Welcome to Tech Support Forum home to more then 136,000 problems solved. Issues have included: Spyware, Malware, Virus Issues, Windows, Microsoft, Linux, Networking, Security, Hardware, and Gaming Getting your problem solved is as easy as:
1. Registering for a free account
2. Asking your question
3. Receiving an answer

Registered members:
* Get free support
* Communicate privately with other members (PM).
* Removal of this message
* See fewer ads.
* And much more..

 


Want to know how to post a question? click here Having problems with spyware and pop-ups? First Steps
Go Back   Tech Support Forum > Security Center > Virus/Trojan/Spyware Help > Resolved HJT Threads
Reload this Page Constant popups in IE 6 and Firefox 2
User Name
Password
Site Map Register Donate Rules Blogs Mark Forums Read


Resolved HJT Threads Resolved spyware and popup issues.

 
 
LinkBack Thread Tools
Old 10-08-2007, 09:32 AM   #1 (permalink)
Registered User
 
Join Date: Jan 2007
Location: Paris, France
Posts: 298
OS: Win XP SP3, OS X 10.6


Constant popups in IE 6 and Firefox 2
Hi,
I've been having pop-up windows showing up regularly in Internet Explorer 6 and Firefox 2, on a Windows XP Home SP2 system, over the past few days. Most of these pop-ups advertise what really looks like rogue antispyware and other junk.
I have run the five steps.
Any idea how to get back on my feet ?
Thanks guys.


Deckard's System Scanner v20070905.67
Run by kouye on 2007-10-08 18:08:57
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 5 Restore Point(s) --
32: 2007-10-08 16:09:01 UTC - RP32 - Deckard's System Scanner Restore Point
31: 2007-10-08 16:00:27 UTC - RP31 - Supprimé Ma-Config.com plugin
30: 2007-10-07 20:51:44 UTC - RP30 - Software Distribution Service 3.0
29: 2007-10-07 17:57:58 UTC - RP29 - Point de vérification système
28: 2007-10-06 17:57:34 UTC - RP28 - Point de vérification système


-- First Restore Point --
1: 2007-07-23 21:18:02 UTC - RP1 - Point de vérification système


Backed up registry hives.
Performed disk cleanup.



-- HijackThis Clone ------------------------------------------------------------

Emulating logfile of HijackThis v1.99.1
Scan saved at 2007-10-08 18:10:13
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (6.00.2900.2180)

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\sugarcrm-4.5.1e\apache2\bin\Apache.exe
C:\Program Files\sugarcrm-4.5.1e\mysql\bin\mysqld.exe
C:\Program Files\sugarcrm-4.5.1e\apache2\bin\Apache.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTTrayp.exe
C:\WINDOWS\soundman.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\kouye\Bureau\dss.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKEY_LOCAL_MACHINE\..\Run: [VTTimer] VTTimer.exe
O4 - HKEY_LOCAL_MACHINE\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKEY_LOCAL_MACHINE\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKEY_LOCAL_MACHINE\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKEY_LOCAL_MACHINE\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKEY_LOCAL_MACHINE\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - "C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe"
O23 - Service: sugarApache - Apache Software Foundation - "C:\PROGRA~1\SUGARC~1.1E\apache2\bin\Apache.exe" -k runservice
O23 - Service: sugarMysql - Unknown owner - C:\PROGRA~1\SUGARC~1.1E\mysql\bin\mysqld.exe --defaults-file=C:\PROGRA~1\SUGARC~1.1E\mysql\my.ini sugarMysql


-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

S3 GMSIPCI - d:\install\gmsipci.sys (file missing)
S3 TVICHW32 - c:\windows\system32\drivers\tvichw32.sys <Not Verified; EnTech Taiwan; TVicHW32 Generic Device Driver for Windows 95/98/ME/NT/2000/2003/XP/XP64>
S3 USBIO (USBIO Driver (usbio.sys)) - c:\windows\system32\drivers\usbio.sys <Not Verified; Thesycon GmbH, Germany; Universal USB Device Driver>


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 sugarApache - "c:\progra~1\sugarc~1.1e\apache2\bin\apache.exe" -k runservice <Not Verified; Apache Software Foundation; Apache HTTP Server>
R2 sugarMysql - c:\progra~1\sugarc~1.1e\mysql\bin\mysqld.exe --defaults-file=c:\progra~1\sugarc~1.1e\mysql\my.ini sugarmysql


-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: Contrôleur d'interruptions systèmes
Device ID: PCI\VEN_1106&DEV_5327&SUBSYS_53271849&REV_00\3&267A616A&0&05
Manufacturer:
Name: Contrôleur d'interruptions systèmes
PNP Device ID: PCI\VEN_1106&DEV_5327&SUBSYS_53271849&REV_00\3&267A616A&0&05
Service:


-- Scheduled Tasks -------------------------------------------------------------

2007-10-03 16:32:05 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job


-- Files created between 2007-09-08 and 2007-10-08 -----------------------------

2007-10-05 22:40:42 0 d-------- C:\WINDOWS\system32\ActiveScan
2007-10-05 20:53:34 0 d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-10-05 20:51:48 0 d---s---- C:\Documents and Settings\kouye\UserData
2007-10-03 17:28:58 0 d-------- C:\Program Files\Lavasoft
2007-10-03 17:28:57 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-10-03 17:27:27 0 d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2007-10-03 17:05:14 0 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-10-03 16:30:29 0 d-------- C:\Program Files\sugarcrm-4.5.1e
2007-10-03 16:01:13 72192 --a------ C:\WINDOWS\system32\taskkill.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2007-10-02 23:14:17 0 d--hs---- C:\$RECYCLE.BIN
2007-10-02 22:27:18 438840 -rahs---- C:\bootmgr
2007-10-02 22:27:17 0 d--hs---- C:\Boot


