Malwares, Spywares ?

superphile · le 21 août 2008

Bonjour,

J'ai récupéré le PC portable d'un ami qui ne s'en sortait plus... En effet, son PC est très lent et de nombreuses pop-up s'ouvrent intempestivement ( Antivirus, Error...) Bref, je pensais pouvoir résoudre son problème mais pas évident de s'y retrouver ...

Je me permets de vous demander un peu d'aide...

Je vous place le rapport HijackThis et le log de Combofix

En vous remerciant d'avance

Philippe

Rapport Hijackthis :

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 9:42:08, on 21/08/2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Boot mode: Safe mode with network support

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://global.acer.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O4 - HKLM\..\Run: [LaunchApp] Alaunch

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe

O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe

O4 - HKLM\..\Run: [synTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\System32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe

O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\TELENE~1\SMARTB~1\MotiveSB.exe

O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"

O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Browser MOUSE\mouse32a.exe

O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\telenet internet security pack\Common\FSM32.EXE" /splash

O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\telenet internet security pack\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW

O4 - HKLM\..\Run: [statusClient 2.6] C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe /auto

O4 - HKLM\..\Run: [TomcatStartup 2.5] C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\QtDTAcer.EXE

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll

O9 - Extra button: Ouderlijk... - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\telenet internet security pack\FSPC\fspcmsie.dll

O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\telenet internet security pack\FSPC\fspcmsie.dll

O9 - Extra 'Tools' menuitem: Ouderlijk... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\telenet internet security pack\FSPC\fspcmsie.dll

O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\telenet internet security pack\FSPC\fspcmsie.dll

O9 - Extra 'Tools' menuitem: Webpaginafilter tijdelijk uit - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\telenet internet security pack\FSPC\fspcmsie.dll

O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\telenet internet security pack\FSPC\fspcmsie.dll

O9 - Extra 'Tools' menuitem: Deze website &weigeren - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\telenet internet security pack\FSPC\fspcmsie.dll

O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\telenet internet security pack\FSPC\fspcmsie.dll

O9 - Extra 'Tools' menuitem: Deze website &toestaan - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\telenet internet security pack\FSPC\fspcmsie.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {08BEF711-06DA-48B2-9534-802ECAA2E4F9} (PlxInstall Class) - http://down.plaxo.com/down/latest/PlaxoInstall.cab

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC...bin/AvSniff.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by13fd.bay13.hotmail.msn.com/resources/MsnPUpld.cab

O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1124973987281

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse...pdownloader.cab

O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corporation - C:\Program Files\telenet internet security pack\Anti-Virus\fsgk32st.exe

O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\telenet internet security pack\FSAUA\program\fsaua.exe

O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\telenet internet security pack\FWES\Program\fsdfwd.exe

O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\telenet internet security pack\Common\FSMA32.EXE

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

--

End of file - 9030 bytes

Rapport Combofix :

ComboFix 08-08-19.06 - Administrator 2008-08-21 9:23:33.1 - NTFSx86 NETWORK

Microsoft Windows XP Home Edition 5.1.2600.3.1252.31.1043.18.358 [GMT 2:00]

Gestart vanuit: C:\Documents and Settings\Administrator\Bureaublad\ComboFix.exe

WAARSCHUWING - DE RECOVERY CONSOLE IS NIET OP DIT SYSTEEM GEINSTALLEERD !!

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Program Files\Common Files\companion wizard

