Envoi non souhaité de pubs via mon adresse mail

Thanos · le 21 novembre 2009

salut

Rien de notable sur le rapport.

Est ce que tu as modifié ton mot de passe sur ta messagerie ana ? fais le dès à présent si ce n'est pas fait.

Trouve toi un vrai mot de passe (pas un mot de passe faible et facile à découvrir) >> http://windows.microsoft.com/fr-FR/windows...strong-password

Important car certaines personnes malveillantes peuvent deviner ton mot de passe en fonction d'indices/d'éléments qu'elles auront pu obtenir sur toi (c'est ce qu'on appelle de l'ingénierie sociale).

De plus, fais ce scan quand tu auras le temps >>

Clique sur le lien suivant > ESET Online Scanner Link

Coche la case YES, I accept the Terms Of Use
Clique sur le bouton Start
Clique ensuite sur le bouton Install
Clique sur Start
Le scanner va se mettre à jour.
Ne coche pas la case Remove found threats
Clique sur le bouton Scan
Le scan va se lancer: soit patient.
Lorsque le scan s'achève, clique sur le menu Details
Copie/colle le contenu du rapport généré: il se trouve ici > the contents of the C:\Program Files\EsetOnlineScanner et se nomme log.txt

Modifié le 21 novembre 2009 par Thanos

ana · le 22 novembre 2009

Bonjour voila le rapport ESET:

ESETSmartInstaller@High as CAB hook log:

OnlineScanner.ocx - registred OK

# version=7

# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)

# OnlineScanner.ocx=1.0.0.6211

# api_version=3.0.2

# EOSSerial=f5972c414bb07a48aea06d35486260cc

# end=finished

# remove_checked=false

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2009-11-22 11:23:05

# local_time=2009-11-22 12:23:05 (+0100, Paris, Madrid)

# country="France"

# lang=1033

# osver=6.0.6002 NT Service Pack 2

# compatibility_mode=512 16777215 100 0 399936 399936 0 0

# compatibility_mode=769 16775165 100 98 60094 195174865 52933 0

# compatibility_mode=5892 16776573 100 100 0 96419239 0 0

# compatibility_mode=8192 67108863 100 0 3921 3921 0 0

# scanned=138395

# found=8

# cleaned=0

# scan_time=2474

C:\ProgramData\great barb\BASH 1 TEAM MODE.exe a variant of Win32/TrojanDownloader.Swizzor.NCV trojan 00000000000000000000000000000000 I

C:\ProgramData\great barb\fubodazt.exe probably a variant of Win32/TrojanDownloader.Swizzor.NBD trojan 00000000000000000000000000000000 I

C:\ProgramData\great barb\puieyzgx.exe a variant of Win32/TrojanDownloader.Swizzor.NBZ trojan 00000000000000000000000000000000 I

C:\ProgramData\great barb\uzgbcwne.exe a variant of Win32/TrojanDownloader.Swizzor.NCR trojan 00000000000000000000000000000000 I

C:\Users\All Users\great barb\BASH 1 TEAM MODE.exe a variant of Win32/TrojanDownloader.Swizzor.NCV trojan 00000000000000000000000000000000 I

C:\Users\All Users\great barb\fubodazt.exe probably a variant of Win32/TrojanDownloader.Swizzor.NBD trojan 00000000000000000000000000000000 I

C:\Users\All Users\great barb\puieyzgx.exe a variant of Win32/TrojanDownloader.Swizzor.NBZ trojan 00000000000000000000000000000000 I

C:\Users\All Users\great barb\uzgbcwne.exe a variant of Win32/TrojanDownloader.Swizzor.NCR trojan 00000000000000000000000000000000 I

Thanos · le 22 novembre 2009

salut

Ok: le scan Eset a mis en évidence des fichiers liés à l'infection LOP que LOP S&D n'a pas encore intégré. On va réutiliser LOP S&D comme ceci >>

Selectionne le texte ci dessous en entier (sauf le mot CODE) puis fais un clic droit dessus et choisis Copier
```
C:\ProgramData\great barb
C:\Users\All Users\great barb
```
Fais un clic droit sur le fichier Lop S&D.exe puis choisis Exécuter en tant qu'administrateur.
Choisis l'Option 4 (LopScript)
Une page blanche va s'ouvrir: fais un clic droit dedans et choisis Coller.
Ferme la page: il te sera demandé de la sauvegarder, clique sur le bouton [save]
Ne ferme pas la fenêtre durant la suppression!
Poste le rapport qui a été créé: si tu ne le vois pas, il se trouve dans le lecteur C:\ et se nomme lopR.txt

