View original (French)

Win32:Adware-gen [Adw]

Solved/Closed
nico -  
Good evening, it's late and I don't know what to do! Indeed, Avast is indicating that my PC is infected with a file "Win32:Adware-gen [Adw]"... I'm a total novice when it comes to removing viruses, and a simple "delete" unfortunately isn't enough!
I admit that I'm extremely stressed by this attack (I'm shaking!). I don't know exactly what I'm at risk for and, above all, how to get rid of this crap! I'm eagerly waiting for your help and if I manage to close my eyes, that would be great...
Thank you in advance for everything.
Configuration: Windows XP Internet Explorer 7.0

34 answers

  1. nico
    I would love to, just to close the issue ;), but I can't change the status of the problem, maybe it's because I'm not a member?! In that case, I can try to report one of our latest posts to a mod, letting them know they can mark it as "resolved"?
    0
    1. nico
      Ok, I think everything is good, thanks again, and if I ever have another problem of this kind I’ll know who to turn to! (even if I’d prefer not to have to resort to it ;))
      Kudos for the work done and good luck for the future vernie29!
      0
      1. verni29 Security Contributor
        Don't forget to mark it as resolved.
        0
    2. nico
      Yes, I am glad that he is reacting, but the "deny access" box is checked by default... Should I leave it like this and click OK or change the option (delete, remove, quarantine, ignore)? Moreover, I clicked on the JS\director.A link and it is not recognized on the antivirus site. After that, I will clean up the system and mark the topic as resolved.
      I deeply thank you for the attention you have given to my problem and the time you have dedicated to it, hats off!
      0
      1. verni29 Security Contributor
        Give yourself the choice to be able to delete.
        Unless you know the file that is displayed during alerts, I would advise you to never open that kind of thing.

        HELLO.
        0
    3. nico
      Alert! After posting this message, I went online, and my antivirus alerted me that a virus was found:
      "A virus or unwanted program was found!
      C:\Documents and Settings\Temporary Internet files\Content.IE5\0L6YB5IN\prototype[1]"
      Below it is marked:
      "contains detection pattern of the Java script virus
      JS/Director.A (in the form of a link).
      What should I do? Put it in quarantine, delete it...?
      0
      1. verni29 Security Contributor
        Go :
        Programs --> Accessories --> System Tools --> Disk Cleanup
        The temporary files option must be checked.

        It's Antivir that's reacting. Good sign, right?
        You can trust it if your antivirus detects an intrusion and blocks it.
        0
    5. nico
      Hijack report:

      Logfile of HijackThis v1.99.1
      Scan saved at 14:53:30, on 12/07/2008
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.6000.16674)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
      C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
      C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
      C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      C:\WINDOWS\system32\nvsvc32.exe
      C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
      C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\RTHDCPL.EXE
      C:\WINDOWS\system32\RUNDLL32.EXE
      C:\Program Files\Java\jre1.6.0\bin\jusched.exe
      C:\Program Files\DAEMON Tools\daemon.exe
      C:\PROGRA~1\Wanadoo\CnxMon.exe
      C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
      C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
      C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
      C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
      C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
      C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
      C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe
      C:\WINDOWS\system32\wuauclt.exe
      C:\DOCUME~1\Nicolas\LOCALS~1\Temp\Rar$EX00.750\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Links
      R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
      O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll
      O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
      O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
      O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
      O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
      O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
      O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe
      O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\JMRaidSetup.exe boot
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
      O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
      O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
      O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exe
      O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
      O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
      O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
      O4 - HKLM\..\Run: [DaemonTools_WhenUSave_Installer] C:\Program Files\DaemonTools_WhenUSave_Installer\DaemonTools_WhenUSave_Installer.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
      O4 - HKCU\..\Run: [Steam] C:\Valve\Steam\Steam.exe -silent
      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
      O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
      O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
      O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
      O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
      O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
      O11 - Options group: [INTERNATIONAL] International*
      O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
      O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?e=1215865838395&h=d25db4a49e84af280db9dd1465543dae/&filename=jinstall-6u7-windows-i586-jc.cab
      O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
      O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
      O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
      O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
      O23 - Service: SbPF.Launcher - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
      O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe

      For your information, I still have programs on the desktop (malwarebytes, sreng2) with the associated folders and files, as well as the infamous fix.reg. What should I do with all of this?
      And in my programs, the antivirus XP08 still appears, should I remove it via the control panel?
      0
      1. verni29 Security Contributor
        For the programs:
        - MalwareBytes: keep it, you found it useful to have this tool.
        - Sreng: delete
        - Hijackthis: you can remove it. It won't be very useful to you.
        - Fix.reg: unnecessary, delete

        For antivirusXP08, as I told you, download TunesUp.
        It's free to use for 30 days. After that, you will uninstall it.
        It's a very good tool to optimize your PC.

        One last thing. Before deleting Hijackthis ( via Add/Remove Programs ), you will remove the following lines ( these are processes that start up with Windows and are unnecessary. They take up RAM )

        close your browser.
        Launch Hijackthis and select "Do a system scan only."
        You select the following lines:

        O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
        O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
        O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
        O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
        O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
        O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
        O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
        O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

        You choose the "Fixchecked" option at the bottom of the page.

        That said, I believe we are at the end of the road.
        Glad to have been of service to you.

        Goodbye.

        Can you mark the topic as resolved, please?
        0
    6. nico
      installation of java ok, it has of course allowed me to see the effectiveness of the firewall (impressive!). I have a small issue with the last link (the one from step 4), it is apparently incorrect (according to Orange). See you soon!
      0
      2. nico
        @verni29surely in one of your many infection resolutions ;)
        Just so you know, do I only need the executable or do I still need to install it?
        0
      3. verni29 Security Contributor
        @nicoYou execute it only.
        0
    7. nico
      Sorry, once again I rushed too much... I can't restart the PC, here is what the last installation window displays: "The wizard was interrupted before Sunbelt (..) could be completely installed.
      Your system has not been modified. To complete installation at another time, please run setup again.
      Click finish to exit (...)."
      So I will click and restart the installation!
      0
      1. nico
        I restarted the installation, and this time everything went smoothly. The firewall icon is in my taskbar, and the program is running. See you later!
        0
    8. nico
      It's done, thank you. I've started the installation of Sunbelt Personal Firewall, everything went normally, but before the last window asking me to restart the PC to finish the installation, I got an error message "internal error...". I clicked on "OK" (no other choice), and now I can restart my PC. That said, would the installation still have been completed successfully?
      0
      1. verni29 Security Contributor
        You'll know if it's correctly installed after the restart.

        See you!
        0
    9. verni29 Security Contributor
      Nico,

      Here is the solution to disable the resident protection:

      start menu --> Programs --> Avast

      Open Avast (it should not be the skin but the normal interface)

      Settings --> Resident Protection

      set to disable

      A+
      0
      1. verni29 Security Contributor
        Another link.

        https://www.clubic.com/telecharger-fiche10821-avira-antivir-personal-free-antivirus.html
        0
        1. nico
          Ok, download started, it's already much lighter.. I'll keep you posted, thanks, see you later.
          0
        2. nico
          @nicoTo uninstall Avast, since I no longer have the icon at the bottom, I can no longer access the dropdown menu by right-clicking to disable its self-defense module. What should I do?
          0
        3. verni29 Security Contributor
          @nicoOpen Avast and disable the module.
          I'm providing you with a tutorial:
          https://forums.cnetfrance.fr
          You need to disable all shields (web, P2P, ...)

          Avast is not installed on my machine (but on the virtual machine and I need to start it)

          If you can't do it, let me know.
          0
      2. nico
        I think you are more informed than I am on the issue of protection, so I will follow your "guidelines" and install what needs to be installed. I will then post another Hijackthis report. See you later!
        0
        1. nico
          Problem with the installation of antivirus... I downloaded the archive, extracted it into a folder, but the files present are neither executables nor setups. There are 2 files that I think could perform the installation: "install" which is only a type "file" 60kb and ".installrc", in "installrc file" which is 1kb. The licenses are in .DE, I cannot read them. However, there are other folders like "bin", "contrib", "gui", "script", or "vdf" for example. Should I search inside those to find an executable file?
          0
        2. verni29 Security Contributor
          @nicoI check.
          0
      3. nico
        HijackThis report:

        Logfile of Trend Micro HijackThis v2.0.2
        Scan saved at 12:20:19, on 12/07/2008
        Platform: Windows XP SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v7.00 (7.00.6000.16674)
        Boot mode: Normal

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
        C:\Program Files\Alwil Software\Avast4\ashServ.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        C:\WINDOWS\system32\nvsvc32.exe
        C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
        C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
        C:\WINDOWS\Explorer.EXE
        C:\WINDOWS\RTHDCPL.EXE
        C:\WINDOWS\system32\RUNDLL32.EXE
        C:\Program Files\Java\jre1.6.0\bin\jusched.exe
        C:\Program Files\DAEMON Tools\daemon.exe
        C:\PROGRA~1\Wanadoo\CnxMon.exe
        C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
        C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
        C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
        C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
        C:\WINDOWS\system32\wuauclt.exe
        C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Links
        R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
        O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll
        O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
        O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
        O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
        O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
        O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
        O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe
        O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\JMRaidSetup.exe boot
        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
        O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
        O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
        O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
        O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
        O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exe
        O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
        O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
        O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
        O4 - HKLM\..\Run: [DaemonTools_WhenUSave_Installer] C:\Program Files\DaemonTools_WhenUSave_Installer\DaemonTools_WhenUSave_Installer.exe
        O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
        O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
        O4 - HKCU\..\Run: [Steam] C:\Valve\Steam\Steam.exe -silent
        O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
        O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
        O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
        O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
        O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
        O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
        O9 - Extra button: Wanadoo Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
        O9 - Extra 'Tools' menuitem: Wanadoo Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
        O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
        O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
        O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
        O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
        O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
        O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
        O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

        --
        End of file - 6410 bytes
        0
        1. verni29 Security Contributor
          Indeed, we keep running into each other.
          Check the security points on your PC.