C:\Program Files\Common Files\companion wizard\WapCHK.dll

C:\WINDOWS\Downloaded Program Files\egauth.inf

C:\WINDOWS\Downloaded Program Files\nethv32.inf

C:\WINDOWS\Downloaded Program Files\sysinetsvc32.inf

C:\WINDOWS\Downloaded Program Files\syswbsvc32.inf

C:\WINDOWS\system32\awftgoeb.dat

c:\WINDOWS\system32\awftgoeb_navps.dat

c:\WINDOWS\system32\awftgoeb_navup.dat

C:\WINDOWS\system32\fxnqpgd.dat

C:\WINDOWS\system32\fxnqpgd_nav.dat

C:\WINDOWS\system32\fxnqpgd_navps.dat

C:\WINDOWS\system32\haungzeb.dat

C:\WINDOWS\system32\haungzeb_nav.dat

c:\WINDOWS\system32\haungzeb_navps.dat

c:\WINDOWS\system32\ijvrpxnqlg.dat

c:\WINDOWS\system32\ijvrpxnqlg_nav.dat

c:\WINDOWS\system32\ijvrpxnqlg_navps.dat

c:\WINDOWS\system32\kgdrhoz.dat

C:\WINDOWS\system32\kgdrhoz_nav.dat

C:\WINDOWS\system32\kgdrhoz_navps.dat

C:\WINDOWS\system32\lqlzzjbhy.dat

C:\WINDOWS\system32\lqlzzjbhy_nav.dat

C:\WINDOWS\system32\lqlzzjbhy_navps.dat

C:\WINDOWS\system32\pztjkq.dat

C:\WINDOWS\system32\pztjkq_nav.dat

C:\WINDOWS\system32\pztjkq_navps.dat

c:\WINDOWS\system32\pzxgwuk.dat

C:\WINDOWS\system32\pzxgwuk_nav.dat

c:\WINDOWS\system32\pzxgwuk_navps.dat

C:\WINDOWS\system32\qcxaliw.dat

C:\WINDOWS\system32\qcxaliw_navps.dat

c:\WINDOWS\system32\qcxaliw_navup.dat

C:\WINDOWS\system32\qsvpowjzuk_navtmp.dat

c:\WINDOWS\system32\rkztviqlwb.dat

c:\WINDOWS\system32\rkztviqlwb_nav.dat

c:\WINDOWS\system32\rkztviqlwb_navps.dat

C:\WINDOWS\system32\szmcreqiot.dat

C:\WINDOWS\system32\szmcreqiot_nav.dat

C:\WINDOWS\system32\szmcreqiot_navps.dat

C:\WINDOWS\system32\tvsimgdfak.dat

c:\WINDOWS\system32\tvsimgdfak_nav.dat

C:\WINDOWS\system32\tvsimgdfak_navps.dat

C:\WINDOWS\system32\wokgbujrp.dat

c:\WINDOWS\system32\wokgbujrp_nav.dat

c:\WINDOWS\system32\wokgbujrp_navps.dat

c:\WINDOWS\system32\xceoyfrhu.dat

C:\WINDOWS\system32\xceoyfrhu_nav.dat

c:\WINDOWS\system32\xceoyfrhu_navps.dat

C:\WINDOWS\system32\zhtfwlypa.dat

C:\WINDOWS\system32\zhtfwlypa_nav.dat

C:\WINDOWS\system32\zhtfwlypa_navps.dat

C:\WINDOWS\tmlpcert2005

C:\WINDOWS\tmlpcert2007

.

(((((((((((((((((((( Bestanden Gemaakt van 2008-07-21 to 2008-08-21 ))))))))))))))))))))))))))))))

.

2008-08-21 00:22 . 2008-08-21 00:22 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\AdobeUM

2008-08-21 00:04 . 2008-08-21 00:04 <DIR> d-------- C:\Program Files\Avira

2008-08-21 00:04 . 2008-08-21 00:04 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avira

2008-08-20 22:52 . 2004-02-12 13:01 <DIR> d--h----- C:\Documents and Settings\Administrator\Sjablonen

2008-08-20 22:52 . 2008-08-21 09:16 <DIR> dr-h----- C:\Documents and Settings\Administrator\Onlangs geopend

2008-08-20 22:52 . 2004-02-12 13:01 <DIR> d--h----- C:\Documents and Settings\Administrator\Netwerkprinteromgeving

2008-08-20 22:52 . 2004-02-12 13:10 <DIR> dr------- C:\Documents and Settings\Administrator\Mijn documenten

