Systeme infecté SOS

salut :

▶ Télécharge ZHPDiag (de Nicolas Coolman)

ou :ZHPDiag

▶ Enregistre le sur ton Bureau.

Une fois le téléchargement achevé,

▶ lance ZHPDiag.exe et clique sur Unzip dans la fenêtre qui s'ouvre.

▶ Clique sur la clé à molette puis sur Tous pour cocher toutes les cases des options.

▶ Clique sur la loupe pour lancer l'analyse.

A la fin de l'analyse,

▶ clique sur l'appareil photo et enregistre le rapport sur ton Bureau.

Pour me le transmettre clique sur ce lien :

http://www.cijoint.fr/

▶ Clique sur Parcourir et cherche le fichier C:\Documents and settings\le_nom_de_ta_session\.ZHPDiag.txt

▶ Clique sur Ouvrir.

▶ Clique sur "Cliquez ici pour déposer le fichier".

Un lien de cette forme :

http://www.cijoint.fr/cjlink.php?file=cj200905/cib7SU.txt

est ajouté dans la page.

▶ Copie ce lien dans ta réponse.

merci pour votre rapiditée

je m y met de suite

il scan 1 quart puis s arrette et le log ne repond plus

etrange

que faire ???

Desactive ton antivirus le temps de la manip ainsi que ton parefeu si présent

▶ Télécharge List&Kill'em et enregistre le sur ton bureau

▶ dezippe-le , (clic droit/ extraire.....)

Il ne necessite pas d'installation

▶double clic (clic droit "executer en tant qu'administrateur" pour Vista) pour lancer le scan

choisis la langue puis choisis l'option 1 = Mode Recherche

▶laisse travailler l'outil

▶Poste le contenu du rapport qui s'ouvre

ok le scan dure une dizaine

voila, il travaille

a savoir que je n ai plus acces a mes outils de securité

je pense ne plus avoir de pare feu

je suis sous XP

mon antivirus est avg free

je n ai plus de restauration systeme

bien je t envoie le resultat des que fini

encore merci car la, je galere grave

le pc est mon outil de travail donc je suis vraiment embeter

on va s'occuper de tout ca

la il me dit "test rootkits" "patienc"

merci, j'espere que c'est pas trop grave

en meme temps que cette invasion de choses bizarre....
j ai mon disque dur externe qui a perdu toutes ces données

impossible de l ouvrir
comme si tout avait été effacé

on va voir , j 'attennds deja ce rapport ^^

dacodac

il est toujours en scan....

il me dit toujours "patience"........

Alors je patiente en esperant avoir le resultat qui me soignera mon pc

Mais c'est bien plus de 10 mn, est ce bien normal??

ca depend de ton pc , si c est un vieux coucou , le processeur , la RAM...etc...c'est une moyenne pour un pc moderne que je t ai donné , maintenant....

mon PC a deux ans
Il est surtout tres ralenti actuellement.....

Sinon avant tout ça, il tournait tres bien.....

Mais je sens que tu vas faire des miracles.....LOL

on va essayer ^^

toujours en scan

t as pas moyen de savoir ou ça en est???

je crains toujours que le log soit stopper comme sur le precedent....

mais bon moi j y connais pas grand chose..... donc.............

je te laisse les commandes

stoppe-le et fournis moi le rapport :

C:\List'em.txt

comment fais tu pour le stopper???

tu fermes la fenetre ou est ecrit rootkits sur fond blanc

ca y est il vient de s arretter tous seul
voila le resultat :

(comme tout arrive a qui sait attendre)

List'em by g3n-h@ckm@n 1.0.6.0

Thx to Chiquitine29.....

User : tuttilafamilia (Utilisateurs) # DELL
Update on 30/11/2009 by g3n-h@ckm@n ::::: 07:00
Start at: 10:25:33 | 30/11/2009
Contact : g3n-h@ckm@n sur CCM

Intel(R) Pentium(R) 4 CPU 3.00GHz
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 6.0.2900.2180
Windows Firewall Status : Disabled
AV : AVG Anti-Virus Free 8.5 [ Enabled | Updated ]

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local | 71.43 Go (13.79 Go free) | NTFS
D:\ -> Disque CD-ROM | 3.45 Go (0 Mo free) [FARCRY_1] | UDF
E:\ -> Disque CD-ROM
F:\ -> Disque fixe local | 31.5 Go (31.43 Go free) | NTFS