-- Find3M Report ---------------------------------------------------------------

2007-10-08 18:03:08 0 d-------- C:\Program Files\SpywareBlaster
2007-10-08 18:00:32 0 d-------- C:\Documents and Settings\kouye\Application Data\ma-config.com
2007-10-07 22:56:24 458230 --a------ C:\WINDOWS\system32\perfh00C.dat
2007-10-07 22:56:24 71248 --a------ C:\WINDOWS\system32\perfc00C.dat
2007-10-03 17:27:27 0 d-------- C:\Program Files\Fichiers communs
2007-08-26 18:37:37 339968 --a------ C:\WINDOWS\system32\chotdkcbs.exe
2007-08-26 12:14:24 336896 --a------ C:\WINDOWS\system32\wxyvcxot.exe
2007-08-26 11:52:53 323584 --a------ C:\WINDOWS\system32\idsgnwv.exe
2007-08-25 17:05:09 0 d-------- C:\Program Files\QuickTime
2007-08-25 17:04:26 0 d-------- C:\Program Files\Apple Software Update
2007-08-25 16:51:53 337408 --a------ C:\WINDOWS\system32\riligssxuk.exe
2007-08-25 13:33:48 336384 --a------ C:\WINDOWS\system32\spwbsg.exe
2007-08-25 10:46:56 340480 --a------ C:\WINDOWS\system32\rqiwsgjab.exe
2007-08-24 1938 341504 --a------ C:\WINDOWS\system32\mtnvkjn.exe
2007-08-24 15:24:45 327680 --a------ C:\WINDOWS\system32\gdndsltoq.exe
2007-08-24 11:16:41 331776 --a------ C:\WINDOWS\system32\cohnlnyqg.exe
2007-08-23 22:38:34 334848 --a------ C:\WINDOWS\system32\mficltwjq.exe
2007-08-23 19:35:49 0 d-------- C:\Program Files\Mindscape
2007-08-23 19:32:10 0 d-------- C:\Program Files\Aventures sur l'Ile LEGO
2007-08-23 19:05:26 0 d-------- C:\Program Files\InterActual
2007-08-23 14:54:26 0 d-------- C:\Program Files\MSXML 4.0
2007-08-23 14:53:29 0 d-------- C:\Program Files\Datel
2007-07-30 12:44:03 2745 --a------ C:\WINDOWS\mozver.dat
2007-07-24 10:26:24 0 --a------ C:\WINDOWS\nsreg.dat
2007-07-24 01:02:22 62 --ahs---- C:\Documents and Settings\kouye\Application Data\desktop.ini
2007-07-23 23:12:30 0 -rahs---- C:\MSDOS.SYS
2007-07-23 23:12:30 0 -rahs---- C:\IO.SYS
2007-07-23 23:12:30 0 --a------ C:\CONFIG.SYS
2007-07-23 23:12:30 0 --a------ C:\AUTOEXEC.BAT
2007-07-23 23:09:48 21892 --a------ C:\WINDOWS\system32\emptyregdb.dat


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTimer"="VTTimer.exe" [07/03/2005 21:33 C:\WINDOWS\system32\VTTimer.exe]
"VTTrayp"="VTtrayp.exe" [10/07/2006 20:33 C:\WINDOWS\system32\VTTrayp.exe]
"SoundMan"="SOUNDMAN.EXE" [02/03/2006 01:22 C:\WINDOWS\soundman.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [06/09/2007 12:06]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [11/05/2007 03:06]
"xizdvfpbsu"="c:\windows\system32\xizdvfpbsu.exe" [23/08/2007 22:36]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [29/06/2007 06:24]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [19/08/2004 16:09]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

*Newly Created Service* - APPMGMT



-- End of Deckard's System Scanner: finished at 2007-10-08 18:12:43 ------------



Panda online scan report :


Incident Status Location

Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Johan\Application Data\Mozilla\Firefox\Profiles\atwl8r92.default\cookies.txt[.xiti.com/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Johan\Application Data\Mozilla\Firefox\Profiles\atwl8r92.default\cookies.txt[.advertising.com/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Johan\Application Data\Mozilla\Firefox\Profiles\atwl8r92.default\cookies.txt[.doubleclick.net/]
Spyware:Cookie/Smartadserver Not disinfected C:\Documents and Settings\Johan\Application Data\Mozilla\Firefox\Profiles\atwl8r92.default\cookies.txt[.smartadserver.com/]
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Johan\Application Data\Mozilla\Firefox\Profiles\atwl8r92.default\cookies.txt[.overture.com/]
Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Johan\Application Data\Mozilla\Firefox\Profiles\atwl8r92.default\cookies.txt[.bluestreak.com/]
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Johan\Application Data\Mozilla\Firefox\Profiles\atwl8r92.default\cookies.txt[.atdmt.com/]
Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\Johan\Application Data\Mozilla\Firefox\Profiles\atwl8r92.default\cookies.txt[.adtech.de/]
Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\Johan\Application Data\Mozilla\Firefox\Profiles\atwl8r92.default\cookies.txt[.tradedoubler.com/]
Spyware:Cookie/Weborama Not disinfected C:\Documents and Settings\Johan\Application Data\Mozilla\Firefox\Profiles\atwl8r92.default\cookies.txt[.weborama.fr/]
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Johan\Application Data\Mozilla\Firefox\Profiles\atwl8r92.default\cookies.txt[.mediaplex.com/]
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Johan\Application Data\Mozilla\Firefox\Profiles\atwl8r92.default\cookies.txt[.2o7.net/]
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Johan\Application Data\Mozilla\Firefox\Profiles\atwl8r92.default\cookies.txt[.fastclick.net/]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Johan\Application Data\Mozilla\Firefox\Profiles\atwl8r92.default\cookies.txt[.247realmedia.com/]
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Johan\Cookies\johan@xiti[1].txt
Spyware:Cookie/Weborama Not disinfected C:\Documents and Settings\kouye\Application Data\Mozilla\Firefox\Profiles\ewg6v4od.default\cookies.txt[.weborama.fr/]
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\kouye\Application Data\Mozilla\Firefox\Profiles\ewg6v4od.default\cookies.txt[.2o7.net/]
Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\kouye\Application Data\Mozilla\Firefox\Profiles\ewg6v4od.default\cookies.txt[.adtech.de/]
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\kouye\Application Data\Mozilla\Firefox\Profiles\ewg6v4od.default\cookies.txt[.atdmt.com/]
Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\kouye\Application Data\Mozilla\Firefox\Profiles\ewg6v4od.default\cookies.txt[.toplist.cz/]
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\kouye\Application Data\Mozilla\Firefox\Profiles\ewg6v4od.default\cookies.txt[.xiti.com/]
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\kouye\Cookies\kouye@xiti[1].txt
Adware:Adware/NaviPromo Not disinfected C:\WINDOWS\system32\cohnlnyqg.exe
Adware:Adware/NaviPromo Not disinfected C:\WINDOWS\system32\gdndsltoq.exe
Adware:Adware/NaviPromo Not disinfected C:\WINDOWS\system32\idsgnwv.exe
Adware:Adware/NaviPromo Not disinfected C:\WINDOWS\system32\mficltwjq.exe
Adware:Adware/NaviPromo Not disinfected C:\WINDOWS\system32\mtnvkjn.exe
Adware:Adware/NaviPromo Not disinfected C:\WINDOWS\system32\riligssxuk.exe
Adware:Adware/NaviPromo Not disinfected C:\WINDOWS\system32\rqiwsgjab.exe
Adware:Adware/NaviPromo Not disinfected C:\WINDOWS\system32\spwbsg.exe
Adware:Adware/NaviPromo Not disinfected C:\WINDOWS\system32\wxyvcxot.exe
Adware:Adware/NaviPromo Not disinfected C:\WINDOWS\system32\xizdvfpbsu.exe
Spyware:Cookie/2o7 Not disinfected F:\Users\Edward\AppData\Roaming\Microsoft\Windows\Cookies\Low\edward@2o7[2].txt
Spyware:Cookie/Bluestreak Not disinfected F:\Users\Edward\AppData\Roaming\Microsoft\Windows\Cookies\Low\edward@bluestreak[1].txt
Spyware:Cookie/Serving-sys Not disinfected F:\Users\Edward\AppData\Roaming\Microsoft\Windows\Cookies\Low\edward@bs.serving-sys[1].txt
Spyware:Cookie/Doubleclick Not disinfected F:\Users\Edward\AppData\Roaming\Microsoft\Windows\Cookies\Low\edward@doubleclick[1].txt
Spyware:Cookie/Serving-sys Not disinfected F:\Users\Edward\AppData\Roaming\Microsoft\Windows\Cookies\Low\edward@serving-sys[1].txt
Spyware:Cookie/Smartadserver Not disinfected F:\Users\Edward\AppData\Roaming\Microsoft\Windows\Cookies\Low\edward@smartadserver[1].txt
Spyware:Cookie/Toplist Not disinfected F:\Users\Edward\AppData\Roaming\Microsoft\Windows\Cookies\Low\edward@toplist[1].txt
Attached Files
File Type: txt extra.txt (17.5 KB, 1 views)
kouye is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Sponsored Links
Old 10-10-2007, 07:48 PM   #2 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 32,563
OS: 2000 Pro; XP Pro; XP Home


