Smitfraud-C très récalcitrant

Monsieur Furtif · le 1 octobre 2007

Bonjour,

alors, voilà, il y a quelques temps, j'ai été infecté par Smitfraud-C.toolbar888, problème résolu ici.

Mais sur un poste professionnel, je rencontre un autre problème dû à un Smitfraud récurrent.

Spybot retrouve de manière récurrente KillSec, Smitfraud-C., CoolWWWSearch.SmartSearch et CoolWWWSearch.Leftovers

J'ai très certainement été infecté par clé USB. Le poste est en réseau.

Voilà mes rapports HiJackThis et SmitfraudFix.

Vundofix n'a rien donné.

J'ai bien essayé de m'en sortir par moi-même, sans résultats.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:38:53, on 02/10/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\DOCUME~1\user\LOCALS~1\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\CAMBO-1.exe

C:\WINDOWS\user.exe

C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe

C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPZipm12.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe

C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe

C:\Program Files\Softwin\BitDefender10\vsserv.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe

C:\PROGRA~1\MOZILL~1\FIREFOX.EXE

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

C:\Documents and Settings\user\Desktop\Securite\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.hp.co.th/

F3 - REG:win.ini: load=C:\DOCUME~1\user\LOCALS~1\services.exe

F3 - REG:win.ini: run=explorer.exe C:\WINDOWS\System\regedit.exe

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\DOCUME~1\user\LOCALS~1\smss.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [statusClient 2.6] C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe /auto

O4 - HKLM\..\Run: [TomcatStartup 2.5] C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe

O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"

O4 - HKLM\..\Run: [bDMCon] C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [CAMBO-1] C:\WINDOWS\win.pif

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [user] C:\DOCUME~1\user\LOCALS~1\Temp\Tmp.com

O4 - HKLM\..\Policies\Explorer\Run: [(Default)] C:\DOCUME~1\user\LOCALS~1\winlogon.exe

O4 - HKCU\..\Policies\Explorer\Run: [(Default)] win.com C:\WINDOWS\system32\msdp32.dll

O4 - HKUS\S-1-5-18\..\Run: [sYSTEM] C:\WINDOWS\TEMP\Tmp.com (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [(Default)] win.com C:\WINDOWS\system32\msdp32.dll (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [sYSTEM] C:\WINDOWS\TEMP\Tmp.com (User 'Default user')

O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [(Default)] win.com C:\WINDOWS\system32\msdp32.dll (User 'Default user')

O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot\SDHelper.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe

O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe

O23 - Service: MsNet Service (MsNet) - - C:\WINDOWS\Fonts\font.bat

O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Password - Unknown owner - C:\WINDOWS\System32\PwdServ.exe (file missing)

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPZipm12.exe

O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe

O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

Ci-dessous, en rouge, un fichier malicieux qui prend le nom de l'ordi.

SmitFraudFix v2.234

Scan done at 2:36:13,48, 02/10/2007

Run from C:\Documents and Settings\user\Desktop\SmitfraudFix

OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT

The filesystem type is NTFS

Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\DOCUME~1\user\LOCALS~1\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\CAMBO-1.exe

C:\WINDOWS\user.exe

C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe

C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Adobe\Acrobat 7.0\Acrobat\acrobat_sl.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPZipm12.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe

C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe

C:\Program Files\Softwin\BitDefender10\vsserv.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe

C:\PROGRA~1\MOZILL~1\FIREFOX.EXE

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

hosts file corrupted !

127.0.0.1 www.legal-at-spybot.info

127.0.0.1 legal-at-spybot.info

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

C:\WINDOWS\svchost.exe FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\user

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\user\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Start Menu

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\user\FAVORI~1

»»»»»»»»»»»»»»»»»»»»»»»» Desktop

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components]

"Source"="About:Home"

"SubscribedURL"="About:Home"

"FriendlyName"="My Current Home Page"

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler

!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri

Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs

!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"AppInit_DLLs"="sockspy.dll"

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System

!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

"System"="C:\\WINDOWS\\svchost.exe"

»»»»»»»»»»»»»»»»»»»»»»»» Rustock

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Intel® PRO/100 VE Network Connection - Packet Scheduler Miniport

DNS Server Search Order: 203.189.134.3

DNS Server Search Order: 203.189.128.2

HKLM\SYSTEM\CCS\Services\Tcpip\..\{A2EDE8E6-AE87-4270-9C84-2C0AB0B2AE61}: DhcpNameServer=203.189.134.3 203.189.128.2

HKLM\SYSTEM\CS1\Services\Tcpip\..\{A2EDE8E6-AE87-4270-9C84-2C0AB0B2AE61}: DhcpNameServer=203.189.134.3 203.189.128.2

HKLM\SYSTEM\CS2\Services\Tcpip\..\{A2EDE8E6-AE87-4270-9C84-2C0AB0B2AE61}: DhcpNameServer=203.189.134.3 203.189.128.2

HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=203.189.134.3 203.189.128.2

HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=203.189.134.3 203.189.128.2

HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=203.189.134.3 203.189.128.2

»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection

»»»»»»»»»»»»»»»»»»»»»»»» End

Si vous pouvez m'aider...

Merci d'avance

Thanos · le 1 octobre 2007

salut

Poste moi le rapport suivant stp >

Télécharge combofix.exe de sUBs

Assure toi que tous les programmes sont fermés avant de lancer le fix!
Fait un double clique sur combofix.exe.
Note: Ne ferme pas la fenêtre qui vient de s'ouvrir , tu te retrouverais avec un bureau vide !
Tape sur la touche 1 pour démarrer le scan.
Lorsque le scan est terminé, un rapport sera généré : poste en le contenu dans ton prochain message.
Si le rapport est trop long, poste le en deux fois.

Note: il va falloir choisir entre les deux antivirus!, n'en conserve qu'un!

Monsieur Furtif · le 2 octobre 2007

Voilà le rapport...

ComboFix 07-10-02.2 - user 2007-10-02 7:33:52.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3051 [GMT 7:00]

Running from: C:\Documents and Settings\user\Desktop\Securite\ComboFix.exe

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Autorun.inf

C:\Documents and Settings\user\Desktop\internet.lnk

C:\WINDOWS\.exe

C:\WINDOWS\services.exe

C:\WINDOWS\smss.exe

C:\WINDOWS\svchost.exe

C:\WINDOWS\system.exe

C:\WINDOWS\winlogon.exe

D:\Autorun.inf

.

((((((((((((((((((((((((( Files Created from 2007-09-02 to 2007-10-02 )))))))))))))))))))))))))))))))

.