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\WINDOWS\System32\smss.exe 636
C:\WINDOWS\system32\csrss.exe 684
C:\WINDOWS\system32\winlogon.exe 712
C:\WINDOWS\system32\services.exe 756
C:\WINDOWS\system32\lsass.exe 768
C:\WINDOWS\system32\Ati2evxx.exe 960
C:\WINDOWS\system32\svchost.exe 976
C:\WINDOWS\system32\svchost.exe 1072
C:\WINDOWS\System32\svchost.exe 1164
C:\WINDOWS\system32\svchost.exe 1208
C:\WINDOWS\system32\svchost.exe 1284
C:\WINDOWS\system32\svchost.exe 1352
C:\WINDOWS\system32\spoolsv.exe 1560
C:\WINDOWS\Explorer.EXE 1800
C:\WINDOWS\Logi_MwX.Exe 1984
C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe 240
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe 440
C:\Program Files\Windows Media Player\WMPNSCFG.exe 452
C:\Program Files\Logitech\SetPoint\SetPoint.exe 1000
C:\WINDOWS\system32\svchost.exe 1136
C:\Program Files\IncrediMail\bin\IMApp.exe 1144
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe 1276
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 1308
C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE 1304
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe 1384
C:\Program Files\Bonjour\mDNSResponder.exe 1508
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe 1676
C:\WINDOWS\system32\drivers\CDAC11BA.EXE 1760
C:\WINDOWS\System32\svchost.exe 1932
C:\Program Files\Java\jre6\bin\jqs.exe 1992
C:\Program Files\Sunbelt Software\CounterSpy\SBAMSvc.exe 348
C:\WINDOWS\system32\svchost.exe 1612
C:\PROGRA~1\AVG\AVG8\avgrsx.exe 2016
C:\PROGRA~1\AVG\AVG8\avgnsx.exe 2076
C:\Program Files\AVG\AVG8\avgcsrvx.exe 2156
C:\Program Files\Windows Media Player\WMPNetwk.exe 2188
C:\Program Files\Sunbelt Software\CounterSpy\SBAMTray.exe 3152
C:\WINDOWS\system32\wbem\wmiapsrv.exe 3880
C:\WINDOWS\System32\alg.exe 420
C:\WINDOWS\system32\wuauclt.exe 3380
C:\Program Files\Mozilla Firefox\firefox.exe 3284
C:\Documents and Settings\tuttilafamilia\Bureau\List_Kill'em.exe 3280
C:\WINDOWS\system32\cmd.exe 3344
C:\WINDOWS\system32\wbem\wmiprvse.exe 3560
C:\Documents and Settings\tuttilafamilia\Local Settings\Temp\46.tmp\pv.exe 2352

======================
Keys "Run"
======================

! REG.EXE VERSION 3.0

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Magentic REG_SZ "C:\PROGRA~1\Magentic\bin\Magentic.exe" /c
BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} REG_SZ "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
IncrediMail REG_SZ C:\Program Files\IncrediMail\bin\IncMail.exe /c
swg REG_SZ "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
WMPNSCFG REG_SZ C:\Program Files\Windows Media Player\WMPNSCFG.exe

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Logitech Utility REG_SZ Logi_MwX.Exe
Kernel and Hardware Abstraction Layer REG_SZ KHALMNPR.EXE
AVG8_TRAY REG_SZ C:\PROGRA~1\AVG\AVG8\avgtray.exe
QuickTime Task REG_SZ "C:\Program Files\QuickTime\qttask.exe" -atboottime
KernelFaultCheck REG_EXPAND_SZ %systemroot%\system32\dumprep 0 -k
Malwarebytes Anti-Malware (reboot) REG_SZ "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
=====================
Other Keys
=====================

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System
dontdisplaylastusername REG_DWORD 0x0
legalnoticecaption REG_SZ
legalnoticetext REG_SZ
shutdownwithoutlogon REG_DWORD 0x1
undockwithoutlogon REG_DWORD 0x1
ConsentPromptBehaviorAdmin REG_DWORD 0x0
===============
===============
BHO :
======

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}

========
Services
========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]

Ndisuio : 0x3
EapHost : 0x3
SharedAccess : 0x2
wuauserv : 0x2
=========

D:\Autorun.inf :
----------------
[autorun]
open=FarCryAutoCD.exe
icon=FarCry.exe, 0

