caravilio

Bonjour a tous Suite a un disfonctionement de mon PC (XP PRO pack 2) horloge fausse, lanteur system, browser qui plante souvant, jai efectuer un ComboFix jaimerais savoir votre suggestion Merci ComboFix 12-02-25.02 - Administrator 02/27/2012 12:12:52.2.2 - x86 Microsoft Windows XP Professional 5.1.2600.2.1255.972.1037.18.2037.1449 [GMT 2:00] Running from: f:\soft\ComboFix.exe AV: ESET NOD32 Antivirus 4.0 *Enabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . C:\LOG3E1.tmp C:\LOG50.tmp c:\windows\system32\awgina.dll . . ((((((((((((((((((((((((( Files Created from 2012-01-27 to 2012-02-27 ))))))))))))))))))))))))))))))) . . . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-02-27 08:37 . 2012-02-27 08:37 6651761 ----a-w- C:\GibHugim_1120.Zip . . ------- Sigcheck ------- Note: Unsigned files aren't necessarily malware. . [-] 2007-03-11 . D54B14DC1069FBC5620D10CF2C168C8B . 1547776 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll . ((((((((((((((((((((((((((((( SnapShot@2012-02-27_09.45.03 ))))))))))))))))))))))))))))))))))))))))) . + 2012-02-27 10:16 . 2012-02-27 10:16 16384 c:\windows\Temp\Perflib_Perfdata_4e0.dat - 2004-08-27 11:00 . 2012-02-27 09:38 60426 c:\windows\system32\perfc00d.dat + 2004-08-27 11:00 . 2012-02-27 10:08 60426 c:\windows\system32\perfc00d.dat - 2004-08-27 11:00 . 2012-02-27 09:38 60500 c:\windows\system32\perfc009.dat + 2004-08-27 11:00 . 2012-02-27 10:08 60500 c:\windows\system32\perfc009.dat + 2004-08-27 11:00 . 2012-02-27 10:08 316050 c:\windows\system32\perfh00d.dat - 2004-08-27 11:00 . 2012-02-27 09:38 316050 c:\windows\system32\perfh00d.dat - 2004-08-27 11:00 . 2012-02-27 09:38 397122 c:\windows\system32\perfh009.dat + 2004-08-27 11:00 . 2012-02-27 10:08 397122 c:\windows\system32\perfh009.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{f228c6a4-a593-4017-944c-4e7958fb3177}"= "c:\program files\Radio_G\prxtbRad0.dll" [2011-05-09 176936] . [HKEY_CLASSES_ROOT\clsid\{f228c6a4-a593-4017-944c-4e7958fb3177}] . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{f228c6a4-a593-4017-944c-4e7958fb3177}] 2011-05-09 09:49 176936 ----a-w- c:\program files\Radio_G\prxtbRad0.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{f228c6a4-a593-4017-944c-4e7958fb3177}"= "c:\program files\Radio_G\prxtbRad0.dll" [2011-05-09 176936] . [HKEY_CLASSES_ROOT\clsid\{f228c6a4-a593-4017-944c-4e7958fb3177}] . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{F228C6A4-A593-4017-944C-4E7958FB3177}"= "c:\program files\Radio_G\prxtbRad0.dll" [2011-05-09 176936] . [HKEY_CLASSES_ROOT\clsid\{f228c6a4-a593-4017-944c-4e7958fb3177}] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [2008-02-13 16857600] "Xerox Common SM2"="c:\windows\Xerox\ComSMMgr2\ssmmgr.exe" [2005-04-28 372736] "Xerox PanelMgr"="c:\windows\Xerox\PanelMgr\SSMMgr.exe" [2010-01-25 557056] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712] "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-11-16 2054360] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-27 15360] . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PCANotify] 2001-11-02 08:50 24636 ----a-w- c:\windows\system32\PCANotify.dll . [HKLM\~\startupfolder\C:^Documents and Settings^All Users^����� �����^�������^�����^InterVideo WinCinema Manager.lnk] path=c:\documents and settings\All Users\����� �����\�������\�����\InterVideo WinCinema Manager.lnk backup=c:\windows\pss\InterVideo WinCinema Manager.lnkCommon Startup . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GEST] m �|\� [X] . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2012-01-03 07:37 843712 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2011-09-07 22:58 37296 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] 2007-06-01 08:21 153136 ----a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds] 2007-09-05 09:13 166424 ----a-r- c:\windows\system32\hkcmd.