2007-10-02 07:32 51,200 --a------ C:\WINDOWS\NirCmd.exe

2007-10-02 02:07 <DIR> d-------- C:\Program Files\Sunbelt Software

2007-10-02 00:27 <DIR> d-------- C:\Program Files\Alwil Software

2007-10-01 22:55 552 --a------ C:\WINDOWS\system32\d3d8caps.dat

2007-10-01 22:06 77,824 -r-hs---- C:\WINDOWS\Administrator.exe

2007-10-01 22:04 77,824 -r-hs---- C:\WINDOWS\.exe

2007-10-01 22:00 <DIR> d-------- C:\VundoFix Backups

2007-10-01 21:58 <DIR> d-------- C:\Program Files\EasyCleaner

2007-10-01 21:42 2,460 --a------ C:\WINDOWS\system32\tmp.reg

2007-10-01 19:18 77,824 -r-hs---- C:\WINDOWS\winlogon.exe

2007-10-01 19:18 77,824 -r-hs---- C:\WINDOWS\svchost.exe

2007-10-01 19:18 77,824 -r-hs---- C:\WINDOWS\smss.exe

2007-10-01 19:18 77,824 -r-hs---- C:\WINDOWS\services.exe

2007-10-01 18:31 77,824 -r-hs---- C:\WINDOWS\win.pif

2007-10-01 18:31 77,824 -r-hs---- C:\WINDOWS\user.exe

2007-10-01 18:31 77,824 -r-hs---- C:\WINDOWS\system32\msdp32.dll

2007-10-01 18:31 77,824 -r-hs---- C:\WINDOWS\system32\command.cmd

2007-10-01 18:31 77,824 -r-hs---- C:\WINDOWS\system32\CAMBO-1.exe

2007-10-01 18:31 77,824 -r-hs---- C:\WINDOWS\system\wininit.com

2007-10-01 18:31 77,824 -r-hs---- C:\WINDOWS\system\regedit.exe

2007-10-01 18:31 77,824 ---hs---- C:\AutoRun.exe

2007-09-25 16:44 221,184 --a------ C:\WINDOWS\system32\wmpns.dll

2007-09-24 12:06 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys

2007-09-24 11:52 <DIR> d-------- C:\Program Files\Spybot

2007-09-24 11:52 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy

2007-09-24 11:27 <DIR> d-------- C:\Program Files\Lavasoft

2007-09-24 11:27 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft

2007-09-24 11:26 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard

2007-09-23 22:17 <DIR> d-------- C:\Documents and Settings\user\Contacts

2007-09-23 19:25 1,277 --a------ C:\WINDOWS\mozver.dat

2007-09-23 19:20 0 --a------ C:\WINDOWS\nsreg.dat

2007-09-18 13:04 74,752 --a------ C:\WINDOWS\system32\jst.dll

2007-09-18 13:04 61,440 --a------ C:\WINDOWS\system32\PMLJNI.dll

2007-09-18 13:04 40,960 --a------ C:\WINDOWS\system32\d4channel.dll

2007-09-18 13:04 36,864 --a------ C:\WINDOWS\system32\hpbmmjno.dll

2007-09-18 13:03 <DIR> d--h----- C:\Program Files\Zero G Registry

2007-09-18 13:02 207,360 --a--c--- C:\WINDOWS\system32\dllcache\dot4.sys

2007-09-18 13:02 207,360 --a------ C:\WINDOWS\system32\drivers\Dot4.sys

2007-09-18 13:02 12,928 --a--c--- C:\WINDOWS\system32\dllcache\dot4prt.sys

2007-09-18 13:02 12,928 --a------ C:\WINDOWS\system32\drivers\Dot4Prt.sys

2007-09-18 12:35 <DIR> d-------- C:\Program Files\Common Files\SWF Studio

2007-09-18 09:13 16,384 --a------ C:\WINDOWS\system32\FileOps.exe

2007-09-18 09:12 <DIR> d-------- C:\WINDOWS\Adobe Illustrator CS

2007-09-18 09:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Macrovision

2007-09-17 10:25 <DIR> d--h----- C:\Share

2007-09-17 10:22 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Bitdefender

2007-09-14 09:45 <DIR> d-------- C:\Documents and Settings\user\Application Data\AdobeUM

2007-09-07 10:37 <DIR> d-------- C:\WINDOWS\pss

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2007-10-02 07:42 15454 --a------ C:\WINDOWS\system32\drivers\fwdrv.err

2007-10-02 07:39 81984 --a------ C:\WINDOWS\system32\bdod.bin

2007-10-01 21:59 --------- d--h----- C:\Program Files\InstallShield Installation Information

2007-09-25 19:01 218624 --a------ C:\WINDOWS\system32\uxtheme.dll

2007-09-23 22:25 --------- d-------- C:\Program Files\MSN Messenger

2007-09-18 13:04 --------- d-------- C:\Program Files\Hewlett-Packard

2007-09-04 10:12 --------- d-------- C:\Documents and Settings\user\Application Data\Ahead

2007-08-31 13:37 --------- d-------- C:\Program Files\Dream Aquarium

2007-08-31 12:35 --------- d-------- C:\Program Files\Windows Media Connect 2

2007-08-31 12:31 --------- d-------- C:\Program Files\Winamp

2007-08-31 12:22 --------- d-------- C:\Program Files\Common Files\Ahead

2007-08-31 12:17 --------- d-------- C:\Program Files\Nero

2007-08-31 12:17 --------- d-------- C:\Documents and Settings\All Users\Application Data\Nero

2007-08-31 12:03 --------- d-------- C:\Program Files\Microsoft.NET

2007-08-31 12:03 --------- d-------- C:\Program Files\Microsoft ActiveSync

2007-08-31 12:03 --------- d-------- C:\Program Files\Common Files\L&H

2007-08-31 12:02 --------- d-------- C:\Program Files\Microsoft Works

2007-08-31 11:35 --------- d-------- C:\Documents and Settings\user\Application Data\Bitdefender

2007-08-31 11:35 --------- d-------- C:\Documents and Settings\All Users\Application Data\BitDefender

2007-08-31 11:08 --------- d-------- C:\Documents and Settings\All Users\Application Data\Adobe Systems

2007-08-31 11:07 --------- d-------- C:\Program Files\Common Files\Adobe Systems Shared

2007-08-31 10:58 --------- d-------- C:\Documents and Settings\user\Application Data\ACD Systems

2007-08-31 10:57 10368 --a------ C:\WINDOWS\system32\drivers\pfc.sys

2007-08-31 10:57 --------- d-------- C:\Program Files\Common Files\ACD Systems

2007-08-31 10:57 --------- d-------- C:\Program Files\ACD Systems

2007-08-31 10:57 --------- d-------- C:\Documents and Settings\All Users\Application Data\ACD Systems

2007-08-31 10:55 --------- d-------- C:\Program Files\Realtek

2007-08-31 10:53 --------- d-------- C:\Program Files\Intel

2007-08-31 10:52 --------- d-------- C:\Program Files\CONEXANT

2007-08-31 10:45 --------- d-------- C:\Program Files\Common Files\InstallShield

2007-08-31 10:38 --------- d-------- C:\Program Files\microsoft frontpage

2007-08-11 01:01 77824 -r-hs---- C:\WINDOWS\Web\Picture.exe

2007-08-11 01:01 77824 -r-hs---- C:\WINDOWS\Fonts\font.bat

2007-08-11 01:01 77824 -r-hs---- C:\WINDOWS\.exe

2007-08-07 13:58 8320 --a------ C:\WINDOWS\system32\drivers\AWRTRD.sys

2007-08-07 13:56 9344 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys

2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll

2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll

2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe

2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll

2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll

2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll

2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll

2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 12:22]

"StatusClient 2.6"="C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe" [2004-02-28 01:29]

"TomcatStartup 2.5"="C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe" [2004-02-13 04:40]

"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2006-01-12 20:52]

"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 16:25]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]

"BDMCon"="C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe" [2007-04-02 16:48]

"CAMBO-1"="C:\WINDOWS\win.pif" [2007-08-11 01:01]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 19:00]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]

"SYSTEM"=C:\WINDOWS\TEMP\Tmp.com

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]

"System"="C:\WINDOWS\svchost.exe"

"Userinit"="C:\WINDOWS\system32\userinit.exe,C:\DOCUME~1\user\LOCALS~1\smss.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"appinit_dlls"=sockspy.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]

path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk

backup=C:\WINDOWS\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]

"C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]

ALCMTR.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDAgent]

"C:\Program Files\Softwin\BitDefender10\bdagent.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDMCon]

"C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]

"C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]

C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]

"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]

C:\HP\KBD\KBD.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]

RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]

RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]

nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]

C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]

C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]

RTHDCPL.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]

SkyTel.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"user"=C:\DOCUME~1\user\LOCALS~1\Temp\Tmp.com

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"CAMBO-1"=C:\WINDOWS\win.pif

R1 bdftdif;BitDefender Firewall TDI Filter;\??\C:\Program Files\Common Files\Softwin\BitDefender Firewall\bdftdif.sys

R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys

R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys

R2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe"

R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;C:\WINDOWS\system32\DRIVERS\bdfndisf.sys

S2 Password;Password;C:\WINDOWS\System32\PwdServ.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0c6a9484-6fcd-11dc-8db1-001a922eec44}]

AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe MS32DLL.dll.vbs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{15ddd8ab-6749-11dc-8d8d-001a922eec44}]

Auto\command- K:\AutoRun.exe

AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4a23f46e-6a6b-11dc-8d9d-001a922eec44}]

AutoRun\command- J:\.\Autorun\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bb9f0e0e-57a9-11dc-a011-806d6172696f}]

Auto\command- D:\AutoRun.exe

AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bb9f0e10-57a9-11dc-a011-806d6172696f}]

Auto\command- C:\AutoRun.exe

AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{be358db4-658b-11dc-8d88-001a922eec44}]

AutoRun\command- ntde1ect.com

explore\Command- ntde1ect.com

open\Command- ntde1ect.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{be358db5-658b-11dc-8d88-001a922eec44}]

AutoRun\command- ntde1ect.com

explore\Command- ntde1ect.com

open\Command- ntde1ect.com

*Newly Created Service* - CATCHME

.

**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2007-10-02 07:42:40

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 2007-10-02 7:44:27

C:\ComboFix-quarantined-files.txt ... 2007-10-02 07:44

.

--- E O F ---

Et des deux antivirus, un seul a survécu...

Thanos · le 2 octobre 2007

ComboFix a fait du nettoyage, mais il en reste! je te répond sous peu Mr Furtif

Modifié le 2 octobre 2007 par charles ingals

Thanos · le 2 octobre 2007

Poste moi les deux rapports suivants stp >

1) Stp rend toi sur cette page afin de télécharger le fichier CFScript > http://www.sendspace.com/file/3kvvgq

pour cela, clique sur le lien en bas de page > Download Link: CFScript

Branche tous les disques amovibles que tu possèdes avant de commencer (lecteur flash/disque dur etc..) afin de désinfecter.
Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture
Une fenêtre bleue va apparaitre: au message qui apparait (Type 1 to continue, or 2 to abort) , tape 1 puis valide.
Patiente le temps du scan.Le bureau va disparaitre à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
Si le fichier n'apparait pas, il se trouve ici > C:\ComboFix.txt

2) Lance HijackThis.

