besoin d'aide pour rapport hijackthis

sanka974 · le 29 juillet 2009

http://www.virustotal.com/fr/analisis/8086...8656-1239529867

angelique · le 29 juillet 2009

c'est pas l'analyse de tes fichiers /!\

Fichier 5b9c69fd00df398be86100a618861900c4f23042.EXE reçu le 2009.07.17 04:00:06 (UTC)

Situation actuelle: terminé

Résultat: 7/40 (17.50%)

recommence avec :

c:\windows\system32\Adobek.dll

c:\windows\system32\Adobec.exe

sanka974 · le 29 juillet 2009

http://www.virustotal.com/fr/analisis/7280...04cf-1248878473

sanka974 · le 29 juillet 2009

http://www.virustotal.com/fr/analisis/8086...8656-1248878113

angelique · le 29 juillet 2009

ok , je te demande tout ça pour faire un tout en un apres

analyse idem celui là: c:\windows\system32\drivers\ndis.sys

et poste le lien

sanka974 · le 29 juillet 2009

http://www.virustotal.com/fr/analisis/6998...4d02-1248707196

angelique · le 29 juillet 2009

ok ndis.sys patché \o/

• desinstalle Findykill et supp : C:\FindyKill et C:\ToolBar SD

• desinstalle Norton Security Scan si present dans ajout\supp de programmes

• ouvre ton bloc note[executer--notepad] et copies/colles le contenu du cadre ci dessous:

Extra::
Driver::
riode32
Duw71
{FF9BACB3-2B8E-45ba-9E68-B6720E5D81A3}
File::
C:\errigh.exe
C:\ymws.exe
c:\windows\system32\Adobek.dll
c:\windows\system32\Adobec.exe
c:\windows\system32\224112670.dat
C:\DOCUME~1\PROPRI~1\Bureau\jp\Desktop\virtual dj\AceCrack-VirtualDJ_2.04.exe
c:\documents and settings\Propriétaire\Menu Démarrer\Programmes\Démarrage\zqosys32.exe
c:\windows\pss\zqosys32.exeStartup
c:\windows\Tasks\Norton Security Scan for Propriétaire.job
Folder::
c:\program files\EoRezo
c:\program files\Fichiers communs\Symantec Shared
c:\program files\Norton Security Scan
Registry::
[-HKLM\~\startupfolder\C:^Documents and Settings^Propriétaire^Menu Démarrer^Programmes^Démarrage^zqosys32.exe]
[-HKEY_LOCAL_MACHINE\System\ControlSet004\Services\{FF9BACB3-2B8E-45ba-9E68-B6720E5D81A3}]
Firefox::
FF - ProfilePath - c:\documents and settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\y5vu102d.default\
FF - prefs.js: browser.startup.homepage - hxxp://lo.st#
DDS::
uStart Page = hxxp://www.ask.com/?o=13928&l=dis
FCopy::
c:\windows\ServicePackFiles\i386\ndis.sys | c:\windows\system32\drivers\ndis.sys
c:\windows\ServicePackFiles\i386\ndis.sys | c:\windows\system32\dllcache\ndis.sys

[*]Va en haut de la page et clique sur le menu"Fichier" , une liste apparait=>

[*]Choisis "Enregistrer sous" et choisis "Bureau"

[*]Dans le champs "Nom du fichier" en bas de page donne le nom suivant:CFScript

[*]Clique sur le bouton "Enregistrer" à droite du champs "nom du fichier"

[*]Quitte le Bloc Notes.

[*]Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture

* suis les instructions

* Patiente le temps du scan.Le bureau va disparaitre à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

* Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

* Si le fichier n'apparait pas, il se trouve ici > C:\ComboFix.txt

sanka974 · le 29 juillet 2009

ComboFix 09-07-28.04 - Propriétaire 29/07/2009 17:23.2.1 - NTFSx86

Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.502.168 [GMT 2:00]

Running from: c:\documents and settings\Propriétaire\Bureau\ComboFix.exe

Command switches used :: c:\documents and settings\Propriétaire\Bureau\CFScript.txt

AV: avast! antivirus 4.8.1335 [VPS 090728-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::

"c:\docume~1\PROPRI~1\Bureau\jp\Desktop\virtual dj\AceCrack-VirtualDJ_2.04.exe"

"c:\documents and settings\Propriétaire\Menu Démarrer\Programmes\Démarrage\zqosys32.exe"

"C:\errigh.exe"