Re: Constant popups in IE 6 and Firefox 2
Hello, and Welcome to TSF.

Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

---------------------------------------------------------------------------------------------
  1. Download this file - http://download.bleepingcomputer.com...a/ComboFix.exe

    * IMPORTANT !!! Place combofix.exe on your Desktop


  2. Disconnect from the internet....pull the plug!
  3. Go to -> Run -> paste in the following single line command & click OK

    "%userprofile%\desktop\combofix.exe" /killall



  4. Follow the prompts. Type "1" and press Enter to begin the scan.
  5. Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
  6. When finished, it shall produce a log for you. Post that log in your next reply

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

    ---------------------------------------------------------------------------------------------
  7. Re-establish an internet connection.
  8. Please download HijackThis to your desktop

    Alternate link

    Double-click on the file you just downloaded.
    Click on the "Unzip" button to install. It will by default install to the directory - C:\Program Files\Trend Micro\HijackThis

    Upon install, HijackThis should open for you.

    Should it not open, navigate to C:\Program Files\Trend Micro\HijackThis and double click on HijackThis.exe

    1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'.
    2. If you don't get the intro screen, just hit Scan and then click on Save log.
    3. Post the hijackthis.log file here. Do not fix anything in HijackThis since they may be harmless.

    ---------------------------------------------------------------------------------------------

    ---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006


Please do not ask for help via Private Message.
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 10-11-2007, 09:39 AM   #3 (permalink)
Registered User
 
Join Date: Jan 2007
Location: Paris, France
Posts: 298
OS: Win XP SP3, OS X 10.6


Re: Constant popups in IE 6 and Firefox 2
Hi Tetonbob,
Good to "see" ou again. Here are the Combofix and HijackThis logs.
A bientôt.


ComboFix 07-10-11.5 - kouye 2007-10-11 18:24:35.1 - NTFSx86
Microsoft Windows XP dition familiale 5.1.2600.2.1252.1.1036.18.657 [GMT 2:00]
Running from: C:\Documents and Settings\kouye\bureau\combofix.exe
Command switches used :: /killall
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Johan\Application Data\MessengerSkinner
C:\Documents and Settings\Johan\Application Data\MessengerSkinner\Userdata\languages_v2.xml
C:\WINDOWS\system32\xizdvfpbsu.dat
C:\WINDOWS\system32\xizdvfpbsu.exe
C:\WINDOWS\system32\xizdvfpbsu_nav.dat
C:\WINDOWS\system32\xizdvfpbsu_navps.dat

.
((((((((((((((((((((((((((((( Fichiers créés 2007-09-11 to 2007-10-11 ))))))))))))))))))))))))))))))))))))
.

2007-10-11 18:23 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-11 08:24 <REP> d-------- C:\Program Files\MSXML 6.0
2007-10-08 18:59 <REP> d-------- C:\Documents and Settings\kouye\Application Data\IsolatedStorage
2007-10-08 18:59 1,682 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
2007-10-08 18:59 88 -r-hs---- C:\WINDOWS\system32\124FEE2AA2.sys
2007-10-08 18:55 536,576 --a------ C:\WINDOWS\system32\msvcr70d.dll
2007-10-08 18:55 344,064 --a------ C:\WINDOWS\system32\msvcr70.dll
2007-10-08 18:55 94,208 --a------ C:\WINDOWS\system32\msvci70d.dll
2007-10-08 18:51 <REP> d-------- C:\Program Files\Microsoft.NET
2007-10-08 18:49 <REP> d-------- C:\Program Files\Microsoft SQL Server
2007-10-08 18:49 <REP> d-------- C:\Program Files\ACT
2007-10-08 18:49 <REP> d-------- C:\Documents and Settings\kouye\Application Data\ACT
2007-10-08 18:49 <REP> d-------- C:\Documents and Settings\All Users\Application Data\ACT
2007-10-08 18:08 <REP> d-------- C:\Deckard
2007-10-05 22:40 <REP> d-------- C:\WINDOWS\system32\ActiveScan
2007-10-05 20:53 <REP> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-10-05 20:51 <REP> d---s---- C:\Documents and Settings\kouye\UserData
2007-10-03 17:28 <REP> d-------- C:\Program Files\Lavasoft
2007-10-03 17:28 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-10-03 17:27 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2007-10-03 17:05 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-10-03 16:30 <REP> d-------- C:\Program Files\sugarcrm-4.5.1e
2007-10-03 16:01 72,192 --a------ C:\WINDOWS\system32\taskkill.exe

