I think I fell into the arms of a hacker. Solved

Question

I downloaded a suspicious cracked file and since then, a software named xmax opens by itself from time to time and it bugs. I close it with Alt + F4, but now it tells me that someone is connecting to my personal virtual visa card account from Brazil or Spain. Help me on how to clean my PC of all viruses and protect it, especially from this kind of virus, while avoiding formatting.   And sorry for my French, lol.

juju666 · Answer

Hi,  Well, that's clever, let that be a lesson for you. It smells like a stealer. You will need to change your passwords once the disinfection is complete.  &#9654 Download here:  RogueKiller  &#9654 Save and close all running programs &#9654 Run RogueKiller and wait for the Prescan to finish &#9654 Accept the EULA and then click on Scan. &#9654 Once finished, click on Report and copy/paste the report in your next reply.  --  .::. Security Contributor .::.

eko · Answer

When I launch RogueKiller my PC restarts and I get annoying errors.

juju666 · Answer

Right-click and "Save target as..." -> yourfirstname.exe -> destination your desktop (AND NOT ELSEWHERE) on the following link: ComboFix  &#9654 Close all open program windows. Temporarily disable only while using ComboFix, the real-time protection of your Antivirus and Antispyware, which may significantly interfere with the search and cleaning procedure of the tool.   if you have XP => double click if you have Vista or Windows 7 => right-click "run as..."  on the renamed combofix  If you are on Windows XP, let it install the recovery console.  &#9654 Do not touch anything during the scan  ComboFix should restart your PC.  &#9654 don’t forget to reactivate your Antivirus and Antispyware protection before reconnecting to the internet.  &#9654&#9654 Come back to the forum, and copy and paste the entire content of C:\Combofix.txt into your next message.   &#9654&#9654&#9654 If, after ComboFix restarts your PC, you have "Marked for deletion" errors or internet connection issues, restart your computer again.  --  .::. Security Contributor .::.

