Infection trojandownloader.xs +log HijackThis

Résolu
freedo Messages postés 160 Statut Membre -  
jfkpresident Messages postés 13877 Statut Contributeur sécurité -
Bonsoir à tous,

Je vois ci dessous dans liste des post les mêmes symptômes que sur mon PC,
apparament c'est "trojandownloader.xs" d'après les messages incessant.

Je suis sous Vista c'est la 1ère attaque depuis 6 mois.
J'ai passé un coup de CCleaner, spybot, Avast....toujours actif la bête...
Merci de m'aider, je post ci-dessous mon log HijackThis :

Merci pour l'analyse et conseils.
freedo

Logfile of HijackThis v1.99.1
Scan saved at 22:09:17, on 25/03/2008
Platform: Unknown Windows (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\sbwltbxa.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\CyberLink\Shared files\brs.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Users\freud\AppData\Local\Temp\IMAdvertiser.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Internet Explorer\IEUser.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\HijackThis\HIJACKTHIS VF\hijackthis vf.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.free.fr/freebox/index.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe,C:\Windows\system32\sbwltbxa.exe,
O1 - Hosts: ::1 localhost
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: BatBHO - {63F7460B-C831-4142-A4AA-5EC303EC4343} - C:\Program Files\Bat\Bat.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [BDRegion] C:\Program Files\Cyberlink\Shared Files\brs.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\opnopqn.dll,#1
O4 - HKLM\..\Run: [IMprocess] C:\Users\freud\AppData\Local\Temp\IMAdvertiser.EXE
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\freud\AppData\Local\Temp\ddaab.dll,#1
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\freud\AppData\Local\Temp\tusqo.dll,c
O4 - Startup: Bat - Auto Update.lnk = C:\Program Files\Bat\Bat.exe
O4 - Startup: Paramètres de la souris et du clavier.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Ajouter au fichier PDF existant - res://C:\Program Files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix:
O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.fr/s/v/25.24/uploader2.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Acronis OS Selector Reinstall Service (AcronisOSSReinstallSvc) - Unknown owner - C:\Program Files\Common Files\Acronis\Partition Suite\oss_reinstall_svc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\Windows\system32\drivers\CDAC11BA.EXE
O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\Windows\system32\oodag.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: UPnPService - Magix AG - C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)
Configuration: Windows Vista
Firefox 2.0.0.12

26 réponses

  • 1
  • 2
Résumé de la discussion

Des symptômes similaires à trojandownloader.xs apparaissent sur un PC sous Vista, malgré des nettoyages répétés avec CCleaner, Spybot et Avast, et un log HijackThis signe des éléments suspects actifs. Plusieurs conseils préconisent d'utiliser le mode sans échec pour faciliter la suppression et de désactiver temporairement l'UAC afin d'éliminer des fichiers ou entrées mémoire bloqués par les processus. En cas de persistance, il est recommandé de terminer la désinfection complète avant de relancer les outils, car certaines menaces restent en mémoire et échouent à être supprimées si elles demeurent actives. D'autres éléments d'analyse montrent de multiples entrées suspectes dans les paramètres système et les modules chargés, indiquant qu'un nettoyage plus complet et une évaluation des services démarrés pourraient être nécessaires.

Bobot (l'IA à votre service)
  1. freedo Messages postés 160 Statut Membre 3
     
    Je me réponds à moi même,

    J'ai repéré :
    O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\freud\AppData\Local\Temp\ddaab.dll,#1
    O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\freud\AppData\Local\Temp\tusqo.dll,c
    Impossible de fixer avec Vista...

    Toujours personne pour m'aider ???
    0
    1. freedo Messages postés 160 Statut Membre 3
       
      Je me réponds à moi même,

      Bon , bon ,
      en exécutant HijackThis en mode administrateur, on peut fixer..... après faut savoir quoi fixer?!!

      J'ai repéré aussi :
      04-MS server.....
      0
  2. green day Messages postés 26374 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   2 166
     
    Salut

    Télécharger ComboFix (par sUBs) sur le Bureau : http://download.bleepingcomputer.com/sUBs/ComboFix.exe

    * Démarrer en mode sans echec
    * Double cliquer combofix.exe.
    * Appuyer sur la touche Y (Yes) pour démarrer le scan
    * Le rapport sera crée dans: C:\Combofix.txt, poste le stp

    ++
    0
  3. jfkpresident Messages postés 13877 Statut Contributeur sécurité 1 175
     
    Vista !! pour suivre.....

    PS:coucou vous deux .
    0
  4. green day Messages postés 26374 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   2 166
     
    Salut ;-)

    ++
    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  7. green day Messages postés 26374 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   2 166
     
    :-))
    0
  8. Utilisateur anonyme
     
    Bonsoir vous trois !
    :)
    Vous allez bien ? (pas besoin de répondre).
    Pour suivre aussi. ;)
    Juste deux questions pour Green Day : pourquoi en MSE et pourquoi pas de désactivation de l'UAC ? (tu peux me répondre ici, en MP ou pas du tout (lol)).
    A+
    ;)
    0
  9. green day Messages postés 26374 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   2 166
     
    Salut !

    j'oublie presque toujours de désactivé l'UAC ! :p

    merci, je vais éditer

    et pourquoi le mode sans échec : pour que le scan soit plus efficace, et que la suppression se fasse, souvent que tu veux supprimer un fichier mais qu'il est en mémoire, tu as le message d'erreur " cette ressource est utilisé par ..." et tu ne peux pas le supprimler, d'où l'avantage du mode sans échec qui ne charge que les processus et service minimum !

    @+
    0
    1. Utilisateur anonyme
       
      Ok,
      :)
      Juste un come back pour greenette. Dakor pour le MSE sous combo. Je le savais pour d'autres AVG, Ccleaner, MalwareByte's et gna gna gna... mais pour combo je ne le pensais pas nécessaire (comme pour Navilog, par exemple). Mais c'est tout à fait logique en fait. Merci pour l'info et désolé du dérangement.
      Bonne chasse vous deux.
      ;)
      0
  10. freedo Messages postés 160 Statut Membre 3
     
    bonsoir à tous,

    oula! plein de monde d'un coup, je me sentais seul...ça fait plaiz...
    j'ai fais le scan combofix en mode sans échec. ci-dessous :
    Merci pour l'analyse

    ComboFix 08-03-25.4 - freud 2008-03-26 20:44:21.1 - NTFSx86 MINIMAL
    Microsoft® Windows Vista™ Édition Intégrale 6.0.6000.0.1252.1.1033.18.1603 [GMT 1:00]
    Running from: C:\Users\freud\Desktop\ComboFix.exe
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Program Files\seekmo
    C:\Program Files\seekmo\seekmohook.dll
    C:\Windows\180ax.exe
    C:\Windows\2020search.dll
    C:\Windows\2020search2.dll
    C:\Windows\bjam.dll
    C:\Windows\bokja.exe
    C:\Windows\cdsm32.dll
    C:\Windows\default.htm
    C:\Windows\mspphe.dll
    C:\Windows\mssvr.exe
    C:\Windows\saiemod.dll
    C:\Windows\salm.exe
    C:\Windows\stcloader.exe
    C:\Windows\swin32.dll
    C:\Windows\system32\msixu.dll
    C:\Windows\system32\wer8274.dll
    C:\Windows\TEMP\salm.exe
    C:\Windows\updatetc.exe
    C:\Windows\voiceip.dll

    .
    ((((((((((((((((((((((((( Files Created from 2008-02-26 to 2008-03-26 )))))))))))))))))))))))))))))))
    .