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-08 16:59 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-10-08 16:03 --------- d-----w C:\Program Files\SpywareBlaster
2007-10-08 16:00 --------- d-----w C:\Documents and Settings\kouye\Application Data\ma-config.com
2007-10-03 15:31 9,344 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys
2007-10-03 15:31 8,320 ----a-w C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-09-06 10:09 801,144 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-09-06 10:05 94,416 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-09-06 10:05 92,848 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-09-06 10:03 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-09-06 10:02 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-09-06 10:00 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr
2007-09-06 10:00 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-08-26 16:37 339,968 ----a-w C:\WINDOWS\system32\chotdkcbs.exe
2007-08-26 10:14 336,896 ----a-w C:\WINDOWS\system32\wxyvcxot.exe
2007-08-26 09:52 323,584 ----a-w C:\WINDOWS\system32\idsgnwv.exe
2007-08-25 15:05 --------- d-----w C:\Program Files\QuickTime
2007-08-25 15:04 --------- d-----w C:\Program Files\Apple Software Update
2007-08-25 15:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-08-25 15:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2007-08-25 14:51 337,408 ----a-w C:\WINDOWS\system32\riligssxuk.exe
2007-08-25 11:33 336,384 ----a-w C:\WINDOWS\system32\spwbsg.exe
2007-08-25 08:46 340,480 ----a-w C:\WINDOWS\system32\rqiwsgjab.exe
2007-08-24 17:06 341,504 ----a-w C:\WINDOWS\system32\mtnvkjn.exe
2007-08-24 13:24 327,680 ----a-w C:\WINDOWS\system32\gdndsltoq.exe
2007-08-24 09:16 331,776 ----a-w C:\WINDOWS\system32\cohnlnyqg.exe
2007-08-23 20:38 334,848 ----a-w C:\WINDOWS\system32\mficltwjq.exe
2007-08-23 17:35 --------- d-----w C:\Program Files\Mindscape
2007-08-23 17:32 --------- d-----w C:\Program Files\Aventures sur l'Ile LEGO
2007-08-23 17:05 --------- d-----w C:\Program Files\InterActual
2007-08-23 12:54 --------- d-----w C:\Program Files\MSXML 4.0
2007-08-23 12:53 --------- d-----w C:\Program Files\Datel
2007-08-21 06:17 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-07-30 17:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-07-30 17:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-07-30 17:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-07-30 17:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
2007-07-30 17:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-07-30 17:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-07-30 17:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-07-30 17:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTimer"="VTTimer.exe" [2005-03-07 21:33 C:\WINDOWS\system32\VTTimer.exe]
"VTTrayp"="VTtrayp.exe" [2006-07-10 20:33 C:\WINDOWS\system32\VTTrayp.exe]
"SoundMan"="SOUNDMAN.EXE" [2006-03-02 01:22 C:\WINDOWS\soundman.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24]
"Act.Outlook.Service"="C:\Program Files\ACT\ACT for Windows\Act.Outlook.Service.exe" [2007-03-28 11:43]
"Act! Preloader"="C:\Program Files\ACT\ACT for Windows\ActSage.exe" [2007-03-28 11:38]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 16:09]

R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys
R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys
R2 MSSQL$ACT7;SQL Server (ACT7);"C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sACT7
R2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe"
S3 SQLWriter;SQL Server VSS Writer;"C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"

*Newly Created Service* - CATCHME
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2007-10-10 14:32:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-11 18:27:52
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-11 18:29:17
.
--- E O F ---



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:33:37, on 11/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Act.UI.InternetExplorer.Plugins.AttachFile.CAttachFile - {D5233FCD-D258-4903-89B8-FB1568E7413D} - mscoree.dll (file missing)
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Act.Outlook.Service] "C:\Program Files\ACT\ACT for Windows\Act.Outlook.Service.exe"
O4 - HKLM\..\Run: [Act! Preloader] "C:\Program Files\ACT\ACT for Windows\ActSage.exe" -preload
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: Joindre la page Web au contact ACT! - {6F431AC3-364A-478b-BBDB-89C7CE1B18F6} - mscoree.dll (file missing)
O9 - Extra 'Tools' menuitem: Joindre la page Web au contact ACT!... - {6F431AC3-364A-478b-BBDB-89C7CE1B18F6} - mscoree.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

--
End of file - 4333 bytes
kouye is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 10-11-2007, 10:38 AM   #4 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 32,563
OS: 2000 Pro; XP Pro; XP Home


Re: Constant popups in IE 6 and Firefox 2
Open notepad and copy/paste the text in the quotebox below into it:

Quote:
http://www.techsupportforum.com/security-center/hijackthis-log-help/186664-constant-popups-ie-6-firefox-2-a.html

Collect::
C:\WINDOWS\system32\chotdkcbs.exe
C:\WINDOWS\system32\wxyvcxot.exe
C:\WINDOWS\system32\idsgnwv.exe
C:\WINDOWS\system32\riligssxuk.exe
C:\WINDOWS\system32\spwbsg.exe
C:\WINDOWS\system32\rqiwsgjab.exe
C:\WINDOWS\system32\mtnvkjn.exe
C:\WINDOWS\system32\gdndsltoq.exe
C:\WINDOWS\system32\cohnlnyqg.exe
C:\WINDOWS\system32\mficltwjq.exe
Save this as CFScript.txt




Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply.

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture a file to submit for analysis.

Ensure you are connected to the internet and click OK. A browser will open. Simply follow the instructions to copy/paste/send the requested file.

---------------------------------------------------------------------------------------------

Please run this online scan to help look for remnants.

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Answer Yes, when prompted to install an ActiveX component.
  • The program will then begin downloading the latest definition files.
  • Once the files have been downloaded click on NEXT
  • Locate the Scan Settings button & configure to:
    • Scan using the following Anti-Virus database:
      • Extended
    • Scan Options:
      • Scan Archives
      • Scan Mail Bases
  • Click OK & have it scan My Computer
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply
* Turn off the real time scanner of any existing antivirus program while performing the online scan

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the licence, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

---------------------------------------------------------------------------------------------

Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.