"c:\windows\pss\zqosys32.exeStartup"

"c:\windows\system32\224112670.dat"

"c:\windows\system32\Adobec.exe"

"c:\windows\system32\Adobek.dll"

"c:\windows\Tasks\Norton Security Scan for Propriétaire.job"

"C:\ymws.exe"

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\docume~1\PROPRI~1\Bureau\jp\Desktop\virtual dj\AceCrack-VirtualDJ_2.04.exe

c:\documents and settings\Propriétaire\Menu Démarrer\Programmes\Démarrage\zqosys32.exe

C:\errigh.exe

c:\program files\EoRezo

c:\program files\EoRezo\EoAdv\eoAdv.url

c:\program files\EoRezo\EoAdv\EoRezoBho.old

c:\program files\Fichiers communs\Symantec Shared

c:\program files\Fichiers communs\Symantec Shared\NSSSetup\{E579F5FB-D9C9-43A6-8DCF-67B9573C2E7C}_2_0_0\ccL70U.dll

c:\program files\Fichiers communs\Symantec Shared\NSSSetup\{E579F5FB-D9C9-43A6-8DCF-67B9573C2E7C}_2_0_0\NSSSetup.exe

c:\program files\Fichiers communs\Symantec Shared\NSSSetup\{E579F5FB-D9C9-43A6-8DCF-67B9573C2E7C}_2_0_0\Setup.msi

c:\program files\Fichiers communs\Symantec Shared\NSSSetup\{E579F5FB-D9C9-43A6-8DCF-67B9573C2E7C}_2_0_0\SymHTML.dll

c:\program files\Fichiers communs\Symantec Shared\NSSSetup\{E579F5FB-D9C9-43A6-8DCF-67B9573C2E7C}_2_0_0\SymTheme.dll

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\CATALOG.DAT

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\CCERASER.DLL

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\ECBOOTIL.VXD

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\ECMSVR32.DLL

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\eeCtrl.sys

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\ERASER.grd

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\ERASER.sig

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\ERASER.spm

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\eraser.sys

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\ESRDEF.BIN

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\HH

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\hub.scr

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\NAVENG.EXP

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\NAVENG.SYS

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\NAVENG.VXD

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\NAVENG32.DLL

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\NAVEX15.EXP

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\NAVEX15.SYS

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\NAVEX15.VXD

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\NAVEX32A.DLL

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\NCSACERT.TXT

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\SCRAUTH.DAT

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\SYMAVENG.CAT

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\SYMAVENG.INF

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\SymErase.cat

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\SymErase.inf

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\TCDEFS.DAT

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\TCSCAN7.DAT

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\TCSCAN8.DAT

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\TCSCAN9.DAT

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\TECHNOTE.TXT

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\TINF.DAT

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\TINFIDX.DAT

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\TINFL.DAT

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\TSCAN1.DAT

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\TSCAN1HD.DAT

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\V.GRD

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\V.SIG

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\VIRSCAN.INF

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\VIRSCAN1.DAT

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\VIRSCAN2.DAT

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\VIRSCAN3.DAT

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\VIRSCAN4.DAT

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\VIRSCAN5.DAT

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\VIRSCAN6.DAT

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\VIRSCAN7.DAT

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\VIRSCAN8.DAT

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\VIRSCAN9.DAT

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\VIRSCANT.DAT

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\vscanmsx.dat

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\WHATSNEW.TXT

c:\program files\Fichiers communs\Symantec Shared\SymcData\virusdefs-2.5-e\20081015.003\ZDONE.DAT

c:\windows\Installer\4b79661.msi

c:\windows\pss\zqosys32.exeStartup

c:\windows\system32\224112670.dat

c:\windows\system32\Adobec.exe

c:\windows\system32\Adobek.dll

C:\ymws.exe

.

--------------- FCopy ---------------

c:\windows\ServicePackFiles\i386\ndis.sys --> c:\windows\system32\drivers\ndis.sys

c:\windows\ServicePackFiles\i386\ndis.sys --> c:\windows\system32\dllcache\ndis.sys

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_DUW71

-------\Legacy_RIODE32

-------\Legacy_{FF9BACB3-2B8E-45BA-9E68-B6720E5D81A3}

-------\Service_Duw71

-------\Service_riode32

((((((((((((((((((((((((( Files Created from 2009-06-28 to 2009-07-29 )))))))))))))))))))))))))))))))

.