Modifié le 22 novembre 2009 par Thanos

ana · le 23 novembre 2009

Bonjour, voici le nouveau rapport:

--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6002 ) Service Pack 2

X86-based PC ( Multiprocessor Free : Intel® Core2 Duo CPU T8100 @ 2.10GHz )

BIOS : PhoenixBIOS 4.0 Release 6.1

USER : utilisateur ( Administrator )

BOOT : Normal boot

Antivirus : avast! antivirus 4.8.1335 [VPS 090228-0] 4.8.1335 (Activated)

C:\ (Local Disk) - NTFS - Total:117 Go (Free:11 Go)

E:\ (Local Disk) - NTFS - Total:113 Go (Free:108 Go)

F:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )

Option : [4] ( 23/11/2009|20:11 )

[ UAC => 1 ]

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ Lop Script

C:\ProgramData\great barb

C:\Users\All Users\great barb

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION

Supprime! - C:\ProgramData\great barb

... C:\Users\All Users\great barb -> n'existe pas !

Supprime! - C:\Users\UTILIS~1\AppData\Roaming\MICROS~1\Windows\Cookies\utilisateur@advertstream[2].txt

Supprime! - C:\Users\UTILIS~1\AppData\Roaming\MICROS~1\Windows\Cookies\utilisateur@d2.advertserve[1].txt

Supprime! - C:\Users\UTILIS~1\AppData\Roaming\MICROS~1\Windows\Cookies\utilisateur@adultfriendfinder[1].txt

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

--------------------\\ Listing des dossiers dans Local

[17/05/2008|13:37] C:\Users\UTILIS~1\AppData\Local\Adobe

[17/05/2008|11:16] C:\Users\UTILIS~1\AppData\Local\Application Data

[17/05/2008|11:20] C:\Users\UTILIS~1\AppData\Local\ATI

[04/09/2009|12:56] C:\Users\UTILIS~1\AppData\Local\d3d9caps.dat

[23/11/2009|19:56] C:\Users\UTILIS~1\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[19/05/2009|20:40] C:\Users\UTILIS~1\AppData\Local\eMule

[25/07/2009|02:10] C:\Users\UTILIS~1\AppData\Local\GDIPFONTCACHEV1.DAT

[15/10/2009|21:56] C:\Users\UTILIS~1\AppData\Local\Google

[17/05/2008|11:16] C:\Users\UTILIS~1\AppData\Local\Historique

[18/11/2009|03:19] C:\Users\UTILIS~1\AppData\Local\IconCache.db

[03/08/2008|18:48] C:\Users\UTILIS~1\AppData\Local\JollyBear

[21/05/2008|18:01] C:\Users\UTILIS~1\AppData\Local\Lphant

[14/11/2009|21:08] C:\Users\UTILIS~1\AppData\Local\Microsoft

[06/11/2009|14:20] C:\Users\UTILIS~1\AppData\Local\Microsoft Games

[07/11/2008|11:36] C:\Users\UTILIS~1\AppData\Local\Microsoft Help

[21/09/2008|20:24] C:\Users\UTILIS~1\AppData\Local\Seven Zip

[23/11/2009|20:11] C:\Users\UTILIS~1\AppData\Local\Temp

[17/05/2008|11:16] C:\Users\UTILIS~1\AppData\Local\Temporary Internet Files

[17/05/2008|11:20] C:\Users\UTILIS~1\AppData\Local\Toshiba

[17/05/2008|13:37] C:\Users\UTILIS~1\AppData\Local\VirtualStore

[08/02/2009|11:48] C:\Users\UTILIS~1\AppData\Local\Zylom Games

--------------------\\ Tâches planifiées dans C:\Windows\tasks

[23/11/2009 05:16][--ah-----] C:\Windows\tasks\User_Feed_Synchronization-{9972FA03-8046-448B-BEF5-D28E3ACDB978}.job

