Infecte avec Mirar et autres malwares, help! - Page 2

le log

-----------\\ ToolBar S&D 1.2.5 XP/Vista

Microsoft® Windows Vista™ Home Premium ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 Duo CPU T7250 @ 2.00GHz )
BIOS : BIOS Date: 10/09/07 12:03:10 Ver: R1.01
USER : CORECOG ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1169 [VPS 081204-0] 4.8.1169 (Activated)
C:\ (Local Disk) - NTFS - Total:104 Go (Free:7 Go)
D:\ (CD or DVD)
E:\ (CD or DVD)
S:\ (Local Disk) - NTFS - Total:1 Go (Free:1 Go)

"C:\ToolBar SD" ( MAJ : 20-11-2008|20:25 )
Option : [1] ( 05/12/2008| 9:11 )

[ UAC => 0 ]

-----------\\ Recherche de Fichiers / Dossiers ...

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\Windows\\system32\\blank.htm"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Start Page"="http://www.philips.com/pc"
"Url"="http://www.microsoft.com/athome/community/rss.xml"
"Url"="http://www.microsoft.com/atwork/community/rss.xml"
"Url"="http://rss.msn.com/en-us/?feedoutput=rss&ocid=iehrs&unsub=true"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"

--------------------\\ Recherche d'autres infections

--------------------\\ Cracks & Keygens ..

C:\Users\CORECOG\AppData\Roaming\Azureus\torrents\Miss Marple.The Mirror Crack'd[1992]Eng.DvDrip.NeRoZ [mininova].torrent
C:\Users\CORECOG\AppData\Roaming\Azureus\torrents\Run.Fat.Boy.Run.DVDRip.XviD-Crackpots.4029029.TPB [mininova].torrent
C:\Users\CORECOG\Documents\Azureus Downloads\Call of duty 4 [PC-DVD] [English] [www.topetorrent.com]\crack
C:\Users\CORECOG\Documents\Azureus Downloads\Call of duty 4 [PC-DVD] [English] [www.topetorrent.com]\crack\rzr-cod4.exe
C:\Users\CORECOG\Documents\Azureus Downloads\PC_Call of Duty 1 -(.rip.)-(ToeD)\Call of Duty\The Call of Duty\Crack
C:\Users\CORECOG\Documents\Azureus Downloads\PC_Call of Duty 1 -(.rip.)-(ToeD)\Call of Duty\The Call of Duty\Crack\CoDMP.exe
C:\Users\CORECOG\Documents\Azureus Downloads\PC_Call of Duty 1 -(.rip.)-(ToeD)\Call of Duty\The Call of Duty\Crack\CoDSP.exe
C:\Users\CORECOG\Documents\Azureus Downloads\PC_Call of Duty 1 -(.rip.)-(ToeD)\Call of Duty\The Call of Duty\Crack\ToeD.exe
C:\Users\CORECOG\Documents\Azureus Downloads\PC_Call of Duty 1 -(.rip.)-(ToeD)\Call of Duty\The Call of Duty\Crack\Vistro.exe

[ UAC => 1 ]

1 - "C:\ToolBar SD\TB_1.txt" - 05/12/2008| 9:13 - Option : [1]

-----------\\ Fin du rapport a 9:13:14.48

Re,

6) Double clique sur l'icône de MBAM sur ton Bureau. La fenêtre principale de MBAM s'affiche. Clique sur l'onglet Mise à jour et mets à jour.

7)reviens sur l'onglet analyse, vérifie que "Exécuter une analyse rapide" est coché et clique sur le bouton Rechercher pour démarrer l'analyse.

8) MBAM analyse ton ordinateur. L'analyse peut prendre un certain temps. Il suffit de vérifier de temps en temps son avancement.

9) A la fin de l'analyse, un message s'affiche indiquant la fin de l'analyse. Clique sur OK pour poursuivre.

10) Si des malwares ont été détectés, leur liste s'affiche.
En cliquant sur Suppression (?) , MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.

11) MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Ferme le Bloc-notes. (Le rapport peut être retrouvé sous l'onglet Rapports/logs)

12) Ferme MBAM en cliquant sur Quitter.