2009-07-27 17:21 . 2009-07-27 17:21 -------- d-sh--w- c:\windows\system32\config\systemprofile\PrivacIE

2009-07-27 17:20 . 2009-07-27 17:20 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache

2009-07-27 16:52 . 2009-07-27 16:52 -------- d-----w- C:\fdb0607b709ca8363c6cf6aded51

2009-07-27 16:51 . 2009-07-28 06:50 -------- d-----w- c:\windows\SxsCaPendDel

2009-07-27 16:22 . 2009-07-28 21:31 54 ----a-w- c:\windows\system32\rp_stats.dat

2009-07-27 16:22 . 2009-07-28 21:31 39 ----a-w- c:\windows\system32\rp_rules.dat

2009-07-27 16:22 . 2009-07-27 16:22 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache

2009-07-27 16:18 . 2009-07-01 07:08 101376 -c----w- c:\windows\system32\dllcache\iecompat.dll

2009-07-27 16:18 . 2009-07-27 16:18 -------- d-----w- c:\windows\ie8updates

2009-07-27 16:17 . 2009-04-30 21:16 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll

2009-07-27 16:17 . 2009-04-30 21:16 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll

2009-07-27 16:15 . 2009-07-27 16:17 -------- dc-h--w- c:\windows\ie8

2009-07-27 09:15 . 2008-03-21 11:57 14640 ------w- c:\windows\system32\spmsgXP_2k3.dll

2009-07-27 09:15 . 2009-05-19 15:43 139264 ----a-w- c:\windows\system32\hdjcprop.dll

2009-07-27 09:15 . 2008-03-27 15:49 1112288 ----a-w- c:\windows\system32\WdfCoInstaller01007.dll

2009-07-27 09:13 . 2009-05-20 07:08 24576 ----a-w- c:\windows\system32\drivers\HDJCtrl.sys

2009-07-27 09:13 . 2009-05-20 07:08 122240 ----a-w- c:\windows\system32\drivers\HDJMidi.sys

2009-07-27 09:13 . 2009-05-20 07:08 125056 ----a-w- c:\windows\system32\drivers\HDJBulk.sys

2009-07-27 09:13 . 2009-05-20 07:08 172416 ----a-w- c:\windows\system32\drivers\HDJAsioK.sys

2009-07-27 09:13 . 2009-07-27 09:13 -------- d-----w- c:\program files\Guillemot

2009-07-27 09:13 . 2009-05-19 15:43 79872 ----a-w- c:\windows\system32\HerculesDJDevices.dll

2009-07-27 09:13 . 2009-05-19 14:56 106496 ----a-w- c:\windows\system32\HRFDongle.dll

2009-07-27 09:13 . 2008-04-28 09:29 27136 ----a-w- c:\windows\system32\HDJSAPI.dll

2009-07-27 09:13 . 2009-05-19 14:56 262144 ----a-w- c:\windows\system32\HDJAPI.dll

2009-07-27 09:13 . 2009-07-27 09:13 -------- d-----w- c:\program files\Hercules

2009-07-27 07:56 . 2009-07-27 07:47 15688 ----a-w- c:\windows\system32\lsdelete.exe

2009-07-27 07:48 . 2009-07-27 07:46 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys

2009-07-27 07:42 . 2009-01-18 21:43 2892112 -c--a-w- c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}\Ad-AwareAE.exe

2009-07-27 07:41 . 2009-07-28 18:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft

2009-07-27 07:41 . 2009-07-27 07:41 -------- d-----w- c:\program files\Lavasoft

2009-07-22 14:44 . 2009-02-05 20:07 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys

2009-07-22 14:44 . 2009-02-05 20:07 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

2009-07-18 11:39 . 2009-07-18 11:39 -------- d-----w- c:\program files\Trend Micro

2009-07-18 11:39 . 2009-07-27 07:42 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}

2009-07-16 20:36 . 2008-04-13 19:20 182656 -c--a-w- c:\windows\system32\dllcache\ndis.sys

2009-07-06 21:25 . 2009-07-06 21:25 -------- d-----w- c:\windows\l2schemas

2009-07-06 21:25 . 2009-07-06 21:25 -------- d-----w- c:\windows\system32\fr

2009-07-06 21:25 . 2009-07-06 21:25 -------- d-----w- c:\windows\system32\bits

2009-07-06 21:23 . 2009-07-06 21:25 -------- d-----w- c:\windows\ServicePackFiles