          Give me your opinion.
          0
      4. nico
        Ok, sorry for the response time but I had some issues with the forum page display. So yes, it does appear in the add/remove programs. I don't remember if I used it or not, I don't think so because it should have asked me to acquire a license, which I didn't do. But it's true that it installed itself and appeared suddenly a little after the infection was found...
        Anyway, what should I do? How should my PC react?
        0
        1. verni29 Security Contributor
          Do you have ad pages like in message 35 (you know, the thing you had never seen).

          Can you post a Hijackthis report for me?

          Then, we'll see about the cleanup.
          0
        2. verni29 Security Contributor
          @verni29For your question about your wallpaper, it's the file we used with OTmoveIt:

          moveit report!
          File/Folder C:\WINDOWS\system32\Iphc3rnj0ecfn.exe not found.
          OTmoveIt 2 by Oldimer - version 1.0.4.3 log created on 07102008_181601
          0
        3. nico
          @verni29No, I don't have any more pesky ads; however, I no longer have the little "Avast!" icon in my taskbar near the clock, but it is still properly installed. Am I at risk? (Report in the next message.)
          0
        4. verni29 Security Contributor
          @nicoFor Avast, I believe the problem will be resolved.

          1) Your computer is not properly protected.
          Avast is not enough. The proof!!!
          However, I see that you have
          Spybot, keep it, it's very good.
          I would rather recommend Antivir:

          I'm attaching an article comparing Avast and Antivir
          http://forum.malekal.com/ftopic3528.php

          Antivir tutorial:
          https://www.malekal.com/avira-free-security-antivirus-gratuit/

          Uninstalling Avast:
          https://www.avast.com/fr-fr/uninstall-utility

          Second protection you must have: the firewall
          I will indicate two possible products (in French)

          Kerio Personal Firewall
          http://www.sunbelt-software.com/Kerio-Download.cfm
          Tutorial: https://www.malekal.com/tutorial-et-guide-counterspy/

          PC Tools Firewall Plus
          https://fr.norton.com/

          3) Java: go to this site
          https://www.java.com/fr/download/manual.jsp

          In the Windows section, click on check now.
          Another window will open. Follow the instructions.

          4) We will remove the software that has been used..
          Download ToolsCleaner to the desktop
          http://perso.orange.fr/AceRothstein/ToolsCleaner2.exe
          Double-click on ToolsCleaner2.exe --> Search --> Delete.
          It is possible that your desktop will disappear.

          If the screen does not reappear, press Ctrl + Alt + Delete. This will open the task manager.
          In the Processes tab, click on the File menu, then Run and type Explorer. Confirm.

          5) You will recreate a clean restore point.

          To recreate a restore point:
          Start --> Programs --> Accessories --> System Tools --> System Restore

          Choose "Create a restore point". Follow the prompts.

          After these various actions, send me a Hijackthis report and we'll take stock.
          0
      5. nico
        Moreover, since the appearance of the virus, I have a blue screen as my background, and I wanted to put my old background back, and the name of the blue screen intrigued me... it is the same name as the first file found by Avast!: an image file named "phc3rnj0ecfn". I suppose that it's normal, but can I put my usual background back? Is it a harmless "residue"?
        0
        1. verni29 Security Contributor
          Yes, it is harmless, cleaned.

          For antivirXP08, I just checked. It's an empty entry in add/remove programs.
          A software like TunesUp cleans up this kind of entry.
          0
      6. nico
        Hello, here are the 2 reports:
        - the one from DiagHelp:

        DiagHelp version v1.4 - http://www.malekal.com
        executed on 12/07/2008 at 9:54:29.87

        List of the latest files modified/created in windir\system32 and prefetch
        C:\WINDOWS\prefetch\CMD.EXE-087B4001.pf -->12/07/2008 09:54:29
        C:\WINDOWS\prefetch\CHCP.COM-18156052.pf -->12/07/2008 09:54:24
        C:\WINDOWS\prefetch\GOOGLEUPDATER.EXE-2CAF5929.pf -->12/07/2008 09:54:18
        C:\WINDOWS\prefetch\WINRAR.EXE-39C6DAD9.pf -->12/07/2008 09:53:16
        C:\WINDOWS\prefetch\VERCLSID.EXE-3667BD89.pf -->12/07/2008 09:52:34
        C:\WINDOWS\prefetch\RUNDLL32.EXE-451FC2C0.pf -->12/07/2008 09:52:13
        C:\WINDOWS\prefetch\WUAUCLT.EXE-399A8E72.pf -->12/07/2008 09:44:42
        C:\WINDOWS\prefetch\WMIPRVSE.EXE-28F301A9.pf -->12/07/2008 09:44:42
        C:\WINDOWS\prefetch\NTOSBOOT-B00DFAAD.pf -->12/07/2008 09:44:42
        C:\WINDOWS\prefetch\CONTROL.EXE-013DBFB5.pf -->10/07/2008 22:53:08

        C:\WINDOWS\System32\drivers\mbamcatchme.sys -->07/07/2008 17:35:36
        C:\WINDOWS\System32\drivers\mbam.sys -->07/07/2008 17:35:30
        C:\WINDOWS\System32\drivers\tcpip.sys -->20/06/2008 12:45:13
        C:\WINDOWS\System32\drivers\afd.sys -->20/06/2008 12:44:38
        C:\WINDOWS\System32\drivers\tcpip6.sys -->20/06/2008 11:52:06
        C:\WINDOWS\System32\drivers\bthport.sys -->14/06/2008 19:59:52
        C:\WINDOWS\System32\drivers\aswSP.sys -->16/05/2008 01:20:32

        C:\WINDOWS\System32\wpa.dbl -->12/07/2008 09:43:14
        C:\WINDOWS\System32\67d5e971-.txt -->10/07/2008 18:39:41
        C:\WINDOWS\System32\PerfStringBackup.INI -->08/07/2008 11:14:18
        C:\WINDOWS\System32\perfh00C.dat -->08/07/2008 11:14:18
        C:\WINDOWS\System32\perfh009.dat -->08/07/2008 11:14:18
        C:\WINDOWS\System32\perfc00C.dat -->08/07/2008 11:14:18
        C:\WINDOWS\System32\perfc009.dat -->08/07/2008 11:14:18
        C:\WINDOWS\System32\FNTCACHE.DAT -->08/07/2008 02:48:56
        C:\WINDOWS\System32\TZLog.log -->08/07/2008 01:44:19
        C:\WINDOWS\System32\CONFIG.NT -->07/07/2008 22:36:32
        C:\WINDOWS\System32\CmdLineExt03.dll -->06/07/2008 00:50:22
        C:\WINDOWS\System32\MRT.exe -->25/06/2008 18:15:46
        C:\WINDOWS\System32\mswsock.dll -->20/06/2008 19:41:06
        C:\WINDOWS\System32\dnsapi.dll -->20/06/2008 19:41:06
        C:\WINDOWS\System32\aswBoot.exe -->16/05/2008 01:24:43
        C:\WINDOWS\System32\AvastSS.scr -->16/05/2008 01:12:36
        C:\WINDOWS\System32\quartz.dll -->07/05/2008 07:15:36
        C:\WINDOWS\System32\mshtml.dll -->23/04/2008 22:16:42
        C:\WINDOWS\System32\wininet.dll -->23/04/2008 06:16:40
        C:\WINDOWS\System32\webcheck.dll -->23/04/2008 06:16:40
        C:\WINDOWS\System32\urlmon.dll -->23/04/2008 06:16:40
        C:\WINDOWS\System32\url.dll -->23/04/2008 06:16:40
        C:\WINDOWS\System32\pngfilt.dll -->23/04/2008 06:16:40
        C:\WINDOWS\System32\occache.dll -->23/04/2008 06:16:40
        C:\WINDOWS\System32\mstime.dll -->23/04/2008 06:16:40

        C:\WINDOWS\0.log -->12/07/2008 09:43:18
        C:\WINDOWS\WindowsUpdate.log -->12/07/2008 09:43:17
        C:\WINDOWS\bootstat.dat -->12/07/2008 09:43:12
        C:\WINDOWS\SchedLgU.Txt -->10/07/2008 22:53:34
        C:\WINDOWS\system.ini -->10/07/2008 21:32:51
        C:\WINDOWS\wininit.ini -->10/07/2008 04:41:39
        C:\WINDOWS\NeroDigital.ini -->10/07/2008 01:31:45
        C:\WINDOWS\QTFont.qfn -->09/07/2008 14:55:19
        C:\WINDOWS\win.ini -->07/02/2008 19:39:15
        C:\WINDOWS\BricoPackUninst.txt -->17/09/2007 00:13:06
        C:\WINDOWS\BricoPackUninst.cmd -->17/09/2007 00:13:06
        C:\WINDOWS\BricoPackFoldersDelete.cmd -->17/09/2007 00:13:06
        C:\WINDOWS\BricoPack Wallpaper.bmp -->17/09/2007 00:12:56
        C:\WINDOWS\QTFont.for -->16/09/2007 23:23:41
        C:\WINDOWS\HideWin.exe -->11/09/2007 16:00:43

        winlogon.exe
        Verified: Signed
        svchost.exe
        Verified: Signed
        ws2_32.dll
        Verified: Signed
        user32.dll
        Verified: Signed
        tcpip.sys
        Verified: Signed
        ndis.sys
        Verified: Signed
        null.sys
        Verified: Signed

