aide sur infections multiples, ...[RESOLU]

rockz · le 27 juin 2007

Bonjour a vous, je viens solliciter votre aide et votre oeil expert pour trouver de l'aide :

Depuis 3 jours, je suis victime d'attaques en regles, et malgres les desinfections multiples (en mode normal et sans echec) les attaques continuent. En vrac Spybot, vundofix,smitfraudfix, adaware, norton, avast, kerio et j'en passe, tous cherchent, trouvent, eliminent sans fin.

Ne sachnt plus quoi faire et ne sachant pas d'ou viennent les attaques, je me tourne vers vous !

Je ne comprends rien a hijackthis, merci d'avance de m'aider a eradiquer ces cochonneries (qui commencent a me rendre dingue), voici mon rapport (du moment...)

merci d'avance,

Logfile of Trend Micro HijackThis v2.0.0 (BETA)

Scan saved at 18:40:41, on 27/06/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\ehome\ehtray.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\RunDLL32.exe

C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe

C:\Acer\Empowering Technology\eRecovery\eRAgent.exe

C:\WINDOWS\Twain_32\FlatBed\HotKey.exe

C:\WINDOWS\system32\SysMonitor.exe

C:\Documents and Settings\All Users\Application Data\gbobwfyx.exe

C:\Acer\Empowering Technology\ePerformance\MemCheck.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe

C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\Tablet.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\system32\dllhost.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe

C:\WINDOWS\system32\WTablet\TabUserW.exe

C:\WINDOWS\system32\Tablet.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe

C:\WINDOWS\eHome\ehmsas.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\Program Files\Outlook Express\msimn.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Documents and Settings\Steve\Bureau\HiJackThis_v2.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://recherche.neuf.fr/ie/default.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://recherche.neuf.fr/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://somethingatthewindow.over-blog.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.fr.acer.yahoo.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://recherche.neuf.fr/ie/default.html

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/def...://fr.yahoo.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {1F6581D5-AA53-4b73-A6F9-41420C6B61F1} - C:\WINDOWS\system32\ebrtivvo.dll

O2 - BHO: (no name) - {2F7B9A47-ADCE-41B6-B644-6CF78195C1EC} - C:\WINDOWS\system32\jkhfe.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: (no name) - {A6807262-1D7A-44AB-947B-23B71E97915C} - C:\WINDOWS\system32\byxutqn.dll

O2 - BHO: (no name) - {EFD3B970-077A-41F2-9C73-2ADDE489501E} - (no file)

O2 - BHO: (no name) - {FDBD0745-CE91-49D4-9CE2-636FBF34922C} - (no file)

O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll

O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe

O4 - HKLM\..\Run: [LaunchApp] Alaunch

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [skyTel] SkyTel.EXE

O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [iMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE

O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC

O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"

O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 1

O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe

O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe /idle

O4 - HKLM\..\Run: [HotKey] C:\WINDOWS\Twain_32\FlatBed\HotKey.exe

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\WINDOWS\system32\SysMonitor.exe

O4 - HKLM\..\Run: [gbobwfyx.exe] C:\Documents and Settings\All Users\Application Data\gbobwfyx.exe

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Acer Empowering Technology.lnk = ?

O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://eu-housecall.trendmicro-europe.com/...ivex/hcImpl.cab

O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.2.100.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.mail.live.com/mail/w1/resources/MSNPUpld.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab

O20 - Winlogon Notify: byxutqn - C:\WINDOWS\SYSTEM32\byxutqn.dll

O20 - Winlogon Notify: jkhfe - C:\WINDOWS\system32\jkhfe.dll

O20 - Winlogon Notify: winzzc32 - C:\WINDOWS\SYSTEM32\winzzc32.dll

O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe

O23 - Service: Service de planification Media Center (ehSched) - Unknown owner - C:\WINDOWS\eHome\ehSched.exe

O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe

O23 - Service: Fax - Unknown owner - C:\WINDOWS\system32\fxssvc.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe

O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe

O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe

O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe

O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe

O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe

O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe

O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe

--

End of file - 11958 bytes

Modifié le 28 juin 2007 par rockz

chercheur · le 27 juin 2007

Bonjour

Bienvenu sur Zebulon.

Télécharge Combofix.exe (par sUBs) sur ton Bureau

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Double clique combofix.exe et suis les invites.

Lorsque le scan sera complété, un rapport apparaîtra.