2009-07-06 21:14 . 2009-07-06 21:14 -------- d-----w- c:\windows\EHome

2009-07-06 21:00 . 2009-07-06 21:00 -------- d-----w- c:\program files\Fichiers communs\Digidesign

2009-07-06 21:00 . 2009-07-06 21:04 -------- d-----w- c:\program files\Waves

2009-07-06 20:47 . 2009-07-06 20:47 -------- d-----w- c:\program files\PowerISO

2009-07-06 15:40 . 2009-07-06 15:40 -------- d-----w- c:\program files\uTorrent

2009-07-03 07:34 . 2009-07-03 07:35 -------- d-----w- c:\program files\Kellogg's Arctique

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-07-29 13:56 . 2008-03-12 19:15 -------- d-----w- c:\program files\Mozilla Firefox 3 Beta 4

2009-07-28 21:35 . 2008-03-18 15:56 -------- d-----w- c:\program files\Yahoo!

2009-07-28 18:55 . 2004-08-05 12:00 80706 ----a-w- c:\windows\system32\perfc00C.dat

2009-07-28 18:55 . 2004-08-05 12:00 500720 ----a-w- c:\windows\system32\perfh00C.dat

2009-07-27 09:15 . 2009-07-27 09:15 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_HDJCtrl_01007.Wdf

2009-07-27 09:15 . 2009-07-27 09:15 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf

2009-07-27 09:13 . 2007-09-14 13:18 -------- d--h--w- c:\program files\InstallShield Installation Information

2009-07-25 15:42 . 2007-09-16 17:18 -------- d-----w- c:\program files\lx_cats

2009-07-18 15:37 . 2008-03-12 19:20 -------- d-----w- c:\program files\Spybot - Search & Destroy

2009-07-15 18:35 . 2007-09-20 18:33 -------- d-----w- c:\program files\MSN Messenger

2009-07-14 08:39 . 2007-10-31 06:30 -------- d-----w- c:\program files\TuxPaint

2009-07-06 21:26 . 2007-09-13 08:53 76507 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat

2009-06-24 17:47 . 2007-11-04 17:15 -------- d-----w- c:\program files\Native Instruments

2009-06-16 14:40 . 2004-08-05 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll

2009-06-16 14:40 . 2004-08-05 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll

2009-06-03 19:10 . 2004-08-05 12:00 1297408 ----a-w- c:\windows\system32\quartz.dll

2009-05-13 05:04 . 2004-08-05 12:00 915456 ----a-w- c:\windows\system32\wininet.dll

2009-05-07 15:33 . 2004-08-05 12:00 348672 ----a-w- c:\windows\system32\localspl.dll

2007-11-19 11:37 . 2007-11-19 11:34 11978626 -c--a-w- c:\program files\Virtu

.

((((((((((((((((((((((((((((( SnapShot@2009-07-29_13.38.20 )))))))))))))))))))))))))))))))))))))))))

.

+ 2009-07-29 15:30 . 2009-07-29 15:30 16384 c:\windows\Temp\Perflib_Perfdata_154.dat

+ 2009-07-27 17:21 . 2009-07-29 15:21 81920 c:\windows\system32\config\systemprofile\PrivacIE\index.dat

+ 2009-07-28 22:03 . 2009-07-29 15:21 32768 c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012009072920090730\index.dat

- 2009-07-28 22:03 . 2009-07-29 11:42 32768 c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012009072920090730\index.dat

+ 2009-07-29 13:58 . 2009-07-29 15:00 22528 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{E0668656-7C47-11DE-8C29-000FB0D664D6}.dat

+ 2009-07-29 15:01 . 2009-07-29 15:05 59904 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{A65C006E-7C50-11DE-8C29-000FB0D664D6}.dat

+ 2009-07-29 15:21 . 2009-07-29 15:21 20480 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{7F2CD852-7C53-11DE-8C29-000FB0D664D6}.dat

+ 2009-07-29 15:04 . 2009-07-29 15:18 13312 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{274AAB76-7C51-11DE-8C29-000FB0D664D6}.dat

- 2009-07-28 18:49 . 2009-07-29 13:09 32768 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat

+ 2009-07-28 18:49 . 2009-07-29 15:21 32768 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat

- 2009-07-27 17:20 . 2009-07-29 13:09 16384 c:\windows\system32\config\systemprofile\IETldCache\index.dat

+ 2009-07-27 17:20 . 2009-07-29 15:21 16384 c:\windows\system32\config\systemprofile\IETldCache\index.dat