    No new files created in this timespan

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-03-26 19:54 --------- d-----w C:\Program Files\seekmo
    2008-03-26 19:15 --------- d-----w C:\PROGRA~2\Google Updater
    2008-03-26 18:43 --------- d-----w C:\Program Files\180solutions
    2008-03-26 17:54 --------- d-----w C:\Program Files\zango
    2008-03-26 17:54 --------- d-----w C:\Program Files\180searchassistant
    2008-03-26 17:45 --------- d-----w C:\PROGRA~2\Rabio
    2008-03-25 19:56 --------- d-----w C:\Program Files\Bat
    2008-03-25 19:31 --------- d-----w C:\Program Files\Power Video Converter
    2008-03-25 18:47 --------- d-----w C:\Users\freud\AppData\Roaming\Vso
    2008-03-25 18:20 --------- d-----w C:\Users\freud\AppData\Roaming\GrabIt
    2008-03-25 06:14 --------- d-----w C:\Program Files\Micro Application
    2008-03-24 09:00 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-03-24 09:00 --------- d-----w C:\Program Files\Common Files\Adobe
    2008-03-23 09:29 307,968 ----a-w C:\Windows\System32\TuneUpDefragService.exe
    2008-03-23 09:29 --------- d-----w C:\Users\freud\AppData\Roaming\TuneUp Software
    2008-03-23 09:29 --------- d-----w C:\Program Files\TuneUp Utilities 2008
    2008-03-23 09:29 --------- d-----w C:\PROGRA~2\TuneUp Software
    2008-03-23 09:28 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2008-03-22 09:31 --------- d-----w C:\Users\freud\AppData\Roaming\LimeWire
    2008-03-21 22:31 90,537 ----a-w C:\Windows\System32\sbwltbxa.exe
    2008-03-12 19:35 --------- d-----w C:\Program Files\TFPTools3_0
    2008-03-11 22:53 --------- d-----w C:\Program Files\Windows Mail
    2008-03-11 22:52 --------- d-----w C:\PROGRA~2\Microsoft Help
    2008-03-10 17:37 --------- d-----w C:\Program Files\MAGIX
    2008-03-10 17:34 --------- d-----w C:\Program Files\Microsoft Silverlight
    2008-03-09 19:02 --------- d-----w C:\PROGRA~2\MAGIX
    2008-03-05 19:32 --------- d-----w C:\Users\freud\AppData\Roaming\MAGIX
    2008-03-05 19:20 --------- d-----w C:\Program Files\Common Files\MAGIX Shared
    2008-03-02 10:34 --------- d-----w C:\Users\freud\AppData\Roaming\FileZilla
    2008-03-02 10:15 --------- d-----w C:\Program Files\HomePlayer1.5.4
    2008-02-27 12:15 28,416 ----a-w C:\Windows\System32\uxtuneup.dll
    2008-02-27 12:15 16,640 ----a-w C:\Windows\System32\authuitu.dll
    2008-02-27 04:00 --------- d-----w C:\Users\freud\AppData\Roaming\dvdcss
    2008-02-25 19:35 --------- d-----w C:\Program Files\DVDFab Platinum 4
    2008-02-24 12:57 --------- d-----w C:\Users\freud\AppData\Roaming\DVDFab
    2008-02-16 07:36 --------- d-----w C:\PROGRA~2\Spybot - Search & Destroy
    2008-02-16 07:34 --------- d-----w C:\Program Files\Spybot - Search & Destroy
    2008-02-15 19:17 691,545 ----a-w C:\Windows\unins000.exe
    2008-02-14 18:38 --------- d-----w C:\Program Files\AGEIA Technologies
    2008-02-13 23:18 194,560 ----a-w C:\Windows\System32\WebClnt.dll
    2008-02-13 23:18 110,080 ----a-w C:\Windows\system32\drivers\mrxdav.sys
    2008-02-13 23:16 595,456 ----a-w C:\Windows\System32\schedsvc.dll
    2008-02-13 23:14 45,112 ----a-w C:\Windows\system32\drivers\pciidex.sys
    2008-02-13 23:14 3,504,696 ----a-w C:\Windows\System32\ntkrnlpa.exe
    2008-02-13 23:14 3,470,392 ----a-w C:\Windows\System32\ntoskrnl.exe
    2008-02-13 23:14 21,560 ----a-w C:\Windows\system32\drivers\atapi.sys
    2008-02-13 23:14 154,624 ----a-w C:\Windows\system32\drivers\nwifi.sys
    2008-02-13 23:14 15,928 ----a-w C:\Windows\system32\drivers\pciide.sys
    2008-02-13 23:14 109,624 ----a-w C:\Windows\system32\drivers\ataport.sys
    2008-02-13 23:13 803,328 ----a-w C:\Windows\system32\drivers\tcpip.sys
    2008-02-13 23:13 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
    2008-02-13 23:13 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
    2008-02-13 23:13 4,247,552 ----a-w C:\Windows\System32\GameUXLegacyGDFs.dll
    2008-02-13 23:13 24,064 ----a-w C:\Windows\System32\netcfg.exe
    2008-02-13 23:13 22,016 ----a-w C:\Windows\System32\netiougc.exe
    2008-02-13 23:13 216,632 ----a-w C:\Windows\system32\drivers\netio.sys
    2008-02-13 23:13 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
    2008-02-13 23:13 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
    2008-02-13 23:13 167,424 ----a-w C:\Windows\System32\tcpipcfg.dll
    2008-02-13 23:13 1,686,528 ----a-w C:\Windows\System32\gameux.dll
    2008-02-13 23:11 824,832 ----a-w C:\Windows\System32\wininet.dll
    2008-02-13 23:11 56,320 ----a-w C:\Windows\System32\iesetup.dll
    2008-02-13 23:11 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
    2008-02-13 23:11 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
    2008-02-12 23:02 --------- d-----w C:\Users\freud\AppData\Roaming\skypePM
    2008-02-12 22:52 --------- d-----w C:\Users\freud\AppData\Roaming\Skype
    2008-02-12 11:18 --------- d-----w C:\Program Files\Acrobat 8.0
    2008-02-08 23:25 --------- d-----w C:\Program Files\LimeWire
    2008-02-08 22:47 --------- d-----w C:\Program Files\BitComet
    2008-02-07 17:57 418,480 ----a-w C:\Windows\System32\wrap_oal.dll
    2008-02-07 17:57 115,432 ----a-w C:\Windows\System32\OpenAL32.dll
    2008-02-07 17:57 --------- d-----w C:\Program Files\OpenAL
    2008-01-31 22:25 --------- d-----w C:\PROGRA~2\NVIDIA
    2008-01-31 22:17 --------- d-----w C:\Program Files\NVIDIA
    2008-01-26 21:15 --------- d-----w C:\Program Files\Common Files\ACD Systems
    2008-01-26 21:15 --------- d-----w C:\PROGRA~2\ACD Systems
    2008-01-26 21:14 --------- d-----w C:\Program Files\ACD Systems
    2008-01-26 17:56 --------- d-----w C:\Program Files\Winamp
    2008-01-26 15:42 1,390,730 ----a-w C:\Windows\System32\AutoPartNt.exe
    2008-01-26 11:40 --------- d-----w C:\PROGRA~2\Acronis
    2008-01-26 10:33 47,360 ----a-w C:\Windows\system32\drivers\pcouffin.sys
    2008-01-26 10:33 47,360 ----a-w C:\Users\freud\AppData\Roaming\pcouffin.sys
    2008-01-10 05:50 1,244,672 ----a-w C:\Windows\System32\mcmde.dll
    2008-01-09 22:51 11,776 ----a-w C:\Windows\System32\sbunattend.exe
    2008-01-08 20:00 799,424 ----a-r C:\Windows\System32\tmp9DD5.tmp
    2008-01-08 20:00 799,424 ----a-r C:\Windows\System32\tmp9D67.tmp
    2007-11-30 21:43 32 ----a-w C:\Users\All Users\ezsid.dat
    2007-11-30 21:43 32 ----a-w C:\PROGRA~2\ezsid.dat
    2007-11-18 05:52 22,328 ----a-w C:\Users\freud\AppData\Roaming\PnkBstrK.sys
    2007-10-03 15:29 174 --sha-w C:\Program Files\desktop.ini
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{63F7460B-C831-4142-A4AA-5EC303EC4343}]
    2008-03-07 21:15 413696 --a------ C:\Program Files\Bat\Bat.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-16 23:42 68856]
    "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
    "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-09 23:51 1232896]
    "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 12:24 167368]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" [2007-08-03 11:51 202024]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-07-11 16:26 1006264]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
    "Skytel"="Skytel.exe" [2007-03-16 16:06 1822720 C:\Windows\SkyTel.exe]
    "RtHDVCpl"="RtHDVCpl.exe" [2007-03-23 20:04 4423680 C:\Windows\RtHDVCpl.exe]
    "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2007-10-28 09:35 72736]
    "NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 14:57 153136]
    "LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2007-10-11 12:06 62760]
    "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 03:10 55824 C:\Windows\KHALMNPR.Exe]
    "BDRegion"="C:\Program Files\Cyberlink\Shared Files\brs.exe" [2007-11-16 19:20 91432]
    "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
    "Acrobat Assistant 8.0"="C:\Program Files\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-01-11 19:54 623992]
    "AAWTray"="C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe" [2007-08-08 14:53 88024]
    "NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-12-18 19:55 86016]
    "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-12-18 19:55 8530464]
    "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-12-18 19:55 81920]
    "MSConfig"="C:\Windows\system32\msconfig.exe" [2006-11-02 10:45 222208]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
    "GrpConv"="grpconv -o" []