2008-08-20 22:52 . 2004-02-12 13:01 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start

2008-08-20 22:52 . 2004-02-12 13:10 <DIR> dr------- C:\Documents and Settings\Administrator\Favorieten

2008-08-20 22:52 . 2008-08-21 09:22 <DIR> d-------- C:\Documents and Settings\Administrator\Bureaublad

2008-08-20 22:52 . 2008-08-20 22:52 <DIR> d-------- C:\Documents and Settings\Administrator

2008-08-20 22:52 . 2003-03-25 12:28 13,089,928 -ra------ C:\Documents and Settings\Administrator\mpsetup.exe

2008-08-14 10:14 . 2008-04-11 21:06 691,712 --------- C:\WINDOWS\system32\dllcache\inetcomm.dll

2008-08-14 10:12 . 2008-05-01 16:37 331,776 --------- C:\WINDOWS\system32\dllcache\msadce.dll

2008-08-04 19:00 . 2008-08-20 13:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Google Updater

2008-07-21 11:31 . 2001-09-06 19:40 23,936 --a------ C:\WINDOWS\system32\drivers\Dot4usb.sys

2008-07-21 11:31 . 2001-09-06 19:40 23,936 --a------ C:\WINDOWS\system32\dllcache\dot4usb.sys

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-08-20 20:56 --------- d-----w C:\Program Files\Spybot - Search & Destroy

2008-08-20 20:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy

2008-08-20 08:51 --------- d-----w C:\Program Files\Launch Manager

2008-08-04 19:26 --------- d-----w C:\Program Files\Google

2008-07-08 09:16 --------- d-----w C:\Program Files\CCleaner

2008-07-07 20:30 253,952 ----a-w C:\WINDOWS\system32\es.dll

2008-07-07 20:30 253,952 ------w C:\WINDOWS\system32\dllcache\es.dll

2008-07-07 15:59 --------- d-----w C:\Program Files\OpenOffice.org 2.4

2008-07-07 15:56 --------- d-----w C:\Program Files\Open Office

2008-07-07 09:00 --------- d-----w C:\Program Files\Synaptics

2008-07-07 09:00 --------- d-----w C:\Program Files\MiTAC Research (Shanghai) Ltd

2008-07-07 08:11 --------- d--h--w C:\Program Files\InstallShield Installation Information

2008-06-24 16:46 74,240 ----a-w C:\WINDOWS\system32\mscms.dll

2008-06-24 16:46 74,240 ------w C:\WINDOWS\system32\dllcache\mscms.dll

2008-06-24 08:43 3,592,192 ------w C:\WINDOWS\system32\dllcache\mshtml.dll

2008-06-23 09:23 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe

2008-06-23 09:22 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe

2008-06-23 09:20 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe

2008-06-21 05:23 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll

2008-06-20 17:49 247,296 ----a-w C:\WINDOWS\system32\mswsock.dll

2008-06-20 17:49 247,296 ------w C:\WINDOWS\system32\dllcache\mswsock.dll

2008-06-20 17:49 147,968 ------w C:\WINDOWS\system32\dllcache\dnsapi.dll

2008-06-20 11:51 361,600 ------w C:\WINDOWS\system32\dllcache\tcpip.sys

2008-06-20 11:40 138,496 ------w C:\WINDOWS\system32\dllcache\afd.sys

2008-06-20 11:08 225,856 ------w C:\WINDOWS\system32\dllcache\tcpip6.sys

2008-06-14 17:36 272,640 ------w C:\WINDOWS\system32\dllcache\bthport.sys

2006-09-04 14:54 46,760 ----a-w C:\Documents and Settings\Gast\Application Data\GDIPFONTCACHEV1.DAT

2003-03-25 10:28 13,089,928 -c--a-r C:\WINDOWS\system32\config\systemprofile\mpsetup.exe

2003-03-25 10:28 13,089,928 -c--a-r C:\Documents and Settings\Gast\mpsetup.exe

2003-03-25 10:28 13,089,928 -c--a-r C:\Documents and Settings\Default User\mpsetup.exe