eko · Answer

I downloaded and launched ComboFix, still having issues with the internet even after rebooting, and all I found on my desktop is this long RogueKiller report I think.     [00:00:0000] ***** Global Init ***** [00:00:0000] Has crashed before: Yes [00:00:0000] Create mutex: RogueKiller [00:00:0000] Mutex Created: 0x1b4 [00:00:0000] Fill lists [00:00:0000] OS Language: French [00:00:0000] Take Privileges [00:00:0016] Modify Token [00:00:0016] Set priority to HIGH [00:00:0016] Getting Operating System [00:00:0016] Os Getted: Windows XP (5.1.2600 Service Pack 3) 32 bits version [00:00:0016] ***** Global Init OK ***** [00:00:0016] ***** GUI Init ***** [00:00:0016] Get build number [00:00:0016] build number: RogueKiller(TM) v8.5.4 [Mar 18 2013] (x64: No) [00:00:0125] ***** GUI Init OK ***** [00:00:0141] ***** PreScan ***** [00:00:0141] Clear ListViews [00:00:0141] Clear Objects: 0x0 [00:00:0141] Enum Windows [00:00:0156] [Check Window] Eula - Please read [00:00:0172] [Check Window] Debug log sending [00:00:0172] [Check Window] Start Menu [00:00:0172] [Check Window] CiceroUIWndFrame [00:00:0172] [Check Window] SysFader [00:00:0172] [Check Window] Session Restore [00:00:0172] [Check Window] CiceroUIWndFrame [00:00:0172] [Check Window] TF_FloatingLangBar_WndTitle [00:00:0172] [Check Window] DivX Update [00:00:0172] [Check Window] RogueKiller(TM) v8.5.4 [00:00:0172] [Check Window] Downloads [00:00:0172] [Check Window] Native KiesPDLR [00:00:0172] [Check Window] Internet Mobile+ [00:00:0172] [Check Window] MCI command handling window [00:00:0172] [Check Window] .NET-BroadcastEventWindow.2.0.0.0.ea7aec.0 [00:00:0172] [Check Window] Adobe Reader Updater - Adobe Reader (10.1.0) [00:00:0172] [Check Window] .NET-BroadcastEventWindow.2.0.0.0.2e65425.0 [00:00:0172] [Check Window] nsAppShell:EventWindow [00:00:0172] [Check Window] .NET-BroadcastEventWindow.2.0.0.0.bf7771.0 [00:00:0172] [Check Window] .NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0 [00:00:0188] [Check Window] .NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0 [00:00:0188] [Check Window] .NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0 [00:00:0188] [Check Window] .NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0 [00:00:0188] [Check Window] .NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0 [00:00:0188] [Check Window] .NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0 [00:00:0188] [Check Window] .NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0 [00:00:0188] [Check Window] WinAMRestoreWnd [00:00:0188] [Check Window] Connections Tray [00:00:0188] [Check Window] HelperMsgListenerWnd [00:00:0188] [Check Window] Battery Gauge [00:00:0188] [Check Window] MS_WebcheckMonitor [00:00:0188] [Check Window] MCI command handling window [00:00:0188] [Check Window] KiesTrayAgent [00:00:0188] [Check Window] DivXUpdate [00:00:0188] [Check Window] Updater Error [00:00:0188] [Check Window] DivX Update [00:00:0188] [Check Window] DivXIPCWindowName [00:00:0188] [Check Window] SMax4PNP [00:00:0188] [Check Window] PersistWndName [00:00:0203] [Check Window] HkWndName [00:00:0203] [Check Window] PlusService [00:00:0203] [Check Window] LOGITECH_MOUSEWARE_X_CLASS [00:00:0203] [Check Window] igfxtrayWindow [00:00:0203] [Check Window] AEBalloonTip [00:00:0203] [Check Window] GDI+ Window [00:00:0203] [Check Window] GDI+ Window [00:00:0203] [Check Window] GDI+ Window [00:00:0203] [Check Window] GDI+ Window [00:00:0219] [Check Window] GDI+ Window [00:00:0219] [Check Window] GDI+ Window [00:00:0219] [Check Window] GDI+ Window [00:00:0219] [Check Window] GDI+ Window [00:00:0219] [Check Window] GDI+ Window [00:00:0219] [Check Window] I think I've fallen into the arms of a hacker | CommentCaMarche - Mozilla Firefox [00:00:0219] [Check Window] SysFader [00:00:0219] [Check Window] Program Manager [00:00:0219] [Check Window] M [00:00:0219] [Check Window] Default IME [00:00:0219] [Check Window] M [00:00:0219] [Check Window] Default IME [00:00:0235] [Check Window] M [00:00:0235] [Check Window] Default IME [00:00:0235] [Check Window] M [00:00:0235] [Check Window] Default IME [00:00:0235] [Check Window] M [00:00:0235] [Check Window] Default IME [00:00:0235] [Check Window] Default IME [00:00:0235] [Check Window] Default IME [00:00:0235] [Check Window] M [00:00:0235] [Check Window] Default IME [00:00:0235] [Check Window] Default IME [00:00:0235] [Check Window] Default IME [00:00:0235] [Check Window] Default IME [00:00:0235] [Check Window] Default IME [00:00:0235] [Check Window] Default IME [00:00:0235] [Check Window] Default IME [00:00:0235] [Check Window] Default IME [00:00:0250] [Check Window] Default IME [00:00:0250] [Check Window] Default IME [00:00:0250] [Check Window] Default IME [00:00:0250] [Check Window] Default IME [00:00:0250] [Check Window] Default IME [00:00:0250] [Check Window] Default IME [00:00:0250] [Check Window] Default IME [00:00:0250] [Check Window] Default IME [00:00:0250] [Check Window] Default IME [00:00:0250] [Check Window] Default IME [00:00:0266] [Check Window] Default IME [00:00:0266] [Check Window] Default IME [00:00:0266] [Check Window] Default IME [00:00:0266] [Check Window] Default IME [00:00:0266] [Check Window] Default IME [00:00:0266] [Check Window] Default IME [00:00:0266] [Check Window] Default IME [00:00:0266] [Check Window] Default IME [00:00:0266] [Check Window] Default IME [00:00:0266] [Check Window] Default IME [00:00:0266] [Check Window] Default IME [00:00:0266] [Check Window] Default IME [00:00:0281] [Check Window] Default IME [00:00:0281] [Check Window] Default IME [00:00:0281] [Check Window] Default IME [00:00:0281] [Check Window] Default IME [00:00:0281] [Check Window] Default IME [00:00:0281] [Check Window] M [00:00:0281] [Check Window] Default IME [00:00:0297] [Check Window] M [00:00:0297] [Check Window] Default IME [00:00:0297] [Check Processes] Service PID: 992 [00:01:0719] [Check Processes] [0][_0] [System Process]: [00:01:0719] [CHECK] WhiteDLL [00:01:0719] [CHECK] WellKnown [00:01:0719] [Check Processes] [4][_0] System: [00:01:0719] [CHECK] WhiteDLL [00:01:0719] [CHECK] WellKnown [00:01:0719] [Check Processes] [876][_4] smss.exe: C:\WINDOWS\System32\smss.exe [00:01:0719] [CHECK] WhiteDLL [00:01:0719] [CHECK] WellKnown [00:01:0719] [Check Processes] [924][_876] csrss.exe: C:\WINDOWS\system32\csrss.exe [00:01:0719] [CHECK] WhiteDLL [00:01:0719] [CHECK] WellKnown [00:01:0719] [Check Processes] [948][_876] winlogon.exe: C:\WINDOWS\system32\winlogon.exe [00:01:0719] [CHECK] WhiteDLL [00:01:0719] [CHECK] WellKnown [00:01:0719] [Check Processes] [992][_948] services.exe: C:\WINDOWS\system32\services.exe [00:01:0719] [CHECK] WhiteDLL [00:01:0719] [CHECK] WellKnown [00:01:0719] [Check Processes] [1004][_948] savedump.exe: C:\WINDOWS\system32\savedump.exe [00:01:0719] [CHECK] WhiteDLL [00:01:0719] [CHECK] WellKnown [00:01:0719] [CHECK] HijackName [00:01:0719] [CHECK] Signature [00:01:0735] [CHECK] Patterns [00:01:0735] [CHECK] Blacklist [00:01:0735] [CHECK] BlacklistPath [00:01:0735] [CHECK] BlacklistMD5 [00:01:0735] [CHECK] MadeNumbers [00:01:0735] [CHECK] SuspPath [00:01:0735] [CHECK] PrevRun [00:01:0735] [CHECK] Not found! [00:01:0735] [Check Processes] [1012][_948] lsass.exe: C:\WINDOWS\system32\lsass.exe [00:01:0735] [CHECK] WhiteDLL [00:01:0735] [CHECK] WellKnown [00:01:0735] [Check Processes] [1176][_992] svchost.exe: C:\WINDOWS\system32\svchost.exe [00:01:0735] [CHECK] WhiteDLL [00:01:0735] [CHECK] WellKnown [00:01:0735] [Check Processes] [1264][_992] svchost.exe: C:\WINDOWS\system32\svchost.exe [00:01:0735] [CHECK] WhiteDLL [00:01:0735] [CHECK] WellKnown [00:01:0735] [Check Processes] [1304][_992] svchost.exe: C:\WINDOWS\system32\svchost.exe [00:01:0735] [CHECK] WhiteDLL [00:01:0735] [CHECK] WellKnown [00:01:0735] [Check Processes] [1348][_992] svchost.exe: C:\WINDOWS\system32\svchost.exe [00:01:0735] [CHECK] WhiteDLL [00:01:0735] [CHECK] WellKnown [00:01:0750] [Check Processes] [1404][_992] svchost.exe: C:\WINDOWS\system32\svchost.exe [00:01:0750] [CHECK] WhiteDLL [00:01:0750] [CHECK] WellKnown [00:01:0750] [Check Processes] [1476][_992] svchost.exe: C:\WINDOWS\system32\svchost.exe [00:01:0750] [CHECK] WhiteDLL [00:01:0750] [CHECK] WellKnown [00:01:0750] [Check Processes] [1632][_992] spoolsv.exe: C:\WINDOWS\system32\spoolsv.exe [00:01:0750] [CHECK] WhiteDLL [00:01:0750] [CHECK] WellKnown [00:01:0750] [Check Processes] [1720][_992] svchost.exe: C:\WINDOWS\system32\svchost.exe [00:01:0750] [CHECK] WhiteDLL [00:01:0750] [CHECK] WellKnown [00:01:0750] [Check Processes] [1752][_992] AppleMobileDeviceService.exe: C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [00:01:0750] [CHECK] WhiteDLL [00:01:0750] [CHECK] WellKnown [00:01:0750] [CHECK] HijackName [00:01:0750] [CHECK] Signature [00:01:0750] [CHECK] Patterns [00:01:0750] [CHECK] Blacklist [00:01:0750] [CHECK] BlacklistPath [00:01:0750] [CHECK] BlacklistMD5 [00:01:0750] [CHECK] MadeNumbers [00:01:0750] [CHECK] SuspPath [00:01:0750] [CHECK] PrevRun [00:01:0750] [CHECK] Not found! [00:01:0750] [Check Processes] [1776][_992] mDNSResponder.exe: C:\Program Files\Bonjour\mDNSResponder.exe [00:01:0750] [CHECK] WhiteDLL [00:01:0750] [CHECK] WellKnown [00:01:0750] [CHECK] HijackName [00:01:0750] [CHECK] Signature [00:01:0766] [CHECK] Patterns [00:01:0766] [CHECK] Blacklist [00:01:0766] [CHECK] BlacklistPath [00:01:0766] [CHECK] BlacklistMD5 [00:01:0766] [CHECK] MadeNumbers [00:01:0766] [CHECK] SuspPath [00:01:0766] [CHECK] PrevRun [00:01:0766] [CHECK] Not found! [00:01:0766] [Check Processes] [1824][_992] DCService.exe: C:\Documents and Settings\All Users\Application Data\DatacardService\DCService.exe [00:01:0766] [CHECK] WhiteDLL [00:01:0766] [CHECK] WellKnown [00:01:0766] [Check Processes] [1912][_992] hsswd.exe: C:\Program Files\Hotspot Shield\bin\hsswd.exe [00:01:0766] [CHECK] WhiteDLL [00:01:0766] [CHECK] WellKnown [00:01:0766] [CHECK] HijackName [00:01:0766] [CHECK] Signature [00:01:0781] [CHECK] Patterns [00:01:0781] [CHECK] Blacklist [00:01:0781] [CHECK] BlacklistPath [00:01:0781] [CHECK] BlacklistMD5 [00:01:0781] [CHECK] MadeNumbers [00:01:0781] [CHECK] SuspPath [00:01:0781] [CHECK] PrevRun [00:01:0781] [CHECK] Not found! [00:01:0781] [Check Processes] [1932][_992] jqs.exe: C:\Program Files\Java\jre7\bin\jqs.exe [00:01:0781] [CHECK] WhiteDLL [00:01:0781] [CHECK] WellKnown [00:01:0781] [CHECK] HijackName [00:01:0781] [CHECK] Signature [00:01:0781] [CHECK] Patterns [00:01:0781] [CHECK] Blacklist [00:01:0781] [CHECK] BlacklistPath [00:01:0781] [CHECK] BlacklistMD5 [00:01:0781] [CHECK] MadeNumbers [00:01:0781] [CHECK] SuspPath [00:01:0781] [CHECK] PrevRun [00:01:0781] [CHECK] Not found! [00:01:0781] [Check Processes] [124][_992] svchost.exe: C:\WINDOWS\system32\svchost.exe [00:01:0781] [CHECK] WhiteDLL [00:01:0781] [CHECK] WellKnown [00:01:0781] [Check Processes] [276][_1304] wuauclt.exe: C:\WINDOWS\system32\wuauclt.exe [00:01:0797] [CHECK] WhiteDLL [00:01:0797] [CHECK] WellKnown [00:01:0797] [Check Processes] [744][_704] explorer.exe: C:\WINDOWS\explorer.exe [00:01:0797] [Check DLLs] Explorer.EXE: C:\WINDOWS\Explorer.EXE [00:01:0797] [Check DLLs] ntdll.dll: C:\WINDOWS\system32
tdll.dll [00:01:0797] [CHECK] WhiteDLL [00:01:0797] [CHECK] WellKnown [00:01:0797] [CHECK] HijackName [00:01:0797] [CHECK] Signature [00:01:0813] [CHECK] Patterns [00:01:0813] [CHECK] Blacklist [00:01:0813] [CHECK] BlacklistPath [00:01:0813] [CHECK] BlacklistMD5 [00:01:0813] [CHECK] MadeNumbers [00:01:0813] [CHECK] SuspPath [00:01:0813] [CHECK] PrevRun [00:01:0813] [CHECK] Not found! [00:01:0813] [Check DLLs] kernel32.dll: C:\WINDOWS\system32\kernel32.dll [00:01:0813] [CHECK] WhiteDLL [00:01:0813] [CHECK] WellKnown [00:01:0813] [CHECK] HijackName [00:01:0813] [CHECK] Signature [00:01:0828] [CHECK] Patterns [00:01:0828] [CHECK] Blacklist [00:01:0828] [CHECK] BlacklistPath [00:01:0828] [CHECK] BlacklistMD5 [00:01:0844] [CHECK] MadeNumbers [00:01:0844] [CHECK] SuspPath [00:01:0844] [CHECK] PrevRun [00:01:0844] [CHECK] Not found! [00:01:0844] [Check DLLs] ADVAPI32.dll: C:\WINDOWS\system32\ADVAPI32.dll [00:01:0844] [CHECK] WhiteDLL [00:01:0844] [CHECK] WellKnown [00:01:0844] [CHECK] HijackName [00:01:0844] [CHECK] Signature [00:01:0860] [CHECK] Patterns [00:01:0860] [CHECK] Blacklist [00:01:0860] [CHECK] BlacklistPath [00:01:0860] [CHECK] BlacklistMD5 [00:01:0860] [CHECK] MadeNumbers [00:01:0860] [CHECK] SuspPath [00:01:0860] [CHECK] PrevRun [00:01:0860] [CHECK] Not found! [00:01:0860] [Check DLLs] RPCRT4.dll: C:\WINDOWS\system32\RPCRT4.dll [00:01:0860] [CHECK] WhiteDLL [00:01:0860] [CHECK] WellKnown [00:01:0860] [CHECK] HijackName [00:01:0860] [CHECK] Signature [00:01:0875] [CHECK] Patterns [00:01:0875] [CHECK] Blacklist [00:01:0875] [CHECK] BlacklistPath [00:01:0875] [CHECK] BlacklistMD5 [00:01:0875] [CHECK] MadeNumbers [00:01:0875] [CHECK] SuspPath [00:01:0875] [CHECK] PrevRun [00:01:0875] [CHECK] Not found! [00:01:0875] [Check DLLs] Secur32.dll: C:\WINDOWS\system32\Secur32.dll [00:01:0875] [CHECK] WhiteDLL [00:01:0875] [CHECK] WellKnown [00:01:0875] [CHECK] HijackName [00:01:0875] [CHECK] Signature [00:01:0891] [CHECK] Patterns [00:01:0891] [CHECK] Blacklist [00:01:0891] [CHECK] BlacklistPath [00:01:0891] [CHECK] BlacklistMD5 [00:01:0891] [CHECK] MadeNumbers [00:01:0891] [CHECK] SuspPath [00:01:0891] [CHECK] PrevRun [00:01:0891] [CHECK] Not found! [00:01:0891] [Check DLLs] BROWSEUI.dll: C:\WINDOWS\system32\BROWSEUI.dll [00:01:0891] [CHECK] WhiteDLL [00:01:0891] [CHECK] WellKnown [00:01:0891] [CHECK] HijackName [00:01:0891] [CHECK] Signature [00:01:0906] [CHECK] Patterns [00:01:0906] [CHECK] Blacklist [00:01:0906] [CHECK] BlacklistPath [00:01:0906] [CHECK] BlacklistMD5 [00:01:0906] [CHECK] MadeNumbers [00:01:0906] [CHECK] SuspPath [00:01:0906] [CHECK] PrevRun [00:01:0906] [CHECK] Not found! [00:01:0906] [Check DLLs] GDI32.dll: C:\WINDOWS\system32\GDI32.dll [00:01:0906] [CHECK] WhiteDLL [00:01:0906] [CHECK] WellKnown [00:01:0906] [CHECK] HijackName [00:01:0922] [CHECK] Signature [00:01:0922] [CHECK] Patterns [00:01:0922] [CHECK] Blacklist [00:01:0922] [CHECK] BlacklistPath [00:01:0922] [CHECK] BlacklistMD5 [00:01:0922] [CHECK] MadeNumbers [00:01:0922] [CHECK] SuspPath [00:01:0922] [CHECK] PrevRun [00:01:0922] [CHECK] Not found! [00:01:0922] [Check DLLs] USER32.dll: C:\WINDOWS\system32\USER32.dll [00:01:0922] [CHECK] WhiteDLL [00:01:0922] [CHECK] WellKnown [00:01:0922] [CHECK] HijackName [00:01:0922] [CHECK] Signature [00:01:0938] [CHECK] Patterns [00:01:0938] [CHECK] Blacklist [00:01:0938] [CHECK] BlacklistPath [00:01:0938] [CHECK] BlacklistMD5 [00:01:0938] [CHECK] MadeNumbers [00:01:0938] [CHECK] SuspPath [00:01:0938] [CHECK] PrevRun [00:01:0938] [CHECK] Not found! [00:01:0938] [Check DLLs] msvcrt.dll: C:\WINDOWS\system32\msvcrt.dll

juju666 · Answer

This is the crash report that I'm sending to Tigzy.  And my combofix report?  --  .::. Security Contributor .::.

eko · Answer

I launch its scan, restart, and no report.

juju666 · Answer

start /execute  type: cmd  ok  in the black window, copy-paste:  dir /A/B/S %Homedrive%\Qoobox >> %Homedrive%\Qoobox.txt  then press enter  after that, close this window and paste the content of Qoobox.txt that you will find in C:\  --  .::. Security Contributor .::.

eko · Answer

qoobox is totally empty.

juju666 · Answer

he worked on combofix though? :o  --  .::. Security Contributor .::.

eko · Answer

yes! :s

juju666 · Answer

Redo it in safe mode.  --  .::. Security Contributor .::.