=========================
Environnement variables :
=========================

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\tuttilafamilia\Application Data
CDPPATH=C
choix=1
CLASSPATH=.;©h'|C:\WINDOWS\system32\QTJava.zip;C:\Program Files\Java\jre6\lib\ext\QTJava.zip
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Fichiers communs
COMPUTERNAME=DELL
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\tuttilafamilia
LOGONSERVER=\\DELL
NUMBER_OF_PROCESSORS=2
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\ATI Technologies\ATI Control Panel;C:\Program Files\Samsung\Samsung PC Studio 3\;C:\Program Files\QuickTime\QTSystem\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 4 Stepping 3, GenuineIntel
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=0403
ProgramFiles=C:\Program Files
PROMPT=$P$G
QTJAVA=C:\Program Files\Java\jre6\lib\ext\QTJava.zip
SESSIONNAME=Console
SonicCentral=C:\Program Files\Fichiers communs\Sonic Shared\Sonic Central\
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\TUTTIL~1\LOCALS~1\Temp
TMP=C:\DOCUME~1\TUTTIL~1\LOCALS~1\Temp
USERDOMAIN=DELL
USERNAME=tuttilafamilia
USERPROFILE=C:\Documents and Settings\tuttilafamilia
windir=C:\WINDOWS
__COMPAT_LAYER=EnableNXShowUI

¤¤¤¤¤¤¤¤¤¤ Files/folders :

C:\Documents and Settings\All Users\Application Data\C9B086CE-4A3B-11DB-8373-B622A1EF5492
C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
C:\Program Files\AskPBar
C:\Program Files\Dealio
C:\Program Files\Windows Live\Messenger\msimg32.dll
C:\WINDOWS\system32\ycbeg.ini2
C:\WINDOWS\System32\drivers\etc\hosts.msn
C:\WINDOWS\system32\tmp.reg
C:\WINDOWS\winstart.bat
C:\Documents and Settings\tuttilafamilia\Application Data\Dealio
C:\Documents and Settings\tuttilafamilia\Application Data\Desktopicon
C:\Documents and Settings\tuttilafamilia\Application Data\ItsLabel
C:\Documents and Settings\tuttilafamilia\Application Data\Search Settings
C:\Documents and Settings\tuttilafamilia\Application Data\Skinux
C:\Documents and Settings\tuttilafamilia\LOCAL Settings\Temp\msizapMG.exe

¤¤¤¤¤¤¤¤¤¤ Keys :

"HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}"
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}"
HKCR\.torrent
HKCR\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632
HKCR\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0
HKCR\interface\{B0D071A1-36B3-4757-A126-14C89C56013A}
HKCR\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}
HKCU\SOFTWARE\EoRezo
HKCU\SOFTWARE\ItsLabel
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.torrent
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}
HKLM\Software\Classes\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\1AC67655DD68F8240B2860F2D511EBD8
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\34EDDB1BFB3A2D448845F3EFD0F15A43
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\351716A953E21214898904032EAE2E81
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\397C771A7BCAC904697C3EC629ED33ED
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4318DF19719275242801CBE292063A4C
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D19F074C042AD34BAB463D4175A062E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\98CC8BF5A4A6E6C4ABF7051DDAB8B058
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A189D17A469616C4688D23E192996267
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D15DAF33C220F91468A1D7D57C31ACD7
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D3BA76A44C779424889063D5098ED2D6
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D6D0EB9FDBD90C04D92A7E729058F10D
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB59FDB786388EA4D897F3EE715683AC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E337925F629CF4C4FB08F3D9674DD839
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E4748F9A4181FCE46A23C13B517B9420
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\EC65F200D112357449C8B1BC3CFA03D0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9