Clique sur Open Misc Tools Section

Assure toi que les deux cases de droite sont bien cochées:

* List all minor sections(Full)

* List Empty Sections(Complete)

Clique sur Generate StartupList Log

Click sur "oui" lorsque l'on te le demande.

Cela va générer un rapport, copie le et poste le ici.

@+

Monsieur Furtif · le 2 octobre 2007

Le rapport ComboFix donne ceci

ComboFix 07-10-02.2 - user 2007-10-02 14:18:51.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3052 [GMT 7:00]

Running from: C:\Documents and Settings\user\Desktop\Securite\ComboFix.exe

Command switches used :: C:\Documents and Settings\user\Desktop\Securite\CFScript.txt

* Created a new restore point

FILE::

C:\WINDOWS\.exe

C:\WINDOWS\Administrator.exe

C:\WINDOWS\system32\tmp.reg

C:\WINDOWS\winlogon.exe

C:\WINDOWS\svchost.exe

C:\WINDOWS\smss.exe

C:\WINDOWS\services.exe

C:\WINDOWS\win.pif

C:\WINDOWS\user.exe

C:\WINDOWS\system32\msdp32.dll

C:\WINDOWS\system32\command.cmd

C:\WINDOWS\system32\CAMBO-1.exe

C:\WINDOWS\system\wininit.com

C:\WINDOWS\system\regedit.exe

C:\AutoRun.exe

D:\AutoRun.exe

J:\.\Autorun\autorun.exe

K:\AutoRun.exe

C:\WINDOWS\TEMP\Tmp.com

C:\Documents and Settings\user\Local Settings\smss.exe

C:\Documents and Settings\user\Local Settings\services.exe

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\AutoRun.exe

C:\Documents and Settings\user\Local Settings\services.exe

C:\Documents and Settings\user\Local Settings\smss.exe

C:\VundoFix Backups

C:\WINDOWS\.exe

C:\WINDOWS\Administrator.exe

C:\WINDOWS\services.exe

C:\WINDOWS\smss.exe

C:\WINDOWS\svchost.exe

C:\WINDOWS\system.exe

C:\WINDOWS\system\regedit.exe

C:\WINDOWS\system\wininit.com

C:\WINDOWS\system32\CAMBO-1.exe

C:\WINDOWS\system32\command.cmd

C:\WINDOWS\system32\msdp32.dll

C:\WINDOWS\system32\tmp.reg

C:\WINDOWS\TEMP\Tmp.com

C:\WINDOWS\user.exe

C:\WINDOWS\win.pif

C:\WINDOWS\winlogon.exe

D:\AutoRun.exe

.

((((((((((((((((((((((((( Files Created from 2007-09-02 to 2007-10-02 )))))))))))))))))))))))))))))))

.

2007-10-02 14:24 77,824 -r-hs---- C:\WINDOWS\win.pif

2007-10-02 14:24 77,824 -r-hs---- C:\WINDOWS\user.exe

2007-10-02 14:24 77,824 -r-hs---- C:\WINDOWS\system32\msdp32.dll

2007-10-02 14:24 77,824 -r-hs---- C:\WINDOWS\system32\command.cmd

2007-10-02 14:24 77,824 -r-hs---- C:\WINDOWS\system32\CAMBO-1.exe

2007-10-02 14:24 77,824 ---hs---- C:\AutoRun.exe

2007-10-02 07:32 51,200 --a------ C:\WINDOWS\NirCmd.exe

2007-10-02 02:07 <DIR> d-------- C:\Program Files\Sunbelt Software

2007-10-02 00:27 <DIR> d-------- C:\Program Files\Alwil Software

2007-10-01 22:55 552 --a------ C:\WINDOWS\system32\d3d8caps.dat

2007-10-01 21:58 <DIR> d-------- C:\Program Files\EasyCleaner

2007-09-25 16:44 221,184 --a------ C:\WINDOWS\system32\wmpns.dll

2007-09-24 12:06 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys

2007-09-24 11:52 <DIR> d-------- C:\Program Files\Spybot

2007-09-24 11:52 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy

2007-09-24 11:27 <DIR> d-------- C:\Program Files\Lavasoft

2007-09-24 11:27 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft

2007-09-24 11:26 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard

2007-09-23 22:17 <DIR> d-------- C:\Documents and Settings\user\Contacts

2007-09-23 19:25 1,277 --a------ C:\WINDOWS\mozver.dat

2007-09-23 19:20 0 --a------ C:\WINDOWS\nsreg.dat

2007-09-18 13:04 74,752 --a------ C:\WINDOWS\system32\jst.dll

2007-09-18 13:04 61,440 --a------ C:\WINDOWS\system32\PMLJNI.dll

2007-09-18 13:04 40,960 --a------ C:\WINDOWS\system32\d4channel.dll

2007-09-18 13:04 36,864 --a------ C:\WINDOWS\system32\hpbmmjno.dll

2007-09-18 13:03 <DIR> d--h----- C:\Program Files\Zero G Registry

2007-09-18 13:02 207,360 --a--c--- C:\WINDOWS\system32\dllcache\dot4.sys

2007-09-18 13:02 207,360 --a------ C:\WINDOWS\system32\drivers\Dot4.sys

2007-09-18 13:02 12,928 --a--c--- C:\WINDOWS\system32\dllcache\dot4prt.sys

2007-09-18 13:02 12,928 --a------ C:\WINDOWS\system32\drivers\Dot4Prt.sys

2007-09-18 12:35 <DIR> d-------- C:\Program Files\Common Files\SWF Studio

2007-09-18 09:13 16,384 --a------ C:\WINDOWS\system32\FileOps.exe

2007-09-18 09:12 <DIR> d-------- C:\WINDOWS\Adobe Illustrator CS

2007-09-18 09:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Macrovision

2007-09-17 10:25 <DIR> d--h----- C:\Share

2007-09-17 10:22 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Bitdefender

2007-09-14 09:45 <DIR> d-------- C:\Documents and Settings\user\Application Data\AdobeUM

2007-09-07 10:37 <DIR> d-------- C:\WINDOWS\pss

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2007-10-02 14:26 360431 --a------ C:\WINDOWS\system32\drivers\fwdrv.err

2007-10-02 14:23 81984 --a------ C:\WINDOWS\system32\bdod.bin

2007-10-01 21:59 --------- d--h----- C:\Program Files\InstallShield Installation Information

2007-09-25 19:01 218624 --a------ C:\WINDOWS\system32\uxtheme.dll

2007-09-23 22:25 --------- d-------- C:\Program Files\MSN Messenger

2007-09-18 13:04 --------- d-------- C:\Program Files\Hewlett-Packard

2007-09-04 10:12 --------- d-------- C:\Documents and Settings\user\Application Data\Ahead

2007-08-31 13:37 --------- d-------- C:\Program Files\Dream Aquarium

2007-08-31 12:35 --------- d-------- C:\Program Files\Windows Media Connect 2

2007-08-31 12:31 --------- d-------- C:\Program Files\Winamp

2007-08-31 12:22 --------- d-------- C:\Program Files\Common Files\Ahead

2007-08-31 12:17 --------- d-------- C:\Program Files\Nero

2007-08-31 12:17 --------- d-------- C:\Documents and Settings\All Users\Application Data\Nero

2007-08-31 12:03 --------- d-------- C:\Program Files\Microsoft.NET

2007-08-31 12:03 --------- d-------- C:\Program Files\Microsoft ActiveSync

2007-08-31 12:03 --------- d-------- C:\Program Files\Common Files\L&H

2007-08-31 12:02 --------- d-------- C:\Program Files\Microsoft Works

2007-08-31 11:35 --------- d-------- C:\Documents and Settings\user\Application Data\Bitdefender

2007-08-31 11:35 --------- d-------- C:\Documents and Settings\All Users\Application Data\BitDefender

2007-08-31 11:08 --------- d-------- C:\Documents and Settings\All Users\Application Data\Adobe Systems

2007-08-31 11:07 --------- d-------- C:\Program Files\Common Files\Adobe Systems Shared

2007-08-31 10:58 --------- d-------- C:\Documents and Settings\user\Application Data\ACD Systems

2007-08-31 10:57 10368 --a------ C:\WINDOWS\system32\drivers\pfc.sys

2007-08-31 10:57 --------- d-------- C:\Program Files\Common Files\ACD Systems

2007-08-31 10:57 --------- d-------- C:\Program Files\ACD Systems

2007-08-31 10:57 --------- d-------- C:\Documents and Settings\All Users\Application Data\ACD Systems