13) Poste le rapport dans ta réponse

merci beaucoup

voila le log Mbam (scan rapide seulement), un element trouve

Malwarebytes' Anti-Malware 1.31
Version de la base de données: 1464
Windows 6.0.6001 Service Pack 1

05/12/2008 22:17:02
mbam-log-2008-12-05 (22-17-02).txt

Type de recherche: Examen rapide
Eléments examinés: 51240
Temps écoulé: 3 minute(s), 11 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\xpre (Trojan.Downloader) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Re,

désinstalle Spybot S&D (démarrer, Panneau de configuration et Ajout.suppression de programmes)

==================

On va utiliser ComboFix.exe. Rends toi sur cette page web pour obtenir les liens de téléchargement, ainsi que des instructions pour exécuter l'outil:

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

* Vérifie que tu as fermé/désactivé tous les programmes anti-virus, anti-malware ou anti-spyware afin qu'ils n'interfèrent pas avec le travail de ComboFix.

Envoie le contenu de C:\ComboFix.txt dans ta prochaine réponse afin que je l'examine.

salut

voici le log combofix
cela m'a pris un peu de temps car j'ai eu du mal a voir comment cela marchait avec vista, mais bon j'ai charge la recovery console sur dvd et j'ai redemare, j'espere que c'etait comme ca!
en tout cas merci encore

ComboFix 08-12-06.06 - CORECOG 2008-12-07 11:01:12.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.1190 [GMT 0:00]
Running from: c:\users\CORECOG\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2008-11-07 to 2008-12-07 )))))))))))))))))))))))))))))))
.

2008-12-04 08:02 . 2008-12-04 08:02 <DIR> d-------- C:\rsit
2008-12-03 19:38 . 2008-12-03 19:38 <DIR> d-------- c:\users\CORECOG\AppData\Roaming\Malwarebytes
2008-12-03 19:38 . 2008-12-03 19:38 <DIR> d-------- c:\programdata\Malwarebytes
2008-12-03 19:38 . 2008-12-05 22:05 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-03 19:38 . 2008-12-03 19:52 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys
2008-12-03 19:38 . 2008-12-03 19:52 15,504 --a------ c:\windows\System32\drivers\mbam.sys
2008-12-03 16:17 . 2008-12-05 09:13 <DIR> d-------- C:\ToolBar SD
2008-12-03 15:13 . 2008-12-03 15:28 <DIR> d-------- C:\SDFix
2008-12-03 11:55 . 2008-12-03 11:55 153 --a------ c:\windows\wininit.ini
2008-12-03 11:05 . 2008-12-03 11:05 <DIR> d-------- c:\program files\Trend Micro
2008-12-03 10:57 . 2008-12-05 09:06 <DIR> d-------- c:\programdata\Spybot - Search & Destroy
2008-12-03 10:57 . 2008-12-05 09:06 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2008-12-02 21:12 . 2008-12-02 21:13 <DIR> d-------- c:\programdata\Lavasoft
2008-12-02 21:12 . 2008-12-02 21:12 <DIR> d-------- c:\program files\Lavasoft
2008-11-26 08:14 . 2008-10-21 05:25 1,645,568 --a------ c:\windows\System32\connect.dll
2008-11-26 08:14 . 2008-08-28 03:40 712,704 --a------ c:\windows\System32\WindowsCodecs.dll
2008-11-26 08:14 . 2008-08-28 03:40 425,472 --a------ c:\windows\System32\PhotoMetadataHandler.dll
2008-11-26 08:14 . 2008-08-28 03:40 347,136 --a------ c:\windows\System32\WindowsCodecsExt.dll
2008-11-26 08:14 . 2008-10-22 03:57 241,152 --a------ c:\windows\System32\PortableDeviceApi.dll
2008-11-22 08:03 . 2008-10-16 21:13 1,809,944 --a------ c:\windows\System32\wuaueng.dll
2008-11-22 08:03 . 2008-10-16 20:56 1,524,736 --a------ c:\windows\System32\wucltux.dll
2008-11-22 08:03 . 2008-10-16 21:12 561,688 --a------ c:\windows\System32\wuapi.dll
2008-11-22 08:03 . 2008-10-16 20:55 83,456 --a------ c:\windows\System32\wudriver.dll
2008-11-22 08:03 . 2008-10-16 21:09 51,224 --a------ c:\windows\System32\wuauclt.exe
2008-11-22 08:03 . 2008-10-16 21:09 43,544 --a------ c:\windows\System32\wups2.dll
2008-11-22 08:03 . 2008-10-16 21:08 34,328 --a------ c:\windows\System32\wups.dll
2008-11-22 08:02 . 2008-10-16 14:08 162,064 --a------ c:\windows\System32\wuwebv.dll
2008-11-22 08:02 . 2008-10-16 13:56 31,232 --a------ c:\windows\System32\wuapp.exe
2008-11-11 19:26 . 2008-09-10 03:40 1,334,272 --a------ c:\windows\System32\msxml6.dll
2008-11-11 19:26 . 2008-09-05 05:14 1,191,936 --a------ c:\windows\System32\msxml3.dll
2008-11-11 19:26 . 2008-08-27 01:05 212,480 --a------ c:\windows\System32\drivers\mrxsmb10.sys
2008-11-11 19:22 . 2008-11-11 19:22 0 --ah----- c:\windows\System32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2008-11-11 14:52 . 2000-05-22 00:58 647,872 --------- c:\windows\System32\Mscomct2.ocx
2008-11-11 14:52 . 2006-10-05 22:17 53,248 --------- c:\windows\Ctregrun.exe
2008-11-11 14:51 . 2008-11-11 14:54 <DIR> d-------- c:\programdata\Creative
2008-11-11 14:49 . 2008-11-11 14:51 <DIR> d--h----- c:\program files\Creative Installation Information
2008-11-11 14:49 . 2008-11-11 14:52 <DIR> d-------- c:\program files\Creative
2008-11-11 14:49 . 2008-11-11 14:49 <DIR> d-------- c:\program files\Common Files\Creative
2008-11-10 13:05 . 2008-11-10 13:05 <DIR> d-------- c:\programdata\Apple Computer
2008-11-10 13:05 . 2008-11-10 13:05 <DIR> d-------- c:\program files\Common Files\Apple