        ListDLLs v2.25 - DLL lister for Win9x/NT
        Copyright (C) 1997-2004 Mark Russinovich
        Sysinternals - www.sysinternals.com

        ------------------------------------------------------------------------------
        explorer.exe pid: 1748
        Command line: C:\WINDOWS\Explorer.EXE

        Base Size Version Path
        0x44080000 0xd0000 7.00.6000.16674 C:\WINDOWS\system32\WININET.dll
        0x00400000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll
        0x43e00000 0x45000 7.00.6000.16674 C:\WINDOWS\system32\iertutil.dll
        0x58b50000 0x9a000 5.82.2900.2982 C:\WINDOWS\system32\comctl32.dll
        0x76f80000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL
        0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll
        0x4c5a0000 0x18000 9.00.0000.3250 C:\PROGRA~1\WINDOW~2\wmpband.dll
        0x76ac0000 0x11000 3.05.2284.0000 C:\WINDOWS\system32\ATL.DLL
        0x7d200000 0x2be000 3.01.4000.4039 C:\WINDOWS\system32\msi.dll
        0x44360000 0x5cd000 7.00.6000.16674 C:\WINDOWS\system32\ieframe.dll
        0x44160000 0x127000 7.00.6000.16674 C:\WINDOWS\system32\urlmon.dll
        0x442b0000 0x3c000 7.00.6000.16674 C:\WINDOWS\system32\webcheck.dll
        0x02150000 0x187000 1.06.0000.0012 C:\PROGRA~1\SPYBOT~1\SDHelper.dll
        0x43ff0000 0xa000 7.00.6000.16674 C:\WINDOWS\system32\jsproxy.dll
        0x74730000 0x3d000 3.525.1117.0000 C:\WINDOWS\system32\ODBC32.dll
        0x015d0000 0x18000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll
        0x61c20000 0x54000 8.00.0000.9118 C:\Program Files\OpenOffice.org 2.2\program\shlxthdl.dll
        0x5fc70000 0x18000 8.00.0000.9107 C:\Program Files\OpenOffice.org 2.2\program\uwinapi.dll
        0x7c340000 0x56000 7.10.3052.0004 C:\Program Files\OpenOffice.org 2.2\program\MSVCR71.dll
        0x61740000 0x8e000 4.05.2003.0120 C:\Program Files\OpenOffice.org 2.2\program\stlport_vc7145.dll
        0x7c3a0000 0x7b000 7.10.3077.0000 C:\Program Files\OpenOffice.org 2.2\program\MSVCP71.dll
        0x10000000 0x1c000 7.00.0000.0000 C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll
        0x00ed0000 0x2d000 C:\Program Files\WinRAR\rarext.dll
        0x00e10000 0x8000 1.00.0000.0000 C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll
        0x64f00000 0x12000 4.08.1201.0000 C:\Program Files\Alwil Software\Avast4\ashShell.dll
        0x03350000 0x836000 6.14.0011.6218 C:\WINDOWS\system32\nvcpl.dll
        0x74bf0000 0x2c000 4.02.5406.0000 C:\WINDOWS\system32\OLEACC.dll
        0x76010000 0x65000 6.02.3104.0000 C:\WINDOWS\system32\MSVCP60.dll
        0x03b90000 0x45000 6.14.0011.6218 C:\WINDOWS\system32\NVRSFR.DLL
        0x03be0000 0x5a000 6.14.0011.6218 C:\WINDOWS\system32\nvapi.dll
        0x03c40000 0x73000 6.14.0010.12002 C:\WINDOWS\system32\nvshell.dll
        0x60980000 0x7000 3.01.4000.1823 C:\WINDOWS\system32\MSISIP.DLL
        0x74e10000 0x10000 5.06.0000.8820 C:\WINDOWS\system32\wshext.dll
        0x73d20000 0xfe000 6.02.4131.0000 C:\WINDOWS\system32\MFC42.DLL
        0x61d70000 0xe000 6.00.8665.0000 C:\WINDOWS\system32\MFC42LOC.DLL
        0x59000000 0xe000 5.06.0000.6626 C:\WINDOWS\system32\wshFR.DLL

        ListDLLs v2.25 - DLL lister for Win9x/NT
        Copyright (C) 1997-2004 Mark Russinovich
        Sysinternals - www.sysinternals.com

        ------------------------------------------------------------------------------
        winlogon.exe pid: 756
        Command line: winlogon.exe

        Base Size Version Path
        0x01000000 0x81000 \??\C:\WINDOWS\system32\winlogon.exe
        0x58b50000 0x9a000 5.82.2900.2982 C:\WINDOWS\system32\COMCTL32.dll
        0x74730000 0x3d000 3.525.1117.0000 C:\WINDOWS\system32\ODBC32.dll
        0x20000000 0x18000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll
        0x76ac0000 0x11000 3.05.2284.0000 C:\WINDOWS\system32\ATL.DLL
        0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll
        0x76f80000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL

        The volume in drive C has no label.
        The volume serial number is 6CF6-2DA0

        Directory of C:\WINDOWS\system32

        02/03/2006 14:00 6,144 csrss.exe
        1 file(s) 6,144 bytes
        0 Dir(s) 145,096,974,336 bytes free

        Contents of Downloaded Program Files
        The volume in drive C has no label.
        The volume serial number is 6CF6-2DA0

        Directory of C:\WINDOWS\Downloaded Program Files

        07/07/2008 23:17 <DIR> .
        07/07/2008 23:17 <DIR> ..
        11/09/2007 15:48 65 desktop.ini
        24/03/2008 19:33 1,527,056 FP_AX_CAB_INSTALLER.exe
        24/03/2008 19:18 247 swflash.inf
        30/07/2007 19:24 293 wuweb.inf
        4 file(s) 1,527,661 bytes

        Total listed files:
        4 file(s) 1,527,661 bytes
        2 Dir(s) 145,096,974,336 bytes free

        Searching for rootkits! (Thank you S!Ri)

        Searching for known infections

        Export of sensitive keys..

        List of exceptions on the XP SP2 firewall

        "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
        "C:\\Program Files\\Sports Interactive\\Football Manager 2008\\fm.exe"="C:\\Program Files\\Sports Interactive\\Football Manager 2008\\fm.exe:*:Enabled:Football Manager 2008"
        "C:\\Valve\\Condition Zero\\czero.exe"="C:\\Valve\\Condition Zero\\czero.exe:*:Enabled:Condition Zero Launcher"
        "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
        "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
        "C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
        "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

        "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
        "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
        "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
        "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

        Export of the SharedTaskScheduler key

        [SharedTaskScheduler]
        "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui Preloader"
        "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Category Cache Demon"

        exports of policies
        REGEDIT4

        [system]
        "dontdisplaylastusername"=dword:00000000
        "legalnoticecaption"=""
        "legalnoticetext"=""
        "shutdownwithoutlogon"=dword:00000001
        "undockwithoutlogon"=dword:00000001
        "DisableRegistryTools"=dword:00000000
        "HideLegacyLogonScripts"=dword:00000000
        "HideLogoffScripts"=dword:00000000
        "RunLogonScriptSync"=dword:00000001
        "RunStartupScriptSync"=dword:00000000
        "HideStartupScripts"=dword:00000000

        Export of sensitive keys..
        Search for sensitive addresses in the HOSTS file...
        catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
        Rootkit scan 2008-07-12 09:54:49
        Windows 5.1.2600 Service Pack 2 NTFS

        scanning hidden services & system hive ...

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
        "s1"=dword:4fc02f53
        "s2"=dword:9f0a7575
        "h0"=dword:00000001

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
        "p0"="C:\Program Files\DAEMON Tools\"
        "h0"=dword:00000000
        "khjeh"=hex:de,79,dc,58,ce,b5,c3,98,63,44,e0,cb,09,e6,13,44,7b,3f,28,e4,66,..

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
        "a0"=hex:20,01,00,00,fd,2a,af,03,1a,53,b3,75,c5,ac,c3,08,ab,d4,5b,45,03,..
        "khjeh"=hex:ae,01,5e,0b,c3,ee,f8,b5,5f,26,36,02,af,ae,22,49,e7,b8,cc,b6,a3,..

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
        "khjeh"=hex:54,af,84,2e,29,36,52,b1,7c,4e,a8,d1,27,e9,ee,2f,ff,fd,09,e7,e3,..

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
        "khjeh"=hex:29,32,2e,5d,e1,30,08,82,7e,23,bf,c5,04,7d,f9,6d,53,1b,c1,92,9b,..

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42]
        "khjeh"=hex:97,07,10,c2,0c,28,1b,d2,ca,1f,cd,2c,85,02,e4,21,0e,bb,5a,74,4e,..
        [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
        "p0"="C:\Program Files\DAEMON Tools\"
        "h0"=dword:00000000
        "khjeh"=hex:de,79,dc,58,ce,b5,c3,98,63,44,e0,cb,09,e6,13,44,7b,3f,28,e4,66,..

        [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
        "a0"=hex:20,01,00,00,fd,2a,af,03,1a,53,b3,75,c5,ac,c3,08,ab,d4,5b,45,03,..
        "khjeh"=hex:ae,01,5e,0b,c3,ee,f8,b5,5f,26,36,02,af,ae,22,49,e7,b8,cc,b6,a3,..

        [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
        "khjeh"=hex:54,af,84,2e,29,36,52,b1,7c,4e,a8,d1,27,e9,ee,2f,ff,fd,09,e7,e3,..

        [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
        "khjeh"=hex:29,32,2e,5d,e1,30,08,82,7e,23,bf,c5,04,7d,f9,6d,53,1b,c1,92,9b,..