- 2009-07-07 01:07 . 2009-07-29 13:09 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat

+ 2009-07-07 01:07 . 2009-07-29 15:21 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat

+ 2009-07-29 13:58 . 2009-07-29 15:04 5120 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{E0668655-7C47-11DE-8C29-000FB0D664D6}.dat

+ 2009-07-29 15:21 . 2009-07-29 15:21 3584 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{7F2CD851-7C53-11DE-8C29-000FB0D664D6}.dat

+ 2009-07-07 01:07 . 2009-07-29 15:21 573440 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat

- 2009-07-07 01:07 . 2009-07-29 13:09 573440 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat

- 2009-07-07 01:07 . 2009-07-29 13:09 212992 c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat

+ 2009-07-07 01:07 . 2009-07-29 15:21 212992 c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"LXCYCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCYtime.dll" [2006-02-24 65536]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2007-10-23 443968]

"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\

BTTray.lnk - c:\program files\Lenovo\Bluetooth Software\BTTray.exe [2006-1-17 618557]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]

2006-12-14 09:06 28672 ----a-w- c:\program files\Lenovo\HOTKEY\tphklock.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"midi1"=ma_cmidn.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^Propriétaire^Menu Démarrer^Programmes^Démarrage^OpenOffice.org 2.2.lnk]

path=c:\documents and settings\Propriétaire\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 2.2.lnk

backup=c:\windows\pss\OpenOffice.org 2.2.lnkStartup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=

"c:\\Program Files\\MSN Messenger\\livecall.exe"=

"c:\\Program Files\\LimeWire\\LimeWire.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"c:\\WINDOWS\\system32\\sessmgr.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Mozilla Firefox 3 Beta 4\\firefox.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [27/07/2009 09:48 64160]

R1 Asapi;Asapi;c:\windows\system32\drivers\asapi.sys [28/02/2008 19:17 11264]

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [22/07/2009 16:44 114768]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [22/07/2009 16:44 20560]

R2 FNF5SVC;Fn+F5 Service;c:\program files\Lenovo\HOTKEY\FnF5svc.exe [09/04/2007 10:24 54832]

R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [18/01/2009 23:34 1029456]

R2 TVT Backup Protection Service;TVT Backup Protection Service;c:\program files\Lenovo\Rescue and Recovery\rrpservice.exe [11/07/2007 20:38 569344]

R3 HDJCtrl;Hercules DJ Control MP3 Service;c:\windows\system32\drivers\HDJCtrl.sys [27/07/2009 11:13 24576]

R3 HDJMidi;Hercules DJ Control MP3 MIDI;c:\windows\system32\drivers\HDJMidi.sys [27/07/2009 11:13 122240]

R3 lxcy_device;lxcy_device;c:\windows\system32\lxcycoms.exe -service --> c:\windows\system32\lxcycoms.exe -service [?]

R3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\drivers\tvti2c.sys [22/05/2007 15:59 30336]

S3 rrau0001;rrau0001;c:\windows\system32\drivers\rrau0001.sys [13/02/2008 14:27 24576]

S3 rrwd0001;rrwd0001;c:\windows\system32\drivers\rrwd0001.sys [12/01/2008 09:38 71936]

S3 SaiH5F0D;SaiH5F0D;c:\windows\system32\drivers\SaiH5F0D.sys [31/01/2009 22:15 176640]

S3 SaiU5F0D;SaiU5F0D;c:\windows\system32\drivers\SaiU5F0D.sys [31/01/2009 22:16 27264]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]

"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

.

Contents of the 'Scheduled Tasks' folder

2009-07-28 c:\windows\Tasks\Ad-Aware Update (Weekly).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 07:45]

2009-07-22 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 11:34]

.

------- Supplementary Scan -------

.

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

mWindow Title =

IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

IE: Envoyer au périphérique &Bluetooth... - c:\program files\Lenovo\Bluetooth Software\btsendto_ie_ctx.htm

FF - ProfilePath - c:\documents and settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\y5vu102d.default\

FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt=fr-FR&FORM=MIMWA5&q=

FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-07-29 17:36

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

LXCYCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXCYtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]

@Denied: (2) (LocalSystem)

"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,7e,4a,7a,f1,81,15,b7,48,84,2f,37,\

"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,7e,4a,7a,f1,81,15,b7,48,84,2f,37,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]

"ThreadingModel"="Apartment"