[18/11/2009 03:21][--ah-----] C:\Windows\tasks\SA.DAT

[18/11/2009 03:19][--a------] C:\Windows\tasks\SCHEDLGU.TXT

--------------------\\ Listing des dossiers dans C:\ProgramData

[10/01/2009|20:04] C:\ProgramData\Adobe

[02/11/2006|14:02] C:\ProgramData\Application Data

[17/05/2008|11:20] C:\ProgramData\ATI

[31/05/2008|19:51] C:\ProgramData\Azureus

[17/05/2008|11:13] C:\ProgramData\Bureau

[02/11/2006|14:02] C:\ProgramData\Desktop

[02/11/2006|14:02] C:\ProgramData\Documents

[19/05/2009|20:40] C:\ProgramData\eMule

[27/07/2008|21:36] C:\ProgramData\ezsidmv.dat

[17/05/2008|11:13] C:\ProgramData\Favoris

[02/11/2006|14:02] C:\ProgramData\Favorites

[19/10/2009|22:25] C:\ProgramData\Fugazo

[15/10/2009|21:56] C:\ProgramData\Google

[15/07/2008|19:08] C:\ProgramData\Hewlett-Packard

[16/07/2008|16:24] C:\ProgramData\HP

[16/11/2008|23:11] C:\ProgramData\HP Product Assistant

[15/07/2008|19:13] C:\ProgramData\HPSSUPPLY

[20/06/2009|07:43] C:\ProgramData\hpzinstall.log

[03/08/2008|18:48] C:\ProgramData\JollyBear

[11/11/2009|12:20] C:\ProgramData\Malwarebytes

[04/09/2008|17:21] C:\ProgramData\McAfee

[17/05/2008|11:13] C:\ProgramData\Menu D‚marrer

[26/05/2008|18:30] C:\ProgramData\Messenger Plus!

[20/03/2009|22:42] C:\ProgramData\Microsoft

[13/11/2009|03:03] C:\ProgramData\Microsoft Help

[17/05/2008|11:13] C:\ProgramData\ModŠles

[26/10/2009|12:29] C:\ProgramData\Nero

[04/10/2009|20:29] C:\ProgramData\Office Genuine Advantage

[08/02/2009|11:55] C:\ProgramData\Skype

[25/10/2009|15:02] C:\ProgramData\Spybot - Search & Destroy

[02/11/2006|14:02] C:\ProgramData\Start Menu

[14/06/2009|11:41] C:\ProgramData\Studio-Scrap2

[02/11/2006|14:02] C:\ProgramData\Templates

[17/05/2008|10:11] C:\ProgramData\Toshiba

[17/05/2008|11:17] C:\ProgramData\ToshibaEurope

[18/02/2008|16:08] C:\ProgramData\Ulead Systems

[15/07/2008|19:18] C:\ProgramData\WEBREG

[17/05/2008|14:01] C:\ProgramData\WLInstaller

--------------------\\ Listing des dossiers dans C:\Program Files

[10/01/2009|20:04] C:\Program Files\Adobe

[04/09/2008|19:41] C:\Program Files\Alwil Software

[17/05/2008|10:03] C:\Program Files\ATI

[17/05/2008|10:04] C:\Program Files\ATI Technologies

[26/03/2009|19:10] C:\Program Files\Azureus

[17/05/2008|10:08] C:\Program Files\Camera Assistant Software for Toshiba

[25/10/2009|14:44] C:\Program Files\CCleaner

[19/11/2009|20:59] C:\Program Files\Common Files

[17/05/2008|10:01] C:\Program Files\CONEXANT

[04/12/2008|18:25] C:\Program Files\DivX

[19/05/2009|20:39] C:\Program Files\eMule

[22/11/2009|11:36] C:\Program Files\ESET

[17/05/2008|11:13] C:\Program Files\Fichiers communs [C:\Program Files\Common Files]