        [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42]
        "khjeh"=hex:97,07,10,c2,0c,28,1b,d2,ca,1f,cd,2c,85,02,e4,21,0e,bb,5a,74,4e,..

        scanning hidden registry entries ...

        scanning hidden files ...

        scan completed successfully
        hidden services: 0
        hidden files: 0

        KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

        Process list by traversal of KiWaitListHead

        4 - System
        224 - ashMaiSv.exe
        416 - ashWebSv.exe
        624 - alg.exe
        732 - csrss.exe
        756 - winlogon.exe
        800 - services.exe
        812 - lsass.exe
        968 - svchost.exe
        1016 - svchost.exe
        1056 - svchost.exe
        1136 - svchost.exe
        1172 - svchost.exe
        1344 - ashServ.exe
        1736 - AppleMobileDevi
        1748 - explorer.exe
        1764 - GoogleUpdaterSe
        1800 - nvsvc32.exe
        2144 - RTHDCPL.exe
        2228 - CnxMon.exe
        2240 - dragdiag.exe
        2256 - TaskBarIcon.exe
        2268 - ctfmon.exe
        2276 - GoogleToolbarNo
        2304 - msnmsgr.exe
        2312 - TeaTimer.exe
        3052 - cmd.exe

        Total number of processes = 27
        NOTE: Under WinXP, this will not show all processes.

        KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

        Driver/Module list by traversal of PsLoadedModuleList

        804D7000 - \WINDOWS\system32\ntkrnlpa.exe
        806E2000 - \WINDOWS\system32\hal.dll
        BADA8000 - \WINDOWS\system32\KDCOM.DLL
        BACB8000 - \WINDOWS\system32\BOOTVID.dll
        BA6D0000 - sptd.sys
        BADAA000 - \WINDOWS\System32\Drivers\WMILIB.SYS
        BA6B8000 - \WINDOWS\System32\Drivers\SCSIPORT.SYS
        BA689000 - ACPI.sys
        BA678000 - pci.sys
        BA8A8000 - isapnp.sys
        BAE70000 - pciide.sys
        BAB28000 - \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
        BA8B8000 - MountMgr.sys
        BA659000 - ftdisk.sys
        BAB30000 - PartMgr.sys
        BA8C8000 - VolSnap.sys
        BA641000 - atapi.sys
        BA8D8000 - jraid.sys
        BA8E8000 - disk.sys
        BA8F8000 - \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
        BA621000 - fltMgr.sys
        BA60A000 - KSecDD.sys
        BA57D000 - Ntfs.sys
        BA550000 - NDIS.sys
        BA535000 - Mup.sys
        BADAC000 - JGOGO.sys
        BAA28000 - \SystemRoot\system32\DRIVERS\intelppm.sys
        B9ACB000 - \SystemRoot\system32\DRIVERS\nv4_mini.sys
        B9AB7000 - \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
        BABC0000 - \SystemRoot\system32\DRIVERS\usbuhci.sys
        B9A94000 - \SystemRoot\system32\DRIVERS\USBPORT.SYS
        BABC8000 - \SystemRoot\system32\DRIVERS\usbehci.sys
        B9A6F000 - \SystemRoot\system32\DRIVERS\HDAudBus.sys
        B9A58000 - \SystemRoot\system32\DRIVERS\Rtenicxp.sys
        BABD0000 - \SystemRoot\system32\DRIVERS\fdc.sys
        B9A47000 - \SystemRoot\system32\DRIVERS\serial.sys
        BAD9C000 - \SystemRoot\system32\DRIVERS\serenum.sys
        B9A33000 - \SystemRoot\system32\DRIVERS\parport.sys
        BAA38000 - \SystemRoot\system32\DRIVERS\i8042prt.sys
        BABD8000 - \SystemRoot\system32\DRIVERS\mouclass.sys
        BABE0000 - \SystemRoot\system32\DRIVERS\kbdclass.sys
        BAA48000 - \SystemRoot\system32\DRIVERS\imapi.sys
        BAA58000 - \SystemRoot\system32\DRIVERS\cdrom.sys
        BAA68000 - \SystemRoot\system32\DRIVERS\redbook.sys
        B9A10000 - \SystemRoot\system32\DRIVERS\ks.sys
        B99C6000 - \SystemRoot\System32\Drivers\acn8ehko.SYS
        BAFF5000 - \SystemRoot\system32\DRIVERS\audstub.sys
        BAA78000 - \SystemRoot\system32\DRIVERS\rasl2tp.sys
        BA4F5000 - \SystemRoot\system32\DRIVERS\ndistapi.sys
        B9991000 - \SystemRoot\system32\DRIVERS\ndiswan.sys
        BAA88000 - \SystemRoot\system32\DRIVERS\raspppoe.sys
        BAA98000 - \SystemRoot\system32\DRIVERS\raspptp.sys
        BAC30000 - \SystemRoot\system32\DRIVERS\TDI.SYS
        B9980000 - \SystemRoot\system32\DRIVERS\psched.sys
        BAAA8000 - \SystemRoot\system32\DRIVERS\msgpc.sys
        BAC38000 - \SystemRoot\system32\DRIVERS\ptilink.sys
        BAC40000 - \SystemRoot\system32\DRIVERS\raspti.sys
        BAAD8000 - \SystemRoot\system32\DRIVERS\termdd.sys
        BADC2000 - \SystemRoot\system32\DRIVERS\swenum.sys
        B9927000 - \SystemRoot\system32\DRIVERS\update.sys
        BA4E9000 - \SystemRoot\system32\DRIVERS\mssmbios.sys
        BAAF8000 - \SystemRoot\System32\Drivers\NDProxy.SYS
        BAB18000 - \SystemRoot\system32\DRIVERS\usbhub.sys
        BADC4000 - \SystemRoot\system32\DRIVERS\USBD.SYS
        B6309000 - \SystemRoot\system32\drivers\RtkHDAud.sys
        B62E7000 - \SystemRoot\system32\drivers\portcls.sys
        BA928000 - \SystemRoot\system32\drivers\drmk.sys
        BAC70000 - \SystemRoot\system32\DRIVERS\flpydisk.sys
        BADF0000 - \SystemRoot\System32\Drivers\Fs_Rec.SYS
        BAF1D000 - \SystemRoot\System32\Drivers\Null.SYS
        BADF2000 - \SystemRoot\System32\Drivers\Beep.SYS
        BAC88000 - \SystemRoot\System32\drivers\vga.sys
        BADF4000 - \SystemRoot\System32\Drivers\mnmdd.SYS
        BADF6000 - \SystemRoot\System32\DRIVERS\RDPCDD.sys
        BAC90000 - \SystemRoot\System32\Drivers\Msfs.SYS
        BAC98000 - \SystemRoot\System32\Drivers\Npfs.SYS
        B6773000 - \SystemRoot\system32\DRIVERS\rasacd.sys
        B6264000 - \SystemRoot\system32\DRIVERS\ipsec.sys
        B620C000 - \SystemRoot\system32\DRIVERS\tcpip.sys
        BA998000 - \SystemRoot\System32\Drivers\aswTdi.SYS
        B61EB000 - \SystemRoot\system32\DRIVERS\ipnat.sys
        B61C3000 - \SystemRoot\system32\DRIVERS\netbt.sys
        BA9A8000 - \SystemRoot\system32\DRIVERS\wanarp.sys
        B61A1000 - \SystemRoot\System32\drivers\afd.sys
        BA9B8000 - \SystemRoot\system32\DRIVERS\netbios.sys
        B6176000 - \SystemRoot\system32\DRIVERS\rdbss.sys
        B6107000 - \SystemRoot\system32\DRIVERS\mrxsmb.sys
        BA9C8000 - \SystemRoot\System32\Drivers\Fips.SYS
        B60F0000 - \SystemRoot\System32\Drivers\aswSP.SYS
        BACA8000 - \SystemRoot\System32\Drivers\Aavmker4.SYS
        BA9E8000 - \SystemRoot\System32\Drivers\Cdfs.SYS
        BA9F8000 - \SystemRoot\system32\DRIVERS\alcaudsl.sys
        BAE00000 - \SystemRoot\system32\DRIVERS\alcawh.sys
        BAF65000 - \SystemRoot\system32\DRIVERS\alcacr.sys
        BAB40000 - \SystemRoot\system32\DRIVERS\usbccgp.sys
        BAA08000 - \SystemRoot\system32\DRIVERS\alcan5wn.sys
        BAA18000 - \SystemRoot\system32\drivers\usbaudio.sys
        BABA0000 - \SystemRoot\system32\DRIVERS\USBSTOR.SYS
        B6010000 - \SystemRoot\System32\Drivers\dump_atapi.sys
        BAE34000 - \SystemRoot\System32\Drivers\dump_WMILIB.SYS
        BF800000 - \SystemRoot\System32\win32k.sys
        BA505000 - \SystemRoot\System32\drivers\Dxapi.sys
        BABA8000 - \SystemRoot\System32\watchdog.sys
        BF9C3000 - \SystemRoot\System32\drivers\dxg.sys
        BAEEF000 - \SystemRoot\System32\drivers\dxgthk.sys
        BF9D5000 - \SystemRoot\System32\nv4_disp.dll
        BAC20000 - \SystemRoot\system32\DRIVERS\aswFsBlk.sys
        B5D24000 - \SystemRoot\system32\DRIVERS\ndisuio.sys
        B5BA2000 - \SystemRoot\System32\Drivers\aswMon2.SYS
        B59BE000 - \SystemRoot\system32\DRIVERS\mrxdav.sys
        BADD0000 - \SystemRoot\System32\Drivers\ParVdm.SYS
        B5854000 - \SystemRoot\system32\DRIVERS\srv.sys
        B5817000 - \SystemRoot\system32\drivers\wdmaud.sys
        B5AAA000 - \SystemRoot\system32\drivers\sysaudio.sys
        B5A1A000 - \SystemRoot\System32\Drivers\aswRdr.SYS
        B5264000 - \SystemRoot\System32\Drivers\HTTP.sys
        B4FB9000 - \SystemRoot\system32\drivers\kmixer.sys
        B4EF4000 - \SystemRoot\System32\Drivers\Fastfat.SYS
        BAEEC000 - \SystemRoot\System32\DRIVERS\KProcCheck.sys

        Total number of drivers = 119

        List of installed programs

        Adobe Flash Player ActiveX
        Adobe Reader 7.0.8 - French
        Age of Empires III
        Age of Empires III
        AntivirXP08
        Apple Mobile Device Support
        Apple Software Update
        WinRAR Archiver
        avast! Antivirus
        CCleaner (remove only)
        Patch for
        0
        1. verni29 Security Contributor
          Hello, Nico

          While I'm looking at the 2 reports, could you restart MalwareBytes (as a precaution)?