Create an uninstall list:

With HiJackThis still open
  • Click on the configure button on the bottom right
  • Click on the tab "Misc Tools"
  • Click on the Box that says "Open Uninstall Manager"
  • Click on the button "Save list"
  • Copy and past the List from the notepad file into your post

---------------------------------------------------------------------------------------------

Please return with results from:

ComboFix
Kaspersky online scan
HijackThis scan
Uninstall list

How is your system behaving, please?
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006


Please do not ask for help via Private Message.
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 10-11-2007, 02:31 PM   #5 (permalink)
Registered User
 
Join Date: Jan 2007
Location: Paris, France
Posts: 298
OS: Win XP SP3, OS X 10.6


Re: Constant popups in IE 6 and Firefox 2
Hi,
The system seems to be behaving a lot better (no more popups so far). Here are the logs.


ComboFix 07-10-11.5 - kouye 2007-10-11 22:01:29.2 - NTFSx86
Microsoft Windows XP dition familiale 5.1.2600.2.1252.1.1036.18.610 [GMT 2:00]
Running from: C:\Documents and Settings\kouye\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\kouye\Bureau\CFScript.txt
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\chotdkcbs.exe
C:\WINDOWS\system32\cohnlnyqg.exe
C:\WINDOWS\system32\gdndsltoq.exe
C:\WINDOWS\system32\idsgnwv.exe
C:\WINDOWS\system32\mficltwjq.exe
C:\WINDOWS\system32\mtnvkjn.exe
C:\WINDOWS\system32\riligssxuk.exe
C:\WINDOWS\system32\rqiwsgjab.exe
C:\WINDOWS\system32\spwbsg.exe
C:\WINDOWS\system32\wxyvcxot.exe

.
((((((((((((((((((((((((((((( Fichiers créés 2007-09-11 to 2007-10-11 ))))))))))))))))))))))))))))))))))))
.

2007-10-11 18:33 <REP> d-------- C:\Program Files\Trend Micro
2007-10-11 18:23 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-11 08:24 <REP> d-------- C:\Program Files\MSXML 6.0
2007-10-08 18:59 <REP> d-------- C:\Documents and Settings\kouye\Application Data\IsolatedStorage
2007-10-08 18:59 1,682 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
2007-10-08 18:59 88 -r-hs---- C:\WINDOWS\system32\124FEE2AA2.sys
2007-10-08 18:55 536,576 --a------ C:\WINDOWS\system32\msvcr70d.dll
2007-10-08 18:55 344,064 --a------ C:\WINDOWS\system32\msvcr70.dll
2007-10-08 18:55 94,208 --a------ C:\WINDOWS\system32\msvci70d.dll
2007-10-08 18:51 <REP> d-------- C:\Program Files\Microsoft.NET
2007-10-08 18:49 <REP> d-------- C:\Program Files\Microsoft SQL Server
2007-10-08 18:49 <REP> d-------- C:\Program Files\ACT
2007-10-08 18:49 <REP> d-------- C:\Documents and Settings\kouye\Application Data\ACT
2007-10-08 18:49 <REP> d-------- C:\Documents and Settings\All Users\Application Data\ACT
2007-10-08 18:08 <REP> d-------- C:\Deckard
2007-10-05 22:40 <REP> d-------- C:\WINDOWS\system32\ActiveScan
2007-10-05 20:53 <REP> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-10-05 20:51 <REP> d---s---- C:\Documents and Settings\kouye\UserData
2007-10-03 17:28 <REP> d-------- C:\Program Files\Lavasoft
2007-10-03 17:28 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-10-03 17:27 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2007-10-03 17:05 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-10-03 16:30 <REP> d-------- C:\Program Files\sugarcrm-4.5.1e
2007-10-03 16:01 72,192 --a------ C:\WINDOWS\system32\taskkill.exe

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-08 16:59 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-10-08 16:03 --------- d-----w C:\Program Files\SpywareBlaster
2007-10-08 16:00 --------- d-----w C:\Documents and Settings\kouye\Application Data\ma-config.com
2007-10-03 15:31 9,344 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys
2007-10-03 15:31 8,320 ----a-w C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-09-06 10:09 801,144 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-09-06 10:05 94,416 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-09-06 10:05 92,848 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-09-06 10:03 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-09-06 10:02 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-09-06 10:00 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr
2007-09-06 10:00 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-08-25 15:05 --------- d-----w C:\Program Files\QuickTime
2007-08-25 15:04 --------- d-----w C:\Program Files\Apple Software Update
2007-08-25 15:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-08-25 15:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2007-08-23 17:35 --------- d-----w C:\Program Files\Mindscape
2007-08-23 17:32 --------- d-----w C:\Program Files\Aventures sur l'Ile LEGO
2007-08-23 17:05 --------- d-----w C:\Program Files\InterActual
2007-08-23 12:54 --------- d-----w C:\Program Files\MSXML 4.0
2007-08-23 12:53 --------- d-----w C:\Program Files\Datel
2007-08-21 06:17 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-07-30 17:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-07-30 17:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-07-30 17:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-07-30 17:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
2007-07-30 17:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-07-30 17:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-07-30 17:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-07-30 17:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTimer"="VTTimer.exe" [2005-03-07 21:33 C:\WINDOWS\system32\VTTimer.exe]
"VTTrayp"="VTtrayp.exe" [2006-07-10 20:33 C:\WINDOWS\system32\VTTrayp.exe]
"SoundMan"="SOUNDMAN.EXE" [2006-03-02 01:22 C:\WINDOWS\soundman.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24]
"Act.Outlook.Service"="C:\Program Files\ACT\ACT for Windows\Act.Outlook.Service.exe" [2007-03-28 11:43]
"Act! Preloader"="C:\Program Files\ACT\ACT for Windows\ActSage.exe" [2007-03-28 11:38]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 16:09]

R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys
R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys
R2 MSSQL$ACT7;SQL Server (ACT7);"C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sACT7
R2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe"
S3 SQLWriter;SQL Server VSS Writer;"C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"

*Newly Created Service* - CATCHME
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2007-10-10 14:32:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-11 22:04:33
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-11 2200
C:\ComboFix2.txt ... 2007-10-11 18:29
.
--- E O F ---


