Scan Avira + Bug ordi = virus?

Hello Raphy,

Merci pour ton aide, voici le rapport:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:32:22, on 08-07-2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16681)
Boot mode: Normal

Running processes:
c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Windows\System32\WService.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Trend Micro\HijackThis\lalala.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.pt/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: VeriSoft Access Manager - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - c:\Program Files\Bioscrypt\VeriSoft\Bin\ItIEAddIn.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe c:\PROGRA~1\BIOSCR~1\VeriSoft\Bin\ASTSVCC.dll,RegisterModule
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [EPSON Stylus Photo RX520 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIAGE.EXE /F "C:\Windows\TEMP\E_SE2B6.tmp" /EF "HKLM"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [DigidesignMMERefresh] C:\Program Files\Digidesign\Drivers\MMERefresh.exe
O4 - HKLM\..\Run: [WService] WService.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVIÇO LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVIÇO LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVIÇO LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Serviço de rede')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Sistema')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6BFE6A14-132E-4F3D-8B26-45FF584D3537}: NameServer = 212.113.164.54,212.113.164.53
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: APSHook.dll
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Avid SDM Service (AvidSDMService) - Avid Technology, Inc. - C:\Windows\system32\AvidSDMService.exe
O23 - Service: Avid Startup (AvidStartup) - Unknown owner - C:\Windows\system32\AvidStartup.exe
O23 - Service: BestSync Service (BestSyncSvc) - RiseFly Software - C:\Program Files\Synchronisation\BestSync\BestSyncSvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: Digidesign MME Refresh Service (DigiRefresh) - Digidesign, A Division of Avid Technology, Inc. - C:\Program Files\Digidesign\Drivers\MMERefresh.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: WinTab Service (WinTabService) - Tablet Driver - C:\Windows\system32\DRIVERS\WtSrv.exe

Re,

bon, je ne sais pas pourquoi mais il n'y a aucun fichier txt dans C:\windows\bdoscan8\

Donc j'ai cliqué sur "click here to export the scan report"


voilà ce que ça donne:


BitDefender Online Scanner



Scan report generated at: Tue, Jul 08, 2008 - 20:38:36





Scan path: C:\;D:\;E:\;F:\;I:\;







Statistics

Time
02:27:00

Files
1048209

Folders
23015

Boot Sectors
7

Archives
7239

Packed Files
118144




Results

Identified Viruses
1

Infected Files
4

Suspect Files
0

Warnings
0

Disinfected
0

Deleted Files
4




Engines Info

Virus Definitions
1362387

Engine build
AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)

Scan plugins
16

Archive plugins
42

Unpack plugins
7

E-mail plugins
6

System plugins
5




Scan Settings

First Action
Disinfect

Second Action
Delete

Heuristics
Yes

Enable Warnings
Yes

Scanned Extensions
*;

Exclude Extensions


Scan Emails
Yes

Scan Archives
Yes

Scan Packed
Yes

Scan Files
Yes

Scan Boot
Yes




Scanned File
Status

C:\Users\Pablo\Desktop\received files\Adobe After Effects Plugin - Trapcode Plugins (3D Stroke, Lux, Particular, Shine, Sound Keys, Starglow)-Keygen Examples Tutorials.rar=>TrapCode Plugins\trapcode.multikeygen.v1.1.exe
Infected with: Trojan.Generic.321816

C:\Users\Pablo\Desktop\received files\Adobe After Effects Plugin - Trapcode Plugins (3D Stroke, Lux, Particular, Shine, Sound Keys, Starglow)-Keygen Examples Tutorials.rar=>TrapCode Plugins\trapcode.multikeygen.v1.1.exe
Deleted

C:\Users\Pablo\Desktop\received files\Adobe After Effects Plugin - Trapcode Plugins (3D Stroke, Lux, Particular, Shine, Sound Keys, Starglow)-Keygen Examples Tutorials.rar
Update failed

C:\Users\Pablo\Desktop\received files\trapcode plugins (3d stroke, lux, particular, shine, sound keys, starglow)-keygen.examples.tutorials-Adobe After Effects\TrapCode Plugins\trapcode.multikeygen.v1.1.exe
Infected with: Trojan.Generic.321816

C:\Users\Pablo\Desktop\received files\trapcode plugins (3d stroke, lux, particular, shine, sound keys, starglow)-keygen.examples.tutorials-Adobe After Effects\TrapCode Plugins\trapcode.multikeygen.v1.1.exe
Deleted