    C:\Users\freud\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    ParamŠtres de la souris et du clavier.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-12-05 17:31:30 784912]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "DisableTaskMgr"= 1 (0x1)

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
    "DisableTaskMgr"= 1 (0x1)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
    "TCP Query User{728E2D51-1F41-4C38-BFE7-0A8864AFA260}C:\\program files\\windows sidebar\\sidebar.exe"= UDP:C:\program files\windows sidebar\sidebar.exe:Windows Sidebar
    "UDP Query User{F52A9D83-67A9-4C96-87B7-BF5F2269C6C0}C:\\program files\\windows sidebar\\sidebar.exe"= TCP:C:\program files\windows sidebar\sidebar.exe:Windows Sidebar
    "TCP Query User{284045AE-684B-4A36-A114-89D96D624E8D}C:\\program files\\homeplayer1.5.3\\homeplayer.exe"= UDP:C:\program files\homeplayer1.5.3\homeplayer.exe:HomePlayer
    "UDP Query User{320DD36F-4B27-4D86-AE27-A18C1D8196E7}C:\\program files\\homeplayer1.5.3\\homeplayer.exe"= TCP:C:\program files\homeplayer1.5.3\homeplayer.exe:HomePlayer
    "TCP Query User{7D7FEE9D-0685-4964-B161-D0E357B6454C}C:\\program files\\homeplayer1.5.3\\vlc\\vlc.exe"= UDP:C:\program files\homeplayer1.5.3\vlc\vlc.exe:VLC media player
    "UDP Query User{B7DA0AF8-4FA3-4B65-B71B-9E8FAB2D6403}C:\\program files\\homeplayer1.5.3\\vlc\\vlc.exe"= TCP:C:\program files\homeplayer1.5.3\vlc\vlc.exe:VLC media player
    "TCP Query User{DBE1B099-D676-4DE6-BDF7-E50C2D12175D}C:\\program files\\homeplayer1.5.3.1\\homeplayer.exe"= UDP:C:\program files\homeplayer1.5.3.1\homeplayer.exe:HomePlayer
    "UDP Query User{93EFA390-6CDA-41DF-AE7F-1978D68CFD5B}C:\\program files\\homeplayer1.5.3.1\\homeplayer.exe"= TCP:C:\program files\homeplayer1.5.3.1\homeplayer.exe:HomePlayer
    "{CF4B4F50-4A4E-4C13-8BB1-B516F431B48E}"= UDP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
    "{BF6C76CD-E5D1-4145-82B5-AB7C4EF827EB}"= TCP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
    "{897FDD38-8A12-43D5-88F9-7FC59585567B}"= UDP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
    "{DA4BD74E-6F6A-4B7B-A46E-12C9741BF981}"= TCP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
    "TCP Query User{181E1BE0-3B23-41B3-9021-F55E8DDCB772}C:\\program files\\skype\\phone\\skype.exe"= UDP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
    "UDP Query User{BEA72B18-5771-49BA-BFEC-203D9204F1C6}C:\\program files\\skype\\phone\\skype.exe"= TCP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
    "{3C8AA173-D6B2-477F-BAD0-58C38A2D47A5}"= UDP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb
    "{58E4EE09-68F7-46F4-AA9B-BFF3A09237FE}"= TCP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb
    "{C2B45D9C-DD5D-4F85-B2EA-B650E3D84FEF}"= UDP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray
    "{2A1D8BF4-E388-4121-B214-05CBBB63412D}"= TCP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray
    "{F1794328-1D5D-4C77-BB51-409D19518632}"= UDP:C:\Program Files\Winamp Remote\bin\OrbIR.exe:OrbIR
    "{98E90010-91FC-4819-A691-F170207D5568}"= TCP:C:\Program Files\Winamp Remote\bin\OrbIR.exe:OrbIR
    "{566EF3E3-BBC1-4C3C-98CC-1761B29A5E21}"= UDP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client
    "{E8B62EAC-157B-45A6-BB48-13BFA262F805}"= TCP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client
    "{0A5B917D-9C59-4661-91FB-1B711467CBE5}"= C:\Program Files\Cyberlink\PowerDVD\PowerDVD.EXE:CyberLink PowerDVD
    "{635B41D7-4319-48E8-A4CB-73DC12FAFB5F}"= UDP:C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
    "{579B62CA-217D-47BB-A8BE-31AD5AF368E7}"= TCP:C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
    "{0126956B-F352-4723-A3D9-037DA9C6BDA9}"= UDP:E:\Program Files\Eidos\Conflict Denied Ops\ConflictDeniedOps.exe:Conflict: Denied Ops
    "{93791E2F-F4A1-4695-A5BB-154FB0D7EA23}"= TCP:E:\Program Files\Eidos\Conflict Denied Ops\ConflictDeniedOps.exe:Conflict: Denied Ops
    "TCP Query User{069B0084-A726-46BE-8006-4F7ABABF677E}C:\\program files\\bitcomet\\bitcomet.exe"= UDP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
    "UDP Query User{5B785267-686B-4614-8F66-E4E7CA3A4E78}C:\\program files\\bitcomet\\bitcomet.exe"= TCP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
    "TCP Query User{96C2D0EA-D258-4F84-8E46-79870D12D841}C:\\program files\\limewire\\limewire.exe"= UDP:C:\program files\limewire\limewire.exe:LimeWire
    "UDP Query User{FA49FB3E-E8C5-47EC-BAED-6E964F0D4393}C:\\program files\\limewire\\limewire.exe"= TCP:C:\program files\limewire\limewire.exe:LimeWire
    "TCP Query User{10BC2A7B-26E5-4BD8-AAB5-BBD89A1E9604}C:\\program files\\homeplayer1.5.4\\homeplayer.exe"= UDP:C:\program files\homeplayer1.5.4\homeplayer.exe:HomePlayer
    "UDP Query User{C46748D7-2C18-410E-86D4-898A6320CC4A}C:\\program files\\homeplayer1.5.4\\homeplayer.exe"= TCP:C:\program files\homeplayer1.5.4\homeplayer.exe:HomePlayer
    "TCP Query User{841E028D-BADB-45FE-9FFB-10C939DCD361}C:\\program files\\tfptools3_0\\tfptools.exe"= UDP:C:\program files\tfptools3_0\tfptools.exe:TFPTools
    "UDP Query User{FC09EBF1-9F4E-49E0-B1D0-6F39592C040C}C:\\program files\\tfptools3_0\\tfptools.exe"= TCP:C:\program files\tfptools3_0\tfptools.exe:TFPTools
    "{4E79FF87-CF66-490A-9882-9FDFC049C4E8}"= UDP:0:LocalSubnet:LocalSubnet:Magix UPnP Media Server
    "{C54C4595-076B-4954-B57C-4966693F1A91}"= UDP:2869:LocalSubnet:LocalSubnet:Microsoft UPnP-Port (TCP)
    "{E23D4E3A-CD3C-4FC8-81E3-0A747B3383E9}"= TCP:1900:LocalSubnet:LocalSubnet:Microsoft UPnP-Port (UDP)
    "{0A37CC46-DC22-41BD-BCAE-50CEBD5F5A17}"= UDP:C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe:Magix UPnP Service
    "{5FE82C2A-AE9A-4479-931D-E2F70274D208}"= TCP:C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe:Magix UPnP Service