eko · Answer

Comment démarrer en mode sans échec sur XP ?

juju666 · Answer

How to enter Safe Mode:  &#9654 Restart your computer &#9654 Press the F8 key immediately (F5 on some PCs) right after the "Beeps" &#9654 You will see a screen with startup options appear &#9654 Choose the first option: Safe Mode, and confirm with "Enter" &#9654 Choose your usual account, not Administrator (if necessary ...)  --  .::. Security Contributor .::.

eko · Answer

ComboFix 13-04-20.02 - vgame 21/04/2013 19:22:13.1.2 - x86 MINIMAL Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1014.669 [GMT 0:00] Lancé depuis: c:\documents and settings\vgame\Bureau\ComboFix.exe . WARNING - RECOVERY CONSOLE IS NOT INSTALLED ON THIS MACHINE!! . . (((((((((((((((((((((((((((((((((((( Other deletions )))))))))))))))))))))))))))))))))))))))))))))))) . . c:\documents and settings\eko\Application Data\facemoods.com c:\documents and settings\eko\Application Data\PriceGong c:\documents and settings\eko\Application Data\ShoppingReport2 c:\documents and settings\eko\Application Data\ShoppingReport2\cs\Config.xml c:\documents and settings\eko\Application Data\ShoppingReport2\cs\db\Aliases.dbs c:\documents and settings\eko\Application Data\ShoppingReport2\cs\db\Sites.dbs c:\documents and settings\eko\Application Data\ShoppingReport2\cs\dwld\WhiteList.xip c:\documents and settings\eko\Application Data\ShoppingReport2\cseport\aggr_storage.xml c:\documents and settings\eko\Application Data\ShoppingReport2\cseport\send_storage.xml c:\documents and settings\eko\Application Data\ShoppingReport2\cses1\WhiteList.dbs c:\documents and settings\vgame\.tmp c:\documents and settings\vgame\Application Data\csrs.exe c:\documents and settings\vgame\Application Data\dns_t.exe c:\documents and settings\vgame\Application Data\dnsu.exe c:\documents and settings\vgame\Application Data\Facebook.exe c:\documents and settings\vgame\Application Data\Facebook.exe.tmp c:\documents and settings\vgame\Application Data\Skype.exe c:\documents and settings\vgame\Application Data\Skype.exe.tmp c:\documents and settings\vgame\Application Data\SQLite3.dll c:\documents and settings\vgame\Application Data\svchost.exe c:\documents and settings\vgame\Application Data\svchost.exe.tmp c:\documents and settings\vgame\Application Data\svchot.exe c:\documents and settings\vgame\Application Data\svchot.exe.tmp c:\documents and settings\vgame\Application Data\Trojan.exe c:\documents and settings\vgame\Application Data\Trojan.exe.tmp c:\documents and settings\vgame\Local Settings\Temp\Chrome.exe c:\documents and settings\vgame\Local Settings\Temp\crossfire.exe c:\documents and settings\vgame\Local Settings\Temp\csrs.exe c:\documents and settings\vgame\Local Settings\Temp\facebook.exe c:\documents and settings\vgame\Local Settings\Temp\Google.exe c:\documents and settings\vgame\Local Settings\Temp\psyco.exe c:\documents and settings\vgame\Local Settings\Temp\service.exe c:\documents and settings\vgame\Local Settings\Temp\svchost.exe c:\documents and settings\vgame\Local Settings\Temp\Sys.exe c:\documents and settings\vgame\Local Settings\Temp\System.exe c:\documents and settings\vgame\Local Settings\Temp\Trojan.exe c:\documents and settings\vgame\Menu Démarrer\Programmes\Démarrage\01b768079edee5f654080fe50a78d4b7.exe c:\documents and settings\vgame\Menu Démarrer\Programmes\Démarrage\11b66f66324ac0e6e6a3c81ee698d1b6.exe c:\documents and settings\vgame\Menu Démarrer\Programmes\Démarrage\13e5090cee57967233f9b6a72ec1c5dd.exe c:\documents and settings\vgame\Menu Démarrer\Programmes\Démarrage\1899a32ba3565d2a36a228013f5e9799.exe c:\documents and settings\vgame\Menu Démarrer\Programmes\Démarrage\301b5fcf8ce2fab8868e80b6c1f912fe.exe c:\documents and settings\vgame\Menu Démarrer\Programmes\Démarrage\368fc7f563096ad51849f0d2c298fc08.exe c:\documents and settings\vgame\Menu Démarrer\Programmes\Démarrage\488fe9187d45de3434711bfe795a2b63.exe c:\documents and settings\vgame\Menu Démarrer\Programmes\Démarrage\8107c9f97232933cc42c9d6f827202a5.exe c:\documents and settings\vgame\Menu Démarrer\Programmes\Démarrage\8515eb34d8f9de5af815466e9715b3e5.exe c:\documents and settings\vgame\Menu Démarrer\Programmes\Démarrage\8d0fa66a7f70d4b92f3da7199f7f9e8d.exe c:\documents and settings\vgame\Menu Démarrer\Programmes\Démarrage\8e56537133e75df5421f3565a026e09d.exe c:\documents and settings\vgame\Menu Démarrer\Programmes\Démarrage\94e540adc4cf174ca7240135617a6982.exe c:\documents and settings\vgame\Menu Démarrer\Programmes\Démarrage\b57cb8e241634542876c995d99b59a18.exe c:\documents and settings\vgame\Menu Démarrer\Programmes\Démarrage\ba4c12bee3027d94da5c81db2d196bfd.exe c:\documents and settings\vgame\Menu Démarrer\Programmes\Démarrage\c25bb4b46988f213a04e5145e3c057f0.exe c:\documents and settings\vgame\Menu Démarrer\Programmes\Démarrage\e79d569ba77562f0d4316e586835f0a2.exe c:\documents and settings\vgame\Menu Démarrer\Programmes\Démarrage\f5ac7c069b9e6b412c43f7ea38d34f76.exe c:\documents and settings\vgame\Menu Démarrer\Programmes\Démarrage\f851f7347b44de50d7b2e29211ae1802.exe c:\documents and settings\vgame\Menu Démarrer\Programmes\Démarrage\f98c2d3f49d939114e6995a40c552630.exe c:\documents and settings\vgame	askmgr.exe c:\documents and settings\vgame	askmgr.exe.tmp c:\program files\Complitly c:\windows\system32\_000013_.tmp.dll c:\windows\system32\install c:\windows\system32\install\system.exe c:\windows\system32\SET2D0.tmp c:\windows\system32\SET347.tmp c:\windows\system32\SET348.tmp c:\windows\system32\SET349.tmp c:\windows\system32\SET34A.tmp c:\windows\system32\SET34B.tmp c:\windows\system32\windows c:\windows\system32\windows.\csrss.exe c:\windows\system32\Windows\csrss.exe . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . -------\Legacy_DCSERVICE.EXE -------\Service_DCService.exe . . ((((((((((((((((((((((((((((( Files created from 2013-03-21 to 2013-04-21 )))))))))))))))))))))))))))))))))))) . . 2013-04-21 16:23 . 2013-04-21 16:23 -------- dc----w- c:\documents and settings\vgame\Local Settings\Application Data\PCHealth 2013-04-21 12:50 . 2013-04-21 12:50 -------- dc----w- c:\documents and settings\vgame\Application Data\DivX 2013-04-19 12:44 . 2013-04-19 12:46 -------- d-----w- c:\program files\PokerStars.FR 2013-04-19 11:31 . 2013-04-19 11:31 -------- dc----w- c:\documents and settings\vgame\Local Settings\Application Data\Samsung 2013-04-19 11:30 . 2013-04-19 11:32 -------- dc----w- c:\documents and settings\vgame\Application Data\Samsung 2013-04-11 22:19 . 2013-04-11 22:19 -------- d-----w- C:\found.002 2013-04-01 15:28 . 2013-04-01 15:28 -------- dc----w- c:\documents and settings\vgame\Local Settings\Application Data\cache 2013-03-30 19:50 . 2013-04-20 08:50 -------- dc----w- c:\documents and settings\vgame\Local Settings\Application Data\FullTiltPoker 2013-03-30 18:52 . 2013-04-20 22:46 -------- d-----w- c:\program files\Full Tilt Poker 2013-03-29 08:51 . 2013-03-29 08:51 -------- d-----w- C:\found.001 2013-03-27 21:09 . 2013-03-27 21:09 -------- dc----w- C:\Poker . . . (((((((((((((((((((((((((((((((((( Find3M report )))))))))))))))))))))))))))))))))))))))))))))))) . 2013-03-19 23:23 . 2013-03-19 23:00 693976 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2013-03-19 23:23 . 2011-06-18 15:36 73432 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2013-03-19 22:54 . 2013-03-19 22:54 94112 ----a-w- c:\windows\system32\WindowsAccessBridge.dll 2013-03-19 22:54 . 2011-06-07 11:57 143872 ----a-w- c:\windows\system32\javacpl.cpl 2013-03-19 22:54 . 2013-02-10 20:08 861088 ----a-w- c:\windows\system32
pDeployJava1.dll 2013-03-19 22:54 . 2011-12-12 07:59 782240 ----a-w- c:\windows\system32\deployJava1.dll 2013-03-08 08:36 . 2008-04-13 17:33 293888 ----a-w- c:\windows\system32\winsrv.dll 2013-03-07 15:56 . 2008-04-13 19:07 2030592 ----a-w- c:\windows\system32
tkrnlpa.exe 2013-03-07 15:56 . 2008-04-13 17:07 2151936 ----a-w- c:\windows\system32
toskrnl.exe 2013-03-02 01:57 . 2008-04-13 16:58 1867392 ----a-w- c:\windows\system32\win32k.sys 2013-03-02 01:55 . 2008-04-13 17:33 916480 ----a-w- c:\windows\system32\wininet.dll 2013-03-02 01:55 . 2008-04-13 17:34 1469440 ------w- c:\windows\system32\inetcpl.cpl 2013-03-02 01:55 . 2008-04-13 17:33 43520 ------w- c:\windows\system32\licmgr10.dll 2013-03-02 01:08 . 2008-04-13 17:00 385024 ------w- c:\windows\system32\html.iec 2013-02-27 07:56 . 2011-06-06 08:07 2067456 ----a-w- c:\windows\system32\mstscax.dll 2013-02-12 00:32 . 2008-04-13 09:56 12928 ----a-w- c:\windows\system32\drivers\usb8023.sys 2013-01-26 03:55 . 2008-04-13 17:33 552448 ----a-w- c:\windows\system32\oleaut32.dll 2013-04-13 00:31 . 2013-04-13 00:31 263064 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((((((( Registry Run Points )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty & legitimate start items are not listed REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-08-01 1036288] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-01-13 131072] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-01-13 163840] "Persistence"="c:\windows\system32\igfxpers.exe" [2007-01-13 135168] "Logitech Utility"="Logi_MwX.Exe" [2003-12-11 20992] "PlusService"="c:\program files\Yuna Software\Messenger Plus!\PlusService.exe" [2011-05-26 800768] "Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352] "DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376] "APSDaemon"="c:\program files\Fichiers communs\Apple\Apple Application Support\APSDaemon.exe" [2012-08-27 59280] "KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2012-12-20 310280] "iTunesHelper"="e:\itunes\iTunesHelper.exe" [2012-09-09 421776] "SunJavaUpdateSched"="c:\program files\Fichiers communs\Java\Java Update\jusched.exe" [2012-07-03 252848] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360] . c:\documents and settings\vgame\Menu Démarrer\Programmes\Démarrage\ 23556fb1360f366337f97c924e76ead3.exe [2013-4-21 44544] 5cd8f17f4086744065eb0992a09e05a2.exe [2013-4-20 44544] . c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\ McAfee Security Scan Plus.lnk - [N/A] . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\Network Diagnostic\xpnetdiag.exe"= "%windir%\system32\sessmgr.exe"= "c:\Program Files\Windows Live\Messenger\wlcsdk.exe"= "c:\Program Files\Windows Live\Messenger\msnmsgr.exe"= "c:\Program Files\Pando Networks\Media Booster\PMB.exe"= "c:\Program Files\Opera\opera.exe"= "c:\Program Files\Fichiers communs\Apple\Apple Application Support\WebKit2WebProcess.exe"= "c:\Program Files\Bonjour\mDNSResponder.exe"= "e:\iTunes\iTunes.exe"= "c:\Program Files\XBMC\XBMC.exe"= "c:\Documents and Settings\m\Local Settings\Temp\System.exe"= "c:\Documents and Settings\m\Local Settings\Temp\Chrome.exe"= "c:\Documents and Settings\m\Local Settings\Temp\facebook.exe"= . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "56659:TCP"= 56659:TCP:Pando Media Booster "56659:UDP"= 56659:UDP:Pando Media Booster "58936:TCP"= 58936:TCP:Pando Media Booster "58936:UDP"= 58936:UDP:Pando Media Booster . R2 HssWd;Hotspot Shield Monitoring Service;c:\program files\Hotspot Shield\bin\hsswd.exe -product HSS --> c:\program files\Hotspot Shield\bin\hsswd.exe -product HSS [?] R3 huawei_enumerator;huawei_enumerator;c:\windows\system32\drivers\ew_jubusenum.sys [25/08/2011 00:15 70656] S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\drivers\ssudbus.sys [24/01/2013 11:32 83168] S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\drivers\ew_hwusbdev.sys [25/08/2011 00:15 101504] S3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\drivers\ewusbnet.sys [25/08/2011 00:15 117504] S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.0.318\McCHSvc.exe [05/02/2013 15:48 235216] S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\drivers\ssudmdm.sys [24/01/2013 11:32 181344] . --- Other Services/Drivers in memory --- . *NewlyCreated* - WS2IFSL . [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2013-04-11 11:57 1642448 ----a-w- c:\program files\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe . Contents of the 'Scheduled Tasks' folder . 2013-04-21 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-03-19 23:23] . 2013-04-19 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 15:57] . 2013-04-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2013-02-09 16:45] . 2013-04-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2013-02-09 16:45] . . ------- Additional Examination ------- . IE: {{90EAE591-7E7E-434a-8E28-ECFD00071806} - c:\program files\PokerStars.FR\PokerStarsUpdate.exe TCP: Interfaces\{3EFA9696-6DCB-45ED-971E-56C3E64D7652}: NameServer = 8.8.8.8 154.15.199.142 FF - ProfilePath - c:\documents and settings\vgame\Application Data\Mozilla\Firefox\Profiles\mteietq8.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/ . - - - - ORPHANED REMOVED - - - - . BHO-{872b5b88-9db5-4310-bdd0-ac189557e5f5} - c:\program files\DVDVideoSoftTB\prxtbDVD0.dll Toolbar-{9D425283-D487-4337-BAB6-AB8354A81457} - (no file) Toolbar-{872b5b88-9db5-4310-bdd0-ac189557e5f5} - c:\program files\DVDVideoSoftTB\prxtbDVD0.dll HKCU-Run-Steam - c:\program files\Steam\Steam.exe HKCU-Run-8107c9f97232933cc42c9d6f827202a5 - c:\documents and settings\vgame\Application Data\dnsu.exe HKCU-Run-f98c2d3f49d939114e6995a40c552630 - c:\documents and settings\vgame\Application Data\dns_t.exe HKCU-Run-368fc7f563096ad51849f0d2c298fc08 - c:\documents and settings\vgame\Application Data\Skype.exe HKCU-Run-01b768079edee5f654080fe50a78d4b7 - c:\documents and settings\vgame\Application Data\csrs.exe HKCU-Run-94e540adc4cf174ca7240135617a6982 - c:\documents and settings\vgame\Application Data\Facebook.exe HKCU-Run-11b66f66324ac0e6e6a3c81ee698d1b6 - c:\documents and settings\vgame\Application Data\svchot.exe HKCU-Run-c25bb4b46988f213a04e5145e3c057f0 - c:\documents and settings\vgame	askmgr.exe HKCU-Run-8515eb34d8f9de5af815466e9715b3e5 - c:\documents and settings\vgame\Application Data\Trojan.exe HKCU-Run-23556fb1360f366337f97c924e76ead3 - c:\documents and settings\vgame\Application Data\svchost.exe HKLM-Run-8107c9f97232933cc42c9d6f827202a5 - c:\documents and settings\vgame\Application Data\dnsu.exe HKLM-Run-f98c2d3f49d939114e6995a40c552630 - c:\documents and settings\vgame\Application Data\dns_t.exe HKLM-Run-368fc7f563096ad51849f0d2c298fc08 - c:\documents and settings\vgame\Application Data\Skype.exe HKLM-Run-01b768079edee5f654080fe50a78d4b7 - c:\documents and settings\vgame\Application Data\csrs.exe HKLM-Run-94e540adc4cf174ca7240135617a6982 - c:\documents and settings\vgame\Application Data\Facebook.exe HKLM-Run-11b66f66324ac0e6e6a3c81ee698d1b6 - c:\documents and settings\vgame\Application Data\svchot.exe HKLM-Run-c25bb4b46988f213a04e5145e3c057f0 - c:\documents and settings\vgame	askmgr.exe HKLM-Run-8515eb34d8f9de5af815466e9715b3e5 - c:\documents and settings\vgame\Application Data\Trojan.exe HKLM-Run-23556fb1360f366337f97c924e76ead3 - c:\documents and settings\vgame\Application Data\svchost.exe AddRemove-1ClickDownload - c:\program files\1ClickDownload\uninst.exe AddRemove-Casino.com - c:\casino\Casino.com\_SetupCasino_ae7b84.exe AddRemove-HDM Connection Manager - c:\documents and settings\user\Bureau\Téléchargement\HDM Connection Manager\uninst.exe AddRemove-HDMI - c:\windows\system32\igxpun.exe AddRemove-Poker 770 - c:\poker\Poker 770\_SetupCasino_24d4.exe AddRemove-SABnzbd - c:\program files\SABnzbd\uninstall.exe AddRemove-SABnzbOpen_is1 - c:\program files\SABnzbOpen\unins000.exe AddRemove-Search Toolbar - c:\program files\Search Toolbar\SearchToolbarUninstall.exe AddRemove-Steam App 440 - c:\program files\Steam\steam.exe AddRemove-Titan Poker - c:\poker\Titan Poker\_TitanPSetup_654c35.exe AddRemove-WinMover_is1 - c:\program files\WinMover\unins000.exe AddRemove-Winner Casino - c:\casino\Winner Casino\_WinnerCSetup_150ba5_fr.exe AddRemove-winnerpoker - c:\poker\Winner Poker\_WinnerPSetup_c0d06a.exe AddRemove-{7A78CE94-2688-4C57-A5A3-067B9ECBF2BA}_is1 - c:\program files\Easy Money DEMO\unins000.exe AddRemove-01_Simmental - c:\program files\SAMSUNG\USB Drivers\01_Simmental\Uninstall.exe AddRemove-02_Siberian - c:\program files\SAMSUNG\USB Drivers\02_Siberian\Uninstall.exe AddRemove-03_Swallowtail - c:\program files\SAMSUNG\USB Drivers\03_Swallowtail\Uninstall.exe AddRemove-04_semseyite - c:\program files\SAMSUNG\USB Drivers\04_semseyite\Uninstall.exe AddRemove-05_Sloan - c:\program files\SAMSUNG\USB Drivers\05_Sloan\Uninstall.exe AddRemove-06_Spencer - c:\program files\SAMSUNG\USB Drivers\06_Spencer\Uninstall.exe AddRemove-07_Schorl - c:\program files\SAMSUNG\USB Drivers\07_Schorl\Uninstall.exe AddRemove-08_EMPChipset - c:\program files\SAMSUNG\USB Drivers\08_EMPChipset\Uninstall.exe AddRemove-09_Hsp - c:\program files\SAMSUNG\USB Drivers\09_Hsp\Uninstall.exe AddRemove-11_HSP_Plus_Default - c:\program files\SAMSUNG\USB Drivers\11_HSP_Plus_Default\Uninstall.exe AddRemove-16_Shrewsbury - c:\program files\SAMSUNG\USB Drivers\16_Shrewsbury\Uninstall.exe AddRemove-17_EMP_Chipset2 - c:\program files\SAMSUNG\USB Drivers\17_EMP_Chipset2\Uninstall.exe AddRemove-18_Zinia_Serial_Driver - c:\program files\SAMSUNG\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe AddRemove-19_VIA_driver - c:\program files\SAMSUNG\USB Drivers\19_VIA_driver\Uninstall.exe AddRemove-20_NXP_Driver - c:\program files\SAMSUNG\USB Drivers\20_NXP_Driver\Uninstall.exe AddRemove-21_Searsburg - c:\program files\SAMSUNG\USB Drivers\21_Searsburg\Uninstall.exe AddRemove-22_WiBro_WiMAX - c:\program files\SAMSUNG\USB Drivers\22_WiBro_WiMAX\Uninstall.exe AddRemove-24_flashusbdriver - c:\program files\SAMSUNG\USB Drivers\24_flashusbdriver\Uninstall.exe AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2013-04-21 19:35 Windows 5.1.2600 Service Pack 3 NTFS . Searching for hidden processes ... . Searching for hidden auto-start items ... . Searching for hidden files ... . Scan completed successfully Hidden files: 0 . ************************************************************************** . --------------------- BLOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\WINDOWS\system32\Macromed\Flash\FlashUtil32_11_6_602_180_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\WINDOWS\system32\Macromed\Flash\FlashUtil32_11_6_602_180_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . --------------------- DLLs loaded in active processes --------------------- . - - - - - - - > 'explorer.exe'(552) c:\windows\system32\eappprxy.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other active processes ------------------------ . c:\program files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Hotspot Shield\bin\hsswd.exe c:\program files\Java\jre7\bin\jqs.exe c:\windows\system32\wscntfy.exe c:\windows\Logi_MwX.Exe c:\program files\iPod\bin\iPodService.exe . ************************************************************************** . End time: 2013-04-21 19:38:19 - The machine has restarted ComboFix-quarantined-files.txt 2013-04-21 19:38 . Before-CF: 2 256 945 152 bytes free After-CF: 10 474 123 264 bytes free . - - End Of File - - 078E3AB8BCC26C922560C94BD527253E

juju666 · Answer

__________________________________________________ =>/!\The following script was written specifically for this computer/!\ <= =>it is highly discouraged to transfer it to another computer!<= ---------------------------------------------------------------------------- Still with all protections disabled, do this: ▶ Open Notepad (Start menu --> programs --> accessories --> Notepad) ▶ Copy/paste into Notepad what is between the lines below (without the lines): ---------------------------------------------------------- KillAll:: ClearJavaCache:: File:: c:\documents and settings\vgame\Start Menu\Programs\Startup\23556fb1360f366337f97c924e76ead3.exe c:\documents and settings\vgame\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe c:\documents and settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk c:\Documents and Settings\m\Local Settings\Temp\System.exe c:\Documents and Settings\m\Local Settings\Temp\Chrome.exe c:\Documents and Settings\m\Local Settings\Temp\facebook.exe Registry:: [HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\Documents and Settings\m\Local Settings\Temp\System.exe"=- "c:\Documents and Settings\m\Local Settings\Temp\Chrome.exe"=- "c:\Documents and Settings\m\Local Settings\Temp\facebook.exe"=- ------------------------------------------------------------------ ▶ Save this file to your Desktop (and not elsewhere!) under the name CFScript.txt ▶ Close Notepad ▶ Drag and drop this CFScript file onto the ComboFix file like this: Illustration ▶ Wait during the scan. The Desktop will disappear several times: this is normal! Do not touch anything until the scan is complete. ▶ Once the scan is finished, a report will appear: post its contents. ▶ If the file does not open, it is located here => C:\ComboFix.txt .::. Security Contributor .::.