=========
Rootkits
=========

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-30 10:28:04
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System]
"OOCC06.00.00.01WSSV"="741D45430AC722B728AB1BB7E3518C033EAA6F09A7EED24007C26FC46FF77EA9C3E1460F70061E7DFC2CCB8E190FFB586EBAC5B64ACD655F0231B2DA91FAFA455A17AD910355A08CE90D55E917F66D29244FD2F31D0634EEB07E610C43A2994A3DC8EE0922393B4DCE524E28E292638E37006EDA71C4D6D28579B1523D62A08B179AC46A0F8A82A0AF940FD9E93F6593A377B4B9790DE2631383A2581C01D74CB5C1AADEF1F691D9317CB744F9AF7D39097984934F3573EC9411F27E631B8BC98B0AE34352FE843EA049A8E1C7E839F12C58009EEE6A29B3652C2656F5A08DB12D5073A720777E0A6B5189DFE9C3AD27737B8F45FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C8EDD5E5BE2F6E6678EDD5E5BE2F6E667C038D530D6EB34525D575E7D6A3B980846BE9EF361AA416D1113CB0CD3C336153081F88A7210FAD9531FF361D477D21FE85852BABFE7AC433F8A28D20E9FEA63B56C4F242F342DF10145BFE62AF83196FDF5F0DC402BC16813D15468917532EE2348DB825DC1EE768ED910EDC3D29AB5C9E433CAA9BEC0C3FB3A7CEE9D268CD8B00A5B93D44C21E69F975351326FEE79F8C4D7EEE68228EDCCE9CD7916A63D797BFD0E3793FDE8F5B78F78DD2D4D5410180C9F21076AC135BE5A7C11827EC9580442B544B9152E8BBF24F4560E7EB3DF9A0251B2BCFC95196AD8BEB00F4A7E36AD491B030D621C44878DC2715228B9015544356560D5F151D0094EC88BB9E986415B8930F6C9A36EBE58DCD61C07D84084C31AEF6A2369C6565EEABCEB11606CEB91517C0247F88EFAE244283166C39D4644517FFAAAD21640A35665C7A9F745BC5B450DE065145B36E27DF37CAA76CD1C6030B056414712BB77588EDB6F0C9FA97BBDFB6847B1BFCC5E12420AC8AB396D821197605325C056CA3AF888623BBB8908165590A1D05C81328D8C8CCCE5FC83ECD0BBA6DF8ED885624BD6CF166A921AEDAD1AF73DB505788D02C05B53E9E88EB4511757F9E9CA20DA5ED15AB33E4EFA69E7405E776940BCF402C16D0F41821F42F719C3C8E0365F1F4A06F477A44B308EAEAFA742384AB9BF2864E3C6B980ABD02F25E4096272E5F169810EB1CA1E2344E9C5DEA2319141988F72FDD4625190F2E4125588A087B5E91A4ABBC6A38C20450DD2AFB1293B8A80D92CA3271215898E09AA532A9033B5EEBFD8B3ADE712571F891E6B1DB89EAC4B2C415DBE611FBBD8132DC1E6EDE73241409652F4125CDC37565E86253A4527212E58D8B3ADF8AAE17BCEA7483549D9F08665983BE04D2941F0C21A2150F0D8FC0C8BE93097DFC309C0B430EF2A3340E30219A935D67C1AC9596A63F75D940AADF8E905F105425382637BA98ED132DDD4247A4D2BBDB46DAF11EAC2A88A5662D8A5F4"

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

¤¤¤¤¤¤¤¤¤¤ C:\WINDOWS\Prefetch :