2007-08-31 10:55 --------- d-------- C:\Program Files\Realtek

2007-08-31 10:53 --------- d-------- C:\Program Files\Intel

2007-08-31 10:52 --------- d-------- C:\Program Files\CONEXANT

2007-08-31 10:45 --------- d-------- C:\Program Files\Common Files\InstallShield

2007-08-31 10:38 --------- d-------- C:\Program Files\microsoft frontpage

2007-08-11 01:01 77824 -r-hs---- C:\WINDOWS\Web\Picture.exe

2007-08-11 01:01 77824 -r-hs---- C:\WINDOWS\Fonts\font.bat

2007-08-07 13:58 8320 --a------ C:\WINDOWS\system32\drivers\AWRTRD.sys

2007-08-07 13:56 9344 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys

2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll

2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll

2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe

2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll

2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll

2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll

2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll

2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 12:22]

"StatusClient 2.6"="C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe" [2004-02-28 01:29]

"TomcatStartup 2.5"="C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe" [2004-02-13 04:40]

"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2006-01-12 20:52]

"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 16:25]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]

"BDMCon"="C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe" [2007-04-02 16:48]

"CAMBO-1"="C:\WINDOWS\win.pif" [2007-08-11 01:01]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 19:00]

"user"="C:\DOCUME~1\user\LOCALS~1\Temp\Tmp.com" [2007-08-11 01:01]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]

"DisableRegistryTools"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]

"System"="C:\DOCUME~1\user\LOCALS~1\svchost.exe"

"Userinit"="C:\WINDOWS\system32\userinit.exe,C:\DOCUME~1\user\LOCALS~1\smss.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"appinit_dlls"=sockspy.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]

path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk

backup=C:\WINDOWS\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]

"C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]

ALCMTR.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDAgent]

"C:\Program Files\Softwin\BitDefender10\bdagent.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDMCon]

"C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]

"C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]

C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]

"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]

C:\HP\KBD\KBD.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]

RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]

RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]

nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]

C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]

C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]

RTHDCPL.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]

SkyTel.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"user"=C:\DOCUME~1\user\LOCALS~1\Temp\Tmp.com

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"CAMBO-1"=C:\WINDOWS\win.pif

R1 bdftdif;BitDefender Firewall TDI Filter;\??\C:\Program Files\Common Files\Softwin\BitDefender Firewall\bdftdif.sys

R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys

R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys

R2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe"

R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;C:\WINDOWS\system32\DRIVERS\bdfndisf.sys

S2 Password;Password;C:\WINDOWS\System32\PwdServ.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{be358db5-658b-11dc-8d88-001a922eec44}]

AutoRun\command- ntde1ect.com

explore\Command- ntde1ect.com

open\Command- ntde1ect.com

.

**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2007-10-02 14:25:05

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 2007-10-02 14:27:21 - machine was rebooted

C:\ComboFix-quarantined-files.txt ... 2007-10-02 14:27

C:\ComboFix2.txt ... 2007-10-02 07:44

.

--- E O F ---

et le rapport Hijackthis des processus lancés au démarrage donne cela :

StartupList report, 02/10/2007, 14:29:41
StartupList version: 1.52.2

Started from : C:\Documents and Settings\user\Desktop\Securite\HijackThis.EXE

Detected: Windows XP SP2 (WinNT 5.01.2600)

Detected: Internet Explorer v7.00 (7.00.6000.16512)

* Using default options

* Including empty and uninteresting sections

* Showing rarely important sections

==================================================

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\CAMBO-1.exe

C:\WINDOWS\user.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPZipm12.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe

C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe

C:\Program Files\Softwin\BitDefender10\vsserv.exe

C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe

C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Adobe\Acrobat 7.0\Acrobat\acrobat_sl.exe

C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\notepad.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\user\Desktop\Securite\HijackThis.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:

[C:\Documents and Settings\user\Start Menu\Programs\Startup]

*No files*

Shell folders AltStartup:

*Folder not found*

User shell folders Startup:

*Folder not found*

User shell folders AltStartup:

*Folder not found*

Shell folders Common Startup:

[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]

Adobe Acrobat Speed Launcher.lnk = ?

Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

Shell folders Common AltStartup:

*Folder not found*

User shell folders Common Startup:

*Folder not found*

User shell folders Alternate Common Startup:

*Folder not found*

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

UserInit = C:\WINDOWS\system32\userinit.exe,C:\DOCUME~1\user\LOCALS~1\smss.exe

[HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon]

*Registry key not found*

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

*Registry value not found*

[HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon]

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

StatusClient 2.6 = C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe /auto

TomcatStartup 2.5 = C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe

Acrobat Assistant 7.0 = "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"

!AVG Anti-Spyware = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

SunJavaUpdateSched = "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"

BDMCon = C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe

--------------------------------------------------

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*No values found*

--------------------------------------------------

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

*No values found*

--------------------------------------------------

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe

--------------------------------------------------

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices

*No values found*

--------------------------------------------------

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

[OptionalComponents]

*No values found*

--------------------------------------------------

Autorun entries in Registry subkeys of:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices

*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

File association entry for .EXE:

HKEY_CLASSES_ROOT\exefile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .COM:

HKEY_CLASSES_ROOT\comfile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .BAT:

HKEY_CLASSES_ROOT\batfile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .PIF:

HKEY_CLASSES_ROOT\piffile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .SCR:

HKEY_CLASSES_ROOT\scrfile\shell\open\command

(Default) = "%1" /S

--------------------------------------------------

File association entry for .HTA:

HKEY_CLASSES_ROOT\htafile\shell\open\command

(Default) = C:\WINDOWS\system32\mshta.exe "%1" %*

--------------------------------------------------

File association entry for .TXT:

HKEY_CLASSES_ROOT\txtfile\shell\open\command

(Default) = %SystemRoot%\system32\NOTEPAD.EXE %1

--------------------------------------------------

Enumerating Active Setup stub paths:

HKLM\Software\Microsoft\Active Setup\Installed Components

(* = disabled by HKCU twin)

[<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}] *

StubPath = C:\WINDOWS\system32\ieudinit.exe

[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]

StubPath = C:\WINDOWS\inf\unregmp2.exe /ShowWMP

[>{26923b43-4d38-484f-9b9e-de460746276c}] *

StubPath = C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig

[>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] *

StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

[>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] *

StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

[>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] *

StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

[{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *

StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *

StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

[{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] *

StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

[{5945c046-1e7d-11d1-bc44-00c04fd912be}] *

StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser

[{6BF52A52-394A-11d3-B153-00C04F79FAA6}] *

StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *

StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

[{89820200-ECBD-11cf-8B85-00AA005B4340}] *

StubPath = regsvr32.exe /s /n /i:U shell32.dll

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *

StubPath = C:\WINDOWS\system32\ie4uinit.exe -BaseSettings

--------------------------------------------------

Enumerating ICQ Agent Autostart apps:

HKCU\Software\Mirabilis\ICQ\Agent\Apps

*Registry key not found*

--------------------------------------------------

Load/Run keys from C:\WINDOWS\WIN.INI:

load=*INI section not found*

run=*INI section not found*

Load/Run keys from Registry:

HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*

HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*

HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*

HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*

HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*

HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*

HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*

HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*

HKCU\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*

HKCU\..\Windows NT\CurrentVersion\Windows: run=explorer.exe C:\WINDOWS\System\regedit.exe

HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*

HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*

HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=sockspy.dll

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*

SCRNSAVE.EXE=*INI section not found*

drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe

SCRNSAVE.EXE=*Registry value not found*

drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry value not found*

HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------

Checking for EXPLORER.EXE instances:

C:\WINDOWS\Explorer.exe: PRESENT!

C:\Explorer.exe: not present

C:\WINDOWS\Explorer\Explorer.exe: not present

C:\WINDOWS\System\Explorer.exe: not present

C:\WINDOWS\System32\Explorer.exe: not present

C:\WINDOWS\Command\Explorer.exe: not present

C:\WINDOWS\Fonts\Explorer.exe: not present

--------------------------------------------------

Checking for superhidden extensions:

.lnk: HIDDEN! (arrow overlay: yes)

.pif: HIDDEN! (arrow overlay: yes)

.exe: not hidden

.com: not hidden

.bat: not hidden

.hta: not hidden

.scr: not hidden

.shs: HIDDEN!

.shb: HIDDEN!

.vbs: not hidden

.vbe: not hidden

.wsh: not hidden

.scf: HIDDEN! (arrow overlay: NO!)