eko · Answer

ComboFix 13-04-20.02 - vgame 22/04/2013 12:47:50.2.2 - x86 MINIMAL Microsoft Windows XP Professional 5.1.2600.3.1252.33.1036.18.1014.805 [GMT 0:00] Started from: c:\documents and settings\vgame\Desktop\ComboFix.exe Switches used :: c:\documents and settings\vgame\Desktop\CFScript.txt . WARNING - THE RECOVERY CONSOLE IS NOT INSTALLED ON THIS MACHINE!! . FILE :: "c:\documents and settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk" "c:\documents and settings\m\Local Settings\Temp\Chrome.exe" "c:\documents and settings\m\Local Settings\Temp\facebook.exe" "c:\documents and settings\m\Local Settings\Temp\System.exe" "c:\documents and settings\vgame\Start Menu\Programs\Startup\23556fb1360f366337f97c924e76ead3.exe" "c:\documents and settings\vgame\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe" . . (((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))) . . c:\documents and settings\vgame\Local Settings\Temp\Trojan.exe c:\documents and settings\vgame\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe . . ((((((((((((((((((((((((((((( Files Created from 2013-03-22 to 2013-04-22 )))))))))))))))))))))))))))))))))))) . . 2013-04-21 16:23 . 2013-04-21 16:23 -------- dc----w- c:\documents and settings\vgame\Local Settings\Application Data\PCHealth 2013-04-21 12:50 . 2013-04-21 12:50 -------- dc----w- c:\documents and settings\vgame\Application Data\DivX 2013-04-19 12:44 . 2013-04-19 12:46 -------- d-----w- c:\program files\PokerStars.FR 2013-04-19 11:31 . 2013-04-19 11:31 -------- dc----w- c:\documents and settings\vgame\Local Settings\Application Data\Samsung 2013-04-19 11:30 . 2013-04-19 11:32 -------- dc----w- c:\documents and settings\vgame\Application Data\Samsung 2013-04-11 22:19 . 2013-04-11 22:19 -------- d-----w- C:\found.002 2013-04-01 15:28 . 2013-04-01 15:28 -------- dc----w- c:\documents and settings\vgame\Local Settings\Application Data\cache 2013-03-30 19:50 . 2013-04-20 08:50 -------- dc----w- c:\documents and settings\vgame\Local Settings\Application Data\FullTiltPoker 2013-03-30 18:52 . 2013-04-21 23:51 -------- d-----w- c:\program files\Full Tilt Poker 2013-03-29 08:51 . 2013-03-29 08:51 -------- d-----w- C:\found.001 2013-03-27 21:09 . 2013-03-27 21:09 -------- dc----w- C:\Poker . . . (((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))) . 2013-03-19 23:23 . 2013-03-19 23:00 693976 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2013-03-19 23:23 . 2011-06-18 15:36 73432 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2013-03-19 22:54 . 2013-03-19 22:54 94112 ----a-w- c:\windows\system32\WindowsAccessBridge.dll 2013-03-19 22:54 . 2011-06-07 11:57 143872 ----a-w- c:\windows\system32\javacpl.cpl 2013-03-19 22:54 . 2013-02-10 20:08 861088 ----a-w- c:\windows\system32
pDeployJava1.dll 2013-03-19 22:54 . 2011-12-12 07:59 782240 ----a-w- c:\windows\system32\deployJava1.dll 2013-03-08 08:36 . 2008-04-13 17:33 293888 ----a-w- c:\windows\system32\winsrv.dll 2013-03-07 15:56 . 2008-04-13 19:07 2030592 ----a-w- c:\windows\system32
tkrnlpa.exe 2013-03-07 15:56 . 2008-04-13 17:07 2151936 ----a-w- c:\windows\system32
toskrnl.exe 2013-03-02 01:57 . 2008-04-13 16:58 1867392 ----a-w- c:\windows\system32\win32k.sys 2013-03-02 01:55 . 2008-04-13 17:33 916480 ----a-w- c:\windows\system32\wininet.dll 2013-03-02 01:55 . 2008-04-13 17:34 1469440 ------w- c:\windows\system32\inetcpl.cpl 2013-03-02 01:55 . 2008-04-13 17:33 43520 ------w- c:\windows\system32\licmgr10.dll 2013-03-02 01:08 . 2008-04-13 17:00 385024 ------w- c:\windows\system32\html.iec 2013-02-27 07:56 . 2011-06-06 08:07 2067456 ----a-w- c:\windows\system32\mstscax.dll 2013-02-12 00:32 . 2008-04-13 09:56 12928 ----a-w- c:\windows\system32\drivers\usb8023.sys 2013-01-26 03:55 . 2008-04-13 17:33 552448 ----a-w- c:\windows\system32\oleaut32.dll 2013-04-13 00:31 . 2013-04-13 00:31 263064 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((((((( Registry Load Points )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty & legitimate initial items are not listed REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-08-01 1036288] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-01-13 131072] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-01-13 163840] "Persistence"="c:\windows\system32\igfxpers.exe" [2007-01-13 135168] "Logitech Utility"="Logi_MwX.Exe" [2003-12-11 20992] "PlusService"="c:\program files\Yuna Software\Messenger Plus!\PlusService.exe" [2011-05-26 800768] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352] "DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376] "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-08-27 59280] "KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2012-12-20 310280] "iTunesHelper"="e:\itunes\iTunesHelper.exe" [2012-09-09 421776] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360] . c:\documents and settings\vgame\Start Menu\Programs\Startup\ 23556fb1360f366337f97c924e76ead3.exe [2013-4-21 44544] . c:\documents and settings\All Users\Start Menu\Programs\Startup\ McAfee Security Scan Plus.lnk - [N/A] . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\Network Diagnostic\xpnetdiag.exe"= "%windir%\system32\sessmgr.exe"= "c:\Program Files\Windows Live\Messenger\wlcsdk.exe"= "c:\Program Files\Windows Live\Messenger\msnmsgr.exe"= "c:\Program Files\Pando Networks\Media Booster\PMB.exe"= "c:\Program Files\Opera\opera.exe"= "c:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe"= "c:\Program Files\Bonjour\mDNSResponder.exe"= "e:\iTunes\iTunes.exe"= "c:\Program Files\XBMC\XBMC.exe"= "c:\Documents and Settings\m\Local Settings\Temp\System.exe"= "c:\Documents and Settings\m\Local Settings\Temp\Chrome.exe"= "c:\Documents and Settings\m\Local Settings\Temp\facebook.exe"= . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "56659:TCP"= 56659:TCP:Pando Media Booster "56659:UDP"= 56659:UDP:Pando Media Booster "58936:TCP"= 58936:TCP:Pando Media Booster "58936:UDP"= 58936:UDP:Pando Media Booster . R2 HssWd;Hotspot Shield Monitoring Service;c:\program files\Hotspot Shield\bin\hsswd.exe -product HSS --> c:\program files\Hotspot Shield\bin\hsswd.exe -product HSS [?] R3 huawei_enumerator;huawei_enumerator;c:\windows\system32\drivers\ew_jubusenum.sys [25/08/2011 00:15 70656] S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\drivers\ssudbus.sys [24/01/2013 11:32 83168] S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\drivers\ew_hwusbdev.sys [25/08/2011 00:15 101504] S3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\drivers\ewusbnet.sys [25/08/2011 00:15 117504] S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.0.318\McCHSvc.exe [05/02/2013 15:48 235216] S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\drivers\ssudmdm.sys [24/01/2013 11:32 181344] . [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2013-04-11 11:57 1642448 ----a-w- c:\program files\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe . Contents of the 'Scheduled Tasks' folder . 2013-04-22 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-03-19 23:23] . 2013-04-19 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 15:57] . 2013-04-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2013-02-09 16:45] . 2013-04-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2013-02-09 16:45] . . ------- Additional Examination ------- . IE: {{90EAE591-7E7E-434a-8E28-ECFD00071806} - c:\program files\PokerStars.FR\PokerStarsUpdate.exe FF - ProfilePath - c:\documents and settings\vgame\Application Data\Mozilla\Firefox\Profiles\mteietq8.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/ . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2013-04-22 12:58 Windows 5.1.2600 Service Pack 3 NTFS . Searching for hidden processes ... . Searching for hidden auto start items ... . Searching for hidden files ... . Scan completed successfully Hidden files: 0 . ************************************************************************** . --------------------- BLOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\WINDOWS\system32\Macromed\Flash\FlashUtil32_11_6_602_180_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\WINDOWS\system32\Macromed\Flash\FlashUtil32_11_6_602_180_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . --------------------- DLLs loaded in active processes --------------------- . - - - - - - - > 'explorer.exe'(2144) c:\windows\system32\eappprxy.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other active processes ------------------------ . c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Hotspot Shield\bin\hsswd.exe c:\program files\Java\jre7\bin\jqs.exe c:\windows\system32\wscntfy.exe c:\windows\Logi_MwX.Exe c:\program files\iPod\bin\iPodService.exe . ************************************************************************** . End time: 2013-04-22 13:01:06 - The machine has restarted ComboFix-quarantined-files.txt 2013-04-22 13:01 ComboFix2.txt 2013-04-21 19:38 . Before-CF: 10,346,029,056 bytes free After-CF: 10,368,466,944 bytes free . - - End Of File - - 75A2F4D47C62132544F884F521A0426E

juju666 · Answer

Re!  &#9654 Download and install Malwarebytes' Anti-Malware (MBAM).  &#9654 Run it. Accept the update.  &#9654 Select "Run a full scan" &#9654 Click on "Scan" &#9654 The scan starts, it's relatively long, that's normal.  At the end of the scan, a message appears:   Quote:   The scan has completed normally. Click on 'Show results' to view all found items.  &#9654 So click on Show results. &#9654 Select all (or leave checked) and click on Remove Selection, MBAM will delete the files and registry keys and put a copy in quarantine.  MBAM will open Notepad and copy the scan report there: close it.  If MBAM asks to restart the PC: &#9654 do it.  Upon restart, launch MBAM again, go to the "Report/Logs" tab, copy/paste the one corresponding to the scan performed.  --  .::. Security Contributor .::.

