow this list and your potential for being infected again will reduce dramatically.

:( :(
Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#12 krumpli

krumpli
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Hungary
  • Local time:06:20 AM

Posted 08 December 2009 - 09:12 AM

Thank you so much Sam, everything works fine. :( :(

Edited by krumpli, 08 December 2009 - 09:13 AM.


#13 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:12:20 AM

Posted 08 December 2009 - 09:58 AM

I'm glad I could help you out! :(

Now that your problem appears to be resolved, this topic will be closed. If you need this topic reopened, please contact a member of the HJT Team and we will reopen it for you. Include the address of this topic in your request.
Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users