Copie/colle ce rapport dans ta prochaine réponse avec un nouveau HijackThis.

rockz · le 27 juin 2007

Bonjour a toi, j'ai effectué comme prevu combofix, voici le rapport

Merci de ton interet,

Pour infos supplementaires , kerio affiche non stop des intrusions sur winlogon.exe (cest stressant dailleurs), et avg antispyware a bloqué un trojan que je n'avais jamais vu .

voila.

"Steve" - 2007-06-27 21:27:18 - ComboFix 07-06-27.7 - Service Pack 2 NTFS

(((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\system32\ddcaxwv.dll

C:\WINDOWS\system32\qomkkhf.dll

C:\WINDOWS\system32\winzzc32.dll

C:\WINDOWS\system32\efhkj.bak1

C:\WINDOWS\system32\efhkj.ini

* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

((((((((((((((((((((((((( Files Created from 2007-05-27 to 2007-06-27 )))))))))))))))))))))))))))))))

2007-06-27 21:26 49,152 --a------ C:\WINDOWS\nircmd.exe

2007-06-27 15:42 6,797 --ahs---- C:\WINDOWS\system32\efhkj.ini.ren

2007-06-27 15:42 6,369 --a------ C:\WINDOWS\system32\efhkj.bak1.ren

2007-06-27 15:42 266,336 --a------ C:\WINDOWS\system32\jkhfe.dll.vir

2007-06-27 00:28 <REP> d-------- C:\VundoFix Backups

2007-06-26 22:12 95,872 --a------ C:\WINDOWS\system32\AvastSS.scr

2007-06-26 22:12 94,552 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys

2007-06-26 22:12 85,952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys

2007-06-26 22:12 745,600 --a------ C:\WINDOWS\system32\aswBoot.exe

2007-06-26 22:12 43,176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys

2007-06-26 22:12 26,888 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys

2007-06-26 22:12 23,416 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys

2007-06-26 22:12 <REP> d-------- C:\Program Files\Alwil Software

2007-06-26 22:10 <REP> d-------- C:\Program Files\Sunbelt Software

2007-06-26 22:06 <REP> d-------- C:\Program Files\Symantec

2007-06-26 21:56 <REP> d-------- C:\WINDOWS\system32\appmgmt

2007-06-26 20:55 <REP> d-------- C:\DOCUME~1\Steve\.housecall6.6

2007-06-26 20:22 1,164,948 --ahs---- C:\WINDOWS\system32\rqstv.ini2.ren

2007-06-26 20:19 <REP> d-------- C:\WINDOWS\BDOSCAN8

2007-06-26 19:46 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys

2007-06-26 18:29 2,878 --a------ C:\WINDOWS\system32\tmp.reg

2007-06-26 18:27 57,344 --a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\gbobwfyx.exe

2007-06-26 18:19 929,974 --a------ C:\WINDOWS\system32\rekkpnmu.ini.ren

2007-06-26 18:18 66,112 --a------ C:\WINDOWS\system32\ebrtivvo.dll

2007-06-26 18:18 128,576 --a------ C:\WINDOWS\system32\umnpkker.dll.ren

2007-06-26 18:15 4,672 --a------ C:\WINDOWS\system32\fovwwmrx.exe

2007-06-26 17:52 266,336 --a------ C:\WINDOWS\system32\vtsqr.dll.ren

2007-06-26 17:52 1,164,968 --a------ C:\WINDOWS\system32\rqstv.ini.ren

2007-06-26 17:52 1,144,110 --a------ C:\WINDOWS\system32\rqstv.bak1.ren

2007-06-26 17:40 1,144,613 --a------ C:\WINDOWS\system32\utstv.bak2.ren

2007-06-26 17:39 75,264 --a------ C:\WINDOWS\system32\unacev2.dll

2007-06-26 17:39 153,088 --a------ C:\WINDOWS\system32\UNRAR3.dll

2007-06-26 17:39 <REP> d-a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP

2007-06-26 17:39 <REP> d-------- C:\Program Files\Trojan Remover

2007-06-26 17:39 <REP> d-------- C:\DOCUME~1\Steve\APPLIC~1\Simply Super Software

2007-06-26 17:39 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Simply Super Software