eko · Answer

Malwarebytes Anti-Malware (Trial) 1.75.0.1300 www.malwarebytes.org  Database version: v2013.04.21.05  Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 vgame :: USERE [administrator]  Protection: Enabled  22/04/2013 15:32:25 mbam-log-2013-04-22 (15-32-25).txt  Scan type: Full scan (C:\|E:\|) Scan options enabled: Memory | Startup | Registry | File system | Heuristic/Extra | Heuristic/Shuriken | PUP | PUM Scan options disabled: P2P Item(s) scanned: 382209 Time elapsed: 1 hour(s), 31 minute(s), 11 second(s)  Memory processes detected: 0 (No harmful items detected)  Memory modules detected: 0 (No harmful items detected)  Registry key(s) detected: 3 HKCR\Typelib\{B035BA6B-57CD-4F72-B545-65BE465FCAF6} (Adware.ShoppingReport2) -> Quarantined and successfully deleted. HKCR\Typelib\{D44FD6F0-9746-484E-B5C4-C66688393872} (Adware.ShoppingReport2) -> Quarantined and successfully deleted. HKCR\Interface\{0EB3F101-224A-4B2B-9E5B-DF720857529C} (Adware.ShoppingReport2) -> Quarantined and successfully deleted.  Registry value(s) detected: 0 (No harmful items detected)  Registry data item(s) detected: 0 (No harmful items detected)  Folder(s) detected: 6 C:\Documents and Settings\m\Application Data\ShoppingReport2 (Adware.ShoppingReport2) -> Quarantined and successfully deleted. C:\Documents and Settings\m\Application Data\ShoppingReport2\cs (Adware.ShoppingReport2) -> Quarantined and successfully deleted. C:\Documents and Settings\m\Application Data\ShoppingReport2\cs\db (Adware.ShoppingReport2) -> Quarantined and successfully deleted. C:\Documents and Settings\m\Application Data\ShoppingReport2\cs\dwld (Adware.ShoppingReport2) -> Quarantined and successfully deleted. C:\Documents and Settings\m\Application Data\ShoppingReport2\cseport (Adware.ShoppingReport2) -> Quarantined and successfully deleted. C:\Documents and Settings\m\Application Data\ShoppingReport2\cses1 (Adware.ShoppingReport2) -> Quarantined and successfully deleted.  File(s) detected: 128 C:\Documents and Settings\m\Local Settings\Temp\System.exe (Trojan.Ransom) -> Quarantined and successfully deleted. C:\Documents and Settings\m\Local Settings\Temp\facebook.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\Documents and Settings\m\Menu Démarrer\Programmes\Démarrage\301b5fcf8ce2fab8868e80b6c1f912fe.exe (Trojan.Ransom) -> Quarantined and successfully deleted. C:\Qoobox\Quarantine\C\Documents and Settings\vgame	askmgr.exe.vir (Trojan.MSIL) -> Quarantined and successfully deleted. C:\Qoobox\Quarantine\C\Documents and Settings\vgame\Application Data\Facebook.exe.vir (Trojan.MSIL) -> Quarantined and successfully deleted. C:\Qoobox\Quarantine\C\Documents and Settings\vgame\Application Data\svchost.exe.vir (Trojan.MSIL) -> Quarantined and successfully deleted. C:\Qoobox\Quarantine\C\Documents and Settings\vgame\Application Data\svchot.exe.vir (Trojan.MSIL) -> Quarantined and successfully deleted. C:\Qoobox\Quarantine\C\Documents and Settings\vgame\Application Data\Trojan.exe.vir (Backdoor.Agent.TRJ) -> Quarantined and successfully deleted. C:\Qoobox\Quarantine\C\Documents and Settings\vgame\Menu Démarrer\Programmes\Démarrage\11b66f66324ac0e6e6a3c81ee698d1b6.exe.vir (Trojan.MSIL) -> Quarantined and successfully deleted. C:\Qoobox\Quarantine\C\Documents and Settings\vgame\Menu Démarrer\Programmes\Démarrage\13e5090cee57967233f9b6a72ec1c5dd.exe.vir (Backdoor.Agent.NIPGen) -> Quarantined and successfully deleted. C:\Qoobox\Quarantine\C\Documents and Settings\vgame\Menu Démarrer\Programmes\Démarrage\1899a32ba3565d2a36a228013f5e9799.exe.vir (Trojan.MSIL) -> Quarantined and successfully deleted. C:\Qoobox\Quarantine\C\Documents and Settings\vgame\Menu Démarrer\Programmes\Démarrage\301b5fcf8ce2fab8868e80b6c1f912fe.exe.vir (Trojan.Ransom) -> Quarantined and successfully deleted. C:\Qoobox\Quarantine\C\Documents and Settings\vgame\Menu Démarrer\Programmes\Démarrage\488fe9187d45de3434711bfe795a2b63.exe.vir (Trojan.MSIL) -> Quarantined and successfully deleted. C:\Qoobox\Quarantine\C\Documents and Settings\vgame\Menu Démarrer\Programmes\Démarrage\5cd8f17f4086744065eb0992a09e05a2.exe.vir (Backdoor.Agent.TRJ) -> Quarantined and successfully deleted. C:\Qoobox\Quarantine\C\Documents and Settings\vgame\Menu Démarrer\Programmes\Démarrage\8515eb34d8f9de5af815466e9715b3e5.exe.vir (Backdoor.Agent.TRJ) -> Quarantined and successfully deleted. C:\Qoobox\Quarantine\C\Documents and Settings\vgame\Menu Démarrer\Programmes\Démarrage\8d0fa66a7f70d4b92f3da7199f7f9e8d.exe.vir (Trojan.MSIL) -> Quarantined and successfully deleted. C:\Qoobox\Quarantine\C\Documents and Settings\vgame\Menu Démarrer\Programmes\Démarrage\8e56537133e75df5421f3565a026e09d.exe.vir (Trojan.MSIL) -> Quarantined and successfully deleted. C:\Qoobox\Quarantine\C\Documents and Settings\vgame\Menu Démarrer\Programmes\Démarrage\94e540adc4cf174ca7240135617a6982.exe.vir (Trojan.MSIL) -> Quarantined and successfully deleted. C:\Qoobox\Quarantine\C\Documents and Settings\vgame\Menu Démarrer\Programmes\Démarrage\b57cb8e241634542876c995d99b59a18.exe.vir (Trojan.MSIL) -> Quarantined and successfully deleted. C:\Qoobox\Quarantine\C\Documents and Settings\vgame\Menu Démarrer\Programmes\Démarrage\ba4c12bee3027d94da5c81db2d196bfd.exe.vir (Trojan.MSIL) -> Quarantined and successfully deleted. C:\Qoobox\Quarantine\C\Documents and Settings\vgame\Menu Démarrer\Programmes\Démarrage\c25bb4b46988f213a04e5145e3c057f0.exe.vir (Trojan.MSIL) -> Quarantined and successfully deleted. C:\Qoobox\Quarantine\C\Documents and Settings\vgame\Menu Démarrer\Programmes\Démarrage\f5ac7c069b9e6b412c43f7ea38d34f76.exe.vir (Trojan.MSIL) -> Quarantined and successfully deleted. C:\Qoobox\Quarantine\C\Documents and Settings\vgame\Menu Démarrer\Programmes\Démarrage\f851f7347b44de50d7b2e29211ae1802.exe.vir (Trojan.MSIL) -> Quarantined and successfully deleted. C:\Qoobox\Quarantine\C\WINDOWS\system32\install\system.exe.vir (Trojan.Dropper) -> Quarantined and successfully deleted. C:\Qoobox\Quarantine\C\WINDOWS\system32\Windows\csrss.exe.vir (Trojan.Agent.DF) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0198525.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0198526.exe (Backdoor.Agent.TRJ) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0198528.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0198529.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0198530.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0198532.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0198533.exe (Trojan.Ransom) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0198535.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0198536.exe (Backdoor.Agent.NIPGen) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0198537.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0198538.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0198539.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0198540.exe (Backdoor.Agent.TRJ) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0198541.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0199529.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0199530.exe (Trojan.Ransom) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0199531.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0199532.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0199535.exe (Backdoor.Agent.NIPGen) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0199536.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0199537.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0199538.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0199539.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0199540.exe (Backdoor.Agent.TRJ) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0199541.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0199542.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0199544.exe (Backdoor.Agent.TRJ) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0200529.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0200531.exe (Backdoor.Agent.TRJ) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0200532.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0200535.exe (Backdoor.Agent.NIPGen) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0200539.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0200540.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0200541.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0200542.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0200543.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0201530.exe (Trojan.Ransom) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0201533.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0201535.exe (Backdoor.Agent.TRJ) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0201536.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0201538.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0201539.exe (Backdoor.Agent.TRJ) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0201540.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0201541.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0201543.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0201544.exe (Backdoor.Agent.NIPGen) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0199543.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0202536.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0202528.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0202531.exe (Trojan.Ransom) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0202532.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0202533.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0202535.exe (Backdoor.Agent.TRJ) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0202537.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0202538.exe (Backdoor.Agent.NIPGen) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0202539.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0202540.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0202541.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0202542.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0202543.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0202544.exe (Backdoor.Agent.TRJ) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0202545.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0202547.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0203632.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0203635.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0203636.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0203637.exe (Backdoor.Agent.TRJ) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0203639.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0203640.exe (Backdoor.Agent.NIPGen) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0203641.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0203642.exe (Trojan.Ransom) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0203644.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0203646.exe (Backdoor.Agent.TRJ) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0203647.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0203648.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0203649.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0203650.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0203652.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0203654.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0203655.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0203657.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0203659.exe (Trojan.Dropper) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0203660.exe (Trojan.Agent.DF) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0204669.exe (Backdoor.Agent.TRJ) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0205669.exe (Backdoor.Agent.TRJ) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0206669.exe (Backdoor.Agent.TRJ) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0207774.exe (Backdoor.Agent.TRJ) -> Quarantined and successfully deleted. C:\System Volume Information\_restore{F43805F6-FADF-4E9B-8AD1-CDF40A6FBBFE}\RP436\A0203651.exe (Trojan.MSIL) -> Quarantined and successfully deleted. C:\Documents and Settings\m\Local Settings\Temp\System.exe.tmp (Stolen.Data) -> Quarantined and successfully deleted. C:\Documents and Settings\m\Local Settings\Temp\Chrome.exe (Trojan.PWS) -> Quarantined and successfully deleted. C:\Documents and Settings\m\Application Data\logs.dat (Bifrose.Trace) -> Quarantined and successfully deleted. C:\Documents and Settings\vgame\Application Data\logs.dat (Bifrose.Trace) -> Quarantined and successfully deleted. C:\Documents and Settings\m\Local Settings\Temp\IELOGIN.abc (Malware.Trace) -> Quarantined and successfully deleted. C:\Documents and Settings\m\Local Settings\Temp\UuU.uUu (Malware.Trace) -> Quarantined and successfully deleted. C:\Documents and Settings\m\Local Settings\Temp\XxX.xXx (Malware.Trace) -> Quarantined and successfully deleted. C:\Documents and Settings\m\Local

juju666 · Answer

Change all your passwords, they have been stolen.  &#9654 Download from this page: AdwCleaner (by Xplode)   &#9654 Run it  click on Removal and wait for the cleaning process to finish.  &#9654 Post the content of the report you will find on your hard drive c:\ADwcleaner[Sx].txt or its content if it opens.  --  .::. Security Contributor .::.

