Rapport Combofix

[caravilio]

Bonjour a tous

 

Suite a un disfonctionement de mon PC (XP PRO pack 2) horloge fausse, lanteur system, browser qui plante souvant, jai efectuer un ComboFix

 

jaimerais savoir votre suggestion

 

Merci

 

 

 

 

ComboFix 12-02-25.02 - Administrator 02/27/2012 12:12:52.2.2 - x86

Microsoft Windows XP Professional 5.1.2600.2.1255.972.1037.18.2037.1449 [GMT 2:00]

Running from: f:\soft\ComboFix.exe

AV: ESET NOD32 Antivirus 4.0 *Enabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

C:\LOG3E1.tmp

C:\LOG50.tmp

c:\windows\system32\awgina.dll

.

.

((((((((((((((((((((((((( Files Created from 2012-01-27 to 2012-02-27 )))))))))))))))))))))))))))))))

.

.

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-02-27 08:37 . 2012-02-27 08:37 6651761 ----a-w- C:\GibHugim_1120.Zip

.

.

------- Sigcheck -------

Note: Unsigned files aren't necessarily malware.

.

[-] 2007-03-11 . D54B14DC1069FBC5620D10CF2C168C8B . 1547776 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll

.

((((((((((((((((((((((((((((( SnapShot@2012-02-27_09.45.03 )))))))))))))))))))))))))))))))))))))))))

.

+ 2012-02-27 10:16 . 2012-02-27 10:16 16384 c:\windows\Temp\Perflib_Perfdata_4e0.dat

- 2004-08-27 11:00 . 2012-02-27 09:38 60426 c:\windows\system32\perfc00d.dat

+ 2004-08-27 11:00 . 2012-02-27 10:08 60426 c:\windows\system32\perfc00d.dat

- 2004-08-27 11:00 . 2012-02-27 09:38 60500 c:\windows\system32\perfc009.dat

+ 2004-08-27 11:00 . 2012-02-27 10:08 60500 c:\windows\system32\perfc009.dat

+ 2004-08-27 11:00 . 2012-02-27 10:08 316050 c:\windows\system32\perfh00d.dat

- 2004-08-27 11:00 . 2012-02-27 09:38 316050 c:\windows\system32\perfh00d.dat

- 2004-08-27 11:00 . 2012-02-27 09:38 397122 c:\windows\system32\perfh009.dat

+ 2004-08-27 11:00 . 2012-02-27 10:08 397122 c:\windows\system32\perfh009.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{f228c6a4-a593-4017-944c-4e7958fb3177}"= "c:\program files\Radio_G\prxtbRad0.dll" [2011-05-09 176936]

.

[HKEY_CLASSES_ROOT\clsid\{f228c6a4-a593-4017-944c-4e7958fb3177}]

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{f228c6a4-a593-4017-944c-4e7958fb3177}]

2011-05-09 09:49 176936 ----a-w- c:\program files\Radio_G\prxtbRad0.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{f228c6a4-a593-4017-944c-4e7958fb3177}"= "c:\program files\Radio_G\prxtbRad0.dll" [2011-05-09 176936]

.

[HKEY_CLASSES_ROOT\clsid\{f228c6a4-a593-4017-944c-4e7958fb3177}]

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{F228C6A4-A593-4017-944C-4E7958FB3177}"= "c:\program files\Radio_G\prxtbRad0.dll" [2011-05-09 176936]

.

[HKEY_CLASSES_ROOT\clsid\{f228c6a4-a593-4017-944c-4e7958fb3177}]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RTHDCPL"="RTHDCPL.EXE" [2008-02-13 16857600]

"Xerox Common SM2"="c:\windows\Xerox\ComSMMgr2\ssmmgr.exe" [2005-04-28 372736]

"Xerox PanelMgr"="c:\windows\Xerox\PanelMgr\SSMMgr.exe" [2010-01-25 557056]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]

"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-11-16 2054360]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-27 15360]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PCANotify]

2001-11-02 08:50 24636 ----a-w- c:\windows\system32\PCANotify.dll

.