C:\Users\Pablo\Desktop\received files\trapcode plugins (3d stroke, lux, particular, shine, sound keys, starglow)-keygen.examples.tutorials-Adobe After Effects.rar=>TrapCode Plugins\trapcode.multikeygen.v1.1.exe
Infected with: Trojan.Generic.321816

C:\Users\Pablo\Desktop\received files\trapcode plugins (3d stroke, lux, particular, shine, sound keys, starglow)-keygen.examples.tutorials-Adobe After Effects.rar=>TrapCode Plugins\trapcode.multikeygen.v1.1.exe
Deleted

C:\Users\Pablo\Desktop\received files\trapcode plugins (3d stroke, lux, particular, shine, sound keys, starglow)-keygen.examples.tutorials-Adobe After Effects.rar
Update failed

C:\Users\Pablo\Desktop\trapcode.multikeygen.v1.1.exe
Infected with: Trojan.Generic.321816

C:\Users\Pablo\Desktop\trapcode.multikeygen.v1.1.exe
Deleted



Je ne suis pas sûr que ce soit ce que tu voulais mais une chose dont je suis sûr c'est qu'il atrouvé qqch.

J'attends la suite du programme, merci pour ton aide.

A+


On the rocks...

Hello,

J'ai relancé Antivir... Même problème :S
l'ordinateur bloque. J'ai du le redémarer...

Je comprends et connais le risque des cracks... Malheureusement dans le domaine de l'édition multimédia (video, 3d, etc..) tous les logiciels, plugins, updates sont franchement hors de prix. Comment faire?

Je sais bien que telecharger un crack est un gros risque mais parfois je n'ai pas les moyens de ne pas courir ce risque.
Si je n'ai pas les logiciels à la pointe, j'ai l'air de rien avec mes effets. Autant ne pas avoir d'ordinateur et faire du dessin à la main. Mais si je veux avoir des logiciels à la pointe je dois courir le risque de me retrouver sans ordinateur... c'est absurde... c'est un serpent qui se mord la queue! Je ne sais pas comment font les autres gens du milieu mais je doute qu'ils soient tous pleins aux as. Pour ma part je n'ai jamais téléchargé de crack pour des produits liés à la consomation de loisir. Que du pro! J'ai pas le choix.

Bref mon plaidoyer doit te paraitre pathétique. En tous cas j'approuve ta démarche de sensibilisation...

Enfin pour en revenir à ma machine:
donc antivir ne peut pas scanner l'intégralité de mon ordi.
Du reste aucun symptôme particulier si ce n'est... mais je crois que ça date d'il y a plus lgtps...de temps en temps, internet explorer bugge et doit redémarer. Je crois que c'est meme arrivé une ou deux fois à mon windows vista également.

Pourrais-tu m'indiquer la marche à suivre pour éliminer ces virus rétiscents?

merci encore,

A+

Bonjour raphy00,

m'aurais-tu abandonné?
je ne pense pas.
Mais bon...
quand reviendras-tu?

A++

Allo allo, Panique!!!!

Il s'est passé pas mal de chose...
trop en faite pour que je puisse te faire un compte rendu hyper précis.
Je vais essayer.

Je lance le antibagle.
Je vais faire un tour dans la cuisine pour préparer le dîner.

Lorsque je reviens l'ordi est en train de redémarer, antibagle se prépare à me pondre un beau compte-rendu.
Je remarque quant même que mon fond d'écran a disparu. Soudain alors que Antibagle me dit qu'il va m'enregistrer un compte-rendu, spybot se réveille et me dit quedes modif importantes blablabla, j'accepte car je pense que c'est antibagle. Puis un deuxième avertissement de spybot, cette fois par rapport à Epson (mon imprimante).Je me dit "bizarre quand même. Un jour faudra quant même que j'essaie de comprendre à quoi sert spybot.." j'accpete la modif.

Puis un troisième avertissement. Cette fois je fais un peu plus attention. Apparemment il me demande si je veux bien supprimer Dummy.exe. Je dit oui.

Je constate ensuite que ma connection internet ne fonctionne plus.
Je m'apprête À redémarer l'ordi lorsqu'il me dit que TEATIME ne me permet pas de redémarer. Paniqué j'appuie sur le gros bouton.
Depuis j'ai redémaré. le fond d'écran est revenu. Tjrs pas d'internet. J'ai dû rebrancher mon vieil ordi pour poster ceci.