2007-06-26 00:31 <REP> d-------- C:\Program Files\Lavasoft

2007-06-26 00:31 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard

2007-06-26 00:31 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft

2007-06-26 00:11 336 --a------ C:\WINDOWS\system32\tablet.dat

2007-06-25 23:52 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy

2007-06-25 23:31 1,144,312 --ahs---- C:\WINDOWS\system32\utstv.ini2.ren

2007-06-25 21:59 6,679 --a------ C:\WINDOWS\system32\utstv.ini.ren

2007-06-25 21:28 6,369 --a------ C:\WINDOWS\system32\utstv.bak1.ren

2007-06-25 21:28 266,336 --a------ C:\WINDOWS\system32\vtstu.dll.ren

2007-06-25 21:25 57,344 --a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\jopkrcbs.exe

2007-06-25 21:23 31,254 --a------ C:\WINDOWS\system32\byxutqn.dll.vir

2007-06-24 00:23 <REP> d-------- C:\Program Files\CCleaner

2007-06-23 21:39 <REP> d-------- C:\Program Files\Azureus

2007-06-23 21:39 <REP> d-------- C:\DOCUME~1\Steve\APPLIC~1\Azureus

2007-06-23 00:27 <REP> d-------- C:\Program Files\IGN

2007-06-22 23:35 306,688 --a------ C:\WINDOWS\IsUninst.exe

2007-06-22 23:28 <REP> d-------- C:\Program Files\Alcohol Soft

2007-06-22 23:23 639,224 --a------ C:\WINDOWS\system32\drivers\sptd.sys

2007-06-22 23:04 <REP> d-------- C:\DOCUME~1\Steve\APPLIC~1\Help

2007-06-21 14:23 <REP> d-------- C:\personal work

2007-06-20 00:16 55,808 --a------ C:\WINDOWS\system32\lfpsd13n.dll

2007-06-20 00:16 159,744 --a------ C:\WINDOWS\system32\lfpng13n.dll

2007-06-20 00:15 69,632 --a------ C:\WINDOWS\system32\lfgif13n.dll

2007-06-20 00:15 57,344 --a------ C:\WINDOWS\system32\lfbmp13n.dll

2007-06-20 00:15 462,848 --a------ C:\WINDOWS\system32\ltkrn13n.dll

2007-06-20 00:15 450,560 --a------ C:\WINDOWS\system32\ltimg13n.dll

2007-06-20 00:15 401,408 --a------ C:\WINDOWS\system32\lfcmp13n.dll

2007-06-20 00:15 299,008 --a------ C:\WINDOWS\system32\ltdis13n.dll

2007-06-20 00:15 206,336 --a------ C:\WINDOWS\system32\ltefx13n.dll

2007-06-20 00:15 163,840 --a------ C:\WINDOWS\system32\ltfil13n.dll

2007-06-14 01:07 <REP> d-------- C:\Program Files\Windows Media Connect 2

2007-06-14 01:06 <REP> d-------- C:\WINDOWS\system32\drivers\UMDF

2007-06-06 23:33 <REP> d-------- C:\Program Files\Windows Journal Viewer

2007-06-04 15:18 9,344 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys

2007-06-04 15:17 8,320 --a------ C:\WINDOWS\system32\drivers\AWRTRD.sys

2007-06-04 15:14 6,272 --a------ C:\WINDOWS\system32\drivers\AWRTPD.sys

2007-06-01 12:37 <REP> d-------- C:\Program Files\iTunes

2007-06-01 12:37 <REP> d-------- C:\Program Files\iPod

2007-05-30 21:01 <REP> d-------- C:\WINDOWS\pss

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-06-27 18:52:09 -------- d-----w C:\DOCUME~1\Steve\APPLIC~1\WTablet

2007-06-26 20:06:07 48,776 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL

2007-06-26 20:06:07 115,000 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS

2007-06-26 19:59:12 -------- d-----w C:\Program Files\Fichiers communs\Symantec Shared

2007-06-25 22:20:02 -------- d-----w C:\Program Files\MSN Messenger

2007-06-23 22:59:26 -------- d-----w C:\Program Files\Google

2007-06-23 22:30:32 -------- d-----w C:\Program Files\Yahoo!