          Here’s the procedure:

          You've already downloaded the software and it's installed.

          Restart the computer in safe mode (press F8 after rebooting).
          Choose your user account.

          To launch MalwareBytes, double-click on the shortcut on the desktop.

          In the Search tab, select Run a full scan.
          Click on search. Only select the hard drives of the computer.
          Click on start the scan.

          At the end of the search, as requested, click on view search results.
          Then choose Deselect to clean the infections.
          Post the report in your next message.
          If you can't find it, open MalwareBytes and check in the Report/Logs tab. It's there.
          Click on it and choose open.

          See you soon.
          0
        2. nico
          @verni29Malware report, 3 infected files, which I deleted before emptying the quarantine:

          Malwarebytes' Anti-Malware 1.20
          Database version: 935
          Windows 5.1.2600 Service Pack 2

          11:28:01 12/07/2008
          mbam-log-7-12-2008 (11-28-01).txt

          Search type: Full scan (C:\|)
          Items scanned: 109335
          Elapsed time: 1 hour(s), 3 minute(s), 10 second(s)

          Infected memory processes: 0
          Infected memory modules: 0
          Infected Registry keys: 1
          Infected Registry values: 0
          Infected data elements in the Registry: 0
          Infected folders: 0
          Infected files: 3

          Infected memory processes:
          (No harmful items detected)

          Infected memory modules:
          (No harmful items detected)

          Infected Registry keys:
          HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\poof (Rootkit.Agent) -> Quarantined and deleted successfully.

          Infected Registry values:
          (No harmful items detected)

          Infected data elements in the Registry:
          (No harmful items detected)

          Infected folders:
          (No harmful items detected)

          Infected files:
          C:\Program Files\Trend Micro\HijackThis\backups\backup-20080710-211540-240.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
          C:\Program Files\Trend Micro\HijackThis\backups\backup-20080710-211540-427.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
          C:\QooBox\Quarantine\C\WINDOWS\system32\byXRlLEt.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
          0
        3. verni29 Security Contributor
          @nicoWell, the infections found were not (backup or quarantine from Combofix).

          I will give you instructions to clean the PC afterward.

          A word about two programs that have installed on your computer:
          - AntivirXP08 should be removed by Malwarebytes.
          - Malware protector by Combofix (that's done).
          These are rogues (fake antispywares).
          It is unnecessary and risky to install any other protection than the ones we will put in place.

          There are plenty of fake sites for this type of product.
          You must be careful.

          One last thing before the cleanup:

          Double-click on OTMoveIt.exe to launch it.
          Copy the list found in the quote below and paste it into the left box of OTMoveIt under Paste List of Files/Folders to move.

          C:\DOCUME~1\Nicolas\LOCALS~1\Temp\pnicml.sys

          Click on MoveIt! to start the deletion.
          The result will appear in the "Results" box.
          Click on Exit to close it.
          Post the report located in C:\_OTMoveIt\MovedFiles.

          Can you tell me how the PC is behaving?

          Talk later.
          0
        4. nico
          @verni29report moveit!

          File/Folder C:\DOCUME~1\Nicolas\LOCALS~1\Temp\pnicml.sys not found.

          OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 07122008_115023

          What do you mean by "computer behavior"?

          How can I get Malware to remove antivirXP08?
          0
        5. verni29 Security Contributor
          @nicoCan you check in add/remove programs if AntiVirXP08 is present?
          Don't try to uninstall it.

          Have you used this software?
          0
      7. verni29 Security Contributor
        Hello, Nico

        We're going to run two tools to perform a check-up on your PC.

        1) Download DiagHelp to your desktop
        http://www.malekal.com/download/DiagHelp.zip

        Right-click on the file and extract all
        - A folder named DiagHelp will be created
        - Open it and double-click on go.cmd
        - Choose option 1
        - The analysis will start, this may take a few minutes, follow the prompts.
        Important: after the catchme report, you will be asked to press a key to continue the scan.
        Follow the prompts. A report will appear. This can be found at C:\resultat.txt
        Copy/paste the content of the report into your next message.

        2) Download Sreng (System Repair Engineer)
        http://www.kztechs.com/eng/download.html

        Extract all its contents to your Desktop
        In the created folder, double-click on SREnLdr.exe.
        Click on Smart Scan and then on Scan

        When completed, click on the Save Reports button
        Save the report to your Desktop
        Copy/paste the content of SREnglLOG.log into your next response, please.

        See you!
        0
        1. nico
          I should be available around 9 AM, just to let you know, so you don't wait for nothing. See you later
          PS: I haven't touched the computer, it will be a surprise later ^^
          0
          1. nico
            MESSAGE PRECEDENT A NE PAS PRENDRE EN COMPTE DSL (trompé dans les fichiers, y en a tellement maintenant ! dsl )

            report combofix

            ComboFix 08-07-09.5 - Nicolas 2008-07-10 21:30:07.3 - NTFSx86
            Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1036.18.1648 [GMT 2:00]
            Location: C:\Documents and Settings\Nicolas\Desktop\ComboFix.exe
            Command switches used :: C:\Documents and Settings\Nicolas\Desktop\CFScript.txt
            * Creating a new restore point

            [color=red][b]WARNING - THE RECOVERY CONSOLE IS NOT INSTALLED ON THIS MACHINE !![/b][/color]

            FILE ::
            C:\DOCUME~1\Nicolas\LOCALS~1\Temp\pnicml.sys
            C:\program files\IE7-WindowsXP-x86-fra.exe
            C:\Program Files\MsgPlusLive-460.exe
            C:\Program Files\WLinstaller.exe
            C:\WINDOWS\system32\byXRlLEt.dll
            C:\WINDOWS\system32\chhutcvr.dll
            C:\WINDOWS\system32\efcYSiHx.dll
            C:\WINDOWS\system32\ffJmpWeb.dll
            C:\WINDOWS\system32\rsbfew.dll
            C:\WINDOWS\system32\tnqyfeti.dll
            C:\WINDOWS\system32\zlacye.dll
            .

            (((((((((((((((((((((((((((((((((((( Other removals ))))))))))))))))))))))))))))))))))))))))))))))))
            .

            C:\program files\IE7-WindowsXP-x86-fra.exe
            C:\Program Files\MsgPlusLive-460.exe
            C:\Program Files\WLinstaller.exe
            C:\WINDOWS\system32\byXRlLEt.dll
            C:\WINDOWS\system32\chhutcvr.dll
            C:\WINDOWS\system32\ffJmpWeb.dll
            C:\WINDOWS\system32\rsbfew.dll
            C:\WINDOWS\system32\tnqyfeti.dll

            .
            ((((((((((((((((((((((((((((( Files created 2008-06-10 to 2008-07-10 ))))))))))))))))))))))))))))))))))))
            .