eko · Answer

Je ne peux pas poster le rapport. Titre du message non renseigné.

juju666 · Answer

register yourself or send it to https://www.cjoint.com/  --  .::. Security Contributor .::.

ekologic · Answer

# AdwCleaner v2.200 - Report created on 04/22/2013 at 17:33:28 # Updated on 04/02/2013 by Xplode # Operating System: Microsoft Windows XP Service Pack 3 (32 bits) # Username: vgame - USERE # Startup Mode: Normal # Executed from: C:\Documents and Settings\vgame\My Documents\Downloads\adwcleaner.exe # Option [Removal] ***** [Services] ***** ***** [Files / Folders] ***** Folder Deleted: C:\DOCUME~1\m\LOCALS~1\Temp\boost_interprocess Folder Deleted: C:\Documents and Settings\All Users\Application Data\Babylon Folder Deleted: C:\Documents and Settings\All Users\Application Data\InstallMate Folder Deleted: C:\Documents and Settings\All Users\Application Data\Premium Folder Deleted: C:\Documents and Settings\eko\Application Data\Mozilla\Firefox\Profiles\mteietq8.default\extensions\staged Folder Deleted: C:\Documents and Settings\eko\Local Settings\Application Data\Conduit Folder Deleted: C:\Documents and Settings\eko\Local Settings\Application Data\ConduitEngine Folder Deleted: C:\Documents and Settings\eko\Local Settings\Application Data\DVDVideoSoftTB Folder Deleted: C:\Documents and Settings\m\Application Data\Babylon Folder Deleted: C:\Documents and Settings\m\Application Data\dvdvideosoftiehelpers Folder Deleted: C:\Documents and Settings\m\Application Data\freeTVRadio Folder Deleted: C:\Documents and Settings\m\Application Data\kujytuo Folder Deleted: C:\Documents and Settings\m\Application Data\Mozilla\Firefox\Profiles\mteietq8.default\ConduitCommon Folder Deleted: C:\Documents and Settings\m\Application Data\Mozilla\Firefox\Profiles\mteietq8.default\CT2269050 Folder Deleted: C:\Documents and Settings\m\Application Data\Mozilla\Firefox\Profiles\mteietq8.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} Folder Deleted: C:\Documents and Settings\m\Application Data\Mozilla\Firefox\Profiles\mteietq8.default\extensions\{c95a4e8e-816d-4655-8c79-d736da1adb6d} Folder Deleted: C:\Documents and Settings\m\Application Data\Mozilla\Firefox\Profiles\mteietq8.default\extensions\ffxtlbr@babylon.com Folder Deleted: C:\Documents and Settings\m\Application Data\Mozilla\Firefox\Profiles\mteietq8.default\jetpack Folder Deleted: C:\Documents and Settings\m\Application Data\PriceGong Folder Deleted: C:\Documents and Settings\m\Local Settings\Application Data\Babylon Folder Deleted: C:\Documents and Settings\m\Local Settings\Application Data\Conduit Folder Deleted: C:\Documents and Settings\m\Local Settings\Application Data\DVDVideoSoftTB Folder Deleted: C:\Documents and Settings\m\Local Settings\Application Data\freetvradio Air Folder Deleted: C:\Documents and Settings\NetworkService\Local Settings\Application Data\DVDVideoSoftTB Folder Deleted: C:\Documents and Settings\NetworkService\Local Settings\Application Data\Hotspot_Shield Folder Deleted: C:\Program Files\1ClickDownload Folder Deleted: C:\Program Files\Conduit Folder Deleted: C:\Program Files\freeTVRadio Folder Deleted: C:\Program Files\Mozilla Firefox\Extensions\afurladvisor@anchorfree.com Folder Deleted: C:\WINDOWS\Installer\{38470B46-9BF1-40AE-A588-F6AD6D1C2D42} File Deleted: C:\Documents and Settings\m\Application Data\Mozilla\Firefox\Profiles\mteietq8.default\searchplugins\Conduit.xml File Deleted: C:\user.js ***** [Registry] ***** Key Deleted: HKCU\Software\Softonic Key Deleted: HKLM\Software\Babylon Key Deleted: HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947} Key Deleted: HKLM\SOFTWARE\Classes\AppID\{5B1881D1-D9C7-46DF-B041-1E593282C7D0} Key Deleted: HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826} Key Deleted: HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB} Key Deleted: HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C} Key Deleted: HKLM\SOFTWARE\Classes\AppID\escort.DLL Key Deleted: HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr Key Deleted: HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr.1 Key Deleted: HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B} Key Deleted: HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1} Key Deleted: HKLM\SOFTWARE\Classes\CLSID\{746B5408-3579-4CED-B76A-BEC915730F45} Key Deleted: HKLM\SOFTWARE\Classes\CLSID\{750C0E55-CE2F-4E58-8065-DC8417D8A4C9} Key Deleted: HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1} Key Deleted: HKLM\SOFTWARE\Classes\Conduit.Engine Key Deleted: HKLM\SOFTWARE\Classes\Interface\{030C9927-10FC-4169-97A2-55BECD5D88D8} Key Deleted: HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE} Key Deleted: HKLM\SOFTWARE\Classes\Interface\{746B5408-3579-4CED-B76A-BEC915730F45} Key Deleted: HKLM\SOFTWARE\Classes\Interface\{A1F1ECD3-4806-44C6-A869-F0DADF11C57C} Key Deleted: HKLM\SOFTWARE\Classes\Interface\{A9379648-F6EB-4F65-A624-1C10411A15D0} Key Deleted: HKLM\SOFTWARE\Classes\Interface\{F16AB1DB-15C0-4456-A29E-4DF24FB9E3D2} Key Deleted: HKLM\SOFTWARE\Classes\Prod.cap Key Deleted: HKLM\SOFTWARE\Classes\Toolbar.CT1561552 Key Deleted: HKLM\SOFTWARE\Classes\Toolbar.CT2269050 Key Deleted: HKLM\SOFTWARE\Classes\TypeLib\{303D092C-7A38-4F1A-BB61-4C5A90BDA313} Key Deleted: HKLM\Software\Conduit Key Deleted: HKLM\Software\DVDVideoSoftTB Key Deleted: HKLM\SOFTWARE\Google\Chrome\Extensions\pmlghpafmmnmmkjdhacccolfgnkiboco Key Deleted: HKLM\Software\Iminent Key Deleted: HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F9BEF328-5708-47F9-B791-2BFF4DDC22EC} Key Deleted: HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FA1C3C3D-B498-447A-8C4B-8A9F0AD08C3A} Key Deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ShoppingReport2 Key Deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{750C0E55-CE2F-4E58-8065-DC8417D8A4C9} Key Deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966 Key Deleted: HKLM\Software\SimplyGen ***** [Browsers] ***** -\ Internet Explorer v8.0.6001.18702 Replaced: [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://search.babylon.com/?AF=108988&babsrc=NT_ss&mntrId=84643feb000000000000001e101f5bfc --> hxxp://www.google.com -\ Mozilla Firefox v20.0.1 (fr) File: C:\Documents and Settings\m\Application Data\Mozilla\Firefox\Profiles\0\prefs.js [OK] The file contains no illegitimate entries. File: C:\Documents and Settings\m\Application Data\Mozilla\Firefox\Profiles\mteietq8.default\prefs.js C:\Documents and Settings\m\Application Data\Mozilla\Firefox\Profiles\mteietq8.default\user.js ... Deleted! Deleted: user_pref("CT2269050..clientLogIsEnabled", false); Deleted: user_pref("CT2269050..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...] Deleted: user_pref("CT2269050..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...] Deleted: user_pref("CT2269050.ALLOW_SHOWING_HIDDEN_TOOLBAR", false); Deleted: user_pref("CT2269050.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx"); Deleted: user_pref("CT2269050.AppTrackingLastCheckTime", "Mon Apr 23 2012 04:42:55 GMT+0200"); Deleted: user_pref("CT2269050.BrowserCompStateIsOpen_129575150554007677", true); Deleted: user_pref("CT2269050.BrowserCompStateIsOpen_129681780741097243", true); Deleted: user_pref("CT2269050.BrowserCompStateIsOpen_129705015340022508", true); Deleted: user_pref("CT2269050.CTID", "CT2269050"); Deleted: user_pref("CT2269050.CurrentServerDate", "3-5-2012"); Deleted: user_pref("CT2269050.DSChangedManually", false); Deleted: user_pref("CT2269050.DSProtectChoice", true); Deleted: user_pref("CT2269050.DSProtectCount", 3); Deleted: user_pref("CT2269050.DialogsAlignMode", "LTR"); Deleted: user_pref("CT2269050.DialogsGetterLastCheckTime", "Wed May 02 2012 05:41:30 GMT+0200"); Deleted: user_pref("CT2269050.DownloadReferralCookieData", ""); Deleted: user_pref("CT2269050.EMailNotifierPollDate", "Thu May 03 2012 01:40:56 GMT+0200"); Deleted: user_pref("CT2269050.FirstServerDate", "11-9-2011"); Deleted: user_pref("CT2269050.FirstTime", true); Deleted: user_pref("CT2269050.FirstTimeFF3", true); Deleted: user_pref("CT2269050.FixPageNotFoundErrors", true); Deleted: user_pref("CT2269050.GroupingServerCheckInterval", 1440); Deleted: user_pref("CT2269050.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/"); Deleted: user_pref("CT2269050.HPChangedManually", false); Deleted: user_pref("CT2269050.HPProtectChoice", true); Deleted: user_pref("CT2269050.HPProtectCount", 4); Deleted: user_pref("CT2269050.HasUserGlobalKeys", true); Deleted: user_pref("CT2269050.HomePageProtectorEnabled", false); Deleted: user_pref("CT2269050.HomepageBeforeUnload", "hxxp://search.babylon.com/?babsrc=HP_Prot"); Deleted: user_pref("CT2269050.Initialize", true); Deleted: user_pref("CT2269050.InitializeCommonPrefs", true); Deleted: user_pref("CT2269050.InstallationAndCookieDataSentCount", 3); Deleted: user_pref("CT2269050.InstallationType", "UnknownIntegration"); Deleted: user_pref("CT2269050.InstalledDate", "Sun Sep 11 2011 01:44:58 GMT+0200"); Deleted: user_pref("CT2269050.InvalidateCache", false); Deleted: user_pref("CT2269050.IsAlertDBUpdated", true); Deleted: user_pref("CT2269050.IsGrouping", false); Deleted: user_pref("CT2269050.IsInitSetupIni", true); Deleted: user_pref("CT2269050.IsMulticommunity", false); Deleted: user_pref("CT2269050.IsOpenThankYouPage", false); Deleted: user_pref("CT2269050.IsOpenUninstallPage", false); Deleted: user_pref("CT2269050.IsProtectorsInit", true); Deleted: user_pref("CT2269050.LanguagePackLastCheckTime", "Wed May 02 2012 06:15:36 GMT+0200"); Deleted: user_pref("CT2269050.LanguagePackReloadIntervalMM", 1440); Deleted: user_pref("CT2269050.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...] Deleted: user_pref("CT2269050.LastLogin_3.10.0.1", "Thu Apr 19 2012 05:07:12 GMT+0200"); Deleted: user_pref("CT2269050.LastLogin_3.12.0.7", "Sun Apr 29 2012 17:53:50 GMT+0200"); Deleted: user_pref("CT2269050.LastLogin_3.12.2.3", "Wed May 02 2012 23:23:28 GMT+0200"); Deleted: user_pref("CT2269050.LastLogin_3.6.0.10", "Sat Sep 24 2011 06:06:12 GMT+0200"); Deleted: user_pref("CT2269050.LastLogin_3.7.0.6", "Mon Nov 07 2011 03:58:07 GMT+0100"); Deleted: user_pref("CT2269050.LastLogin_3.8.0.8", "Sat Dec 03 2011 22:25:09 GMT+0100"); Deleted: user_pref("CT2269050.LastLogin_3.8.1.0", "Sun Jan 08 2012 20:17:00 GMT+0100"); Deleted: user_pref("CT2269050.LastLogin_3.9.0.3", "Thu Feb 16 2012 01:47:16 GMT+0100"); Deleted: user_pref("CT2269050.LatestVersion", "3.12.2.3"); Deleted: user_pref("CT2269050.Locale", "en"); Deleted: user_pref("CT2269050.MCDetectTooltipHeight", "83"); Deleted: user_pref("CT2269050.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1"); Deleted: user_pref("CT2269050.MCDetectTooltipWidth", "295"); Deleted: user_pref("CT2269050.MyStuffEnabledAtInstallation", true); Deleted: user_pref("CT2269050.OriginalFirstVersion", "3.6.0.10"); Deleted: user_pref("CT2269050.RadioIsPodcast", false); Deleted: user_pref("CT2269050.RadioLastCheckTime", "Wed May 02 2012 06:15:32 GMT+0200"); Deleted: user_pref("CT2269050.RadioLastUpdateIPServer", "3"); Deleted: user_pref("CT2269050.RadioLastUpdateServer", "129132338014870000"); Deleted: user_pref("CT2269050.RadioMediaID", "12473383"); Deleted: user_pref("CT2269050.RadioMediaType", "Media Player"); Deleted: user_pref("CT2269050.RadioMenuSelectedID", "EBRadioMenu_CT226905012473383"); Deleted: user_pref("CT2269050.RadioShrinkedFromSetup", false); Deleted: user_pref("CT2269050.RadioStationName", "Hotmix%20108"); Deleted: user_pref("CT2269050.RadioStationURL", "hxxp://67.202.67.18:8082"); Deleted: user_pref("CT2269050.SavedHomepage", "hxxp://www.google.fr/"); Deleted: user_pref("CT2269050.SearchEngineBeforeUnload", "Search the web (Babylon)"); Deleted: user_pref("CT2269050.SearchFromAddressBarIsInit", true); Deleted: user_pref("CT2269050.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT226[...] Deleted: user_pref("CT2269050.SearchInNewTabEnabled", true); Deleted: user_pref("CT2269050.SearchInNewTabIntervalMM", 1440); Deleted: user_pref("CT2269050.SearchInNewTabLastCheckTime", "Wed May 02 2012 06:15:32 GMT+0200"); Deleted: user_pref("CT2269050.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...] Deleted: user_pref("CT2269050.SearchInNewTabUsageUrl", "hxxp://usage.hosting.toolbar.conduit-services.com/usa[...] Deleted: user_pref("CT2269050.SearchProtectorEnabled", true); Deleted: user_pref("CT2269050.SearchProtectorToolbarDisabled", false); Deleted: user_pref("CT2269050.ServiceMapLastCheckTime", "Wed May 02 2012 06:15:32 GMT+0200"); Deleted: user_pref("CT2269050.SettingsLastCheckTime", "Wed May 02 2012 23:57:26 GMT+0200"); Deleted: user_pref("CT2269050.SettingsLastUpdate", "1333626561"); Deleted: user_pref("CT2269050.ThirdPartyComponentsInterval", 504); Deleted: user_pref("CT2269050.ThirdPartyComponentsLastCheck", "Fri Apr 13 2012 06:09:31 GMT+0200"); Deleted: user_pref("CT2269050.ThirdPartyComponentsLastUpdate", "1312887586"); Deleted: user_pref("CT2269050.ToolbarShrinkedFromSetup", false); Deleted: user_pref("CT2269050.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2269050"); Deleted: user_pref("CT2269050.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...] Deleted: user_pref("CT2269050.UserID", "UN54845534194219058"); Deleted: user_pref("CT2269050.ValidationData_Toolbar", 2); Deleted: user_pref("CT2269050.WeatherNetwork", ""); Deleted: user_pref("CT2269050.WeatherPollDate", "Thu May 03 2012 01:42:01 GMT+0200"); Deleted: user_pref("CT2269050.WeatherUnit", "C"); Deleted: user_pref("CT2269050.alertChannelId", "666138"); Deleted: user_pref("CT2269050.backendstorage./9b+7e+x305", "2423"); Deleted: user_pref("CT2269050.backendstorage./9b+7e,x305", "2423"); Deleted: user_pref("CT2269050.backendstorage./9b+7e-x305", "2423"); Deleted: user_pref("CT2269050.backendstorage./9b+7e.x305", "2423"); Deleted: user_pref("CT2269050.backendstorage./9b+7e/x305", "2423"); Deleted: user_pref("CT2269050.backendstorage./9b+7e06cg5el8:", "6E6D706D6C7474737573"); Deleted: user_pref("CT2269050.backendstorage./9b+7e06cg5el;8i:k", "247E2D2F226A74737673727A7A797B79242F4B4947[...] Deleted: user_pref("CT2269050.backendstorage./9b+7e0x305", "2423"); Deleted: user_pref("CT2269050.backendstorage./9b+7e1x305", "2423"); Deleted: user_pref("CT2269050.backendstorage./9b+7e2x305", "2423"); Deleted: user_pref("CT2269050.backendstorage./9b+7e3x305", "2423"); Deleted: user_pref("CT2269050.backendstorage./9b+7e4x305", "2423"); Deleted: user_pref("CT2269050.backendstorage./9b+7e5x305", "2423"); Deleted: user_pref("CT2269050.backendstorage./9b+7e6x305", "2423"); Deleted: user_pref("CT2269050.backendstorage./9b+7e7x305", "2423"); Deleted: user_pref("CT2269050.backendstorage./9b+7e8x305", "2423"); Deleted: user_pref("CT2269050.backendstorage./9b+7e9x305", "2423"); Deleted: user_pref("CT2269050.backendstorage./9b+7e:x305", "2423"); Deleted: user_pref("CT2269050.backendstorage./9b+7e;x305", "2423"); Deleted: user_pref("CT2269050.backendstorage./9b+7ex305", "2423"); Deleted: user_pref("CT2269050.backendstorage./9b+7e?x305", "2423"); Deleted: user_pref("CT2269050.backendstorage./9b+7e@x305", "2423"); Deleted: user_pref("CT2269050.backendstorage./9b+7eax305", "2423"); Deleted: user_pref("CT2269050.backendstorage./9b+7ebe3g=;d9n9=d", "372C2D326975762E3A3C7B3A39434A494841434B26[...] Deleted: user_pref("CT2269050.backendstorage./9b+7ebx305", "2423"); Deleted: user_pref("CT2269050.backendstorage./9b+7ecx305", "2423"); Deleted: user_pref("CT2269050.backendstorage./9b+7edx305", "2423"); Deleted: user_pref("CT2269050.backendstorage./9b+7etx305", "2423"); Deleted: user_pref("CT2269050.backendstorage./9b-0?3g>d", "69676A6A6B4342737A6F72467A207B7A797E25222421212A21[...] Deleted: user_pref("CT2269050.backendstorage./9b-0?3g@6:5;", ""); Deleted: user_pref("CT2269050.backendstorage./9b-3=3eccja=f>", "247E333D2C452F4135276F292A212C393D44307832332[...] Deleted: user_pref("CT2269050.backendstorage./9b/>01=9a6k6@44i48?", "372C2D326975763342363341484776213F3E484F4E4D464[...] Deleted: user_pref("CT2269050.backendstorage./9b5ba==9cjag", "393E40696F7241727A4643744573757B764E797D7C"); Deleted: user_pref("CT2269050.backendstorage./9b6b11g4c56b>f;p;anr@p", "6E6D6F6F6D6F706F6E77777176"); Deleted: user_pref("CT2269050.backendstorage./9b9643g3/9e", "6A"); Deleted: user_pref("CT2269050.backendstorage./9b<:222h64<", "393F352F3E"); Deleted: user_pref("CT2269050.backendstorage./9b=+03eh8h8j?:", "4443"); Deleted: user_pref("CT2269050.backendstorage./9b?+e2a52d8", "372C2D326975762E3A3C7B3A39434A494841434B26514649[...] Deleted: user_pref("CT2269050.backendstorage./9b?b0d:8aj62