2007-06-01 10:35:22 -------- d-----w C:\Program Files\QuickTime

2007-06-01 10:33:30 -------- d-----w C:\Program Files\Apple Software Update

2007-05-19 22:21:31 1,156 ----a-w C:\WINDOWS\mozver.dat

2007-05-19 22:20:48 -------- d-----w C:\DOCUME~1\Steve\APPLIC~1\Talkback

2007-05-19 22:20:34 0 ----a-w C:\WINDOWS\nsreg.dat

2007-05-16 18:44:58 -------- d-----w C:\DOCUME~1\Steve\APPLIC~1\vlc

2007-05-16 18:42:48 -------- d-----w C:\Program Files\VideoLAN

2007-05-16 15:13:53 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll

2007-05-14 16:44:37 -------- d-----w C:\Program Files\Soulseek-Test

2007-04-25 14:22:35 144,896 ----a-w C:\WINDOWS\system32\schannel.dll

2007-04-18 16:14:18 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll

2007-04-16 20:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll

2007-04-16 20:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll

2007-04-16 20:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll

2007-04-16 20:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll

2007-04-16 20:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll

2007-04-16 20:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll

2007-04-16 20:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe

2007-04-16 20:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll

2007-04-16 20:37:55 188 ----a-w C:\WINDOWS\system32\eDataSecurity.dat

2007-04-13 13:19:52 7,680 ----a-w C:\WINDOWS\system32\lsdelete.exe

2007-04-12 11:27:08 64,724 ----a-w C:\WINDOWS\system32\perfc00C.dat

2007-04-12 11:27:08 446,984 ----a-w C:\WINDOWS\system32\perfh00C.dat

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 01:56]

{53707962-6F74-2D53-2644-206D7942484F}=C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2005-05-31 01:04]

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43]

{9030D464-4C02-4ABF-8ECC-5164760863C6}=C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2006-08-31 20:33]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"LaunchApp"="Alaunch" []

"RTHDCPL"="RTHDCPL.EXE" [2006-06-01 02:48 C:\WINDOWS\RTHDCPL.exe]

"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25]

"SkyTel"="SkyTel.EXE" [2006-05-16 04:04 C:\WINDOWS\SkyTel.exe]

"NvMediaCenter"="NvMCTray.dll" [2006-07-12 00:19 C:\WINDOWS\system32\nvmctray.dll]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]

"eDataSecurity Loader"="C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2006-03-17 15:00]

"eRecoveryService"="C:\Acer\Empowering Technology\eRecovery\eRAgent.exe" [2006-06-01 14:40]

"WarReg_PopUp"="C:\Acer\WR_PopUp\WarReg_PopUp.exe" [2006-09-23 13:08]

"nwiz"="nwiz.exe" [2006-07-12 00:19 C:\WINDOWS\system32\nwiz.exe]

"gbobwfyx.exe"="C:\Documents and Settings\All Users\Application Data\gbobwfyx.exe" [2007-06-26 18:27]

"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-04-30 17:42]

"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-07-12 00:19]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 22:00]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles

"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]

"DisableRegistryTools"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2007-05-30 14:29]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Driver]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Guard]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Reader Speed Launch.lnk]

path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Reader Speed Launch.lnk

backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]

"C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ntiMUI]

c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"StarWindService"=2 (0x2)

"iPod Service"=3 (0x3)

"ccSetMgr"=2 (0x2)

"ccEvtMgr"=2 (0x2)

"aawservice"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"jopkrcbs.exe"=C:\Documents and Settings\All Users\Application Data\jopkrcbs.exe

"Alcmtr"=ALCMTR.EXE

HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\KB910393

rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\EasyCDBlock.inf,PerUserInstall

HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{407408d4-94ed-4d86-ab69-a7f649d112ee}

%SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection QuickLaunchShortcut 640 %systemroot%\inf\mcdftreg.inf

**************************************************************************

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net

Rootkit scan 2007-06-27 21:31:35

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

Completion time: 2007-06-27 21:34:03 - machine was rebooted

C:\ComboFix-quarantined-files.txt ... 2007-06-27 21:34

--- E O F ---

edit : et hjt :

Logfile of Trend Micro HijackThis v2.0.0 (BETA)

Scan saved at 21:40:03, on 27/06/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Acer\Empowering Technology\ePerformance\MemCheck.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Acer\Empowering Technology\eRecovery\eRAgent.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\WINDOWS\system32\RunDLL32.exe

C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe

C:\Documents and Settings\All Users\Application Data\gbobwfyx.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\Tablet.exe

C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\system32\WTablet\TabUserW.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe

C:\WINDOWS\system32\Tablet.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe

C:\WINDOWS\system32\notepad.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\Documents and Settings\Steve\Bureau\scanner.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://somethingatthewindow.over-blog.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank