Rogue.eorezo

Bonjour, je suis infecté ac eorezo , je poste le rapport de combo merçi d'avance si vous avez une sollution.

ComboFix 09-06-09.06 - 10/06/2009 18:26.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.33.1036.18.2037.937 [GMT 2:00]
Lancé depuis: c:\users\HUPIN\Downloads\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\lhili.sys
c:\windows\system32\KBL.LOG
c:\windows\system32\Packet.dll
D:\Desktop.ini

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_jptz


((((((((((((((((((((((((((((( Fichiers créés du 2009-05-10 au 2009-06-10 ))))))))))))))))))))))))))))))))))))
.

2009-06-10 16:24 . 2009-06-10 16:24 -------- d-----w- \Qoobox
2009-06-09 12:59 . 2009-06-09 12:59 -------- d-----w- c:\users\HUPIN\AppData\Local\BVRP Software
2009-06-09 12:58 . 2009-06-09 13:00 -------- d-----w- c:\program files\Avanquest update
2009-06-09 12:55 . 2009-06-09 13:03 -------- d-----w- c:\program files\Motorola Phone Tools
2009-06-09 12:55 . 2009-06-09 12:58 -------- d-----w- c:\programdata\BVRP Software
2009-06-09 12:53 . 2009-06-09 13:00 9232 ----a-w- c:\users\HUPIN\mqdmmdfl.sys
2009-06-09 12:53 . 2009-06-09 13:00 92064 ----a-w- c:\users\HUPIN\mqdmmdm.sys
2009-06-09 12:53 . 2009-06-09 13:00 79328 ----a-w- c:\users\HUPIN\mqdmserd.sys
2009-06-09 12:53 . 2009-06-09 13:00 66656 ----a-w- c:\users\HUPIN\mqdmbus.sys
2009-06-09 12:53 . 2009-06-09 13:00 6208 ----a-w- c:\users\HUPIN\mqdmcmnt.sys
2009-06-09 12:53 . 2009-06-09 13:00 5936 ----a-w- c:\users\HUPIN\mqdmwhnt.sys
2009-06-09 12:53 . 2009-06-09 13:00 4048 ----a-w- c:\users\HUPIN\mqdmcr.sys
2009-06-09 12:53 . 2009-06-09 13:00 25600 ----a-w- c:\users\HUPIN\usbsermptxp.sys
2009-06-09 12:53 . 2009-06-09 13:00 22768 ----a-w- c:\users\HUPIN\usbsermpt.sys
2009-05-29 22:27 . 2009-05-29 22:27 -------- d-----w- c:\program files\LimeWire
2009-05-20 18:05 . 2009-02-05 20:06 51376 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-05-20 18:05 . 2009-02-05 20:06 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-05-20 18:05 . 2009-02-05 20:04 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-05-20 18:05 . 2009-02-05 20:07 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-05-20 18:05 . 2009-02-05 20:07 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-05-20 18:05 . 2009-02-05 20:11 1256296 ----a-w- c:\windows\system32\aswBoot.exe
2009-05-20 18:05 . 2009-02-05 20:06 51792 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2009-05-20 17:40 . 2009-05-20 17:40 698903 ----a-w- c:\users\HUPIN\AppData\Roaming\EoRezo\SoftwareUpdate\unins000.exe
2009-05-20 17:40 . 2008-12-09 08:13 368224 ----a-w- c:\users\HUPIN\AppData\Roaming\EoRezo\SoftwareUpdate\SoftwareUpdateHP.exe
2009-05-20 17:40 . 2008-12-09 08:12 499296 ----a-w- c:\users\HUPIN\AppData\Roaming\EoRezo\SoftwareUpdate\SoftwareUpdate.exe
2009-05-20 17:40 . 2009-06-10 16:35 -------- d-----w- c:\users\HUPIN\AppData\Roaming\EoRezo
2009-05-20 17:40 . 2009-05-20 17:40 -------- d-----w- c:\program files\EoRezo
2009-05-14 08:19 . 2009-05-14 08:20 -------- d-----w- c:\users\HUPIN\AppData\Roaming\muvee Technologies

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-10 16:34 . 2009-03-27 13:12 2137014272 --sha-w- \hiberfil.sys
2009-06-10 16:34 . 2009-02-11 16:52 2450804736 --sha-w- \pagefile.sys
2009-06-10 16:17 . 2009-02-16 14:57 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-10 16:17 . 2009-02-16 14:58 3371383 ----a-w- c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-06-09 12:58 . 2009-02-11 14:33 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-09 12:50 . 2009-06-09 12:50 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2009-06-08 15:13 . 2009-03-03 14:54 -------- d-----w- c:\users\HUPIN\AppData\Roaming\Skype
2009-06-08 14:00 . 2009-03-03 14:56 -------- d-----w- c:\users\HUPIN\AppData\Roaming\skypePM
2009-05-31 11:26 . 2009-02-11 23:10 669566 ----a-w- c:\windows\system32\perfh00C.dat
2009-05-31 11:26 . 2009-02-11 23:10 123556 ----a-w- c:\windows\system32\perfc00C.dat
2009-05-30 02:07 . 2009-02-14 21:48 -------- d-----w- c:\users\HUPIN\AppData\Roaming\LimeWire
2009-05-26 11:20 . 2009-02-16 14:57 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-26 11:19 . 2009-02-16 14:57 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-05-15 16:40 . 2009-02-11 16:13 -------- d-----w- c:\programdata\Microsoft Help
2009-05-15 16:37 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-05-13 07:30 . 2009-02-22 08:59 472 ----a-w- c:\users\HUPIN\AppData\Roaming\wklnhst.dat
2009-05-06 11:30 . 2009-02-22 14:58 0 ----a-r- c:\users\HUPIN\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
2009-05-04 14:52 . 2009-02-14 22:27 -------- d-----w- c:\users\HUPIN\AppData\Roaming\vlc
2009-04-20 07:37 . 2009-03-09 18:25 -------- d-----w- c:\users\HUPIN\AppData\Roaming\uTorrent
2009-03-26 22:17 . 2009-03-26 22:17 0 ----a-w- c:\users\HUPIN\AppData\Roaming\~eu37.tmp
2009-03-17 03:38 . 2009-04-17 12:55 13824 ----a-w- c:\windows\system32\apilogen.dll
2009-03-17 03:38 . 2009-04-17 12:55 24064 ----a-w- c:\windows\system32\amxread.dll
2009-03-16 10:45 . 2009-03-16 10:45 50888 ----a-w- c:\windows\system32\drivers\MiniIcpt.sys
2009-03-16 10:45 . 2009-03-16 10:45 51656 ----a-w- c:\windows\system32\drivers\PktIcpt.sys
2009-03-16 10:44 . 2009-03-16 10:44 39880 ----a-w- c:\windows\system32\drivers\gdwfpcd32.sys
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-07 39408]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2007-12-21 217088]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-03 178712]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-09-27 202032]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-10-03 480560]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"EoEngine"="c:\program files\EoRezo\EoEngine.exe" [2009-02-23 472872]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"SoftwareHelper"="c:\users\HUPIN\AppData\Roaming\eoRezo\SoftwareUpdate\SoftwareUpdateHP.exe" [2008-12-09 368224]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"HPAdvisor"=c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" /background
"Sidebar"=c:\program files\Windows Sidebar\sidebar.exe /autoRun