            2008-07-10 18:01 . 2008-07-10 18:01 <REP> d-------- C:\_OTMoveIt
            2008-07-10 14:31 . 2008-07-10 14:31 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
            2008-07-10 14:31 . 2008-07-10 14:31 <REP> d-------- C:\Documents and Settings\Nicolas\Application Data\Malwarebytes
            2008-07-10 14:31 . 2008-07-10 14:31 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
            2008-07-10 14:31 . 2008-07-07 17:35 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
            2008-07-10 14:31 . 2008-07-07 17:35 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
            2008-07-10 04:41 . 2008-07-10 04:41 86 --a------ C:\WINDOWS\wininit.ini
            2008-07-10 04:31 . 2008-07-10 04:31 <REP> d-------- C:\Program Files\Trend Micro
            2008-07-10 03:41 . 2008-07-10 03:41 <REP> d-------- C:\Program Files\CCleaner
            2008-07-10 03:32 . 2008-07-10 03:32 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
            2008-07-10 03:32 . 2008-07-10 04:08 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
            2008-07-10 03:20 . 2008-07-10 04:00 <REP> d-------- C:\Program Files\Registry Defender Platinum
            2008-07-10 02:08 . 2006-03-02 14:00 4,224 --a------ C:\WINDOWS\system32\beep.sys
            2008-07-08 11:19 . 2008-04-23 06:16 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
            2008-07-08 11:19 . 2007-04-17 11:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
            2008-07-08 11:19 . 2007-03-08 07:10 1,048,576 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
            2008-07-08 11:19 . 2008-04-23 06:16 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
            2008-07-08 11:19 . 2008-04-23 06:16 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
            2008-07-08 11:19 . 2008-04-23 06:16 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
            2008-07-08 11:19 . 2008-04-23 06:16 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
            2008-07-08 11:19 . 2008-04-23 06:16 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
            2008-07-08 11:19 . 2008-04-22 09:39 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
            2008-07-08 11:14 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
            2008-07-08 11:14 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
            2008-07-08 11:14 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
            2008-07-08 01:41 . 2008-07-08 01:41 <REP> d-------- C:\Program Files\MSXML 4.0
            2008-07-08 01:21 . 2008-06-14 19:59 272,768 --------- C:\WINDOWS\system32\drivers\bthport.sys
            2008-07-08 01:21 . 2008-06-14 19:59 272,768 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
            2008-07-08 01:01 . 2008-07-08 01:01 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Messenger Plus!
            2008-07-08 00:57 . 2008-07-09 02:24 <REP> d-------- C:\WINDOWS\system32\fr-fr
            2008-07-08 00:52 . 2008-07-09 16:30 <REP> d-------- C:\Program Files\eMule
            2008-07-07 23:27 . 2008-07-07 23:27 <REP> d-------- C:\Program Files\Messenger Plus! Live
            2008-07-07 23:14 . 2008-07-07 23:27 <REP> d-------- C:\Documents and Settings\Nicolas\Contacts
            2008-07-07 23:00 . 2008-07-07 23:13 <REP> d-------- C:\Program Files\Windows Live
            2008-07-07 23:00 . 2008-07-07 23:13 <REP> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
            2008-07-07 23:00 . 2008-07-07 23:00 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
            2008-07-07 22:54 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll
            2008-07-07 22:54 . 2007-07-30 19:19 38,232 --a------ C:\WINDOWS\system32\wucltui.dll.mui
            2008-07-07 22:54 . 2007-07-30 19:20 30,040 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui
            2008-07-07 22:54 . 2007-07-30 19:19 30,040 --a------ C:\WINDOWS\system32\wuapi.dll.mui
            2008-07-07 22:54 . 2007-07-30 19:18 21,336 --a------ C:\WINDOWS\system32\wuaueng.dll.mui
            2008-07-07 22:52 . 2008-07-07 22:52 <REP> d--hs---- C:\Documents and Settings\Nicolas\UserData
            2008-07-07 22:28 . 2004-10-13 16:12 32,768 --a------ C:\WINDOWS\system32\WooDial2000.dll
            2008-07-07 22:24 . 2008-07-07 22:24 <REP> d-------- C:\Program Files\Wanadoo Messager
            2008-07-07 22:24 . 2008-07-10 21:04 <REP> d-------- C:\Program Files\Wanadoo
            2008-07-07 22:24 . 2008-07-07 22:24 <REP> d-------- C:\Program Files\Thomson
            2008-07-07 22:24 . 2003-12-08 11:53 70,688 --a------ C:\WINDOWS\system32\drivers\alcaudsl.sys
            2008-07-07 22:24 . 2003-12-08 11:53 53,600 --a------ C:\WINDOWS\system32\drivers\alcan5wn.sys
            2008-07-07 22:24 . 2003-12-08 11:53 5,606 --a------ C:\WINDOWS\system32\stci.dll
            2008-07-07 22:24 . 2003-12-08 11:53 5,280 --a------ C:\WINDOWS\system32\drivers\alcawh.sys
            2008-07-07 22:24 . 2003-12-08 11:53 3,968 --a------ C:\WINDOWS\system32\drivers\alcacr.sys

            .
            (((((((((((((((((((((((((((((((((( Find3M report ))))))))))))))))))))))))))))))))))))))))))))))))
            .
            2008-07-10 16:49 --------- d-----w C:\Documents and Settings\Nicolas\Application Data\OpenOffice.org2
            2008-07-09 23:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
            2008-07-07 21:18 --------- d-----w C:\Program Files\Google
            2008-07-07 20:24 --------- d--h--w C:\Program Files\InstallShield Installation Information
            2008-07-07 20:24 --------- d-----w C:\Program Files\Common Files\InstallShield
            2008-07-03 18:03 --------- d-----w C:\Documents and Settings\Nicolas\Application Data\U3
            2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
            2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
            2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
            2008-06-15 13:55 --------- d-----w C:\Program Files\Common Files\Teleca Shared
            2008-06-02 18:44 --------- d-----w C:\Documents and Settings\Nicolas\Application Data\Teleca
            2008-06-01 22:34 --------- d-----w C:\Documents and Settings\Nicolas\Application Data\Apple Computer
            2008-06-01 22:28 --------- d-----w C:\Documents and Settings\Nicolas\Application Data\Sony Ericsson
            .

            ((((((((((((((((((((((((((((( snapshot@2008-07-10_19.01.13.95 )))))))))))))))))))))))))))))))))))))))))

            - 2008-07-10 16:57:47 2,048 --s-a-w C:\WINDOWS\bootstat.dat
            + 2008-07-10 19:32:36 2,048 --s-a-w C:\WINDOWS\bootstat.dat
            + 2008-07-10 19:32:40 16,384 ----atw C:\WINDOWS\TEMP\Perflib_Perfdata_540.dat
            .
            ((((((((((((((((((((((((((((((((( Registry loading point )))))))))))))))))))))))))))))))))))))))))))))))))

            .
            REGEDIT4
            *Note* empty items & legitimate initial items are not listed

            [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
            "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 14:00 15360]
            "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-16 23:41 68856]
            "Steam"="C:\Valve\Steam\Steam.exe" [2003-11-11 16:19 1081344]
            "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
            "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 09:42 2156368]

            [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
            "JMB36X IDE Setup"="C:\WINDOWS\JM\JMInsIDE.exe" [2006-10-30 14:44 36864]
            "36X Raid Configurer"="C:\WINDOWS\system32\JMRaidSetup.exe" [2007-02-06 14:08 1953792]
            "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-28 18:43 8466432]
            "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-06-28 18:43 81920]
            "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0\bin\jusched.exe" [2007-09-16 23:31 77824]
            "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 12:48 157592]
            "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
            "WooCnxMon"="C:\PROGRA~1\Wanadoo\CnxMon.exe" [2004-10-13 16:12 24576]
            "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38 866816]
            "WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-10-13 16:12 24576]
            "WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\TaskbarIcon.exe" [2004-10-13 16:12 49152]
            "DaemonTools_WhenUSave_Installer"="C:\Program Files\DaemonTools_WhenUSave_Installer\DaemonTools_WhenUSave_Installer.exe" [BU]
            "RTHDCPL"="RTHDCPL.EXE" [2007-04-12 11:33 16132608 C:\WINDOWS\RTHDCPL.exe]
            "nwiz"="nwiz.exe" [2007-06-28 18:43 1626112 C:\WINDOWS\system32\nwiz.exe]

            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
            "vidc.3iv2"= 3ivxVfWCodec.dll
            "VIDC.HFYU"= huffyuv.dll
            "VIDC.VP31"= vp31vfw.dll

            [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
            "%windir%\\system32\\sessmgr.exe"=
            "C:\\Program Files\\Sports Interactive\\Football Manager 2008\\fm.exe"=
            "C:\\Valve\\Condition Zero\\czero.exe"=
            "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
            "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
            "C:\\Program Files\\eMule\\emule.exe"=
            "%windir%\\Network Diagnostic\\xpnetdiag.exe"=

            R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
            R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
            S3 pnicml;pnicml;C:\DOCUME~1\Nicolas\LOCALS~1\Temp\pnicml.sys []

            [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0b0bbc9c-204b-11dd-8310-001a4d483381}]
            \Shell\AutoRun\command - L:\LaunchU3.exe -a

            .
            Content of the 'Scheduled Tasks' folder
            "2008-06-05 10:27:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
            - C:\Program Files\Apple Software Update\SoftwareUpdate.exe

            - - - - ORPHANS REMOVED - - - -

            BHO-{62a828f3-a84f-446b-8e80-00ba3081ba05} - (no file)
            BHO-{684BFE7F-F5B2-4AB3-A95E-EB5036A2D286} - (no file)
            BHO-{CD23F372-AD0F-4037-97E6-35AA41124A0D} - (no file)

            **************************************************************************

            catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
            Rootkit scan 2008-07-10 21:32:53
            Windows 5.1.2600 Service Pack 2 NTFS

            Scanning hidden processes ...

            Scanning hidden autostart entries ...

            Scanning hidden files ...