[29/10/2009|03:19] C:\Program Files\Google

[01/09/2008|15:14] C:\Program Files\Hewlett-Packard

[15/07/2008|19:16] C:\Program Files\HP

[18/02/2008|16:15] C:\Program Files\IDM

[08/02/2009|11:54] C:\Program Files\InstallShield Installation Information

[17/05/2008|10:04] C:\Program Files\Intel

[29/10/2009|03:17] C:\Program Files\Internet Explorer

[18/02/2008|16:09] C:\Program Files\InterVideo

[04/10/2009|11:21] C:\Program Files\Java

[11/06/2009|23:39] C:\Program Files\JRE

[25/08/2009|09:01] C:\Program Files\LimeWire

[21/05/2008|12:07] C:\Program Files\Lphant

[11/11/2009|12:20] C:\Program Files\Malwarebytes' Anti-Malware

[18/02/2008|15:37] C:\Program Files\Marvell

[31/10/2009|22:27] C:\Program Files\Messenger Plus! Live

[20/03/2009|22:45] C:\Program Files\Microsoft

[02/11/2006|13:37] C:\Program Files\Microsoft Games

[21/09/2008|20:47] C:\Program Files\Microsoft Office

[04/10/2009|11:18] C:\Program Files\Microsoft Office Outlook Connector

[11/09/2009|02:10] C:\Program Files\Microsoft Silverlight

[20/03/2009|22:37] C:\Program Files\Microsoft SQL Server Compact Edition

[20/03/2009|22:42] C:\Program Files\Microsoft Sync Framework

[21/09/2008|20:46] C:\Program Files\Microsoft Visual Studio

[21/09/2008|20:40] C:\Program Files\Microsoft Visual Studio 8

[12/06/2009|02:09] C:\Program Files\Microsoft Works

[21/09/2008|20:45] C:\Program Files\Microsoft.NET

[29/09/2009|22:38] C:\Program Files\Movie Maker

[21/09/2008|20:47] C:\Program Files\MSBuild

[18/02/2008|15:17] C:\Program Files\MSXML 4.0

[26/10/2009|12:29] C:\Program Files\Nero

[18/02/2008|15:44] C:\Program Files\O2Micro Flash Memory Card Driver

[11/06/2009|23:39] C:\Program Files\OpenOffice.org 3

[19/11/2009|21:11] C:\Program Files\PhotoFiltre Studio

[17/05/2008|14:06] C:\Program Files\Picasa2

[02/11/2006|13:37] C:\Program Files\Reference Assemblies

[03/06/2008|21:07] C:\Program Files\RM-X Player V5.2

[17/09/2009|12:40] C:\Program Files\SGPSA

[15/10/2009|21:18] C:\Program Files\Spybot - Search & Destroy

[14/06/2009|10:46] C:\Program Files\StudioScrap2-Decouverte

[17/05/2008|10:04] C:\Program Files\Synaptics

[17/05/2008|10:12] C:\Program Files\Toshiba

[14/06/2009|10:47] C:\Program Files\Tracker Software

[17/11/2009|21:36] C:\Program Files\trend micro

[18/02/2008|16:05] C:\Program Files\Ulead Systems

[02/11/2006|14:01] C:\Program Files\Uninstall Information

[25/05/2008|20:43] C:\Program Files\VideoLAN

[29/09/2009|22:38] C:\Program Files\Windows Calendar

[29/09/2009|22:38] C:\Program Files\Windows Collaboration

[29/09/2009|22:38] C:\Program Files\Windows Defender

[29/09/2009|22:38] C:\Program Files\Windows Journal

[04/10/2009|11:17] C:\Program Files\Windows Live

[20/03/2009|22:31] C:\Program Files\Windows Live SkyDrive

[13/11/2009|03:19] C:\Program Files\Windows Mail

[18/02/2008|16:08] C:\Program Files\Windows Media Components

[29/10/2009|03:17] C:\Program Files\Windows Media Player

[17/05/2008|11:13] C:\Program Files\Windows NT

[29/09/2009|22:38] C:\Program Files\Windows Photo Gallery

[18/11/2009|03:19] C:\Program Files\Windows Portable Devices

[29/09/2009|22:38] C:\Program Files\Windows Sidebar

[19/05/2008|18:22] C:\Program Files\WinRAR

[25/10/2009|14:51] C:\Program Files\Yahoo!

--------------------\\ Listing des dossiers dans C:\Program Files\Common Files

[10/01/2009|20:05] C:\Program Files\Common Files\Adobe

[21/09/2008|20:46] C:\Program Files\Common Files\DESIGNER

[15/07/2008|19:12] C:\Program Files\Common Files\Hewlett-Packard

[15/07/2008|19:16] C:\Program Files\Common Files\HP

[18/02/2008|16:09] C:\Program Files\Common Files\InstallShield

[18/02/2008|15:21] C:\Program Files\Common Files\Java

[24/07/2009|06:23] C:\Program Files\Common Files\microsoft shared

[26/10/2009|12:30] C:\Program Files\Common Files\Nero

[04/12/2008|18:25] C:\Program Files\Common Files\PX Storage Engine

[02/11/2006|12:18] C:\Program Files\Common Files\Services

[02/11/2006|12:18] C:\Program Files\Common Files\SpeechEngines

[04/10/2009|11:18] C:\Program Files\Common Files\System

[17/05/2008|10:11] C:\Program Files\Common Files\Toshiba Shared

[18/02/2008|16:09] C:\Program Files\Common Files\Ulead Systems

[20/03/2009|18:54] C:\Program Files\Common Files\Windows Live

[17/05/2008|14:27] C:\Program Files\Common Files\WindowsLiveInstaller

--------------------\\ Process

( 75 Processes )

... OK !

