20 réponses
Utilisateur anonyme
22 déc. 2008 à 19:10
22 déc. 2008 à 19:10
bonsoir,
plusieures infections.....
commence par ceci:
Clique sur ce lien :
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe
Clique sur navilog1.exe pour télécharger navilog1
Choisis Enregistrer
et enregistre-le sur ton bureau.
Ensuite double clique sur navilog1.exe pour lancer l'installation.
Une fois l'installation terminée, le fix s'exécutera automatiquement.
(Si ce n'est pas le cas, double-clique sur le raccourci Navilog1 présent sur le bureau).
Laisse-toi guider. Au menu principal, choisis 1 et valide.
(ne fais pas le choix 2,3 ou 4 sans notre avis/accord)
Patiente jusqu'au message :
*** Analyse Terminée le ..... ***
Appuie sur une touche comme demandé, le bloc note va s'ouvrir.
Copie-colle l'intégralité dans une réponse. Referme le bloc note.
Le rapport est en outre sauvegardé à la racine du disque (C:\fixnavi.txt)
poste le rapport obtenu
a+
plusieures infections.....
commence par ceci:
Clique sur ce lien :
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe
Clique sur navilog1.exe pour télécharger navilog1
Choisis Enregistrer
et enregistre-le sur ton bureau.
Ensuite double clique sur navilog1.exe pour lancer l'installation.
Une fois l'installation terminée, le fix s'exécutera automatiquement.
(Si ce n'est pas le cas, double-clique sur le raccourci Navilog1 présent sur le bureau).
Laisse-toi guider. Au menu principal, choisis 1 et valide.
(ne fais pas le choix 2,3 ou 4 sans notre avis/accord)
Patiente jusqu'au message :
*** Analyse Terminée le ..... ***
Appuie sur une touche comme demandé, le bloc note va s'ouvrir.
Copie-colle l'intégralité dans une réponse. Referme le bloc note.
Le rapport est en outre sauvegardé à la racine du disque (C:\fixnavi.txt)
poste le rapport obtenu
a+
Merci beaucoup de m'aider, tu es très gentil!! J'ai tout fait, j'attends le rapport et je le poste de suite! J'espère que tu seras encore là
ca fait 30 mn que c ecrit veuillez patienter et un tiret clignote, c'est normal?
non ce scan est rapide normalement...
as tu validé apres avoir tapé 1?
si oui...
arrete et relance le scan....
a+
Antonio Giacomo Stradivari, souvent appelé Stradivarius (Crémone, 1644 - Crémone, 18 décembre 1737
Le Soil (1714), considéré par beaucoup comme le meilleur instrument du monde.
peu de temps avant sa mort il cherchait encore...
as tu validé apres avoir tapé 1?
si oui...
arrete et relance le scan....
a+
Antonio Giacomo Stradivari, souvent appelé Stradivarius (Crémone, 1644 - Crémone, 18 décembre 1737
Le Soil (1714), considéré par beaucoup comme le meilleur instrument du monde.
peu de temps avant sa mort il cherchait encore...
JE suis désolée ca marche pas
ok onre- essayeras apres...
Fais un scan avec cet antispyware :
Telecharge malwarebytes + tutoriel :
-> https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
Tu l´installes; le programme va se mettre automatiquement a jour.
Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression".
Click maintenant sur l´onglet recherche et coche la case : "executer un examen complet".
Puis click sur "rechercher".
Laisse le scanner le pc...
Si des elements on ete trouvés > click sur supprimer la selection.
si il t´es demandé de redemarrer > click sur "yes".
A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum.
Copie et colle le rapport stp.
a+
Fais un scan avec cet antispyware :
Telecharge malwarebytes + tutoriel :
-> https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
Tu l´installes; le programme va se mettre automatiquement a jour.
Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression".
Click maintenant sur l´onglet recherche et coche la case : "executer un examen complet".
Puis click sur "rechercher".
Laisse le scanner le pc...
Si des elements on ete trouvés > click sur supprimer la selection.
si il t´es demandé de redemarrer > click sur "yes".
A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum.
Copie et colle le rapport stp.
a+
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
Je l'ai lancé mais il fait que de planter, il m'a déjà trouvé 16 virus pr analyser 30000 fichiers, apres il plante. et quand je met arreter j ai le rapport et je clique sur supprimer la selection, mais ca plante!
ok c est tenace.....
1:
relance mbam et choisis : exécuter 1 scan rapide...et poste le rapport(si ca marche...)
si cela ne marche pas....
2:
relance mbam en mode sans echec.:
.
Comment aller en Mode sans échec ?