            **************************************************************************
            .
            ------------------------ Other Running Processes ------------------------
            .
            C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
            C:\Program Files\Alwil Software\Avast4\ashServ.exe
            C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
            C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
            C:\WINDOWS\system32\nvsvc32.exe
            C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
            C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
            C:\WINDOWS\system32\rundll32.exe
            .
            **************************************************************************
            .
            Completion time: 2008-07-10 21:36:50 - machine was rebooted
            ComboFix-quarantined-files.txt 2008-07-10 19:35:47
            ComboFix2.txt 2008-07-10 19:27:20
            ComboFix3.txt 2008-07-10 17:02:36

            Pre-Run: 144,528,109,568 bytes free
            Post-Run: 144,499,118,080 bytes free

            186 --- E O F --- 2008-07-09 11:25:58

            Good report HIJ

            Logfile of Trend Micro HijackThis v2.0.2
            Scan saved at 21:38:21, on 10/07/2008
            Platform: Windows XP SP2 (WinNT 5.01.2600)
            MSIE: Internet Explorer v7.00 (7.00.6000.16674)
            Boot mode: Normal

            Running processes:
            C:\WINDOWS\System32\smss.exe
            C:\WINDOWS\system32\winlogon.exe
            C:\WINDOWS\system32\services.exe
            C:\WINDOWS\system32\lsass.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\System32\svchost.exe
            C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
            C:\Program Files\Alwil Software\Avast4\ashServ.exe
            C:\WINDOWS\system32\spoolsv.exe
            C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
            C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
            C:\WINDOWS\system32\nvsvc32.exe
            C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
            C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
            C:\WINDOWS\RTHDCPL.EXE
            C:\WINDOWS\system32\RUNDLL32.EXE
            C:\Program Files\Java\jre1.6.0\bin\jusched.exe
            C:\Program Files\DAEMON Tools\daemon.exe
            C:\PROGRA~1\Wanadoo\CnxMon.exe
            C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
            C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
            C:\WINDOWS\system32\ctfmon.exe
            C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
            C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
            C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
            C:\WINDOWS\system32\wuauclt.exe
            C:\WINDOWS\explorer.exe
            C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
            R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Links
            R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
            O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll
            O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
            O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
            O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
            O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
            O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
            O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
            O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe
            O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\JMRaidSetup.exe boot
            O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
            O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
            O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
            O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
            O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
            O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
            O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exe
            O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
            O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
            O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
            O4 - HKLM\..\Run: [DaemonTools_WhenUSave_Installer] C:\Program Files\DaemonTools_WhenUSave_Installer\DaemonTools_WhenUSave_Installer.exe
            O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
            O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
            O4 - HKCU\..\Run: [Steam] C:\Valve\Steam\Steam.exe -silent
            O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
            O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
            O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
            O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
            O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
            O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
            O9 - Extra button: Wanadoo Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messenger.exe
            O9 - Extra 'Tools' menuitem: Wanadoo Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messenger.exe
            O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
            O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
            O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
            O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
            O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
            O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
            O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
            O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation
            0
            1. verni29 Security Contributor
              I looked into Spybot.
              Normally, it's the real-time protection module that's working (the tea timer --> a nice cup of tea would be nice :-) )
              It's up to you to accept or not when you get these kinds of messages.
              You have the option to create a rule, meaning that the next alert won't notify you.

              You understand how it works.

              The Hijackthis report is clean.
              I have a question about Daemon Tools.

              However, there are still infected files. ComBofix hasn't finished the job.

              I'm starting to get tired (3 other infections similar to yours) and I’m going to stop here for today.

              I suggest we meet tomorrow evening or this weekend.
              What do you think?
              0
            2. nico
              @verni29I fully understand the workload that this represents... Personally, I will be available whenever you see fit, so if it has to be tomorrow evening, then it will be tomorrow evening ^^
              One last question for Combofix: why didn't it finish the job? Do you have one last action for me to take or should I turn off the PC and not touch it again until further notice?
              0
            3. verni29 Security Contributor
              @nicoYes, we'll see each other Saturday morning.

              Run CCleaner to clear temporary files.
              Reason:
              C:\DOCUME~1\Nicolas\LOCALS~1\Temp\pnicml.sys

              Disable system restore points as well.

              Anyway, avoid using the computer until Saturday.

              See you Saturday.
              0
            4. nico
              @verni29Alright for Saturday, thanks for everything, have a good Friday, take care ;)
              see you later
              0
            5. nico
              @verni29Just one last thing, how do I disable the restore points? Thanks, see you later!
              0
          2. nico
            ComboFix Report:

            ComboFix 08-07-09.5 - Nicolas 2008-07-10 21:30:07.3 - NTFSx86
            Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1036.18.1648 [GMT 2:00]
            Location: C:\Documents and Settings\Nicolas\Desktop\ComboFix.exe
            Command switches used :: C:\Documents and Settings\Nicolas\Desktop\CFScript.txt
            * Creating a new restore point

            [color=red][b]WARNING - THE RECOVERY CONSOLE IS NOT INSTALLED ON THIS MACHINE !![/b][/color]

            FILE ::
            C:\DOCUME~1\Nicolas\LOCALS~1\Temp\pnicml.sys
            C:\program files\IE7-WindowsXP-x86-fra.exe
            C:\Program Files\MsgPlusLive-460.exe
            C:\Program Files\WLinstaller.exe
            C:\WINDOWS\system32\byXRlLEt.dll
            C:\WINDOWS\system32\chhutcvr.dll
            C:\WINDOWS\system32\efcYSiHx.dll
            C:\WINDOWS\system32\ffJmpWeb.dll
            C:\WINDOWS\system32\rsbfew.dll
            C:\WINDOWS\system32\tnqyfeti.dll
            C:\WINDOWS\system32\zlacye.dll
            .

            (((((((((((((((((((((((((((((((((((( Other deletions ))))))))))))))))))))))))))))))))))))))))))))))))
            .

            C:\program files\IE7-WindowsXP-x86-fra.exe
            C:\Program Files\MsgPlusLive-460.exe
            C:\Program Files\WLinstaller.exe
            C:\WINDOWS\system32\byXRlLEt.dll
            C:\WINDOWS\system32\chhutcvr.dll
            C:\WINDOWS\system32\ffJmpWeb.dll
            C:\WINDOWS\system32\rsbfew.dll
            C:\WINDOWS\system32\tnqyfeti.dll

            .
            ((((((((((((((((((((((((((((( Files created 2008-06-10 to 2008-07-10 ))))))))))))))))))))))))))))))))))))
            .

            2008-07-10 18:01 . 2008-07-10 18:01 <REP> d-------- C:\_OTMoveIt
            2008-07-10 14:31 . 2008-07-10 14:31 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
            2008-07-10 14:31 . 2008-07-10 14:31 <REP> d-------- C:\Documents and Settings\Nicolas\Application Data\Malwarebytes
            2008-07-10 14:31 . 2008-07-10 14:31 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
            2008-07-10 14:31 . 2008-07-07 17:35 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
            2008-07-10 14:31 . 2008-07-07 17:35 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
            2008-07-10 04:41 . 2008-07-10 04:41 86 --a------ C:\WINDOWS\wininit.ini
            2008-07-10 04:31 . 2008-07-10 04:31 <REP> d-------- C:\Program Files\Trend Micro
            2008-07-10 03:41 . 2008-07-10 03:41 <REP> d-------- C:\Program Files\CCleaner
            2008-07-10 03:32 . 2008-07-10 03:32 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
            2008-07-10 03:32 . 2008-07-10 04:08 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
            2008-07-10 03:20 . 2008-07-10 04:00 <REP> d-------- C:\Program Files\Registry Defender Platinum
            2008-07-10 02:08 . 2006-03-02 14:00 4,224 --a------ C:\WINDOWS\system32\beep.sys
            2008-07-08 11:19 . 2008-04-23 06:16 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
            2008-07-08 11:19 . 2007-04-17 11:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
            2008-07-08 11:19 . 2007-03-08 07:10 1,048,576 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
            2008-07-08 11:19 . 2008-04-23 06:16 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
            2008-07-08 11:19 . 2008-04-23 06:16 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
            2008-07-08 11:19 . 2008-04-23 06:16 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
            2008-07-08 11:19 . 2008-04-23 06:16 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
            2008-07-08 11:19 . 2008-04-23 06:16 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
            2008-07-08 11:19 . 2008-04-22 09:39 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
            2008-07-08 11:14 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
            2008-07-08 11:14 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
            2008-07-08 11:14 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
            2008-07-08 01:41 . 2008-07-08 01:41 <REP> d-------- C:\Program Files\MSXML 4.0
            2008-07-08 01:21 . 2008-06-14 19:59 272,768 --------- C:\WINDOWS\system32\drivers\bthport.sys
            2008-07-08 01:21 . 2008-06-14 19:59 272,768 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
            2008-07-08 01:01 . 2008-07-08 01:01 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Messenger Plus!
            2008-07-08 00:57 . 2008-07-09 02:24 <REP> d-------- C:\WINDOWS\system32\fr-fr
            2008-07-08 00:52 . 2008-07-09 16:30 <REP> d-------- C:\Program Files\eMule
            2008-07-07 23:27 . 2008-07-07 23:27 <REP> d-------- C:\Program Files\Messenger Plus! Live
            2008-07-07 23:14 . 2008-07-07 23:27 <REP> d-------- C:\Documents and Settings\Nicolas\Contacts
            2008-07-07 23:00 . 2008-07-07 23:13 <REP> d-------- C:\Program Files\Windows Live
            2008-07-07 23:00 . 2008-07-07 23:13 <REP> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
            2008-07-07 23:00 . 2008-07-07 23:00 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
            2008-07-07 22:54 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll
            2008-07-07 22:54 . 2007-07-30 19:19 38,232 --a------ C:\WINDOWS\system32\wucltui.dll.mui
            2008-07-07 22:54 . 2007-07-30 19:20 30,040 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui
            2008-07-07 22:54 . 2007-07-30 19:19 30,040 --a------ C:\WINDOWS\system32\wuapi.dll.mui
            2008-07-07 22:54 . 2007-07-30 19:18 21,336 --a------ C:\WINDOWS\system32\wuaueng.dll.mui
            2008-07-07 22:52 . 2008-07-07 22:52 <REP> d--hs---- C:\Documents and Settings\Nicolas\UserData
            2008-07-07 22:28 . 2004-10-13 16:12 32,768 --a------ C:\WINDOWS\system32\WooDial2000.dll
            2008-07-07 22:24 . 2008-07-07 22:24 <REP> d-------- C:\Program Files\Wanadoo Messenger
            2008-07-07 22:24 . 2008-07-10 21:04 <REP> d-------- C:\Program Files\Wanadoo
            2008-07-07 22:24 . 2008-07-07 22:24 <REP> d-------- C:\Program Files\Thomson
            2008-07-07 22:24 . 2003-12-08 11:53 70,688 --a------ C:\WINDOWS\system32\drivers\alcaudsl.sys
            2008-07-07 22:24 . 2003-12-08 11:53 53,600 --a------ C:\WINDOWS\system32\drivers\alcan5wn.sys
            2008-07-07 22:24 . 2003-12-08 11:53 5,606 --a------ C:\WINDOWS\system32\stci.dll
            2008-07-07 22:24 . 2003-12-08 11:53 5,280 --a------ C:\WINDOWS\system32\drivers\alcawh.sys
            2008-07-07 22:24 . 2003-12-08 11:53 3,968 --a------ C:\WINDOWS\system32\drivers\alcacr.sys