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
    "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

    S2 {95808DC4-FA4A-4C74-92FE-5B863F82066B};{95808DC4-FA4A-4C74-92FE-5B863F82066B};C:\Program Files\CyberLink\PowerDVD\[u]0/u00.fcl [2007-11-03 00:12]
    S2 AcronisOSSReinstallSvc;Acronis OS Selector Reinstall Service;"C:\Program Files\Common Files\Acronis\Partition Suite\oss_reinstall_svc.exe" [2007-03-09 18:02]
    S2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2007-12-04 15:52]
    S2 SBSDWSCService;SBSD Security Center Service;C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2008-01-28 11:43]
    S2 UxTuneUp;TuneUp Theme Extension;C:\Windows\System32\svchost.exe [2006-11-02 10:45]
    S3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;C:\Windows\system32\DRIVERS\atl01v32.sys [2007-03-15 15:41]
    S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\Windows\System32\TuneUpDefragService.exe [2008-03-23 10:29]
    S3 UPnPService;UPnPService;C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [2006-12-14 17:00]

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
    UxTuneUp

    *Newly Created Service* - ECACHE
    .
    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-03-26 20:54:41
    Windows 6.0.6000 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-03-26 20:54:54
    ComboFix-quarantined-files.txt 2008-03-26 19:54:53
    ComboFix2.txt 2008-03-26 19:26:49
    .
    2008-03-25 20:41:37 --- E O F ---
    0
  11. green day Messages postés 26374 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   2 166
     
    ok,

    # Télécharger BTFix de Bibi26 : http://cluster1.easy-hebergement.net/
    # Dézipper l'archive sur le Bureau : faire un clic droit puis extraire
    # Ouvrir le dossier BTFix
    # Double cliquer sur BTFix.exe
    # Cliquer sur Rechercher
    # Un rapport s'ouvre alors, poste le stp

    ++
    0
  12. freedo Messages postés 160 Statut Membre 3
     
    ok,

    Par contre il reste la fenêtre du logiciel ouverte avec 2 options "nettoyer" (seekmo & Zango) et "rechercher" :
    qu'est je fais je nettoie?

    BTFix 1.091 (par bibi26) - 26/03/2008 21:27:27 - Analyse
    Lancé depuis C:\Users\freud\Desktop\BTFix\BTFix.exe

    ---> Fichiers/Dossiers trouvés

    - C:\Program Files\Seekmo\
    - C:\Program Files\Zango\

    ---> Analyse terminée le 26/03/2008 21:27:28
    0
  13. green day Messages postés 26374 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   2 166
     
    oui, tu peux nettoyé !

    ensuite, poste un nouveau combo stp

    ++
    0
  14. freedo Messages postés 160 Statut Membre 3
     
    Je refuse une bonne dizaine d'inscription dans le résident de Spybot,
    j'en ai plein l'écran de petites fenêtre de "modification du registre refusée" (catégorie browser page)!!!
    ci dessous log combofix :

    ComboFix 08-03-25.4 - freud 2008-03-26 21:56:05.1 - NTFSx86 MINIMAL
    Microsoft® Windows Vista™ Édition Intégrale 6.0.6000.0.1252.1.1033.18.1617 [GMT 1:00]
    Running from: C:\Users\freud\Desktop\ComboFix.exe
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Program Files\seekmo
    C:\Program Files\seekmo\seekmohook.dll
    C:\Windows\180ax.exe
    C:\Windows\2020search.dll
    C:\Windows\2020search2.dll
    C:\Windows\bjam.dll
    C:\Windows\bokja.exe
    C:\Windows\cdsm32.dll
    C:\Windows\default.htm
    C:\Windows\mspphe.dll
    C:\Windows\mssvr.exe
    C:\Windows\saiemod.dll
    C:\Windows\salm.exe
    C:\Windows\stcloader.exe
    C:\Windows\swin32.dll
    C:\Windows\system32\msixu.dll
    C:\Windows\system32\wer8274.dll
    C:\Windows\TEMP\salm.exe
    C:\Windows\updatetc.exe
    C:\Windows\voiceip.dll

    .
    ((((((((((((((((((((((((( Files Created from 2008-02-26 to 2008-03-26 )))))))))))))))))))))))))))))))
    .