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-07 09:57 --------- d-----w c:\users\CORECOG\AppData\Roaming\Azureus
2008-12-02 21:11 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-12-02 18:05 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-02 14:37 --------- d-----w c:\program files\Return to Castle Wolfenstein
2008-12-02 14:32 --------- d-----w c:\program files\EA GAMES
2008-12-01 21:07 --------- d-----w c:\users\CORECOG\AppData\Roaming\Gearbox Software
2008-11-24 08:07 --------- d-----w c:\program files\Azureus
2008-11-10 13:06 --------- d-----w c:\program files\QuickTime
2008-10-22 07:50 --------- d-----w c:\program files\Windows Mail
2008-10-02 03:49 827,392 ----a-w c:\windows\System32\wininet.dll
2008-09-30 16:43 1,286,152 ----a-w c:\windows\System32\msxml4.dll
2008-09-18 05:09 3,601,464 ----a-w c:\windows\System32\ntkrnlpa.exe
2008-09-18 05:09 3,549,240 ----a-w c:\windows\System32\ntoskrnl.exe
2008-09-18 04:56 147,456 ----a-w c:\windows\System32\Faultrep.dll
2008-09-18 04:56 125,952 ----a-w c:\windows\System32\wersvc.dll
2008-09-18 02:16 2,032,640 ----a-w c:\windows\System32\win32k.sys
2008-07-22 21:56 174 --sha-w c:\program files\desktop.ini
2008-07-12 19:55 22,328 ----a-w c:\users\CORECOG\AppData\Roaming\PnkBstrK.sys
2008-01-29 12:45 0 ----a-w c:\users\CORECOG\AppData\Roaming\wklnhst.dat
.