.url: HIDDEN! (arrow overlay: yes)

.js: not hidden

.jse: not hidden

--------------------------------------------------

Verifying REGEDIT.EXE integrity:

- Regedit.exe found in C:\WINDOWS

- .reg open command is normal (regedit.exe %1)

- Company name OK: 'Microsoft Corporation'

- Original filename OK: 'REGEDIT.EXE'

- File description: 'Registry Editor'

Registry check passed

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

(no name) - C:\PROGRA~1\Spybot\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F}

(no name) - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}

(no name) - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll - {9030D464-4C02-4ABF-8ECC-5164760863C6}

(no name) - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll - {AE7CD045-E861-484f-8273-0445EE161910}

--------------------------------------------------

Enumerating Task Scheduler jobs:

*No jobs found*

--------------------------------------------------

Enumerating Download Program Files:

[Java Plug-in 1.6.0_02]

InProcServer32 = C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

CODEBASE = http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab

[Java Plug-in 1.6.0_02]

InProcServer32 = C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

CODEBASE = http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab

[Java Plug-in 1.6.0_02]

InProcServer32 = C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll

CODEBASE = http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab

[shockwave Flash Object]

InProcServer32 = C:\WINDOWS\system32\Macromed\Flash\Flash9d.ocx

CODEBASE = http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

--------------------------------------------------

Enumerating Winsock LSP files:

NameSpace #1: C:\WINDOWS\System32\mswsock.dll

NameSpace #2: C:\WINDOWS\System32\winrnr.dll

NameSpace #3: C:\WINDOWS\System32\mswsock.dll

Protocol #1: C:\WINDOWS\system32\mswsock.dll

Protocol #2: C:\WINDOWS\system32\mswsock.dll

Protocol #3: C:\WINDOWS\system32\mswsock.dll

Protocol #4: C:\WINDOWS\system32\rsvpsp.dll

Protocol #5: C:\WINDOWS\system32\rsvpsp.dll

Protocol #6: C:\WINDOWS\system32\mswsock.dll

Protocol #7: C:\WINDOWS\system32\mswsock.dll

Protocol #8: C:\WINDOWS\system32\mswsock.dll

Protocol #9: C:\WINDOWS\system32\mswsock.dll

Protocol #10: C:\WINDOWS\system32\mswsock.dll

Protocol #11: C:\WINDOWS\system32\mswsock.dll

Protocol #12: C:\WINDOWS\system32\mswsock.dll

Protocol #13: C:\WINDOWS\system32\mswsock.dll

--------------------------------------------------

Enumerating Windows NT/2000/XP services

Ad-Aware 2007 Service: "C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe" (autostart)

Microsoft ACPI Driver: system32\DRIVERS\ACPI.sys (system)

Adobe LM Service: "C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe" (manual start)

Microsoft Kernel Acoustic Echo Canceller: system32\drivers\aec.sys (manual start)

AFD: \SystemRoot\System32\drivers\afd.sys (system)

Alerter: %SystemRoot%\system32\svchost.exe -k LocalService (disabled)

Application Layer Gateway Service: %SystemRoot%\System32\alg.exe (manual start)

Application Management: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)

1394 ARP Client Protocol: system32\DRIVERS\arp1394.sys (manual start)

RAS Asynchronous Media Driver: system32\DRIVERS\asyncmac.sys (manual start)

Standard IDE/ESDI Hard Disk Controller: system32\DRIVERS\atapi.sys (system)

ATM ARP Client Protocol: system32\DRIVERS\atmarpc.sys (manual start)

Windows Audio: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

Audio Stub Driver: system32\DRIVERS\audstub.sys (manual start)

AVG Anti-Spyware Driver: \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys (system)

AVG Anti-Spyware Guard: C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe (autostart)

AVG Anti-Spyware Clean Driver: System32\DRIVERS\AvgAsCln.sys (system)

bdfdll: \??\C:\Program Files\Softwin\BitDefender10\bdfdll.sys (manual start)

BitDefender Firewall NDIS Filter Service: system32\DRIVERS\bdfndisf.sys (manual start)

BDFSDRV: \??\C:\Program Files\Softwin\BitDefender10\bdfsdrv.sys (manual start)

BitDefender Firewall TDI Filter: \??\C:\Program Files\Common Files\Softwin\BitDefender Firewall\bdftdif.sys (system)

bdpredir: \??\C:\Program Files\Softwin\BitDefender10\bdpredir.sys (system)

BDRSDRV: \??\C:\Program Files\Softwin\BitDefender10\bdrsdrv.sys (autostart)

BitDefender Scan Server: "C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (autostart)

Background Intelligent Transfer Service: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)

Computer Browser: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)

catchme: \??\C:\DOCUME~1\user\LOCALS~1\Temp\catchme.sys (manual start)

CD-ROM Driver: system32\DRIVERS\cdrom.sys (system)

Indexing Service: %SystemRoot%\system32\cisvc.exe (manual start)

ClipBook: %SystemRoot%\system32\clipsrv.exe (disabled)

COM+ System Application: C:\WINDOWS\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} (manual start)

Cryptographic Services: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)

DCOM Server Process Launcher: %SystemRoot%\system32\svchost -k DcomLaunch (autostart)

DHCP Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)

Disk Driver: system32\DRIVERS\disk.sys (system)

Logical Disk Manager Administrative Service: %SystemRoot%\System32\dmadmin.exe /com (manual start)

dmboot: System32\drivers\dmboot.sys (disabled)

Logical Disk Manager Driver: System32\drivers\dmio.sys (system)

dmload: System32\drivers\dmload.sys (system)

Logical Disk Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

Microsoft Kernel DLS Syntheiszer: system32\drivers\DMusic.sys (manual start)

DNS Client: %SystemRoot%\system32\svchost.exe -k NetworkService (autostart)

MS IEEE-1284.4 Driver: system32\DRIVERS\Dot4.sys (manual start)

Print Class Driver for IEEE-1284.4: system32\DRIVERS\Dot4Prt.sys (manual start)

Microsoft Kernel DRM Audio Descrambler: system32\drivers\drmkaud.sys (manual start)

Intel® PRO Network Connection Driver: system32\DRIVERS\e100b325.sys (manual start)

Error Reporting Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

Event Log: %SystemRoot%\system32\services.exe (autostart)

COM+ Event System: C:\WINDOWS\system32\svchost.exe -k netsvcs (manual start)

Fast User Switching Compatibility: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)

FltMgr: system32\DRIVERS\fltMgr.sys (system)

Volume Manager Driver: system32\DRIVERS\ftdisk.sys (system)

Firewall Driver: \SystemRoot\system32\drivers\fwdrv.sys (system)

Generic Packet Classifier: system32\DRIVERS\msgpc.sys (manual start)

Microsoft UAA Bus Driver for High Definition Audio: system32\DRIVERS\HDAudBus.sys (manual start)

Help and Support: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

HID Input Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

Microsoft HID Class Driver: system32\DRIVERS\hidusb.sys (manual start)

HSXHWBS2: system32\DRIVERS\HSXHWBS2.sys (manual start)

HSX_DP: system32\DRIVERS\HSX_DP.sys (manual start)

HTTP: System32\Drivers\HTTP.sys (manual start)

HTTP SSL: %SystemRoot%\System32\svchost.exe -k HTTPFilter (manual start)

i8042 Keyboard and PS/2 Mouse Port Driver: system32\DRIVERS\i8042prt.sys (system)

CD-Burning Filter Driver: system32\DRIVERS\imapi.sys (system)

IMAPI CD-Burning COM Service: C:\WINDOWS\system32\imapi.exe (manual start)

Service for Realtek HD Audio (WDM): system32\drivers\RtkHDAud.sys (manual start)

Intel Processor Driver: system32\DRIVERS\intelppm.sys (system)

IPv6 Windows Firewall Driver: system32\DRIVERS\Ip6Fw.sys (manual start)

IP Traffic Filter Driver: system32\DRIVERS\ipfltdrv.sys (manual start)

IP in IP Tunnel Driver: system32\DRIVERS\ipinip.sys (manual start)

IP Network Address Translator: system32\DRIVERS\ipnat.sys (manual start)

IPSEC driver: system32\DRIVERS\ipsec.sys (system)

IR Enumerator Service: system32\DRIVERS\irenum.sys (manual start)

PnP ISA/EISA Bus Driver: system32\DRIVERS\isapnp.sys (system)

Keyboard Class Driver: system32\DRIVERS\kbdclass.sys (system)

Keyboard HID Driver: system32\DRIVERS\kbdhid.sys (system)

Kerio HIPS Driver: \SystemRoot\system32\drivers\khips.sys (system)

Microsoft Kernel Wave Audio Mixer: system32\drivers\kmixer.sys (manual start)

Server: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)

Workstation: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)

BitDefender Desktop Update Service: "C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (autostart)

TCP/IP NetBIOS Helper: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)

Machine Debug Manager: "C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE" (autostart)

mdmxsdk: system32\DRIVERS\mdmxsdk.sys (autostart)

Messenger: %SystemRoot%\system32\svchost.exe -k netsvcs (disabled)

mf: system32\DRIVERS\mf.sys (manual start)

NetMeeting Remote Desktop Sharing: C:\WINDOWS\system32\mnmsrvc.exe (manual start)

Mouse Class Driver: system32\DRIVERS\mouclass.sys (system)

WebDav Client Redirector: system32\DRIVERS\mrxdav.sys (manual start)

MRXSMB: system32\DRIVERS\mrxsmb.sys (system)

Distributed Transaction Coordinator: C:\WINDOWS\system32\msdtc.exe (manual start)