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^����� �����^�������^�����^InterVideo WinCinema Manager.lnk]

path=c:\documents and settings\All Users\����� �����\�������\�����\InterVideo WinCinema Manager.lnk

backup=c:\windows\pss\InterVideo WinCinema Manager.lnkCommon Startup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GEST]

m �|\� [X]

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2012-01-03 07:37 843712 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2011-09-07 22:58 37296 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]

2007-06-01 08:21 153136 ----a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]

2007-09-05 09:13 166424 ----a-r- c:\windows\system32\hkcmd.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]

2007-09-05 09:13 141848 ----a-r- c:\windows\system32\igfxtray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

2007-03-01 13:57 153136 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]

2007-09-05 09:13 137752 ----a-r- c:\windows\system32\igfxpers.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"XAudioService"=2 (0x2)

"WMPNetworkSvc"=3 (0x3)

"TeamViewer4"=2 (0x2)

"NMIndexingService"=3 (0x3)

"NBService"=3 (0x3)

"MDM"=2 (0x2)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Symantec\\pcAnywhere\\WINAW32.EXE"=

"c:\\Program Files\\Symantec\\pcAnywhere\\AWHOST32.EXE"=

"c:\\Program Files\\Symantec\\pcAnywhere\\awrem32.exe"=

"c:\\WINDOWS\\system32\\dpvsetup.exe"=

"c:\\Program Files\\ViewPower\\jre\\bin\\javaw.exe"=

.

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [16/11/09 09:03 108792]

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [16/11/09 09:06 96408]

R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [16/11/09 09:04 735960]

S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys --> c:\windows\system32\Drivers\SSPORT.sys [?]

S3 SM_3500_FUService;Phaser 3500 Status Monitor Service;"c:\program files\Xerox\Phaser 3500\CommonSM\ssmsrvc /Service --> c:\program files\Xerox\Phaser 3500\CommonSM\ssmsrvc [?]

S4 TeamViewer4;TeamViewer 4;c:\program files\TeamViewer\Version4\TeamViewer_Service.exe [27/05/09 14:38 185640]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.walla.co.il/

uInternet Connection Wizard,ShellNext = iexplore

IE: &��� �- Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.115.106.10 62.219.186.7

FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\wccx7atz.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.il/

FF - prefs.js: network.proxy.type - 0

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2012-02-27 12:17

Windows 5.1.2600 Service Pack 2 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SM_3500_FUService]

"ImagePath"="\"c:\program files\Xerox\Phaser 3500\CommonSM\ssmsrvc /Service"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_USERS\S-1-5-21-1645522239-329068152-839522115-500\Software\Microsoft\ M*i*c*r*o*s*o*f*t* *M*a*n*a*g*e*m*e*n*t* *C*o*n*s*o*l*e*\Recent File List]

@Allowed: (Read) (RestrictedCode)

@Allowed: (Read) (RestrictedCode)

"File1"="c:\\WINDOWS\\system32\\devmgmt.msc"

"File2"="c:\\WINDOWS\\system32\\compmgmt.msc"

"File3"="c:\\WINDOWS\\system32\\certmgr.msc"

"File4"="c:\\WINDOWS\\system32\\dfrg.msc"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'explorer.exe'(3288)

c:\progra~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL

c:\program files\Common Files\Microsoft Shared\Web Components\10\1037\OWCI10.DLL

c:\progra~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL

c:\program files\Common Files\Microsoft Shared\Web Components\11\1037\OWCI11.DLL

c:\windows\system32\MSCTF.dll

c:\progra~1\WINDOW~2\wmpband.dll

c:\windows\system32\msls31.dll

c:\windows\system32\shdoclc.dll

c:\windows\system32\msimtf.dll

c:\windows\system32\wpdshserviceobj.dll

c:\windows\system32\portabledevicetypes.dll

c:\windows\system32\portabledeviceapi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\RTHDCPL.EXE

c:\program files\Java\jre6\bin\jqs.exe

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Completion time: 2012-02-27 12:18:21 - machine was rebooted

ComboFix-quarantined-files.txt 2012-02-27 10:18

ComboFix2.txt 2012-02-27 09:46

.

Pre-Run: 53,557,465,088 bytes free

Post-Run: 53,479,415,808 bytes free

.

- - End Of File - - BAC28D1FAA074C400E9214487ABA2351