    No new files created in this timespan

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-03-26 20:56 --------- d-----w C:\Program Files\zango
    2008-03-26 19:15 --------- d-----w C:\PROGRA~2\Google Updater
    2008-03-26 18:43 --------- d-----w C:\Program Files\180solutions
    2008-03-26 17:54 --------- d-----w C:\Program Files\180searchassistant
    2008-03-26 17:45 --------- d-----w C:\PROGRA~2\Rabio
    2008-03-25 19:56 --------- d-----w C:\Program Files\Bat
    2008-03-25 19:31 --------- d-----w C:\Program Files\Power Video Converter
    2008-03-25 18:47 --------- d-----w C:\Users\freud\AppData\Roaming\Vso
    2008-03-25 18:20 --------- d-----w C:\Users\freud\AppData\Roaming\GrabIt
    2008-03-25 06:14 --------- d-----w C:\Program Files\Micro Application
    2008-03-24 09:00 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-03-24 09:00 --------- d-----w C:\Program Files\Common Files\Adobe
    2008-03-23 09:29 307,968 ----a-w C:\Windows\System32\TuneUpDefragService.exe
    2008-03-23 09:29 --------- d-----w C:\Users\freud\AppData\Roaming\TuneUp Software
    2008-03-23 09:29 --------- d-----w C:\Program Files\TuneUp Utilities 2008
    2008-03-23 09:29 --------- d-----w C:\PROGRA~2\TuneUp Software
    2008-03-23 09:28 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2008-03-22 09:31 --------- d-----w C:\Users\freud\AppData\Roaming\LimeWire
    2008-03-21 22:31 90,537 ----a-w C:\Windows\System32\sbwltbxa.exe
    2008-03-12 19:35 --------- d-----w C:\Program Files\TFPTools3_0
    2008-03-11 22:53 --------- d-----w C:\Program Files\Windows Mail
    2008-03-11 22:52 --------- d-----w C:\PROGRA~2\Microsoft Help
    2008-03-10 17:37 --------- d-----w C:\Program Files\MAGIX
    2008-03-10 17:34 --------- d-----w C:\Program Files\Microsoft Silverlight
    2008-03-09 19:02 --------- d-----w C:\PROGRA~2\MAGIX
    2008-03-05 19:32 --------- d-----w C:\Users\freud\AppData\Roaming\MAGIX
    2008-03-05 19:20 --------- d-----w C:\Program Files\Common Files\MAGIX Shared
    2008-03-02 10:34 --------- d-----w C:\Users\freud\AppData\Roaming\FileZilla
    2008-03-02 10:15 --------- d-----w C:\Program Files\HomePlayer1.5.4
    2008-02-27 12:15 28,416 ----a-w C:\Windows\System32\uxtuneup.dll
    2008-02-27 12:15 16,640 ----a-w C:\Windows\System32\authuitu.dll
    2008-02-27 04:00 --------- d-----w C:\Users\freud\AppData\Roaming\dvdcss
    2008-02-25 19:35 --------- d-----w C:\Program Files\DVDFab Platinum 4
    2008-02-24 12:57 --------- d-----w C:\Users\freud\AppData\Roaming\DVDFab
    2008-02-16 07:36 --------- d-----w C:\PROGRA~2\Spybot - Search & Destroy
    2008-02-16 07:34 --------- d-----w C:\Program Files\Spybot - Search & Destroy
    2008-02-15 19:17 691,545 ----a-w C:\Windows\unins000.exe
    2008-02-14 18:38 --------- d-----w C:\Program Files\AGEIA Technologies
    2008-02-13 23:18 194,560 ----a-w C:\Windows\System32\WebClnt.dll
    2008-02-13 23:18 110,080 ----a-w C:\Windows\system32\drivers\mrxdav.sys
    2008-02-13 23:16 595,456 ----a-w C:\Windows\System32\schedsvc.dll
    2008-02-13 23:14 45,112 ----a-w C:\Windows\system32\drivers\pciidex.sys
    2008-02-13 23:14 3,504,696 ----a-w C:\Windows\System32\ntkrnlpa.exe
    2008-02-13 23:14 3,470,392 ----a-w C:\Windows\System32\ntoskrnl.exe
    2008-02-13 23:14 21,560 ----a-w C:\Windows\system32\drivers\atapi.sys
    2008-02-13 23:14 154,624 ----a-w C:\Windows\system32\drivers\nwifi.sys
    2008-02-13 23:14 15,928 ----a-w C:\Windows\system32\drivers\pciide.sys
    2008-02-13 23:14 109,624 ----a-w C:\Windows\system32\drivers\ataport.sys
    2008-02-13 23:13 803,328 ----a-w C:\Windows\system32\drivers\tcpip.sys
    2008-02-13 23:13 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
    2008-02-13 23:13 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
    2008-02-13 23:13 4,247,552 ----a-w C:\Windows\System32\GameUXLegacyGDFs.dll
    2008-02-13 23:13 24,064 ----a-w C:\Windows\System32\netcfg.exe
    2008-02-13 23:13 22,016 ----a-w C:\Windows\System32\netiougc.exe
    2008-02-13 23:13 216,632 ----a-w C:\Windows\system32\drivers\netio.sys
    2008-02-13 23:13 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
    2008-02-13 23:13 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
    2008-02-13 23:13 167,424 ----a-w C:\Windows\System32\tcpipcfg.dll
    2008-02-13 23:13 1,686,528 ----a-w C:\Windows\System32\gameux.dll
    2008-02-13 23:11 824,832 ----a-w C:\Windows\System32\wininet.dll
    2008-02-13 23:11 56,320 ----a-w C:\Windows\System32\iesetup.dll
    2008-02-13 23:11 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
    2008-02-13 23:11 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
    2008-02-12 23:02 --------- d-----w C:\Users\freud\AppData\Roaming\skypePM
    2008-02-12 22:52 --------- d-----w C:\Users\freud\AppData\Roaming\Skype
    2008-02-12 11:18 --------- d-----w C:\Program Files\Acrobat 8.0
    2008-02-08 23:25 --------- d-----w C:\Program Files\LimeWire
    2008-02-08 22:47 --------- d-----w C:\Program Files\BitComet
    2008-02-07 17:57 418,480 ----a-w C:\Windows\System32\wrap_oal.dll
    2008-02-07 17:57 115,432 ----a-w C:\Windows\System32\OpenAL32.dll
    2008-02-07 17:57 --------- d-----w C:\Program Files\OpenAL
    2008-01-31 22:25 --------- d-----w C:\PROGRA~2\NVIDIA
    2008-01-31 22:17 --------- d-----w C:\Program Files\NVIDIA
    2008-01-26 21:15 --------- d-----w C:\Program Files\Common Files\ACD Systems
    2008-01-26 21:15 --------- d-----w C:\PROGRA~2\ACD Systems
    2008-01-26 21:14 --------- d-----w C:\Program Files\ACD Systems
    2008-01-26 17:56 --------- d-----w C:\Program Files\Winamp
    2008-01-26 15:42 1,390,730 ----a-w C:\Windows\System32\AutoPartNt.exe
    2008-01-26 11:40 --------- d-----w C:\PROGRA~2\Acronis
    2008-01-26 10:33 47,360 ----a-w C:\Windows\system32\drivers\pcouffin.sys
    2008-01-26 10:33 47,360 ----a-w C:\Users\freud\AppData\Roaming\pcouffin.sys
    2008-01-10 05:50 1,244,672 ----a-w C:\Windows\System32\mcmde.dll
    2008-01-09 22:51 11,776 ----a-w C:\Windows\System32\sbunattend.exe
    2008-01-08 20:00 799,424 ----a-r C:\Windows\System32\tmp9DD5.tmp
    2008-01-08 20:00 799,424 ----a-r C:\Windows\System32\tmp9D67.tmp
    2007-11-30 21:43 32 ----a-w C:\Users\All Users\ezsid.dat
    2007-11-30 21:43 32 ----a-w C:\PROGRA~2\ezsid.dat
    2007-11-18 05:52 22,328 ----a-w C:\Users\freud\AppData\Roaming\PnkBstrK.sys
    2007-10-03 15:29 174 --sha-w C:\Program Files\desktop.ini
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{63F7460B-C831-4142-A4AA-5EC303EC4343}]
    2008-03-07 21:15 413696 --a------ C:\Program Files\Bat\Bat.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-16 23:42 68856]
    "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
    "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-09 23:51 1232896]
    "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 12:24 167368]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" [2007-08-03 11:51 202024]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-07-11 16:26 1006264]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
    "Skytel"="Skytel.exe" [2007-03-16 16:06 1822720 C:\Windows\SkyTel.exe]
    "RtHDVCpl"="RtHDVCpl.exe" [2007-03-23 20:04 4423680 C:\Windows\RtHDVCpl.exe]
    "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2007-10-28 09:35 72736]
    "NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 14:57 153136]
    "LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2007-10-11 12:06 62760]
    "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 03:10 55824 C:\Windows\KHALMNPR.Exe]
    "BDRegion"="C:\Program Files\Cyberlink\Shared Files\brs.exe" [2007-11-16 19:20 91432]
    "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
    "Acrobat Assistant 8.0"="C:\Program Files\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-01-11 19:54 623992]
    "AAWTray"="C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe" [2007-08-08 14:53 88024]
    "NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-12-18 19:55 86016]
    "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-12-18 19:55 8530464]
    "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-12-18 19:55 81920]
    "MSConfig"="C:\Windows\system32\msconfig.exe" [2006-11-02 10:45 222208]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
    "GrpConv"="grpconv -o" []