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 19:02 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"LaunchApp"="Alaunch" [X]

"LtMoh"="C:\Program Files\ltmoh\Ltmoh.exe" [2003-04-28 15:08 184320]

"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2003-04-18 14:36 110592]

"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2003-04-18 15:20 610304]

"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-21 11:52 40960]

"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2004-01-08 00:08 3051520]

"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2003-08-28 06:32 155648]

"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-08-28 06:19 118784]

"Motive SmartBridge"="C:\PROGRA~1\TELENE~1\SMARTB~1\MotiveSB.exe" [2004-04-07 09:05 385024]

"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 09:38 241664]

"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2004-12-15 11:38 98304]

"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 16:49 49152]

"FLMOFFICE4DMOUSE"="C:\Program Files\Browser MOUSE\mouse32a.exe" [2005-04-16 11:29 360448]

"F-Secure Manager"="C:\Program Files\telenet internet security pack\Common\FSM32.EXE" [2007-04-26 19:12 183208]

"F-Secure TNB"="C:\Program Files\telenet internet security pack\FSGUI\TNBUtil.exe" [2007-04-26 19:10 740208]

"StatusClient 2.6"="C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe" [2004-02-27 19:29 61440]

"TomcatStartup 2.5"="C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe" [2004-05-20 18:40 188416]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]

"LManager"="C:\Program Files\Launch Manager\QtDTAcer.EXE" [2003-11-28 13:21 335872]

"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 14:28 266497]

"SoundMan"="SOUNDMAN.EXE" [2003-12-19 17:53 65024 C:\WINDOWS\SOUNDMAN.EXE]

"AGRSMMSG"="AGRSMMSG.exe" [2003-08-20 13:18 88363 C:\WINDOWS\AGRSMMSG.exe]

"nwiz"="nwiz.exe" [2004-01-08 00:08 753664 C:\WINDOWS\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2008-04-14 19:02 15360]

C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\

Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696]

Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"VIDC.MJPG"= mcmjpg32.dll

"VIDC.DMB1"= mcmjpg32.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^Adobe Reader Speed Launch.lnk]

path=C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\Adobe Reader Speed Launch.lnk

backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^HP Digital Imaging Monitor.lnk]

path=C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\HP Digital Imaging Monitor.lnk

backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^InterVideo WinCinema Manager.lnk]

path=C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\InterVideo WinCinema Manager.lnk

backup=C:\WINDOWS\pss\InterVideo WinCinema Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^Snelstart HP Image Zone.lnk]

path=C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\Snelstart HP Image Zone.lnk

backup=C:\WINDOWS\pss\Snelstart HP Image Zone.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^Telenet EasyCare.lnk]

path=C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\Telenet EasyCare.lnk

backup=C:\WINDOWS\pss\Telenet EasyCare.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Van de Walle Marc^Menu Start^Programma's^Opstarten^Diskeeper 10 Professional Edition Registration.lnk]

path=C:\Documents and Settings\Van de Walle Marc\Menu Start\Programma's\Opstarten\Diskeeper 10 Professional Edition Registration.lnk

backup=C:\WINDOWS\pss\Diskeeper 10 Professional Edition Registration.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DiskeeperSystray]

--a------ 2006-06-07 13:35 319488 C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\gStart]

--a------ 2005-07-25 09:05 1896448 C:\Garmin\gStart.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"C:\\Program Files\\Messenger\\msmsgs.exe"=

"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=

"C:\\Program Files\\IncrediMail\\bin\\IMApp.exe"=

"C:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=

"C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=

"C:\\Program Files\\Hewlett-Packard\\Toolbox\\jre\\bin\\javaw.exe"=

"C:\\Program Files\\IncrediMail\\bin\\IncrediMail_Install.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2008-03-18 15:28]

S1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\telenet internet security pack\HIPS\fshs.sys [2008-02-13 12:49]