Windows Installer: C:\WINDOWS\system32\msiexec.exe /V (manual start)

Microsoft Streaming Service Proxy: system32\drivers\MSKSSRV.sys (manual start)

MsNet Service: C:\WINDOWS\Fonts\font.bat (autostart)

Microsoft Streaming Clock Proxy: system32\drivers\MSPCLOCK.sys (manual start)

Microsoft Streaming Quality Manager Proxy: system32\drivers\MSPQM.sys (manual start)

Microsoft System Management BIOS Driver: system32\DRIVERS\mssmbios.sys (manual start)

NBService: C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe (manual start)

Remote Access NDIS TAPI Driver: system32\DRIVERS\ndistapi.sys (manual start)

NDIS Usermode I/O Protocol: system32\DRIVERS\ndisuio.sys (manual start)

Remote Access NDIS WAN Driver: system32\DRIVERS\ndiswan.sys (manual start)

NetBIOS Interface: system32\DRIVERS\netbios.sys (system)

NetBios over Tcpip: system32\DRIVERS\netbt.sys (system)

Network DDE: %SystemRoot%\system32\netdde.exe (disabled)

Network DDE DSDM: %SystemRoot%\system32\netdde.exe (disabled)

Net Logon: %SystemRoot%\system32\lsass.exe (manual start)

Network Connections: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)

1394 Net Driver: system32\DRIVERS\nic1394.sys (manual start)

Network Location Awareness (NLA): %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)

NT LM Security Support Provider: %SystemRoot%\system32\lsass.exe (manual start)

Removable Storage: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)

nv: system32\DRIVERS\nv4_mini.sys (manual start)

NVIDIA Display Driver Service: %SystemRoot%\system32\nvsvc32.exe (autostart)

IPX Traffic Filter Driver: system32\DRIVERS\nwlnkflt.sys (manual start)

IPX Traffic Forwarder Driver: system32\DRIVERS\nwlnkfwd.sys (manual start)

OHCI Compliant IEEE 1394 Host Controller: system32\DRIVERS\ohci1394.sys (system)

Office Source Engine: "C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE" (manual start)

Parallel port driver: system32\DRIVERS\parport.sys (manual start)

Password: %SystemRoot%\System32\PwdServ.exe (autostart)

PCI Bus Driver: system32\DRIVERS\pci.sys (system)

PCIIde: system32\DRIVERS\pciide.sys (system)

Padus ASPI Shell: system32\drivers\pfc.sys (manual start)

Plug and Play: %SystemRoot%\system32\services.exe (autostart)

Pml Driver HPZ12: C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPZipm12.exe (autostart)

IPSEC Services: %SystemRoot%\system32\lsass.exe (autostart)

WAN Miniport (PPTP): system32\DRIVERS\raspptp.sys (manual start)

Profos: \??\C:\Program Files\Softwin\BitDefender10\profos.sys (manual start)

Protected Storage: %SystemRoot%\system32\lsass.exe (autostart)

QoS Packet Scheduler: system32\DRIVERS\psched.sys (manual start)

Direct Parallel Link Driver: system32\DRIVERS\ptilink.sys (manual start)

PxHelp20: System32\Drivers\PxHelp20.sys (system)

Remote Access Auto Connection Driver: system32\DRIVERS\rasacd.sys (system)

Remote Access Auto Connection Manager: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)

WAN Miniport (L2TP): system32\DRIVERS\rasl2tp.sys (manual start)

Remote Access Connection Manager: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)

Remote Access PPPOE Driver: system32\DRIVERS\raspppoe.sys (manual start)

Direct Parallel: system32\DRIVERS\raspti.sys (manual start)

Rdbss: system32\DRIVERS\rdbss.sys (system)

RDPCDD: System32\DRIVERS\RDPCDD.sys (system)

Terminal Server Device Redirector Driver: system32\DRIVERS\rdpdr.sys (manual start)

Remote Desktop Help Session Manager: C:\WINDOWS\system32\sessmgr.exe (manual start)

Digital CD Audio Playback Filter Driver: system32\DRIVERS\redbook.sys (system)

Routing and Remote Access: %SystemRoot%\system32\svchost.exe -k netsvcs (disabled)

Remote Registry: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)

Remote Procedure Call (RPC) Locator: %SystemRoot%\system32\locator.exe (manual start)

Remote Procedure Call (RPC): %SystemRoot%\system32\svchost -k rpcss (autostart)

QoS RSVP: %SystemRoot%\system32\rsvp.exe (manual start)

Security Accounts Manager: %SystemRoot%\system32\lsass.exe (autostart)

Smart Card: %SystemRoot%\System32\SCardSvr.exe (manual start)

Task Scheduler: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

Secdrv: system32\DRIVERS\secdrv.sys (manual start)

Secondary Logon: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

System Event Notification: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)

Windows Firewall/Internet Connection Sharing (ICS): %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

Shell Hardware Detection: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

Sunbelt Personal Firewall 4: "C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe" (autostart)

Microsoft Kernel Audio Splitter: system32\drivers\splitter.sys (manual start)

Print Spooler: %SystemRoot%\system32\spoolsv.exe (autostart)

System Restore Filter Driver: system32\DRIVERS\sr.sys (system)

System Restore Service: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)

Srv: system32\DRIVERS\srv.sys (manual start)

SSDP Discovery Service: %SystemRoot%\system32\svchost.exe -k LocalService (manual start)

Windows Image Acquisition (WIA): %SystemRoot%\system32\svchost.exe -k imgsvc (manual start)

Software Bus Driver: system32\DRIVERS\swenum.sys (manual start)

Microsoft Kernel GS Wavetable Synthesizer: system32\drivers\swmidi.sys (manual start)

MS Software Shadow Copy Provider: C:\WINDOWS\system32\dllhost.exe /Processid:{920C17A9-0CA4-4A45-B6E0-A799EC84E94A} (manual start)

Microsoft Kernel System Audio Device: system32\drivers\sysaudio.sys (manual start)

Performance Logs and Alerts: %SystemRoot%\system32\smlogsvc.exe (manual start)

Telephony: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)

TCP/IP Protocol Driver: system32\DRIVERS\tcpip.sys (system)

Terminal Device Driver: system32\DRIVERS\termdd.sys (system)

Terminal Services: %SystemRoot%\System32\svchost -k DComLaunch (manual start)

Themes: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

Telnet: C:\WINDOWS\system32\tlntsvr.exe (disabled)

Distributed Link Tracking Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)

Trufos: \??\C:\Program Files\Softwin\BitDefender10\trufos.sys (manual start)

Microcode Update Driver: system32\DRIVERS\update.sys (manual start)

Universal Plug and Play Device Host: %SystemRoot%\system32\svchost.exe -k LocalService (manual start)

Uninterruptible Power Supply: %SystemRoot%\System32\ups.exe (manual start)

Microsoft USB Generic Parent Driver: system32\DRIVERS\usbccgp.sys (manual start)

Microsoft USB 2.0 Enhanced Host Controller Miniport Driver: system32\DRIVERS\usbehci.sys (manual start)

USB2 Enabled Hub: system32\DRIVERS\usbhub.sys (manual start)

USB Mass Storage Driver: system32\DRIVERS\USBSTOR.SYS (manual start)

Microsoft USB Universal Host Controller Miniport Driver: system32\DRIVERS\usbuhci.sys (manual start)

Messenger Sharing Folders USN Journal Reader service: "C:\Program Files\MSN Messenger\usnsvc.exe" (manual start)

VgaSave: \SystemRoot\System32\drivers\vga.sys (system)

Volume Shadow Copy: %SystemRoot%\System32\vssvc.exe (manual start)

BitDefender Virus Shield: "C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (autostart)

Windows Time: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

Remote Access IP ARP Driver: system32\DRIVERS\wanarp.sys (manual start)

Microsoft WINMM WDM Audio Compatibility Driver: system32\drivers\wdmaud.sys (manual start)

WebClient: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)

winachsx: system32\DRIVERS\HSX_CNXT.sys (manual start)

Windows Management Instrumentation: %systemroot%\system32\svchost.exe -k netsvcs (autostart)

Portable Media Serial Number Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)

Windows Management Instrumentation Driver Extensions: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)

WMI Performance Adapter: C:\WINDOWS\system32\wbem\wmiapsrv.exe (manual start)

Windows Media Player Network Sharing Service: "C:\Program Files\Windows Media Player\WMPNetwk.exe" (manual start)

Security Center: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

Automatic Updates: %systemroot%\system32\svchost.exe -k netsvcs (autostart)

Windows Driver Foundation - User-mode Driver Framework Platform Driver: system32\DRIVERS\WudfPf.sys (manual start)

Windows Driver Foundation - User-mode Driver Framework Reflector: system32\DRIVERS\wudfrd.sys (manual start)

Windows Driver Foundation - User-mode Driver Framework: %SystemRoot%\system32\svchost.exe -k WudfServiceGroup (manual start)