juju666 · Answer

Still having issues?  --  .::. Security Contributor .::.

ekologic · Answer

Say, am I clean?   I need a good antivirus.

juju666 · Answer

If you have Spybot, uninstall it, it's outdated and ineffective. If you have McAfee Security Scan, the same goes for it, uninstall it, it's useless. And it's the same for AD-Aware, outdated and ineffective, so uninstall it.  ~~  Run Delfix by checking all boxes: https://www.commentcamarche.net/telecharger/securite/7111-delfix/  ~~  Install Malwarebyte's Anti-Malware: https://www.malekal.com/tutoriel-malwarebyte-anti-malware/ Run regular scans with it, it's effective.  ~~  Secure your PC!  Install Avast: http://www.commentcamarche.net/download/telecharger-151-avast  IMPORTANT: update your programs, especially Java/Adobe Reader and Flash: https://www.commentcamarche.net/faq/13362-mettre-a-jour-son-pc-contre-les-failles-de-securite  Disable Java in your web browsers: https://www.commentcamarche.net/faq/35621-desactiver-java-sur-ses-navigateurs-web   Spread the word to your friends!  ~~  The rest of security: http://forum.malekal.com/comment-securiser-son-ordinateur.html  Happy reading and don't forget to indicate that your topic is resolved :)  --  .::. Security Contributor .::.

ekologic · Answer

I can't indicate that it's resolved.

juju666 · Answer

Here it is done.  --  .::. Security Contributor .::.

I think I fell into the arms of a hacker.

27 answers

How to change my username

Texture issues in enshrouded

Gotek information

Self-invoking js function

My pc won’t charge anymore and runs super slowly

Download software against mcafee pop-ups

My computer stays connected for very little time

Unable to open xsl and xslx files

Archival hard drive no longer appears in file explorer

Samsung wallet