((((((((((((((((((((((((((((( snapshot@2008-12-03_15.58.19.44 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-12-03 15:53:24 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2008-12-07 10:56:33 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2008-12-07 10:56:33 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2008-12-03 15:53:46 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-12-07 10:58:10 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-12-07 10:58:10 262,144 ---ha-w c:\windows\ServiceProfiles\LocalService\ntuser.dat.LOG1
- 2008-12-03 15:53:47 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-12-07 10:58:15 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-12-07 10:58:15 262,144 ---ha-w c:\windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
- 2008-12-03 15:55:02 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-12-07 10:56:34 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-12-03 15:55:02 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-12-07 10:56:34 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-12-03 15:55:02 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-12-07 10:56:34 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-12-03 15:46:43 262,144 ----a-w c:\windows\System32\config\systemprofile\ntuser.dat
+ 2008-12-07 10:59:44 262,144 ----a-w c:\windows\System32\config\systemprofile\ntuser.dat
- 2008-12-03 15:47:29 106,696 ----a-w c:\windows\System32\perfc009.dat
+ 2008-12-07 11:03:15 106,696 ----a-w c:\windows\System32\perfc009.dat
- 2008-12-03 15:47:29 603,282 ----a-w c:\windows\System32\perfh009.dat
+ 2008-12-07 11:03:15 603,282 ----a-w c:\windows\System32\perfh009.dat
- 2008-12-03 15:55:37 10,690 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-166733217-2719804015-3413246162-1000_UserData.bin
+ 2008-12-07 10:58:27 10,698 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-166733217-2719804015-3413246162-1000_UserData.bin
- 2008-12-03 15:55:37 72,602 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-12-07 10:58:27 72,926 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2008-08-14 12:27:31 2,564 ----a-w c:\windows\System32\WDI\ERCQueuedResolutions.dat
+ 2008-12-06 16:43:52 1,794 ----a-w c:\windows\System32\WDI\ERCQueuedResolutions.dat
- 2008-12-03 15:43:08 46,892 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-12-07 10:58:25 47,250 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
- 2008-11-30 19:30:44 193,418 ----a-w c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2008-12-06 12:40:18 217,990 ----a-w c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
- 2008-11-28 15:08:02 156,362 ----a-w c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S4.bin
+ 2008-12-06 12:05:31 173,260 ----a-w c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S4.bin
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"ATnotes.exe"="c:\program files\ATnotes\ATnotes.exe" [2005-01-05 1015808]
"TClockEx"="c:\program files\TClockEx\TCLOCKEX.EXE" [2000-03-09 89088]
"swg"="c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-01-29 171448]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2008-03-20 217544]
"CTSyncU.exe"="c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 868352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-03-21 174872]
"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-11-22 630784]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-03-01 857648]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 79224]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-04-18 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-04-18 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-04-18 141848]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"CTCheck"="c:\program files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe" [2007-11-06 397312]
"RtHDVCpl"="RtHDVCpl.exe" [2007-01-18 c:\windows\RtHDVCpl.exe]

c:\users\CORECOG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2008-07-28 575488]
WordWeb.lnk - c:\program files\WordWeb\wweb32.exe [2008-01-29 18944]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]
Device Detector 3.lnk - c:\program files\Olympus\DeviceDetector\DevDtct2.exe [2008-02-03 163840]
Directrec Configuration Tool.lnk - c:\program files\Olympus\DeviceDetector\DirectrecConfig.exe [2008-02-03 122880]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"FilterAdministratorToken"= 1 (0x1)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\kagavuva.dll c:\windows\system32\sufohuwe.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.clmp3enc"= c:\progra~1\CYBERL~1\Power2Go\CLMP3Enc.ACM
"VIDC.X264"= x264vfw.dll
"VIDC.3iv2"= 3ivxVfWCodec.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"TCP Query User{525F25C8-70FD-401C-84B3-553BD3CF39D5}c:\\program files\\azureus\\azureus.exe"= UDP:c:\program files\azureus\azureus.exe:Azureus
"UDP Query User{492EFF8F-39BC-4A61-877D-414BB04749CB}c:\\program files\\azureus\\azureus.exe"= TCP:c:\program files\azureus\azureus.exe:Azureus
"{C11C63EC-288D-4EB0-93D8-A20E8599B72B}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{7171B7A2-F3E8-477D-B686-FD95E0DC1872}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{3FDBADCB-8A87-4F31-AA25-BEC235E3D070}"= UDP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{19C38AA1-5B33-4DC4-88CF-DE143A9963F2}"= TCP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{6463B37B-C9D5-478A-B52A-2F2C395B99B5}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{E9730032-4994-4BD5-9A67-826914FB31F7}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{9847D713-CD9A-448B-A62F-4F26458009DB}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{7A6FE7F7-D035-45D7-A791-0259520BCA8B}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{3F69A3FA-B10A-4E72-B796-1EF23488EF6F}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"TCP Query User{0BAB2137-9FB8-4F27-B328-A2E71C35DFE6}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{15126E54-E5BC-4CBA-84C3-B3196BC10FAA}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox
"{7670FDF4-03B9-403C-9A1E-5B5FD8C2A518}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{B3CF5217-642B-451F-A241-0D028694B28C}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{CAFB00F4-A3CE-4A4A-B85D-2964E8FC8C3C}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{6346D3D6-E9D3-4FE9-A768-39FE3265812D}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{082E9DD0-DEEA-4B3C-842D-97650CC87509}"= UDP:c:\program files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"{583B439C-2137-4466-B516-FB5A5C91C7A1}"= TCP:c:\program files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"TCP Query User{EF56FB63-9856-4D37-AADA-CCF90960E83F}c:\\users\\corecog\\documents\\azureus downloads\\counter-strike 1.6 + half-life\\hl.exe"= UDP:c:\users\corecog\documents\azureus downloads\counter-strike 1.6 + half-life\hl.exe:hl.exe
"UDP Query User{3E88F6C8-8434-4DFF-9D83-88192FA62A72}c:\\users\\corecog\\documents\\azureus downloads\\counter-strike 1.6 + half-life\\hl.exe"= TCP:c:\users\corecog\documents\azureus downloads\counter-strike 1.6 + half-life\hl.exe:hl.exe
"{4B3D47E5-2932-4AE6-87AB-7A9AD0392D1B}"= UDP:c:\windows\System32\VSSVC.exe:vssvc
"{48F3E500-ABDA-4D95-AD7D-488877C59DB4}"= TCP:c:\windows\System32\VSSVC.exe:vssvc