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray] 2007-09-05 09:13 141848 ----a-r- c:\windows\system32\igfxtray.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] 2007-03-01 13:57 153136 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence] 2007-09-05 09:13 137752 ----a-r- c:\windows\system32\igfxpers.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "XAudioService"=2 (0x2) "WMPNetworkSvc"=3 (0x3) "TeamViewer4"=2 (0x2) "NMIndexingService"=3 (0x3) "NBService"=3 (0x3) "MDM"=2 (0x2) . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Symantec\\pcAnywhere\\WINAW32.EXE"= "c:\\Program Files\\Symantec\\pcAnywhere\\AWHOST32.EXE"= "c:\\Program Files\\Symantec\\pcAnywhere\\awrem32.exe"= "c:\\WINDOWS\\system32\\dpvsetup.exe"= "c:\\Program Files\\ViewPower\\jre\\bin\\javaw.exe"= . R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [16/11/09 09:03 108792] R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [16/11/09 09:06 96408] R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [16/11/09 09:04 735960] S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys --> c:\windows\system32\Drivers\SSPORT.sys [?] S3 SM_3500_FUService;Phaser 3500 Status Monitor Service;"c:\program files\Xerox\Phaser 3500\CommonSM\ssmsrvc /Service --> c:\program files\Xerox\Phaser 3500\CommonSM\ssmsrvc [?] S4 TeamViewer4;TeamViewer 4;c:\program files\TeamViewer\Version4\TeamViewer_Service.exe [27/05/09 14:38 185640] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.walla.co.il/ uInternet Connection Wizard,ShellNext = iexplore IE: &��� �- Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.115.106.10 62.219.186.7 FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\wccx7atz.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.il/ FF - prefs.js: network.proxy.type - 0 FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} FF - Ext: Java Quick Starter: [email protected] - c:\program files\Java\jre6\lib\deploy\jqs\ff . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover Rootkit scan 2012-02-27 12:17 Windows 5.1.2600 Service Pack 2 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SM_3500_FUService] "ImagePath"="\"c:\program files\Xerox\Phaser 3500\CommonSM\ssmsrvc /Service" . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_USERS\S-1-5-21-1645522239-329068152-839522115-500\Software\Microsoft\ M*i*c*r*o*s*o*f*t* *M*a*n*a*g*e*m*e*n*t* *C*o*n*s*o*l*e*\Recent File List] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) "File1"="c:\\WINDOWS\\system32\\devmgmt.msc" "File2"="c:\\WINDOWS\\system32\\compmgmt.msc" "File3"="c:\\WINDOWS\\system32\\certmgr.msc" "File4"="c:\\WINDOWS\\system32\\dfrg.msc" . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'explorer.exe'(3288) c:\progra~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL c:\program files\Common Files\Microsoft Shared\Web Components\10\1037\OWCI10.DLL c:\progra~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL c:\program files\Common Files\Microsoft Shared\Web Components\11\1037\OWCI11.DLL c:\windows\system32\MSCTF.dll c:\progra~1\WINDOW~2\wmpband.dll c:\windows\system32\msls31.dll c:\windows\system32\shdoclc.dll c:\windows\system32\msimtf.dll c:\windows\system32\wpdshserviceobj.dll c:\windows\system32\portabledevicetypes.dll c:\windows\system32\portabledeviceapi.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\RTHDCPL.EXE c:\program files\Java\jre6\bin\jqs.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Completion time: 2012-02-27 12:18:21 - machine was rebooted ComboFix-quarantined-files.txt 2012-02-27 10:18 ComboFix2.txt 2012-02-27 09:46 . Pre-Run: 53,557,465,088 bytes free Post-Run: 53,479,415,808 bytes free . - - End Of File - - BAC28D1FAA074C400E9214487ABA2351