S3 {5C8B2B62-A385-11d5-A78B-00104B672758};AIM 3.0 Part 01 Codec Driver CH-7017-A;C:\WINDOWS\system32\drivers\A311.sys [2003-09-15 04:47]

S3 {5C8B2B65-A385-11d5-A78B-00104B672758};AIM 3.0 Part 01 Codec Driver CH-7017-B;C:\WINDOWS\system32\drivers\A310.sys [2003-09-15 04:47]

S3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\telenet internet security pack\Anti-Virus\minifilter\fsgk.sys [2007-04-26 19:07]

S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\telenet internet security pack\Anti-Virus\Win2K\FSfilter.sys [2007-04-26 19:08]

S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\telenet internet security pack\Anti-Virus\Win2K\FSrec.sys [2007-04-26 19:08]

*Newly Created Service* - CATCHME

.

Inhoud van de 'Gedeelde Taken' map

2008-08-20 C:\WINDOWS\Tasks\Scheduled scanning task.job

- C:\PROGRA~1\TELENE~2\ANTI-V~1\fsav.exe [2007-04-26 13:42]

2004-12-12 C:\WINDOWS\Tasks\Schijfopruiming.job

- C:\WINDOWS\system32\cleanmgr.exe [2008-04-14 19:02]

2004-12-12 C:\WINDOWS\Tasks\Systeemherstel.job

- C:\WINDOWS\system32\Restore\rstrui.exe [2008-04-14 19:03]

.

- - - - ORPHANS REMOVED - - - -

HKLM-Run-zzzHPSETUP - E:\Setup.exe

HKU-Default-Run-ALUAlert - C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe

MSConfigStartUp-Error Nuker - C:\Program Files\Error Nuker\bin\ErrorNuker.exe

MSConfigStartUp-ImInstaller_IncrediMail - C:\DOCUME~1\VANDEW~1\LOCALS~1\Temp\ImInstaller\IncrediMail\IncrediMail_Install.exe

MSConfigStartUp-st-1ukk00015 - c:\program files\Webdialer\st-0ukk00015.exe

MSConfigStartUp-Instant Access - p2esocks_1048.dll

.

------- Supplementary Scan -------

.

R0 -: HKCU-Main,Start Page = hxxp://global.acer.com

R0 -: HKLM-Main,Window Title = Telenet Internet

O16 -: Microsoft XML Parser for Java - file://C:\WINDOWS\Java\classes\xmldso.cab

C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd

.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-08-21 09:27:06

Windows 5.1.2600 Service Pack 3 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond

verborgen bestanden: 0

**************************************************************************

.

Voltooingstijd: 2008-08-21 9:28:24

ComboFix-quarantined-files.txt 2008-08-21 07:28:16

Pre-Run: 48,563,040,256 bytes beschikbaar

Post-Run: 48,832,548,864 bytes beschikbaar

233 --- E O F --- 2008-08-14 08:45:37

Apollo · le 21 août 2008

Bonjour,

Combien de fois faudra-t-il vous répéter que l'usage de Combofix doit être prescrit à la demande expresse d'un membre de l'équipe sécurité formé à l'outil?

C'est dangereux!Tu as envie de démolir l'ordi de ton ami?

Désinstalle ComboFix de cette manière en copiant/collant la ligne ci-dessous dans exécuter et valide:

ComboFix /u

Vire aussi le dossier C:\QooBox

Commence ta demande par la procédure habituelle, c'est à dire: défintion des problèmes comme tu as fait et log Hijackthis.

Et rien d'autre stp. Merci.

@++

Modifié le 21 août 2008 par Apollo.01

superphile · le 21 août 2008

Ooops tu as parfaitement raison... Je m'en voudrais de lui démolir son ordi et lui encore plus...

Le PC est donc fort ralenti, des popup s'ouvrent, il s'agit de XP Home en Néerlandais ..

J'ai avant tout installé Antivir, fais un petit nettoyage et ensuite je l'ai désinstallé..

Je joins le log Hijackthis ci-dessous :