            .
            (((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))
            .
            2008-07-10 16:49 --------- d-----w C:\Documents and Settings\Nicolas\Application Data\OpenOffice.org2
            2008-07-09 23:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
            2008-07-07 21:18 --------- d-----w C:\Program Files\Google
            2008-07-07 20:24 --------- d--h--w C:\Program Files\InstallShield Installation Information
            2008-07-07 20:24 --------- d-----w C:\Program Files\Common Files\InstallShield
            2008-07-03 18:03 --------- d-----w C:\Documents and Settings\Nicolas\Application Data\U3
            2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
            2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
            2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
            2008-06-15 13:55 --------- d-----w C:\Program Files\Common Files\Teleca Shared
            2008-06-02 18:44 --------- d-----w C:\Documents and Settings\Nicolas\Application Data\Teleca
            2008-06-01 22:34 --------- d-----w C:\Documents and Settings\Nicolas\Application Data\Apple Computer
            2008-06-01 22:28 --------- d-----w C:\Documents and Settings\Nicolas\Application Data\Sony Ericsson
            .

            ((((((((((((((((((((((((((((( snapshot@2008-07-10_19.01.13.95 )))))))))))))))))))))))))))))))))))))))))

            - 2008-07-10 16:57:47 2,048 --s-a-w C:\WINDOWS\bootstat.dat
            + 2008-07-10 19:32:36 2,048 --s-a-w C:\WINDOWS\bootstat.dat
            + 2008-07-10 19:32:40 16,384 ----atw C:\WINDOWS\TEMP\Perflib_Perfdata_540.dat
            .
            ((((((((((((((((((((((((((((((((( Registry Load Point )))))))))))))))))))))))))))))))))))))))))))))))))
            .
            .
            REGEDIT4
            *Note* empty items & legitimate initial items are not listed

            [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
            "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 14:00 15360]
            "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-16 23:41 68856]
            "Steam"="C:\Valve\Steam\Steam.exe" [2003-11-11 16:19 1081344]
            "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
            "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 09:42 2156368]

            [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
            "JMB36X IDE Setup"="C:\WINDOWS\JM\JMInsIDE.exe" [2006-10-30 14:44 36864]
            "36X Raid Configurer"="C:\WINDOWS\system32\JMRaidSetup.exe" [2007-02-06 14:08 1953792]
            "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-28 18:43 8466432]
            "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-06-28 18:43 81920]
            "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0\bin\jusched.exe" [2007-09-16 23:31 77824]
            "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 12:48 157592]
            "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
            "WooCnxMon"="C:\PROGRA~1\Wanadoo\CnxMon.exe" [2004-10-13 16:12 24576]
            "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38 866816]
            "WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-10-13 16:12 24576]
            "WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\TaskbarIcon.exe" [2004-10-13 16:12 49152]
            "DaemonTools_WhenUSave_Installer"="C:\Program Files\DaemonTools_WhenUSave_Installer\DaemonTools_WhenUSave_Installer.exe" [BU]
            "RTHDCPL"="RTHDCPL.EXE" [2007-04-12 11:33 16132608 C:\WINDOWS\RTHDCPL.exe]
            "nwiz"="nwiz.exe" [2007-06-28 18:43 1626112 C:\WINDOWS\system32\nwiz.exe]

            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
            "vidc.3iv2"= 3ivxVfWCodec.dll
            "VIDC.HFYU"= huffyuv.dll
            "VIDC.VP31"= vp31vfw.dll

            [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
            "%windir%\\system32\\sessmgr.exe"=
            "C:\\Program Files\\Sports Interactive\\Football Manager 2008\\fm.exe"=
            "C:\\Valve\\Condition Zero\\czero.exe"=
            "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
            "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
            "C:\\Program Files\\eMule\\emule.exe"=
            "%windir%\\Network Diagnostic\\xpnetdiag.exe"=

            R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
            R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
            S3 pnicml;pnicml;C:\DOCUME~1\Nicolas\LOCALS~1\Temp\pnicml.sys []

            [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0b0bbc9c-204b-11dd-8310-001a4d483381}]
            \Shell\AutoRun\command - L:\LaunchU3.exe -a

            .
            Contents of the 'Scheduled Tasks' folder
            "2008-06-05 10:27:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
            - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
            .
            - - - - ORPHANS REMOVED - - - -

            BHO-{62a828f3-a84f-446b-8e80-00ba3081ba05} - (no file)
            BHO-{684BFE7F-F5B2-4AB3-A95E-EB5036A2D286} - (no file)
            BHO-{CD23F372-AD0F-4037-97E6-35AA41124A0D} - (no file)

            **************************************************************************

            catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
            Rootkit scan 2008-07-10 21:32:53
            Windows 5.1.2600 Service Pack 2 NTFS

            Scanning for hidden processes ...

            Scanning hidden autostart entries ...

            Scanning for hidden files ...

            **************************************************************************
            .
            ------------------------ Other Running Processes ------------------------
            .
            C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
            C:\Program Files\Alwil Software\Avast4\ashServ.exe
            C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
            C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
            C:\WINDOWS\system32\nvsvc32.exe
            C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
            C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
            C:\WINDOWS\system32\rundll32.exe
            .
            **************************************************************************
            .
            Duration: 2008-07-10 21:36:50 - machine was rebooted
            ComboFix-quarantined-files.txt 2008-07-10 19:35:47
            ComboFix2.txt 2008-07-10 19:27:20
            ComboFix3.txt 2008-07-10 17:02:36

            Pre-Run: 144,528,109,568 bytes free
            Post-Run: 144,499,118,080 bytes free

            186 --- E O F --- 2008-07-09 11:25:58

            Hijackthis Report:

            Logfile of Trend Micro HijackThis v2.0.2
            Scan saved at 20:59:31, on 10/07/2008
            Platform: Windows XP SP2 (WinNT 5.01.2600)
            MSIE: Internet Explorer v7.00 (7.00.6000.16674)
            Boot mode: Normal

            Running processes:
            C:\WINDOWS\System32\smss.exe
            C:\WINDOWS\system32\winlogon.exe
            C:\WINDOWS\system32\services.exe
            C:\WINDOWS\system32\lsass.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\System32\svchost.exe
            C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
            C:\Program Files\Alwil Software\Avast4\ashServ.exe
            C:\WINDOWS\system32\spoolsv.exe
            C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
            C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
            C:\WINDOWS\system32\nvsvc32.exe
            C:\WINDOWS\Explorer.EXE
            C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
            C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
            C:\WINDOWS\RTHDCPL.EXE
            C:\WINDOWS\system32\RUNDLL32.EXE
            C:\Program Files\Java\jre1.6.0\bin\jusched.exe
            C:\Program Files\DAEMON Tools\daemon.exe
            C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
            C:\PROGRA~1\Wanadoo\CnxMon.exe
            C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
            C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
            C:\WINDOWS\system32\ctfmon.exe
            C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
            C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
            C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
            C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
            R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Links
            R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
            O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll
            O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
            O2 - BHO: {50ab1803-ab00-08e8-b644-f48a3f828a26} - {62a828f3-a84f-446b-8e80-00ba3081ba05} - C:\WINDOWS\system32\zlacye.dll
            O2 - BHO: (no name) - {684BFE7F-F5B2-4AB3-A95E-EB5036A2D286} - C:\WINDOWS\system32\byXRlLEt.dll
            O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
            O2 - BHO: (no name) - {92FB130D-04A5-4FF9-9461-806D762EC666} - C:\WINDOWS\system32\efcYSiHx.dll
            O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
            O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
            O2 - BHO: (no name) - {CD23F372-AD0F-4037-97E6-35AA41124A0D} - (no file)
            O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
            O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
            O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe
            O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\JMRaidSetup.exe boot
            O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
            O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
            O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
            O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
            O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
            O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
            O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
            O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exe
            O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
            O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
            O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
            O4 - HKLM\..\Run: [DaemonTools_WhenUSave_Installer] C:\Program Files\DaemonTools_WhenUSave_Installer\DaemonTools_WhenUSave_Installer.exe
            O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
            O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
            O4 - HKCU\..\Run: [Steam] C:\Valve\Steam\Steam.exe -silent
            O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
            O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
            O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
            O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
            O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
            O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
            O9 - Extra button: Wanadoo Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messenger.exe
            O9 - Extra 'Tools' menuitem: Wanadoo Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messenger.exe
            O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
            O20 - Winlogon Notify: byXRlLEt - C:\WINDOWS\SYSTEM32\byXRlLEt.dll
            O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
            O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
            O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
            O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
            O23 - Service: avast! Web Scanner -
            0
            1. verni29 Security Contributor
              Have you cleaned the Hijackthis report?
              It needed to be done before combofix.

              Look at the previous message and redo the comboFix cleanup.
              Send me a new Hijackthis report.

              See you!
              0
            2. nico
              @verni29Arf, we keep running into each other!! By the time I repost the correct reports (I think), you, faster than lightning, had already replied to me... see message 48, everything should be in order, I await your feedback ;)
              0
          3. nico
            Ok, I've started over and it worked well this time, he took it into account.
            0
            • 1
            • 2