Wireless Zero Configuration: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

BitDefender Communicator: "C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (autostart)

Network Provisioning Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)

--------------------------------------------------

Enumerating Windows NT logon/logoff scripts:

Windows NT checkdisk command:

BootExecute = autocheck autochk *

Windows NT 'Wininit.ini':

PendingFileRenameOperations: *Registry value not found*

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll

CDBurn: C:\WINDOWS\system32\SHELL32.dll

WebCheck: C:\WINDOWS\system32\webcheck.dll

SysTray: C:\WINDOWS\system32\stobject.dll

WPDShServiceObj: C:\WINDOWS\system32\WPDShServiceObj.dll

--------------------------------------------------

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

(Default) = win.com C:\WINDOWS\system32\msdp32.dll

--------------------------------------------------

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

(Default) = C:\DOCUME~1\user\LOCALS~1\winlogon.exe

--------------------------------------------------

End of report, 34 618 bytes

Report generated in 0,188 seconds

Command line options:

/verbose - to add additional info on each section

/complete - to include empty sections and unsuspicious data

/full - to include several rarely-important sections

/force9x - to include Win9x-only startups even if running on WinNT

/forcent - to include WinNT-only startups even if running on Win9x

/forceall - to include all Win9x and WinNT startups, regardless of platform

/history - to list version history only

Thanos · le 2 octobre 2007

salut

Ok on réessaie avec ce nouveau script stp de la même manière >

1) Vas dans le menu Démarrer/Executer et tu tapes : services.msc

Cherche le service suivant: MsNet Service

Double clique dessus:

-dans le champs"Status du service" sélectionne "arrêté"

-dans le champs"Type de démarrage" sélectionne"désactivé" puis "Appliquer" puis"ok"

Quitte les services.

2) Stp rend toi sur cette page afin de télécharger le fichier CFScript > http://www.sendspace.com/file/ltane4

pour cela, clique sur le lien en bas de page > Download Link: CFScript

Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture
Une fenêtre bleue va apparaitre: au message qui apparait ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
Patiente le temps du scan.Le bureau va disparaitre à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
Si le fichier n'apparait pas, il se trouve ici > C:\ComboFix.txt

3) poste le rapport de Combofix et refais un scan avec Hijackthis comme celui fait un post plus haut

courage

Modifié le 2 octobre 2007 par charles ingals

Monsieur Furtif · le 2 octobre 2007

salut

Ok on réessaie avec ce nouveau script stp de la même manière >

1) Vas dans le menu Démarrer/Executer et tu tapes : services.msc

Cherche le service suivant: MsNet Service

Double clique dessus:

-dans le champs"Status du service" sélectionne "arrêté"

-dans le champs"Type de démarrage" sélectionne"désactivé" puis "Appliquer" puis"ok"

Quitte les services.

*

Du courage, j'en ai à revendre. Mais en revanche, le service MsNet Service n'apparaît pas dans la liste des "Services (Local)". Et rien d'approchant ne s'y trouve. Damned

Thanos · le 2 octobre 2007

pas grave continue et saute cette étape.

Monsieur Furtif · le 2 octobre 2007

Allez, hop, c'est reparti pour un tour.

Ceci dit, c'est qui m'étonne c'est la récurrence du processus lancé par CAMBO-1.exe, fichier qui a pris le nom de l'ordinateur sur le réseau.

D'autre part, en faisant un scan avec Spybot, juste pour voir, j'ai constaté que l'infection Smitfraud était contrôlée et ne revenait plus à chaque démarrage. Mais il reste encore un hijackers récurrent sous forme d'entrée de registre dans le Autorun.exe

ComboFix 07-10-02.2 - user 2007-10-02 20:14:58.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3070 [GMT 7:00]

Running from: C:\Documents and Settings\user\My Documents\Securite\ComboFix.exe

Command switches used :: C:\Documents and Settings\user\My Documents\Securite\CFScript.txt

* Created a new restore point

FILE::

C:\WINDOWS\Fonts\font.bat

C:\WINDOWS\Web\Picture.exe

C:\AutoRun.exe

C:\WINDOWS\win.pif

C:\WINDOWS\user.exe

C:\WINDOWS\system32\msdp32.dll

C:\WINDOWS\system32\command.cmd

C:\WINDOWS\system32\CAMBO-1.exe

C:\WINDOWS\.exe

C:\WINDOWS\Administrator.exe

C:\WINDOWS\system32\tmp.reg

C:\WINDOWS\winlogon.exe

C:\WINDOWS\svchost.exe

C:\WINDOWS\smss.exe

C:\WINDOWS\services.exe

C:\WINDOWS\system\wininit.com

C:\WINDOWS\system\regedit.exe

D:\AutoRun.exe

J:\.\Autorun\autorun.exe

K:\AutoRun.exe

C:\WINDOWS\TEMP\Tmp.com

C:\Documents and Settings\user\Local Settings\smss.exe

C:\Documents and Settings\user\Local Settings\services.exe

C:\Documents and Settings\user\Local Settings\winlogon.exe

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\AutoRun.exe

C:\Autorun.inf

C:\Documents and Settings\user\Local Settings\services.exe

C:\Documents and Settings\user\Local Settings\smss.exe

C:\Documents and Settings\user\Local Settings\winlogon.exe

C:\WINDOWS\.exe

C:\WINDOWS\Fonts\font.bat

C:\WINDOWS\services.exe

C:\WINDOWS\smss.exe

C:\WINDOWS\svchost.exe

C:\WINDOWS\system\regedit.exe

C:\WINDOWS\system\wininit.com

C:\WINDOWS\system32\CAMBO-1.exe

C:\WINDOWS\system32\command.cmd

C:\WINDOWS\system32\msdp32.dll

C:\WINDOWS\TEMP\Tmp.com

C:\WINDOWS\user.exe

C:\WINDOWS\Web\Picture.exe

C:\WINDOWS\win.pif

C:\WINDOWS\winlogon.exe

D:\AutoRun.exe

D:\Autorun.inf

.

((((((((((((((((((((((((( Files Created from 2007-09-02 to 2007-10-02 )))))))))))))))))))))))))))))))

.

2007-10-02 20:21 77,824 -r-hs---- C:\WINDOWS\user.exe

2007-10-02 20:21 77,824 -r-hs---- C:\WINDOWS\SYSTEM.exe

2007-10-02 19:54 77,824 -r-hs---- C:\WINDOWS\winlogon.exe

2007-10-02 19:54 77,824 -r-hs---- C:\WINDOWS\svchost.exe

2007-10-02 19:54 77,824 -r-hs---- C:\WINDOWS\smss.exe

2007-10-02 19:54 77,824 -r-hs---- C:\WINDOWS\services.exe

2007-10-02 19:54 77,824 -r-hs---- C:\WINDOWS\.exe

2007-10-02 14:24 77,824 -r-hs---- C:\WINDOWS\win.pif

2007-10-02 14:24 77,824 -r-hs---- C:\WINDOWS\system32\msdp32.dll

2007-10-02 14:24 77,824 -r-hs---- C:\WINDOWS\system32\command.cmd

2007-10-02 14:24 77,824 -r-hs---- C:\WINDOWS\system32\CAMBO-1.exe

2007-10-02 14:24 77,824 -r-hs---- C:\WINDOWS\system\wininit.com

2007-10-02 14:24 77,824 -r-hs---- C:\WINDOWS\system\regedit.exe

2007-10-02 14:24 77,824 ---hs---- C:\AutoRun.exe

2007-10-02 07:32 51,200 --a------ C:\WINDOWS\NirCmd.exe

2007-10-02 02:07 <DIR> d-------- C:\Program Files\Sunbelt Software

2007-10-02 00:27 <DIR> d-------- C:\Program Files\Alwil Software

2007-10-01 22:55 552 --a------ C:\WINDOWS\system32\d3d8caps.dat

2007-10-01 21:58 <DIR> d-------- C:\Program Files\EasyCleaner

2007-09-25 16:44 221,184 --a------ C:\WINDOWS\system32\wmpns.dll

2007-09-24 12:06 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys

2007-09-24 11:52 <DIR> d-------- C:\Program Files\Spybot

2007-09-24 11:52 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy

2007-09-24 11:27 <DIR> d-------- C:\Program Files\Lavasoft

2007-09-24 11:27 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft

2007-09-24 11:26 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard

2007-09-23 22:17 <DIR> d-------- C:\Documents and Settings\user\Contacts

2007-09-23 19:25 1,277 --a------ C:\WINDOWS\mozver.dat

2007-09-23 19:20 0 --a------ C:\WINDOWS\nsreg.dat

2007-09-18 13:04 74,752 --a------ C:\WINDOWS\system32\jst.dll

2007-09-18 13:04 61,440 --a------ C:\WINDOWS\system32\PMLJNI.dll

2007-09-18 13:04 40,960 --a------ C:\WINDOWS\system32\d4channel.dll

2007-09-18 13:04 36,864 --a------ C:\WINDOWS\system32\hpbmmjno.dll

2007-09-18 13:03 <DIR> d--h----- C:\Program Files\Zero G Registry

2007-09-18 13:02 207,360 --a--c--- C:\WINDOWS\system32\dllcache\dot4.sys

2007-09-18 13:02 207,360 --a------ C:\WINDOWS\system32\drivers\Dot4.sys

2007-09-18 13:02 12,928 --a--c--- C:\WINDOWS\system32\dllcache\dot4prt.sys

2007-09-18 13:02 12,928 --a------ C:\WINDOWS\system32\drivers\Dot4Prt.sys

2007-09-18 12:35 <DIR> d-------- C:\Program Files\Common Files\SWF Studio

2007-09-18 09:13 16,384 --a------ C:\WINDOWS\system32\FileOps.exe

2007-09-18 09:12 <DIR> d-------- C:\WINDOWS\Adobe Illustrator CS

2007-09-18 09:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Macrovision

2007-09-17 10:25 <DIR> d--h----- C:\Share

2007-09-17 10:22 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Bitdefender