-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Thursday, October 11, 2007 11:20:59 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 11/10/2007
Kaspersky Anti-Virus database records: 431123
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\

Scan Statistics:
Total number of scanned objects: 69172
Number of viruses found: 1
Number of infected objects: 18
Number of suspicious objects: 0
Duration of the scan process: 00:45:26

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\kouye\Application Data\Mozilla\Firefox\Profiles\ewg6v4od.default\cert8.db Object is locked skipped
C:\Documents and Settings\kouye\Application Data\Mozilla\Firefox\Profiles\ewg6v4od.default\formhistory.dat Object is locked skipped
C:\Documents and Settings\kouye\Application Data\Mozilla\Firefox\Profiles\ewg6v4od.default\foxmarks.log Object is locked skipped
C:\Documents and Settings\kouye\Application Data\Mozilla\Firefox\Profiles\ewg6v4od.default\history.dat Object is locked skipped
C:\Documents and Settings\kouye\Application Data\Mozilla\Firefox\Profiles\ewg6v4od.default\key3.db Object is locked skipped
C:\Documents and Settings\kouye\Application Data\Mozilla\Firefox\Profiles\ewg6v4od.default\parent.lock Object is locked skipped
C:\Documents and Settings\kouye\Application Data\Mozilla\Firefox\Profiles\ewg6v4od.default\search.sqlite Object is locked skipped
C:\Documents and Settings\kouye\Application Data\Mozilla\Firefox\Profiles\ewg6v4od.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\kouye\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\kouye\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\kouye\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\kouye\Local Settings\Application Data\Mozilla\Firefox\Profiles\ewg6v4od.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\kouye\Local Settings\Application Data\Mozilla\Firefox\Profiles\ewg6v4od.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\kouye\Local Settings\Application Data\Mozilla\Firefox\Profiles\ewg6v4od.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\kouye\Local Settings\Application Data\Mozilla\Firefox\Profiles\ewg6v4od.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\kouye\Local Settings\Historique\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\kouye\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\kouye\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\kouye\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\Historique\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Historique\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\AshWebSv.ws Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\aswMaiSv.log Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\report\Protection résidente.txt Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\mastlog.ldf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\model.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\modellog.ldf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\msdbdata.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\msdblog.ldf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\tempdb.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\templog.ldf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\LOG\ERRORLOG Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\LOG\log_7.trc Object is locked skipped
C:\Program Files\Sunbelt Software\Personal Firewall\logs\debug.log Object is locked skipped
C:\Program Files\Sunbelt Software\Personal Firewall\logs\debug.log.idx Object is locked skipped
C:\Program Files\Sunbelt Software\Personal Firewall\logs\error.log Object is locked skipped
C:\Program Files\Sunbelt Software\Personal Firewall\logs\error.log.idx Object is locked skipped
C:\Program Files\Sunbelt Software\Personal Firewall\logs\hips.log Object is locked skipped
C:\Program Files\Sunbelt Software\Personal Firewall\logs\hips.log.idx Object is locked skipped
C:\Program Files\Sunbelt Software\Personal Firewall\logs\ids.log Object is locked skipped
C:\Program Files\Sunbelt Software\Personal Firewall\logs\ids.log.idx Object is locked skipped
C:\Program Files\Sunbelt Software\Personal Firewall\logs\network.log Object is locked skipped
C:\Program Files\Sunbelt Software\Personal Firewall\logs\network.log.idx Object is locked skipped
C:\Program Files\Sunbelt Software\Personal Firewall\logs\system.log Object is locked skipped
C:\Program Files\Sunbelt Software\Personal Firewall\logs\system.log.idx Object is locked skipped
C:\Program Files\Sunbelt Software\Personal Firewall\logs\warning.log Object is locked skipped
C:\Program Files\Sunbelt Software\Personal Firewall\logs\warning.log.idx Object is locked skipped
C:\Program Files\Sunbelt Software\Personal Firewall\logs\web.log Object is locked skipped
C:\Program Files\Sunbelt Software\Personal Firewall\logs\web.log.idx Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{5F7443BF-8B92-4C57-8080-432C2A023EDB}\RP15\A0002240.exe/EXE-file/stream/data0006 Infected: not-a-virus:AdWare.Win32.NaviPromo.bw skipped
C:\System Volume Information\_restore{5F7443BF-8B92-4C57-8080-432C2A023EDB}\RP15\A0002240.exe/EXE-file/stream Infected: not-a-virus:AdWare.Win32.NaviPromo.bw skipped
C:\System Volume Information\_restore{5F7443BF-8B92-4C57-8080-432C2A023EDB}\RP15\A0002240.exe/EXE-file Infected: not-a-virus:AdWare.Win32.NaviPromo.bw skipped
C:\System Volume Information\_restore{5F7443BF-8B92-4C57-8080-432C2A023EDB}\RP15\A0002240.exe Embedded EXE: infected - 3 skipped
C:\System Volume Information\_restore{5F7443BF-8B92-4C57-8080-432C2A023EDB}\RP15\A0002240.exe UPX: infected - 3 skipped
C:\System Volume Information\_restore{5F7443BF-8B92-4C57-8080-432C2A023EDB}\RP15\A0002240.exe PE_Patch.UPX: infected - 3 skipped
C:\System Volume Information\_restore{5F7443BF-8B92-4C57-8080-432C2A023EDB}\RP15\A0002245.exe/stream/data0005 Infected: not-a-virus:AdWare.Win32.NaviPromo.bw skipped
C:\System Volume Information\_restore{5F7443BF-8B92-4C57-8080-432C2A023EDB}\RP15\A0002245.exe/stream Infected: not-a-virus:AdWare.Win32.NaviPromo.bw skipped
C:\System Volume Information\_restore{5F7443BF-8B92-4C57-8080-432C2A023EDB}\RP15\A0002245.exe NSIS: infected - 2 skipped
C:\System Volume Information\_restore{5F7443BF-8B92-4C57-8080-432C2A023EDB}\RP15\A0002247.exe/EXE-file/stream/data0006 Infected: not-a-virus:AdWare.Win32.NaviPromo.bw skipped
C:\System Volume Information\_restore{5F7443BF-8B92-4C57-8080-432C2A023EDB}\RP15\A0002247.exe/EXE-file/stream Infected: not-a-virus:AdWare.Win32.NaviPromo.bw skipped
C:\System Volume Information\_restore{5F7443BF-8B92-4C57-8080-432C2A023EDB}\RP15\A0002247.exe/EXE-file Infected: not-a-virus:AdWare.Win32.NaviPromo.bw skipped
C:\System Volume Information\_restore{5F7443BF-8B92-4C57-8080-432C2A023EDB}\RP15\A0002247.exe Embedded EXE: infected - 3 skipped
C:\System Volume Information\_restore{5F7443BF-8B92-4C57-8080-432C2A023EDB}\RP15\A0002247.exe UPX: infected - 3 skipped
C:\System Volume Information\_restore{5F7443BF-8B92-4C57-8080-432C2A023EDB}\RP15\A0002247.exe PE_Patch.UPX: infected - 3 skipped
C:\System Volume Information\_restore{5F7443BF-8B92-4C57-8080-432C2A023EDB}\RP22\A0007381.exe/stream/data0005 Infected: not-a-virus:AdWare.Win32.NaviPromo.bw skipped
C:\System Volume Information\_restore{5F7443BF-8B92-4C57-8080-432C2A023EDB}\RP22\A0007381.exe/stream Infected: not-a-virus:AdWare.Win32.NaviPromo.bw skipped
C:\System Volume Information\_restore{5F7443BF-8B92-4C57-8080-432C2A023EDB}\RP22\A0007381.exe NSIS: infected - 2 skipped
C:\System Volume Information\_restore{5F7443BF-8B92-4C57-8080-432C2A023EDB}\RP38\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{B18205D6-3993-43D9-9E14-55A999B188B6}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_62c.dat Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_7f8.dat Object is locked skipped
C:\WINDOWS\Temp\_avast4_\Webshlock.txt Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
F:\hiberfil.sys Object is locked skipped
F:\System Volume Information\_restore{5F7443BF-8B92-4C57-8080-432C2A023EDB}\RP38\change.log Object is locked skipped
F:\Windows\CSC\v2.0.6\pq Object is locked skipped
F:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDiagLog.etl Object is locked skipped
F:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-Application.etl Object is locked skipped