R0 O2MDRDR;O2MDRDR;c:\windows\system32\DRIVERS\o2media.sys [2007-04-03 39680]
R0 O2SDRDR;O2SDRDR;c:\windows\system32\DRIVERS\o2sd.sys [2007-04-02 35712]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-04-19 75856]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-04-19 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\DRIVERS\aswMonFlt.sys [2008-01-29 50768]
R3 DCamUSBGene;GenesysLogic USB2.0 PC Camera;c:\windows\system32\DRIVERS\usbgene.sys [2007-09-06 123776]
R3 GETND6V;VIA Velocity Family Gigabit Ethernet Adapter Driver;c:\windows\system32\DRIVERS\getnd6v.sys [2007-09-27 47104]
S3 GETNDIS;VIA Networking Velocity Family Gigabit Ethernet Adapter Driver;c:\windows\system32\DRIVERS\getnd6.sys [2006-11-02 38912]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8591b9be-734b-11dd-b8ce-00030d000001}]
\shell\AutoRun\command - xih9.cmd
\shell\explore\Command - xih9.cmd
\shell\open\Command - xih9.cmd

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a0eda68e-6308-11dd-8850-00030d000001}]
\shell\AutoRun\command - Autorun.exe /run
\shell\Shell00\Command - Autorun.exe /run
\shell\Shell01\Command - Autorun.exe /action
\shell\Shell02\Command - Autorun.exe /uninstall

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bca85651-4eb7-11dd-9586-00030d000001}]
\shell\AutoRun\command - d:\setup\rsrc\Autorun.exe
\shell\dinstall\command - d:\directx\dxsetup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fab233eb-5ca0-11dd-a8b9-00030d000001}]
\shell\AutoRun\command - F:\autorun.exe
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{947631EC-6480-455D-9058-3FCDC85DC3FD} - c:\windows\system32\winfe77.dll

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.philips.com/pc
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FireFox -: Profile - c:\users\CORECOG\AppData\Roaming\Mozilla\Firefox\Profiles\81omlbzw.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - www.mail.yahoo.com
FF -: plugin - c:\program files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - c:\program files\Yahoo!\Shared\npYState.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-07 11:03:53
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-12-07 11:05:21
ComboFix-quarantined-files.txt 2008-12-07 11:05:18
ComboFix2.txt 2008-12-03 15:59:35

Pre-Run: 13,457,346,560 bytes free
Post-Run: 12,803,301,376 bytes free

230 --- E O F --- 2008-12-04 19:21:05