    C:\Users\freud\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    ParamŠtres de la souris et du clavier.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-12-05 17:31:30 784912]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "DisableTaskMgr"= 1 (0x1)

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
    "DisableTaskMgr"= 1 (0x1)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
    "TCP Query User{728E2D51-1F41-4C38-BFE7-0A8864AFA260}C:\\program files\\windows sidebar\\sidebar.exe"= UDP:C:\program files\windows sidebar\sidebar.exe:Windows Sidebar
    "UDP Query User{F52A9D83-67A9-4C96-87B7-BF5F2269C6C0}C:\\program files\\windows sidebar\\sidebar.exe"= TCP:C:\program files\windows sidebar\sidebar.exe:Windows Sidebar
    "TCP Query User{284045AE-684B-4A36-A114-89D96D624E8D}C:\\program files\\homeplayer1.5.3\\homeplayer.exe"= UDP:C:\program files\homeplayer1.5.3\homeplayer.exe:HomePlayer
    "UDP Query User{320DD36F-4B27-4D86-AE27-A18C1D8196E7}C:\\program files\\homeplayer1.5.3\\homeplayer.exe"= TCP:C:\program files\homeplayer1.5.3\homeplayer.exe:HomePlayer
    "TCP Query User{7D7FEE9D-0685-4964-B161-D0E357B6454C}C:\\program files\\homeplayer1.5.3\\vlc\\vlc.exe"= UDP:C:\program files\homeplayer1.5.3\vlc\vlc.exe:VLC media player
    "UDP Query User{B7DA0AF8-4FA3-4B65-B71B-9E8FAB2D6403}C:\\program files\\homeplayer1.5.3\\vlc\\vlc.exe"= TCP:C:\program files\homeplayer1.5.3\vlc\vlc.exe:VLC media player
    "TCP Query User{DBE1B099-D676-4DE6-BDF7-E50C2D12175D}C:\\program files\\homeplayer1.5.3.1\\homeplayer.exe"= UDP:C:\program files\homeplayer1.5.3.1\homeplayer.exe:HomePlayer
    "UDP Query User{93EFA390-6CDA-41DF-AE7F-1978D68CFD5B}C:\\program files\\homeplayer1.5.3.1\\homeplayer.exe"= TCP:C:\program files\homeplayer1.5.3.1\homeplayer.exe:HomePlayer
    "{CF4B4F50-4A4E-4C13-8BB1-B516F431B48E}"= UDP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
    "{BF6C76CD-E5D1-4145-82B5-AB7C4EF827EB}"= TCP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
    "{897FDD38-8A12-43D5-88F9-7FC59585567B}"= UDP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
    "{DA4BD74E-6F6A-4B7B-A46E-12C9741BF981}"= TCP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
    "TCP Query User{181E1BE0-3B23-41B3-9021-F55E8DDCB772}C:\\program files\\skype\\phone\\skype.exe"= UDP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
    "UDP Query User{BEA72B18-5771-49BA-BFEC-203D9204F1C6}C:\\program files\\skype\\phone\\skype.exe"= TCP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
    "{3C8AA173-D6B2-477F-BAD0-58C38A2D47A5}"= UDP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb
    "{58E4EE09-68F7-46F4-AA9B-BFF3A09237FE}"= TCP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb
    "{C2B45D9C-DD5D-4F85-B2EA-B650E3D84FEF}"= UDP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray
    "{2A1D8BF4-E388-4121-B214-05CBBB63412D}"= TCP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray
    "{F1794328-1D5D-4C77-BB51-409D19518632}"= UDP:C:\Program Files\Winamp Remote\bin\OrbIR.exe:OrbIR
    "{98E90010-91FC-4819-A691-F170207D5568}"= TCP:C:\Program Files\Winamp Remote\bin\OrbIR.exe:OrbIR
    "{566EF3E3-BBC1-4C3C-98CC-1761B29A5E21}"= UDP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client
    "{E8B62EAC-157B-45A6-BB48-13BFA262F805}"= TCP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client
    "{0A5B917D-9C59-4661-91FB-1B711467CBE5}"= C:\Program Files\Cyberlink\PowerDVD\PowerDVD.EXE:CyberLink PowerDVD
    "{635B41D7-4319-48E8-A4CB-73DC12FAFB5F}"= UDP:C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
    "{579B62CA-217D-47BB-A8BE-31AD5AF368E7}"= TCP:C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
    "{0126956B-F352-4723-A3D9-037DA9C6BDA9}"= UDP:E:\Program Files\Eidos\Conflict Denied Ops\ConflictDeniedOps.exe:Conflict: Denied Ops
    "{93791E2F-F4A1-4695-A5BB-154FB0D7EA23}"= TCP:E:\Program Files\Eidos\Conflict Denied Ops\ConflictDeniedOps.exe:Conflict: Denied Ops
    "TCP Query User{069B0084-A726-46BE-8006-4F7ABABF677E}C:\\program files\\bitcomet\\bitcomet.exe"= UDP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
    "UDP Query User{5B785267-686B-4614-8F66-E4E7CA3A4E78}C:\\program files\\bitcomet\\bitcomet.exe"= TCP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
    "TCP Query User{96C2D0EA-D258-4F84-8E46-79870D12D841}C:\\program files\\limewire\\limewire.exe"= UDP:C:\program files\limewire\limewire.exe:LimeWire
    "UDP Query User{FA49FB3E-E8C5-47EC-BAED-6E964F0D4393}C:\\program files\\limewire\\limewire.exe"= TCP:C:\program files\limewire\limewire.exe:LimeWire
    "TCP Query User{10BC2A7B-26E5-4BD8-AAB5-BBD89A1E9604}C:\\program files\\homeplayer1.5.4\\homeplayer.exe"= UDP:C:\program files\homeplayer1.5.4\homeplayer.exe:HomePlayer
    "UDP Query User{C46748D7-2C18-410E-86D4-898A6320CC4A}C:\\program files\\homeplayer1.5.4\\homeplayer.exe"= TCP:C:\program files\homeplayer1.5.4\homeplayer.exe:HomePlayer
    "TCP Query User{841E028D-BADB-45FE-9FFB-10C939DCD361}C:\\program files\\tfptools3_0\\tfptools.exe"= UDP:C:\program files\tfptools3_0\tfptools.exe:TFPTools
    "UDP Query User{FC09EBF1-9F4E-49E0-B1D0-6F39592C040C}C:\\program files\\tfptools3_0\\tfptools.exe"= TCP:C:\program files\tfptools3_0\tfptools.exe:TFPTools
    "{4E79FF87-CF66-490A-9882-9FDFC049C4E8}"= UDP:0:LocalSubnet:LocalSubnet:Magix UPnP Media Server
    "{C54C4595-076B-4954-B57C-4966693F1A91}"= UDP:2869:LocalSubnet:LocalSubnet:Microsoft UPnP-Port (TCP)
    "{E23D4E3A-CD3C-4FC8-81E3-0A747B3383E9}"= TCP:1900:LocalSubnet:LocalSubnet:Microsoft UPnP-Port (UDP)
    "{0A37CC46-DC22-41BD-BCAE-50CEBD5F5A17}"= UDP:C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe:Magix UPnP Service
    "{5FE82C2A-AE9A-4479-931D-E2F70274D208}"= TCP:C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe:Magix UPnP Service