Scan process completed.



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:23:50, on 11/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Act.UI.InternetExplorer.Plugins.AttachFile.CAttachFile - {D5233FCD-D258-4903-89B8-FB1568E7413D} - mscoree.dll (file missing)
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Act.Outlook.Service] "C:\Program Files\ACT\ACT for Windows\Act.Outlook.Service.exe"
O4 - HKLM\..\Run: [Act! Preloader] "C:\Program Files\ACT\ACT for Windows\ActSage.exe" -preload
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: Joindre la page Web au contact ACT! - {6F431AC3-364A-478b-BBDB-89C7CE1B18F6} - mscoree.dll (file missing)
O9 - Extra 'Tools' menuitem: Joindre la page Web au contact ACT!... - {6F431AC3-364A-478b-BBDB-89C7CE1B18F6} - mscoree.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

--
End of file - 4384 bytes


Uninstall list :


ACT! by Sage
Ad-Aware 2007
Adobe Reader 8.1.0 - Français
Apple Software Update
avast! Antivirus
Correctif Windows XP - KB873339
Correctif Windows XP - KB885835
Correctif Windows XP - KB885836
Correctif Windows XP - KB886185
Correctif Windows XP - KB887472
Correctif Windows XP - KB888302
Correctif Windows XP - KB890859
Correctif Windows XP - KB891781
EVEREST Home Edition v2.20
HijackThis 2.0.2
Kaspersky Online Scanner
Microsoft .NET Framework 2.0
Microsoft SQL Server 2005
Microsoft SQL Server 2005 Express Edition (ACT7)
Microsoft SQL Server Native Client
Microsoft SQL Server Setup Support Files (English)
Microsoft SQL Server VSS Writer
Mise à jour de sécurité pour Lecteur Windows Media (KB911564)
Mise à jour de sécurité pour Lecteur Windows Media 6.4 (KB925398)
Mise à jour de sécurité pour Lecteur Windows Media 9 (KB917734)
Mise à jour de sécurité pour Lecteur Windows Media 9 (KB936782)
Mise à jour de sécurité pour Windows XP (KB890046)
Mise à jour de sécurité pour Windows XP (KB893756)
Mise à jour de sécurité pour Windows XP (KB896358)
Mise à jour de sécurité pour Windows XP (KB896423)
Mise à jour de sécurité pour Windows XP (KB896428)
Mise à jour de sécurité pour Windows XP (KB899587)
Mise à jour de sécurité pour Windows XP (KB899591)
Mise à jour de sécurité pour Windows XP (KB900725)
Mise à jour de sécurité pour Windows XP (KB901017)
Mise à jour de sécurité pour Windows XP (KB901214)
Mise à jour de sécurité pour Windows XP (KB902400)
Mise à jour de sécurité pour Windows XP (KB904706)
Mise à jour de sécurité pour Windows XP (KB905414)
Mise à jour de sécurité pour Windows XP (KB905749)
Mise à jour de sécurité pour Windows XP (KB908519)
Mise à jour de sécurité pour Windows XP (KB911562)
Mise à jour de sécurité pour Windows XP (KB911927)
Mise à jour de sécurité pour Windows XP (KB913580)
Mise à jour de sécurité pour Windows XP (KB914388)
Mise à jour de sécurité pour Windows XP (KB914389)
Mise à jour de sécurité pour Windows XP (KB917344)
Mise à jour de sécurité pour Windows XP (KB917953)
Mise à jour de sécurité pour Windows XP (KB918118)
Mise à jour de sécurité pour Windows XP (KB918439)
Mise à jour de sécurité pour Windows XP (KB919007)
Mise à jour de sécurité pour Windows XP (KB920213)
Mise à jour de sécurité pour Windows XP (KB920670)
Mise à jour de sécurité pour Windows XP (KB920683)
Mise à jour de sécurité pour Windows XP (KB920685)
Mise à jour de sécurité pour Windows XP (KB921503)
Mise à jour de sécurité pour Windows XP (KB922819)
Mise à jour de sécurité pour Windows XP (KB923191)
Mise à jour de sécurité pour Windows XP (KB923414)
Mise à jour de sécurité pour Windows XP (KB923689)
Mise à jour de sécurité pour Windows XP (KB923789)
Mise à jour de sécurité pour Windows XP (KB923980)
Mise à jour de sécurité pour Windows XP (KB924191)
Mise à jour de sécurité pour Windows XP (KB924270)
Mise à jour de sécurité pour Windows XP (KB924496)
Mise à jour de sécurité pour Windows XP (KB924667)
Mise à jour de sécurité pour Windows XP (KB925902)
Mise à jour de sécurité pour Windows XP (KB926255)
Mise à jour de sécurité pour Windows XP (KB926436)
Mise à jour de sécurité pour Windows XP (KB927779)
Mise à jour de sécurité pour Windows XP (KB927802)
Mise à jour de sécurité pour Windows XP (KB928255)
Mise à jour de sécurité pour Windows XP (KB928843)
Mise à jour de sécurité pour Windows XP (KB929123)
Mise à jour de sécurité pour Windows XP (KB929969)
Mise à jour de sécurité pour Windows XP (KB930178)
Mise à jour de sécurité pour Windows XP (KB931261)
Mise à jour de sécurité pour Windows XP (KB931784)
Mise à jour de sécurité pour Windows XP (KB932168)
Mise à jour de sécurité pour Windows XP (KB933566)
Mise à jour de sécurité pour Windows XP (KB933729)
Mise à jour de sécurité pour Windows XP (KB935839)
Mise à jour de sécurité pour Windows XP (KB935840)
Mise à jour de sécurité pour Windows XP (KB936021)
Mise à jour de sécurité pour Windows XP (KB937143)
Mise à jour de sécurité pour Windows XP (KB938127)
Mise à jour de sécurité pour Windows XP (KB938829)
Mise à jour de sécurité pour Windows XP (KB939653)
Mise à jour de sécurité pour Windows XP (KB941202)
Mise à jour pour Windows XP (KB894391)
Mise à jour pour Windows XP (KB898461)
Mise à jour pour Windows XP (KB900485)
Mise à jour pour Windows XP (KB908531)
Mise à jour pour Windows XP (KB910437)
Mise à jour pour Windows XP (KB911280)
Mise à jour pour Windows XP (KB916595)
Mise à jour pour Windows XP (KB920872)
Mise à jour pour Windows XP (KB922582)
Mise à jour pour Windows XP (KB927891)
Mise à jour pour Windows XP (KB930916)
Mise à jour pour Windows XP (KB931836)
Mise à jour pour Windows XP (KB933360)
Mise à jour pour Windows XP (KB936357)
Mise à jour pour Windows XP (KB938828)
Mozilla Firefox (2.0.0.5)
Mozilla Firefox (2.0.0.6)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 Parser and SDK
MSXML 6.0 Parser (KB933579)
Panda ActiveScan
QuickTime
Realtek AC'97 Audio
Security Update for Microsoft .NET Framework 2.0 (KB928365)
Spybot - Search & Destroy 1.4
SpywareBlaster v3.5.1
Sunbelt Personal Firewall
VIA Rhine-Family Fast Ethernet Adapter
VIA/S3G Display Driver 6.14.10.0326
Windows Installer 3.1 (KB893803)
kouye is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 10-11-2007, 02:34 PM   #6 (permalink)
Registered User
 