Je transferre le fichier .txt par clé usb et le voici:

ComboFix 08-07-08.9 - Pablo 2008-07-09 21:01:16.1 - NTFSx86
Executando de: C:\Users\Pablo\Desktop\antibagle.exe
* Criado um novo ponto de restauro
.

((((((((((((((((((((((((((((((((((((( Outras Exclusäes )))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Windows\system32\twunk_16.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SROSA


((((((((((((((((((((((( Ficheiros criados de 2008-06-09 to 2008-07-09 ))))))))))))))))))))))))))))))))
.

Nenhum ficheiro/arquivo criado durante este per¡odo

.
((((((((((((((((((((((((((((((((((((( Relat¢rio Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-09 19:59 --------- d-----w C:\Users\Pablo\AppData\Roaming\Skype
2008-07-09 11:31 174 --sha-w C:\Program Files\desktop.ini
2008-07-09 03:51 --------- d-----w C:\Program Files\Windows Mail
2008-07-08 16:31 --------- d-----w C:\Program Files\Trend Micro
2008-07-08 12:06 --------- d-----w C:\ProgramData\Avira
2008-07-08 12:06 --------- d-----w C:\Program Files\Avira
2008-07-08 11:25 591,163 ----a-w C:\Users\Pablo\AppData\Roaming\nvModes.dat
2008-07-01 00:30 --------- d-----w C:\Program Files\Common Files\Autodesk Shared
2008-07-01 00:27 --------- d-----w C:\ProgramData\Autodesk
2008-07-01 00:20 --------- d-----w C:\Program Files\Autodesk
2008-06-30 16:48 --------- d-----w C:\Users\Pablo\AppData\Roaming\Ahead
2008-05-30 18:31 --------- d-----w C:\Program Files\eMule
2008-05-10 01:21 113,664 ----a-w C:\Windows\system32\drivers\rmcast.sys
2008-04-25 04:23 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-04-22 15:20 110 ----a-w C:\Users\Pablo\AppData\Roaming\wklnhst.dat
2007-09-10 00:52 22 --sha-w C:\Windows\SMINST\HPCD.sys
2008-03-26 16:28 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012008031020080317\index.dat
2008-03-26 16:28 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012008032620080327\index.dat
2008-03-29 21:43 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012008032920080330\index.dat
.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* entradas vazias & leg¡timas por defeito nÆo sÆo mostradas.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 13:35 125440]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 14:49 153136]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 12:43 2097488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-01-13 04:36 827392]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-02-12 15:37 174872]
"QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2007-04-23 18:11 176128]
"HP Health Check Scheduler"="C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-03-12 11:54 50696]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-05-01 11:27 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-05-01 11:27 8429568]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-05-01 11:27 81920]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00 132496]
"CognizanceTS"="c:\PROGRA~1\BIOSCR~1\VeriSoft\Bin\ASTSVCC.dll" [2003-12-22 19:12 17920]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06 40048]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24 286720]
"DigidesignMMERefresh"="C:\Program Files\Digidesign\Drivers\MMERefresh.exe" [2006-02-15 00:31 61440]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-09 19:53 153136]
"hpWirelessAssistant"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-10-03 16:15 480560]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]
"RtHDVCpl"="RtHDVCpl.exe" [2007-03-09 18:50 4390912 C:\Windows\RtHDVCpl.exe]
"WService"="WService.EXE" [2006-12-20 14:59 40960 C:\Windows\System32\WService.exe]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-09-05 14:09:54 727592]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MIDI3"= diomidi.dll
"wave3"= Digi32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2958061169-2700821280-3964504084-1000]
"EnableNotificationsRef"=dword:00000003