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
    "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

    S2 {95808DC4-FA4A-4C74-92FE-5B863F82066B};{95808DC4-FA4A-4C74-92FE-5B863F82066B};C:\Program Files\CyberLink\PowerDVD\[u]0/u00.fcl [2007-11-03 00:12]
    S2 AcronisOSSReinstallSvc;Acronis OS Selector Reinstall Service;"C:\Program Files\Common Files\Acronis\Partition Suite\oss_reinstall_svc.exe" [2007-03-09 18:02]
    S2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2007-12-04 15:52]
    S2 SBSDWSCService;SBSD Security Center Service;C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2008-01-28 11:43]
    S2 UxTuneUp;TuneUp Theme Extension;C:\Windows\System32\svchost.exe [2006-11-02 10:45]
    S3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;C:\Windows\system32\DRIVERS\atl01v32.sys [2007-03-15 15:41]
    S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\Windows\System32\TuneUpDefragService.exe [2008-03-23 10:29]
    S3 UPnPService;UPnPService;C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [2006-12-14 17:00]

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
    UxTuneUp

    *Newly Created Service* - ECACHE
    .
    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-03-26 21:59:28
    Windows 6.0.6000 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-03-26 21:59:42
    ComboFix-quarantined-files.txt 2008-03-26 20:59:40
    ComboFix2.txt 2008-03-26 19:54:55
    ComboFix3.txt 2008-03-26 19:26:49
    .
    2008-03-25 20:41:37 --- E O F ---
    0
    1. freedo Messages postés 160 Statut Membre 3
       
      Up Up !
      toujours dans la panade....
      0
  15. jfkpresident Messages postés 13877 Statut Contributeur sécurité 1 175
     
    poste un nouveau hijack en attendant g!rly
    0
    1. green day Messages postés 26374 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   2 166
       
      moi c'est green day ! :p
      0
      1. freedo Messages postés 160 Statut Membre 3 > green day Messages postés 26374 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention  
         
        Salut Green day!

        "Dookie" leur meilleur album pour moi!...
        on si remet ?
        0
  16. freedo Messages postés 160 Statut Membre 3
     
    ci fait!

    j'ai plus accès au "gestionnaire de programme" Alt + ctrl+ Supr (je suis sous vista)

    log Hijack :
    Logfile of HijackThis v1.99.1
    Scan saved at 22:09:17, on 25/03/2008
    Platform: Unknown Windows (WinNT 6.00.1904)
    MSIE: Internet Explorer v7.00 (7.00.6000.16609)

    Running processes:
    C:\Windows\system32\Dwm.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\Explorer.EXE
    C:\Windows\system32\sbwltbxa.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Windows\RtHDVCpl.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\CyberLink\Shared files\brs.exe
    C:\Program Files\Alwil Software\Avast4\ashDisp.exe
    C:\Program Files\Acrobat 8.0\Acrobat\Acrotray.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
    C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe
    C:\Users\freud\AppData\Local\Temp\IMAdvertiser.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe
    C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
    C:\Program Files\Logitech\SetPoint\SetPoint.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
    C:\Program Files\Internet Explorer\IEUser.exe
    C:\Windows\system32\rundll32.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Program Files\HijackThis\HIJACKTHIS VF\hijackthis vf.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.free.fr/freebox/index.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe,C:\Windows\system32\sbwltbxa.exe,
    O1 - Hosts: ::1 localhost
    O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: BatBHO - {63F7460B-C831-4142-A4AA-5EC303EC4343} - C:\Program Files\Bat\Bat.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [Skytel] Skytel.exe
    O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
    O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [BDRegion] C:\Program Files\Cyberlink\Shared Files\brs.exe
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Acrobat 8.0\Acrobat\Acrotray.exe"
    O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
    O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\opnopqn.dll,#1
    O4 - HKLM\..\Run: [IMprocess] C:\Users\freud\AppData\Local\Temp\IMAdvertiser.EXE
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\freud\AppData\Local\Temp\ddaab.dll,#1
    O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\freud\AppData\Local\Temp\tusqo.dll,c
    O4 - Startup: Bat - Auto Update.lnk = C:\Program Files\Bat\Bat.exe
    O4 - Startup: Paramètres de la souris et du clavier.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
    O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
    O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
    O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
    O8 - Extra context menu item: Ajouter au fichier PDF existant - res://C:\Program Files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file missing)
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
    O11 - Options group: [INTERNATIONAL] International*
    O13 - Gopher Prefix:
    O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.fr/s/v/25.24/uploader2.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Acronis OS Selector Reinstall Service (AcronisOSSReinstallSvc) - Unknown owner - C:\Program Files\Common Files\Acronis\Partition Suite\oss_reinstall_svc.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: C-DillaCdaC11BA - Macrovision - C:\Windows\system32\drivers\CDAC11BA.EXE
    O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
    O23 - Service: O&O Defrag - O&O Software GmbH - C:\Windows\system32\oodag.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
    O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
    O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
    O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
    O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
    O23 - Service: UPnPService - Magix AG - C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe
    O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)
    0
    1. Utilisateur anonyme
       
      Bonsoir à tous.