Join Date: Jan 2007
Location: Paris, France
Posts: 298
OS: Win XP SP3, OS X 10.6


Re: Constant popups in IE 6 and Firefox 2
BTW, the Combofix file was successfully submitted to Bleeping Computer.
kouye is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 10-11-2007, 03:54 PM   #7 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 32,563
OS: 2000 Pro; XP Pro; XP Home


Re: Constant popups in IE 6 and Firefox 2
Thank you for the file submission.

Go to -> Run -> copy/paste the following single line command & click OK

combofix /u



This will uninstall ComboFix. It will also implement some cleanup procedures and reset System Restore points. That's where all of Kaspersky finds are.

-------------------------------------------------------------------------------------------------------------------------------



Your logs appear clean.You should be good to go. We still have a few items to address.

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programs if you don't have them already:
  • SpywareBlaster to help prevent spyware from installing in the first place.
    • Install & update SpywareBlaster with the latest definitions.
      After you have updated, click the button - enable protection for all unprotected items
  • SpywareGuard to catch and block spyware before it can execute.
  • SPYBOT - SEARCH & DESTROY
    Download and install Spybot - Search & Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here

    IE-SpyAd - IE/Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impairs attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. An installation tutorial is available here.

  • MVPS HOST FILE
    The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites form serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer.
    • Download Host.zip to your desktop.
    • From your Desktop right-click (hosts.zip) and select:
      Extract All from the menu.
    • Click Next, click Next, select the option:
      "Show Extracted files", click Finish
    • This will open the newly created hosts folder on your Desktop.
    • Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine.
    • Once updated you should see another prompt that the task was completed.

See this link for a listing of some online antivirus scanners:

Anti-Spyware Tutorial

Here are some additional utilities that will further enhance your safety.
  • http://www.trillian.cc ? Trillian or http://www.miranda-im.com ? Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)

  • http://www.mozilla.org/products/firefox/ - Firefox - Use this alternate browser. While Internet Explorer is not a bad browser, almost every exploit crafted is targeted to take advantage of an IE weakness.

  • http://java.com/en/index.jsp - Sun's Java - It's much more secure than Microsoft's Java Virtual Machine.

  • http://www.aumha.org/downloads/erunt-setup.exe - ERUNT - A useful freeware utility for users of Windows 2000/XP. It's made up of two parts - ERUNT & NTREGOPT.

    ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry.

    NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster.

In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles
If you want to fight back the Malware Writers that have made your life a misery, please take a look here and read what you can do against it.

Please respond to this thread one more time so we can mark this thread as resolved.
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006


Please do not ask for help via Private Message.
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 10-12-2007, 12:33 AM   #8 (permalink)
Registered User
 
Join Date: Jan 2007
Location: Paris, France
Posts: 298
OS: Win XP SP3, OS X 10.6


Re: Constant popups in IE 6 and Firefox 2
Hi,
I removed combofix using the procedure you outlined and installed the tools you suggested.
Thanks for sorting me out tetonbob !
kouye is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
 

« Previous Thread | Next Thread »

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off



All times are GMT -7. The time now is 12:56 PM.

Contact Us - Tech Support Forum - Archive - Privacy Statement - Top


Copyright 2001 - 2009, Tech Support Forum
Home Tips Plus | Outdoor Basecamp | Automotive Support Forum

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84