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Verification du Registre

..... OK !

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE

--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-11-23 20:12:35

Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden files ...

scan completed successfully

hidden processes: 0

hidden files: 2

--------------------\\ Recherche d'autres infections

--------------------\\ Cracks & Keygens ..

C:\Users\UTILIS~1\AppData\Roaming\Microsoft\Windows\Recent\Crack.lnk

C:\PROGRA~2\Fugazo\Cooking Academy\cached\sounds\eggcrack.wav

[F:63][D:9]-> C:\Users\UTILIS~1\AppData\Local\Temp

[F:849][D:1]-> C:\Users\UTILIS~1\AppData\Roaming\MICROS~1\Windows\Cookies

[F:2652][D:9]-> C:\Users\UTILIS~1\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5

[F:13][D:1]-> C:\$Recycle.Bin

1 - "C:\Lop SD\LopR_1.txt" - 13/11/2009|16:42 - Option : [1]

2 - "C:\Lop SD\LopR_2.txt" - 13/11/2009|16:47 - Option : [1]

3 - "C:\Lop SD\LopR_3.txt" - 13/11/2009|16:55 - Option : [2]

4 - "C:\Lop SD\LopR_4.txt" - 14/11/2009| 9:03 - Option : [2]

5 - "C:\Lop SD\LopR_5.txt" - 14/11/2009|20:15 - Option : [2]

6 - "C:\Lop SD\LopR_6.txt" - 23/11/2009|20:15 - Option : [4]

--------------------\\ Fin du rapport a 20:15:57

[ UAC => 1 ]

Thanos · le 23 novembre 2009

salut

Ok le dossier a été supprimé.

On va faire une dernière vérification stp >>

Télécharge gmer : http://www.gmer.net/gmer.zip

Déconnecte toi d'internet si possible et ferme tous les programmes.

Décompresse le fichier zip et fais un clic droit sur le fichier gmer.exe puis choisir Exécuter en tant qu'administrateur).

clique sur l'onglet "rootkit" et clique sur Scan

Lorsque le scan est terminé, clique sur "copy"

Ouvre le bloc-note et clique sur le Menu Edition / Coller

Le rapport doit alors apparaître.

Enregistre le fichier sur ton bureau et copie/colle le contenu ici.

Modifié le 23 novembre 2009 par Thanos

ana · le 26 novembre 2009

Bonjour! Désolée du petit retard! Voici le rapport que tu m'as demandé:

GMER 1.0.15.15252 - http://www.gmer.net

Rootkit scan 2009-11-26 20:33:52

Windows 6.0.6002 Service Pack 2

Running: gmer.exe; Driver: C:\Users\UTILIS~1\AppData\Local\Temp\kwnoyuob.sys

---- Kernel code sections - GMER 1.0.15 ----

.text C:\Windows\system32\DRIVERS\tos_sps32.sys section is writeable [0x88354000, 0x4036D, 0xE8000020]

.dsrt C:\Windows\system32\DRIVERS\tos_sps32.sys unknown last section [0x8839D000, 0x510, 0x40000040]

.text C:\Windows\system32\DRIVERS\atikmdag.sys section is writeable [0x8BE05000, 0x1E73A0, 0xE8000020]

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe[3728] ntdll.dll!DbgBreakPoint 776B8B2E 1 Byte [90]