      Freedo, pendant que green day te prépare un joli comboscript, je te propose de récupérer ton gestionnaire des programmes :

      > Télécharge Zeb-Restore : http://telechargement.zebulon.fr/zeb-restore.html
      - Mets le dans un dossier, sur ton bureau par exemple.
      - Lance Zebrestore et coche les cases suivantes :

      Gestionnaire des tâches

      - Ne coche que la/les case(s) indiquée(s).
      - Clique sur le bouton Restaurer.
      - Quitte le programme

      A+
      0
  17. green day Messages postés 26374 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   2 166
     
    c'est reparti ! :)

    Télécharge SDFix sur ton bureau

    http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

    Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau.
    Redémarre ton ordinateur en mode sans échec
    Ouvre le dossier SDFix qui vient d'être créé sur le Bureau et double clique sur RunThis.cmd pour lancer le script.
    Appuie sur Y pour commencer le processus de nettoyage.
    Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
    Appuie sur une touche pour redémarrer le PC.
    Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
    Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
    Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
    Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
    Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum,

    ++
    0
    1. Utilisateur anonyme
       
      Oupss...
      Salutation greenette,

      SDFix ne fonctionne pas sous Vista.

      A+
      0
  18. green day Messages postés 26374 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   2 166
     
    Arf ! j'oublie toujours en cours de route mes postes qui sont sous vista ! :/

    merci ! :p

    sdfix, pas compatible ?! je sais jamais ...

    ++
    0
    1. freedo Messages postés 160 Statut Membre 3
       
      marche pas en mode sans échec sous vista, parcontre en session admin y ce passe qqchose mais les menus décrit dans ton tuto :
      c'est un ".bat" à activer,
      y'a pas de "y" (yes) à activer ....mais d'autres options que je n'est pas tantées...
      0
  19. Utilisateur anonyme
     
    Si Si,
    J'en suis certain...Je ne suis fait avoir plus d'une fois : http://mickael.barroux.free.fr/securite/sdfix.php
    Les autres tutos le disent aussi.

    Pour le gestionnaire des taches je proposais :
    http://www.commentcamarche.net/forum/affich 5626225 infection trojandownloader xs log hijackthis#22

    Aller, j'arrête de vous embêter. Puis je passe à la soupe d'ailleurs.
    Bonne appétit pour ceux qui passent à table et bonne soirée pour tous.

    :)
    0
    1. freedo Messages postés 160 Statut Membre 3
       
      j'essaye..je veux mon ctrl alt suppr...merci
      0
    2. freedo Messages postés 160 Statut Membre 3
       
      t'es sûr que ça marche sous vista? parce que pas mieux le gestionainre....
      0
      1. Utilisateur anonyme > freedo Messages postés 160 Statut Membre
         
        Bonsoir,
        Hé bien normalement oui.
        Mais il serait préférable de finir la désinfection avant pour être certain du bon fonctionnement du programme.

        A+
        0
  20. freedo Messages postés 160 Statut Membre 3
     
    bonsoir,

    j'espère pour suite et fin de l'infection,
    SDFIX n'as pas fonctionné sous Vista...
    J'ai tjrs mes pop up qui veulent me faire acheter un anti-spyware...le résident de spybot n'est pas fatigué d'afficher des fenêtre...par contre moi je le suis fatigué de fermer des fenêtres....
    Spybot me corrige bien 18 défault mais à chaque redémarrage...vlan...
    keske je fait?

    merci d'avance
    0
  21. freedo Messages postés 160 Statut Membre 3
     
    Je post mon log Hijackthis.....

    Logfile of HijackThis v1.99.1
    Scan saved at 21:39:30, on 28/03/2008
    Platform: Unknown Windows (WinNT 6.00.1904)
    MSIE: Internet Explorer v7.00 (7.00.6000.16609)

    Running processes:
    C:\Windows\system32\Dwm.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\sbwltbxa.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Windows\RtHDVCpl.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\CyberLink\Shared files\brs.exe
    C:\Program Files\Alwil Software\Avast4\ashDisp.exe
    C:\Program Files\Acrobat 8.0\Acrobat\Acrotray.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
    C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe
    C:\Program Files\Logitech\SetPoint\SetPoint.exe
    C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
    C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Windows\system32\conime.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\GrabIt\GrabIt.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Program Files\HijackThis\HIJACKTHIS VF\hijackthis vf.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.free.fr/freebox/index.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe,C:\Windows\system32\sbwltbxa.exe,
    O1 - Hosts: ::1 localhost
    O2 - BHO: (no name) - {00000250-0320-4dd4-be4f-7566d2314352} - (no file)
    O2 - BHO: (no name) - {13197ace-6851-45c3-a7ff-c281324d5489} - (no file)
    O2 - BHO: (no name) - {15651c7c-e812-44a2-a9ac-b467a2233e7d} - (no file)
    O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll
    O2 - BHO: (no name) - {4e1075f4-eec4-4a86-add7-cd5f52858c31} - (no file)
    O2 - BHO: (no name) - {4e7bd74f-2b8d-469e-92c6-ce7eb590a94d} - (no file)
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {5dafd089-24b1-4c5e-bd42-8ca72550717b} - (no file)
    O2 - BHO: (no name) - {622cc208-b014-4fe0-801b-874a5e5e403a} - (no file)
    O2 - BHO: BatBHO - {63F7460B-C831-4142-A4AA-5EC303EC4343} - C:\Program Files\Bat\Bat.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: (no name) - {8674aea0-9d3d-11d9-99dc-00600f9a01f1} - (no file)
    O2 - BHO: (no name) - {965a592f-8efa-4250-8630-7960230792f1} - (no file)
    O2 - BHO: (no name) - {9c5b2f29-1f46-4639-a6b4-828942301d3e} - (no file)
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
    O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765728274} - (no file)
    O2 - BHO: (no name) - {fc3a74e5-f281-4f10-ae1e-733078684f3c} - (no file)
    O2 - BHO: (no name) - {ffff0001-0002-101a-a3c9-08002b2f49fb} - (no file)
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [Skytel] Skytel.exe
    O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
    O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [BDRegion] C:\Program Files\Cyberlink\Shared Files\brs.exe
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Acrobat 8.0\Acrobat\Acrotray.exe"
    O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
    O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
    O4 - Startup: Paramètres de la souris et du clavier.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
    O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
    O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
    O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
    O8 - Extra context menu item: Ajouter au fichier PDF existant - res://C:\Program Files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file missing)
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.fr/s/v/25.24/uploader2.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Acronis OS Selector Reinstall Service (AcronisOSSReinstallSvc) - Unknown owner - C:\Program Files\Common Files\Acronis\Partition Suite\oss_reinstall_svc.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: C-DillaCdaC11BA - Macrovision - C:\Windows\system32\drivers\CDAC11BA.EXE
    O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)
    O23 - Service: FGZLQZCEFHI - Sysinternals - www.sysinternals.com - C:\Users\freud\AppData\Local\Temp\FGZLQZCEFHI.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
    O23 - Service: O&O Defrag - O&O Software GmbH - C:\Windows\system32\oodag.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
    O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
    O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
    O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
    O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
    O23 - Service: UPnPService - Magix AG - C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe
    O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)
    0
  • 1
  • 2

Discussions similaires

Avez-vous un VPN no logs à me conseiller ?
Utilisateur anonyme -
brupala -

4 réponses
comment taper log10 sur une TI83plus.fr ?
FFFred -
FFFred -

2 réponses
comment utiliser la fonction log
CG -
Utilisateur anonyme -

1 réponse
problème suite mise à jour 2004
eriamel0 -
eriamel0 -

11 réponses
Analyse des logs hijackthis
philnoug -
nayas13 -

35 réponses