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{FB8B39FC-C619-46C2-AE88-21126F72E14F}"= C:\Program Files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{03DD174A-23D7-448E-A085-8FA30C0D8C34}"= C:\Program Files\HP\QuickPlay\QP.exe:Quick Play
"{3441131A-5585-4079-A772-84162CF5656B}"= C:\Program Files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{FA768280-9EEB-4745-A892-1E975AE18F6D}"= Disabled:UDP:C:\Program Files\Skype\Phone\Skype.exe:Skype
"{29DEF132-7793-4B97-85CD-0607D8A010FA}"= Disabled:TCP:C:\Program Files\Skype\Phone\Skype.exe:Skype
"TCP Query User{A2A91138-6EED-4B27-B176-421298BCBD1D}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
"UDP Query User{A35F14CB-8670-485A-AFCB-F79A3000E341}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
"{909E38C0-2474-4405-8B1B-24F74D7DF55E}"= UDP:C:\Program Files\Grisoft\AVG7\avgcc.exe:AVG Control Center
"{3BA4A3B3-8FE7-417E-8557-664DF3033DBF}"= TCP:C:\Program Files\Grisoft\AVG7\avgcc.exe:AVG Control Center
"{4497D2BA-E83B-4523-8058-DEFFC347403E}"= UDP:C:\Program Files\Grisoft\AVG7\avgw.exe:AVG Test Center
"{CF901780-2670-444F-9377-7D1FDDDB34A8}"= TCP:C:\Program Files\Grisoft\AVG7\avgw.exe:AVG Test Center
"{4334ACC4-6F0B-4911-8443-B6FE17DE56F4}"= UDP:C:\Program Files\Grisoft\AVG7\avgvv.exe:AVG Virus Vault
"{463A8D77-3CB2-46F9-BF75-8B6518E7F81A}"= TCP:C:\Program Files\Grisoft\AVG7\avgvv.exe:AVG Virus Vault
"TCP Query User{3D9736A6-3837-46B7-9A14-BA50D133569B}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{6A8A01A5-B9B7-47A4-B677-754DC9A16232}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{64D77A37-2B39-4CD1-95DD-605AF1FF36D5}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
"UDP Query User{66D5C9B4-E14C-41BC-8713-8CE661123DB2}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
"TCP Query User{631E69F4-838D-4AB8-BA00-0B3BE46A7302}C:\\program files\\skype\\phone\\skype.exe"= UDP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"UDP Query User{A4BFEB7A-2A65-4ACF-BC7B-CB6D27B21A8C}C:\\program files\\skype\\phone\\skype.exe"= TCP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

R3 PTSimBus;%PTSimBus.SVCDESC%;C:\Windows\system32\DRIVERS\PTSimBus.sys [2006-12-21 20:26]
R3 PTSimHid;PenTablet Simulated HID MiniDriver;C:\Windows\system32\DRIVERS\PTSimHid.sys [2006-12-20 17:53]
S3 btwaudio;Dispositivo de áudio Bluetooth;C:\Windows\system32\drivers\btwaudio.sys [2007-09-18 14:12]
S3 btwavdt;Bluetooth AVDT;C:\Windows\system32\drivers\btwavdt.sys [2007-09-18 14:12]
S3 btwrchid;btwrchid;C:\Windows\system32\DRIVERS\btwrchid.sys [2007-09-18 14:12]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
Cognizance REG_MULTI_SZ ASBroker ASChannel
GPSvcGroup REG_MULTI_SZ GPSvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bab4b5be-db4f-11dc-9945-001a6bbabc25}]
\shell\AutoRun\command - G:\VMC_PBStarter.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bab4b5ca-db4f-11dc-9945-001a6bbabc25}]
\shell\AutoRun\command - G:\VMC_PBStarter.exe

.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-AVG7_CC - C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
HKLM-Run-NWEReboot - (no file)
HKU-Default-Run-AVG7_Run - C:\PROGRA~1\Grisoft\AVG7\avgw.exe


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-09 21:12:45
Windows 6.0.6000 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializ veis ocultas ...

Procurando ficheiros ocultos ...

Varredura completada com sucesso
Ficheiros ocultos: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Windows\System32\audiodg.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Bioscrypt\VeriSoft\Bin\asghost.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Windows\System32\AvidSDMService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
C:\Windows\System32\drivers\WTSrv.exe
C:\Windows\System32\wisptis.exe
C:\Windows\System32\wisptis.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
C:\Windows\System32\wbem\WMIADAP.exe
C:\Windows\System32\conime.exe
C:\Windows\System32\dllhost.exe
.
**************************************************************************
.
Tempo para conclusÆo: 2008-07-09 21:18:47 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-09 20:18:30

O sistema não pode encontrar o texto correspondente na mensagem de número 0x2379 no ficheiro de mensagens para Application.
Post-Run: 28,255,821,824 bytes livres

168 --- E O F --- 2008-07-09 03:52:32


Voilà.
Finalement j'ai tjrs pas dîné :S

A+