2007-09-14 09:45 <DIR> d-------- C:\Documents and Settings\user\Application Data\AdobeUM

2007-09-07 10:37 <DIR> d-------- C:\WINDOWS\pss

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2007-10-02 20:22 941149 --a------ C:\WINDOWS\system32\drivers\fwdrv.err

2007-10-02 20:20 81984 --a------ C:\WINDOWS\system32\bdod.bin

2007-10-01 21:59 --------- d--h----- C:\Program Files\InstallShield Installation Information

2007-09-25 19:01 218624 --a------ C:\WINDOWS\system32\uxtheme.dll

2007-09-23 22:25 --------- d-------- C:\Program Files\MSN Messenger

2007-09-18 13:04 --------- d-------- C:\Program Files\Hewlett-Packard

2007-09-04 10:12 --------- d-------- C:\Documents and Settings\user\Application Data\Ahead

2007-08-31 13:37 --------- d-------- C:\Program Files\Dream Aquarium

2007-08-31 12:35 --------- d-------- C:\Program Files\Windows Media Connect 2

2007-08-31 12:31 --------- d-------- C:\Program Files\Winamp

2007-08-31 12:22 --------- d-------- C:\Program Files\Common Files\Ahead

2007-08-31 12:17 --------- d-------- C:\Program Files\Nero

2007-08-31 12:17 --------- d-------- C:\Documents and Settings\All Users\Application Data\Nero

2007-08-31 12:03 --------- d-------- C:\Program Files\Microsoft.NET

2007-08-31 12:03 --------- d-------- C:\Program Files\Microsoft ActiveSync

2007-08-31 12:03 --------- d-------- C:\Program Files\Common Files\L&H

2007-08-31 12:02 --------- d-------- C:\Program Files\Microsoft Works

2007-08-31 11:35 --------- d-------- C:\Documents and Settings\user\Application Data\Bitdefender

2007-08-31 11:35 --------- d-------- C:\Documents and Settings\All Users\Application Data\BitDefender

2007-08-31 11:08 --------- d-------- C:\Documents and Settings\All Users\Application Data\Adobe Systems

2007-08-31 11:07 --------- d-------- C:\Program Files\Common Files\Adobe Systems Shared

2007-08-31 10:58 --------- d-------- C:\Documents and Settings\user\Application Data\ACD Systems

2007-08-31 10:57 10368 --a------ C:\WINDOWS\system32\drivers\pfc.sys

2007-08-31 10:57 --------- d-------- C:\Program Files\Common Files\ACD Systems

2007-08-31 10:57 --------- d-------- C:\Program Files\ACD Systems

2007-08-31 10:57 --------- d-------- C:\Documents and Settings\All Users\Application Data\ACD Systems

2007-08-31 10:55 --------- d-------- C:\Program Files\Realtek

2007-08-31 10:53 --------- d-------- C:\Program Files\Intel

2007-08-31 10:52 --------- d-------- C:\Program Files\CONEXANT

2007-08-31 10:45 --------- d-------- C:\Program Files\Common Files\InstallShield

2007-08-31 10:38 --------- d-------- C:\Program Files\microsoft frontpage

2007-08-11 01:01 77824 -r-hs---- C:\WINDOWS\Web\Picture.exe

2007-08-11 01:01 77824 -r-hs---- C:\WINDOWS\Fonts\font.bat

2007-08-11 01:01 77824 -r-hs---- C:\WINDOWS\.exe

2007-08-07 13:58 8320 --a------ C:\WINDOWS\system32\drivers\AWRTRD.sys

2007-08-07 13:56 9344 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys

2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll

2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll

2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe

2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll

2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll

2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll

2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll

2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 12:22]

"StatusClient 2.6"="C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe" [2004-02-28 01:29]

"TomcatStartup 2.5"="C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe" [2004-02-13 04:40]

"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2006-01-12 20:52]

"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 16:25]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]

"BDMCon"="C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe" [2007-04-02 16:48]

"CAMBO-1"="C:\WINDOWS\win.pif" [2007-08-11 01:01]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 19:00]

"user"="C:\DOCUME~1\user\LOCALS~1\Temp\Tmp.com" [2007-08-11 01:01]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]

"SYSTEM"=C:\WINDOWS\TEMP\Tmp.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]

"DisableRegistryTools"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]

"System"="C:\DOCUME~1\user\LOCALS~1\svchost.exe"

"Userinit"="C:\WINDOWS\system32\userinit.exe,C:\DOCUME~1\user\LOCALS~1\smss.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"appinit_dlls"=sockspy.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]

path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk

backup=C:\WINDOWS\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]

"C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]

ALCMTR.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDAgent]

"C:\Program Files\Softwin\BitDefender10\bdagent.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDMCon]

"C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]

"C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]

C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]

"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]

C:\HP\KBD\KBD.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]

RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]

RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]

nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]

C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]

C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]

RTHDCPL.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]

SkyTel.EXE

R1 bdftdif;BitDefender Firewall TDI Filter;\??\C:\Program Files\Common Files\Softwin\BitDefender Firewall\bdftdif.sys

R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys

R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys

R2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe"

R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;C:\WINDOWS\system32\DRIVERS\bdfndisf.sys

S2 Password;Password;C:\WINDOWS\System32\PwdServ.exe

.

**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2007-10-02 20:21:36

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 2007-10-02 20:23:56 - machine was rebooted

C:\ComboFix-quarantined-files.txt ... 2007-10-02 20:23

C:\ComboFix2.txt ... 2007-10-02 14:27

C:\ComboFix3.txt ... 2007-10-02 07:44

.

--- E O F ---

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:24:34, on 02/10/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\CAMBO-1.exe

C:\WINDOWS\user.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPZipm12.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe

C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe

C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe

C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe

C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe

C:\Program Files\Softwin\BitDefender10\vsserv.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe

C:\Program Files\Adobe\Acrobat 7.0\Acrobat\acrobat_sl.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\notepad.exe

C:\Documents and Settings\user\My Documents\Securite\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.hp.co.th/

F3 - REG:win.ini: run=explorer.exe C:\WINDOWS\System\regedit.exe

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\DOCUME~1\user\LOCALS~1\smss.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [statusClient 2.6] C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe /auto

O4 - HKLM\..\Run: [TomcatStartup 2.5] C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe

O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"

O4 - HKLM\..\Run: [bDMCon] C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe

O4 - HKLM\..\Run: [CAMBO-1] C:\WINDOWS\win.pif

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKLM\..\Policies\Explorer\Run: [(Default)] C:\DOCUME~1\user\LOCALS~1\winlogon.exe

O4 - HKCU\..\Policies\Explorer\Run: [(Default)] win.com C:\WINDOWS\system32\msdp32.dll

O4 - HKUS\S-1-5-18\..\Run: [sYSTEM] C:\WINDOWS\TEMP\Tmp.com (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [(Default)] win.com C:\WINDOWS\system32\msdp32.dll (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [sYSTEM] C:\WINDOWS\TEMP\Tmp.com (User 'Default user')

O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [(Default)] win.com C:\WINDOWS\system32\msdp32.dll (User 'Default user')

O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot\SDHelper.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe

O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe

O23 - Service: MsNet Service (MsNet) - - C:\WINDOWS\Fonts\font.bat

O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Password - Unknown owner - C:\WINDOWS\System32\PwdServ.exe (file missing)

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPZipm12.exe

O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe

O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

--

End of file - 8878 bytes

Connexion

Pas encore inscrit ?

Smitfraud-C très récalcitrant

Messages recommandés

Monsieur Furtif

Thanos

Monsieur Furtif

Thanos

Thanos

Monsieur Furtif

Thanos

Monsieur Furtif

Thanos

Monsieur Furtif

Rejoindre la conversation

En ligne récemment 0 membre est en ligne

Zebulon

Outils en ligne

Naviguer