AD-AWAREINSTALLATION.EXE-1006C5A7.pf
ALG.EXE-2226CE17.pf
AVGCMGR.EXE-1A33010C.pf
AVGCSRVX.EXE-085812C0.pf
AVGNSX.EXE-11491657.pf
AVGSCANX.EXE-1526E678.pf
AVGSRMAX.EXE-2DD43816.pf
AVGUI.EXE-1D9B04C8.pf
AVGUPD.EXE-3600AE63.pf
CATCHME.EXE-0BD5627E.pf
CCLEANER.EXE-07D141FC.pf
CFPCONFG.EXE-09A7C857.pf
CFPUPDAT.EXE-130C241E.pf
CMD.EXE-137A0D53.pf
CMDAGENT.EXE-355CAA22.pf
CONTROL.EXE-01F9F0D0.pf
CSCRIPT.EXE-1CE24927.pf
DEFRAG.EXE-10D9C910.pf
DFRGNTFS.EXE-0F55FCE5.pf
DLCCCOMS.EXE-03C58E7E.pf
DUMPREP.EXE-1C032A1C.pf
DW20.EXE-0499C52B.pf
DWWIN.EXE-002B6E58.pf
FARCRY.EXE-15BAD927.pf
FARCRYAUTOCD.EXE-3164ABC0.pf
FARCRYCONFIGURATOR.EXE-393BF31B.pf
FIREFOX.EXE-3495265E.pf
FIXCFG.EXE-14E6CAFD.pf
GOOGLEUPDATERSERVICE.EXE-23E0F530.pf
HELPSVC.EXE-281F45D0.pf
HOTFIXINSTALLER.EXE-002C76E5.pf
HOTFIXINSTALLER.EXE-0032CE48.pf
HOTFIXINSTALLER.EXE-0148469F.pf
HOTFIXINSTALLER.EXE-02BE8FEA.pf
HOTFIXINSTALLER.EXE-03F1E2B7.pf
HOTFIXINSTALLER.EXE-07860CA4.pf
HOTFIXINSTALLER.EXE-0AE03283.pf
HOTFIXINSTALLER.EXE-0EFF0276.pf
HOTFIXINSTALLER.EXE-153F4CEF.pf
HOTFIXINSTALLER.EXE-22B1922B.pf
HOTFIXINSTALLER.EXE-26FFCEF4.pf
HOTFIXINSTALLER.EXE-2BEECB02.pf
HOTFIXINSTALLER.EXE-2E8F01EC.pf
HOTFIXINSTALLER.EXE-394ED91D.pf
HOTFIXINSTALLER.EXE-3B11C671.pf
ICARDAGT.EXE-1CCB41BC.pf
IEDW.EXE-05BBB070.pf
IEXPLORE.EXE-06887102.pf
IMAPI.EXE-10859813.pf
IMAPP.EXE-03CFCDDB.pf
IMNOTFY.EXE-233F3C08.pf
INCMAIL.EXE-04156069.pf
INFOCARD.EXE-11D527DB.pf
JQSNOTIFY.EXE-0722E5CE.pf
LAVASOFTGCHELPER.EXE-145BF0C3.pf
LAVASOFT_ADAWAREFREE.EXE-2DB25448.pf
Layout.ini
LIST_KILL'EM.EXE-1C1941F7.pf
LOGITECHUPDATE.EXE-35A0E1EC.pf
LOGONUI.EXE-3164D1CB.pf
LULNCHR.EXE-063D4ABE.pf
MARINEPARKEMPIRE.EXE-2BDB3B8D.pf
MBAM-SETUP.EXE-3986635C.pf
MBAM-SETUP.TMP-31FAC724.pf
MBAM.EXE-26D201D2.pf
MBAMGUI.EXE-0B28CE92.pf
MODE.COM-31B7A0C0.pf
MPE.EXE-0133683F.pf
MPERUN.EXE-29C48E8B.pf
MSIEXEC.EXE-0CCC6E74.pf
MSNMSGR.EXE-1A70C265.pf
MSXML4-KB973688-ENU.EXE-206B465D.pf
NDP20SP2-KB958481-X86.EXE-135C4791.pf
NDP20SP2-KB974417-X86.EXE-109CEA15.pf
NMINDEXSTORESVR.EXE-36606DE8.pf
NOTEPAD.EXE-08F3A979.pf
NTOSBOOT-B00DFAAD.pf
PHOTOSNAPVIEWER.EXE-207DB3D9.pf
PPTVIEW.EXE-2F8C15E9.pf
PV.EXE-09D765AF.pf
REG.EXE-0114E0EC.pf
REGEDIT.EXE-17A382F4.pf
REGSVR32.EXE-10006695.pf
RSTRUI.EXE-33D92DF1.pf
RUNDLL32.EXE-2B26C55C.pf
RUNDLL32.EXE-2BB74E1B.pf
RUNDLL32.EXE-3481B599.pf
RUNDLL32.EXE-3913D1EF.pf
RUNDLL32.EXE-3DCC3CBD.pf
RUNDLL32.EXE-5638B4C6.pf
RUNDLL32.EXE-5C5FFFE7.pf
RUNDLL32.EXE-6311D783.pf
SBAMTRAY.EXE-2F34EB49.pf
SBAMUI.EXE-12479FEE.pf
SDFILES.EXE-1C1AD4AE.pf
TASKMGR.EXE-20E19D70.pf
UPDATE.EXE-3540A9CA.pf
VERCLSID.EXE-3B227142.pf
VLC.EXE-2E8E9D94.pf
WGATRAY.EXE-2D836F35.pf
WINDOWSINSTALLER-KB893803-V2--234FB453.pf
WINRAR.EXE-2480A367.pf
WLCOMM.EXE-2591AE07.pf
WLMUNINSTALLER[1].EXE-060BEE2B.pf
WLSETUP-CUSTOM.EXE-0013200F.pf
WMIAPSRV.EXE-193A5C0F.pf
WMIPRVSE.EXE-0E69CB0B.pf
WMPNETWK.EXE-11E0FA5A.pf
WUAUCLT.EXE-12D8E25E.pf
WUAUCLT.EXE-1360D60A.pf
ZAPMESSENGER.EXE-1E9845D5.pf
ZAPMESSENGER.EXE-36E6D1AF.pf
ZHPDIAG 1.24.35.EXE-177DACB3.pf
ZHPDIAG 1.24.35.TMP-32B20996.pf
ZHPDIAG.EXE-3B2C81D2.pf
~E5.0001-089BA75D.pf

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