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"QPService"="c:\program files\HP\QuickPlay\QPService.exe"
"IgfxTray"=c:\windows\system32\igfxtray.exe
"Persistence"=c:\windows\system32\igfxpers.exe
"Babylon Client"=c:\program files\Babylon\Babylon-Pro\Babylon.exe -AutoStart
"HP Software Update"=c:\program files\Hp\HP Software Update\HPWuSchd2.exe
"SearchSettings"=c:\program files\Search Settings\SearchSettings.exe
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "c:\program files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
"HotKeysCmds"=c:\windows\system32\hkcmd.exe
"au"=c:\program files\Dealio\DealioAU.exe
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"="1"
"UpdatesDisableNotify"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{B058791E-F690-4BC8-B647-120856C47AA9}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{2CD543DB-FB43-433D-9630-445C79DB0D6A}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{20CDEA6A-B560-4D4E-A8DB-1714386EBAA0}"= c:\program files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector
"{FFD9979B-FA4D-4819-A99E-AC1E3D190090}"= c:\program files\HP\QuickPlay\QP.exe:Quick Play
"{F4BB8E74-1E6C-4EE4-BC30-0E5CA2D2E457}"= c:\program files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{050D31E9-C9A1-430D-9C95-95E10470D0D2}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{DD3DAB61-3AC3-4AB7-9264-7394C3231456}"= UDP:48113:LocalSubnet:LocalSubnet:maconfig_tcp
"{2425B8B9-2684-448C-90F1-21F6ACE7433E}"= TCP:48113:LocalSubnet:LocalSubnet:maconfig_udp
"{8E768EF8-604A-4433-B23B-94F4D88B299E}"= UDP:c:\program files\ma-config.com\maconfservice.exe:maconfservice
"{2C349B2A-82F8-4364-840F-4007E7248CA2}"= TCP:c:\program files\ma-config.com\maconfservice.exe:maconfservice
"{964E1110-B53E-4EFD-B55B-E52D8C850633}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync
"{D12E2019-332A-4ED3-BBA2-7E344DFBBE15}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{EED61862-E8C5-4E4A-966D-42B300B9D293}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{0B125FE0-2E33-487D-9059-4B02D951F6BE}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"TCP Query User{72869946-442A-434C-AD07-61403EE7280C}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule
"UDP Query User{D6A7BCEF-C404-414A-9058-420F6659F8D0}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule
"{A4CA58B7-65A6-4987-98A9-5827B104F7AB}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{176DF765-3700-48DC-90D8-5642C73C075E}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire

R1 aswSP;avast! Self Protection;c:\windows\System32\drivers\aswSP.sys [20/05/2009 20:05 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [20/05/2009 20:05 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [20/05/2009 20:05 51792]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\System32\TUProgSt.exe [02/03/2009 15:34 603904]
S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [14/02/2009 15:51 55280]
S3 fsssvc;Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [06/02/2009 19:08 533360]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [24/01/2009 15:46 216232]
S3 RTL8187;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\System32\drivers\RTL8187.sys [27/02/2009 12:14 205312]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contenu du dossier 'Tâches planifiées'

2009-06-10 c:\windows\Tasks\Maintenance en 1 clic.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-11-21 11:14]

2009-06-10 c:\windows\Tasks\User_Feed_Synchronization-{3FA3AD0A-DBCD-43DC-B406-ABDEF9904427}.job
- c:\windows\system32\msfeedssync.exe [2009-05-06 11:31]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://y.lo.st
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fr_fr&c=81&bd=Presario&pf=laptop
IE: Compare Prices with &Dealio - c:\users\HUPIN\AppData\LocalLow\Dealio\kb127\res\DealioSearch.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Translate with &Babylon - c:\program files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
FF - ProfilePath - c:\users\HUPIN\AppData\Roaming\Mozilla\Firefox\Profiles\t3cjz32r.default\
FF - component: c:\program files\Mozilla Firefox\extensions\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}\components\FFAlert.dll
FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-10 18:35
Windows 6.0.6001 Service Pack 1 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\[u]0/u000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'Explorer.exe'(600)
c:\program files\Hewlett-Packard\HP Advisor\Pillars\Market\MLDeskBand.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\System32\audiodg.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\System32\drivers\XAudio.exe
c:\program files\Hewlett-Packard\Shared\hpqWmiEx.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\System32\conime.exe
c:\program files\Alwil Software\Avast4\ashDisp.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\System32\wbem\unsecapp.exe
c:\program files\Apoint2K\ApMsgFwd.exe
c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
c:\program files\Apoint2K\ApntEx.exe
c:\program files\Hewlett-Packard\Shared\HpqToaster.exe
c:\program files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
.
**************************************************************************
.
Heure de fin: 2009-06-10 18:39 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-06-10 16:39

Avant-CF: 63 881 797 632 octets libres
Après-CF: 63 583 404 032 octets libres

229 --- E O F --- 2009-06-09 16:31