Bonjour a tous
Suite a un disfonctionement de mon PC (XP PRO pack 2) horloge fausse, lanteur system, browser qui plante souvant, jai efectuer un ComboFix
jaimerais savoir votre suggestion
Merci
ComboFix 12-02-25.02 - Administrator 02/27/2012 12:12:52.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1255.972.1037.18.2037.1449 [GMT 2:00]
Running from: f:\soft\ComboFix.exe
AV: ESET NOD32 Antivirus 4.0 *Enabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\LOG3E1.tmp
C:\LOG50.tmp
c:\windows\system32\awgina.dll
.
.
((((((((((((((((((((((((( Files Created from 2012-01-27 to 2012-02-27 )))))))))))))))))))))))))))))))
.
.
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-02-27 08:37 . 2012-02-27 08:37 6651761 ----a-w- C:\GibHugim_1120.Zip
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2007-03-11 . D54B14DC1069FBC5620D10CF2C168C8B . 1547776 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot@2012-02-27_09.45.03 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-02-27 10:16 . 2012-02-27 10:16 16384 c:\windows\Temp\Perflib_Perfdata_4e0.dat
- 2004-08-27 11:00 . 2012-02-27 09:38 60426 c:\windows\system32\perfc00d.dat
+ 2004-08-27 11:00 . 2012-02-27 10:08 60426 c:\windows\system32\perfc00d.dat
- 2004-08-27 11:00 . 2012-02-27 09:38 60500 c:\windows\system32\perfc009.dat
+ 2004-08-27 11:00 . 2012-02-27 10:08 60500 c:\windows\system32\perfc009.dat
+ 2004-08-27 11:00 . 2012-02-27 10:08 316050 c:\windows\system32\perfh00d.dat
- 2004-08-27 11:00 . 2012-02-27 09:38 316050 c:\windows\system32\perfh00d.dat
- 2004-08-27 11:00 . 2012-02-27 09:38 397122 c:\windows\system32\perfh009.dat
+ 2004-08-27 11:00 . 2012-02-27 10:08 397122 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{f228c6a4-a593-4017-944c-4e7958fb3177}"= "c:\program files\Radio_G\prxtbRad0.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{f228c6a4-a593-4017-944c-4e7958fb3177}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{f228c6a4-a593-4017-944c-4e7958fb3177}]
2011-05-09 09:49 176936 ----a-w- c:\program files\Radio_G\prxtbRad0.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{f228c6a4-a593-4017-944c-4e7958fb3177}"= "c:\program files\Radio_G\prxtbRad0.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{f228c6a4-a593-4017-944c-4e7958fb3177}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{F228C6A4-A593-4017-944C-4E7958FB3177}"= "c:\program files\Radio_G\prxtbRad0.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{f228c6a4-a593-4017-944c-4e7958fb3177}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2008-02-13 16857600]
"Xerox Common SM2"="c:\windows\Xerox\ComSMMgr2\ssmmgr.exe" [2005-04-28 372736]
"Xerox PanelMgr"="c:\windows\Xerox\PanelMgr\SSMMgr.exe" [2010-01-25 557056]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-11-16 2054360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-27 15360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PCANotify]
2001-11-02 08:50 24636 ----a-w- c:\windows\system32\PCANotify.dll
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^����� �����^�������^�����^InterVideo WinCinema Manager.lnk]
path=c:\documents and settings\All Users\����� �����\�������\�����\InterVideo WinCinema Manager.lnk
backup=c:\windows\pss\InterVideo WinCinema Manager.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GEST]
m �|\� [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-03 07:37 843712 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-09-07 22:58 37296 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2007-06-01 08:21 153136 ----a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2007-09-05 09:13 166424 ----a-r- c:\windows\system32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2007-09-05 09:13 141848 ----a-r- c:\windows\system32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-01 13:57 153136 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2007-09-05 09:13 137752 ----a-r- c:\windows\system32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"XAudioService"=2 (0x2)
"WMPNetworkSvc"=3 (0x3)
"TeamViewer4"=2 (0x2)
"NMIndexingService"=3 (0x3)
"NBService"=3 (0x3)
"MDM"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Symantec\\pcAnywhere\\WINAW32.EXE"=
"c:\\Program Files\\Symantec\\pcAnywhere\\AWHOST32.EXE"=
"c:\\Program Files\\Symantec\\pcAnywhere\\awrem32.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\ViewPower\\jre\\bin\\javaw.exe"=
.
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [16/11/09 09:03 108792]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [16/11/09 09:06 96408]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [16/11/09 09:04 735960]
S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys --> c:\windows\system32\Drivers\SSPORT.sys [?]
S3 SM_3500_FUService;Phaser 3500 Status Monitor Service;"c:\program files\Xerox\Phaser 3500\CommonSM\ssmsrvc /Service --> c:\program files\Xerox\Phaser 3500\CommonSM\ssmsrvc [?]
S4 TeamViewer4;TeamViewer 4;c:\program files\TeamViewer\Version4\TeamViewer_Service.exe [27/05/09 14:38 185640]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.walla.co.il/
uInternet Connection Wizard,ShellNext = iexplore
IE: &��� �- Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.115.106.10 62.219.186.7
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\wccx7atz.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.il/
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2012-02-27 12:17
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SM_3500_FUService]
"ImagePath"="\"c:\program files\Xerox\Phaser 3500\CommonSM\ssmsrvc /Service"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-1645522239-329068152-839522115-500\Software\Microsoft\ M*i*c*r*o*s*o*f*t* *M*a*n*a*g*e*m*e*n*t* *C*o*n*s*o*l*e*\Recent File List]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"File1"="c:\\WINDOWS\\system32\\devmgmt.msc"
"File2"="c:\\WINDOWS\\system32\\compmgmt.msc"
"File3"="c:\\WINDOWS\\system32\\certmgr.msc"
"File4"="c:\\WINDOWS\\system32\\dfrg.msc"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(3288)
c:\progra~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
c:\program files\Common Files\Microsoft Shared\Web Components\10\1037\OWCI10.DLL
c:\progra~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
c:\program files\Common Files\Microsoft Shared\Web Components\11\1037\OWCI11.DLL
c:\windows\system32\MSCTF.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\msls31.dll
c:\windows\system32\shdoclc.dll
c:\windows\system32\msimtf.dll
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\RTHDCPL.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2012-02-27 12:18:21 - machine was rebooted
ComboFix-quarantined-files.txt 2012-02-27 10:18
ComboFix2.txt 2012-02-27 09:46
.
Pre-Run: 53,557,465,088 bytes free
Post-Run: 53,479,415,808 bytes free
.
- - End Of File - - BAC28D1FAA074C400E9214487ABA2351