.text C:\Program Files\Internet Explorer\iexplore.exe[4040] USER32.dll!CreateDialogParamW 75D272A2 5 Bytes JMP 6A9DDA08 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4040] USER32.dll!GetAsyncKeyState 75D2863C 5 Bytes JMP 6A8F90EF C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4040] USER32.dll!SetWindowsHookExW 75D287AD 5 Bytes JMP 6A9D97F5 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4040] USER32.dll!CallNextHookEx 75D28E3B 5 Bytes JMP 6A9CCE79 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4040] USER32.dll!UnhookWindowsHookEx 75D298DB 5 Bytes JMP 6A94466C C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4040] USER32.dll!EnableWindow 75D2CD8B 5 Bytes JMP 6A9DD895 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4040] USER32.dll!CreateWindowExW 75D31305 5 Bytes JMP 6A9DD67C C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4040] USER32.dll!GetKeyState 75D38CB1 5 Bytes JMP 6A9DCE43 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4040] USER32.dll!IsDialogMessageW 75D40745 5 Bytes JMP 6A905947 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4040] USER32.dll!CreateDialogParamA 75D417AA 5 Bytes JMP 6AAD4DFB C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4040] USER32.dll!IsDialogMessage 75D41847 5 Bytes JMP 6AAD4697 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4040] USER32.dll!CreateDialogIndirectParamA 75D426F1 5 Bytes JMP 6AAD4E32 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4040] USER32.dll!CreateDialogIndirectParamW 75D49A62 5 Bytes JMP 6AAD4E69 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4040] USER32.dll!SetKeyboardState 75D50987 5 Bytes JMP 6AAD4A06 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4040] USER32.dll!DialogBoxParamW 75D510B0 5 Bytes JMP 6A905435 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4040] USER32.dll!DialogBoxIndirectParamW 75D52EF5 5 Bytes JMP 6AAD418F C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4040] USER32.dll!SendInput 75D52F75 5 Bytes JMP 6AAD55C3 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4040] USER32.dll!EndDialog 75D5326E 5 Bytes JMP 6A907DEE C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4040] USER32.dll!SetCursorPos 75D66FB2 5 Bytes JMP 6AAD5617 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4040] USER32.dll!DialogBoxParamA 75D68152 5 Bytes JMP 6AAD412C C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4040] USER32.dll!DialogBoxIndirectParamA 75D6847D 5 Bytes JMP 6AAD41F2 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4040] USER32.dll!MessageBoxIndirectA 75D7D4D9 5 Bytes JMP 6AAD40C1 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4040] USER32.dll!MessageBoxIndirectW 75D7D5D3 5 Bytes JMP 6AAD4056 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4040] USER32.dll!MessageBoxExA 75D7D639 5 Bytes JMP 6AAD3FF4 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4040] USER32.dll!MessageBoxExW 75D7D65D 5 Bytes JMP 6AAD3F92 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4040] USER32.dll!keybd_event 75D7D972 5 Bytes JMP 6AAD5947 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4040] SHELL32.dll!SHRestricted + D95 76528988 4 Bytes [4D, 30, 85, 70]

.text C:\Program Files\Internet Explorer\iexplore.exe[4040] SHELL32.dll!SHRestricted + D9D 76528990 8 Bytes [57, 2F, 85, 70, 9C, 5B, 84, ...]

.text C:\Program Files\Internet Explorer\iexplore.exe[4040] ole32.dll!OleLoadFromStream 75DE1E12 5 Bytes JMP 6AAD44F7 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4040] ole32.dll!CoCreateInstance 75E19EA6 5 Bytes JMP 6A9DD6D8 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4040] ws2_32.dll!closesocket 777E330C 5 Bytes JMP 6BABEEE9 C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4040] ws2_32.dll!recv 777E343A 5 Bytes JMP 6BABF1C3 C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4040] ws2_32.dll!socket 777E36D1 5 Bytes JMP 6BABE59E C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4040] ws2_32.dll!connect 777E40D9 5 Bytes JMP 6BABE62A C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4040] ws2_32.dll!getaddrinfo 777E418A 5 Bytes JMP 6BABE71D C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4040] ws2_32.dll!send 777E659B 5 Bytes JMP 6BABE9ED C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4404] USER32.dll!CreateWindowExW 75D31305 5 Bytes JMP 6A9DD67C C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4404] USER32.dll!DialogBoxParamW 75D510B0 5 Bytes JMP 6A905435 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4404] USER32.dll!DialogBoxIndirectParamW 75D52EF5 5 Bytes JMP 6AAD418F C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4404] USER32.dll!DialogBoxParamA 75D68152 5 Bytes JMP 6AAD412C C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4404] USER32.dll!DialogBoxIndirectParamA 75D6847D 5 Bytes JMP 6AAD41F2 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4404] USER32.dll!MessageBoxIndirectA 75D7D4D9 5 Bytes JMP 6AAD40C1 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4404] USER32.dll!MessageBoxIndirectW 75D7D5D3 5 Bytes JMP 6AAD4056 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4404] USER32.dll!MessageBoxExA 75D7D639 5 Bytes JMP 6AAD3FF4 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[4404] USER32.dll!MessageBoxExW 75D7D65D 5 Bytes JMP 6AAD3F92 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Windows\system32\services.exe[664] @ C:\Windows\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 00190002

IAT C:\Windows\system32\services.exe[664] @ C:\Windows\system32\services.exe [KERNEL32.dll!CreateProcessW] 00190000

IAT C:\Windows\Explorer.EXE[3572] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [73A37817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396