1) Redémarre ton ordi
2) Tapote la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip"
3) Tu verras un écran avec options de démarrage apparaître
4) Choisis la première option : Sans Échec, et valide avec "Entrée"
5) Choisis ton compte habituel, et non Administrateur (si besoin ... )
A+
1:
relance mbam et choisis : exécuter 1 scan rapide...et poste le rapport(si ca marche...)
si cela ne marche pas....
2:
relance mbam en mode sans echec.:
.
Comment aller en Mode sans échec ?
1) Redémarre ton ordi
2) Tapote la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip"
3) Tu verras un écran avec options de démarrage apparaître
4) Choisis la première option : Sans Échec, et valide avec "Entrée"
5) Choisis ton compte habituel, et non Administrateur (si besoin ... )
A+
c bon j'ai réussi en scan rapide! MERCI, voilà le resultat:
Malwarebytes' Anti-Malware 1.31
Version de la base de données: 1456
Windows 5.1.2600 Service Pack 3
22/12/2008 22:39:49
mbam-log-2008-12-22 (22-28-13).txt
Type de recherche: Examen rapide
Eléments examinés: 61252
Temps écoulé: 8 minute(s), 3 second(s)
Processus mémoire infecté(s): 2
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 13
Valeur(s) du Registre infectée(s): 3
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 2
Fichier(s) infecté(s): 19
Processus mémoire infecté(s):
C:\Program Files\WebMediaViewer\qttask.exe (Trojan.Zlob) -> No action taken.
C:\Program Files\WebMediaViewer\qttaskm.exe (Trojan.Zlob) -> No action taken.
Module(s) mémoire infecté(s):
C:\WINDOWS\system32\900053\900053.dll (Trojan.BHO) -> No action taken.
Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\TypeLib\{e63648f7-3933-440e-b4f6-a8584dd7b7eb} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{f7d09218-46d7-4d3d-9b7f-315204cd0836} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{94fea8c1-0d9c-4d8d-a411-33da3c2c567a} (Trojan.BHO) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{94fea8c1-0d9c-4d8d-a411-33da3c2c567a} (Trojan.BHO) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{94fea8c1-0d9c-4d8d-a411-33da3c2c567a} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\setup.player (Spyware.MarketScore) -> No action taken.
HKEY_CLASSES_ROOT\setup.player.2k2 (Spyware.MarketScore) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{35b7e48b-9d81-4c6c-9578-5fd4f620d886} (Spyware.MarketScore) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3b8fb116-d358-48a3-a5c7-db84f15cbb04} (Trojan.Zlob) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{3b8fb116-d358-48a3-a5c7-db84f15cbb04} (Trojan.Zlob) -> No action taken.
HKEY_CLASSES_ROOT\webmedia.chl (Trojan.Zlob) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Online Alert Manager (Trojan.Zlob) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Browser Toolbar (Trojan.Zlob) -> No action taken.
Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{3b8fb116-d358-48a3-a5c7-db84f15cbb04} (Trojan.Zlob) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\quicktime task (Trojan.Zlob) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysftray2 (Trojan.Agent) -> No action taken.
Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> No action taken.
Dossier(s) infecté(s):
C:\Program Files\WebMediaViewer (Trojan.Zlob) -> No action taken.
C:\Program Files\TinyProxy (Trojan.Proxy) -> No action taken.
Fichier(s) infecté(s):
C:\Documents and Settings\Sébastien Habillon\Local Settings\Application Data\iymaeyu_navps.dat (Adware.Navipromo.H) -> No action taken.
C:\Documents and Settings\Sébastien Habillon\Local Settings\Application Data\iymaeyu_nav.dat (Adware.Navipromo.H) -> No action taken.
C:\Documents and Settings\Sébastien Habillon\Local Settings\Application Data\iymaeyu.dat (Adware.Navipromo.H) -> No action taken.
C:\WINDOWS\system32\900053\900053.dll (Trojan.BHO) -> No action taken.
C:\Program Files\WebMediaViewer\browseu.exe (Trojan.Zlob) -> No action taken.
C:\Program Files\WebMediaViewer\myc.ico (Trojan.Zlob) -> No action taken.
C:\Program Files\WebMediaViewer\myd.ico (Trojan.Zlob) -> No action taken.
C:\Program Files\WebMediaViewer\mym.ico (Trojan.Zlob) -> No action taken.
C:\Program Files\WebMediaViewer\myp.ico (Trojan.Zlob) -> No action taken.
C:\Program Files\WebMediaViewer\myv.ico (Trojan.Zlob) -> No action taken.
C:\Program Files\WebMediaViewer\ot.ico (Trojan.Zlob) -> No action taken.
C:\Program Files\WebMediaViewer\qttask.exe (Trojan.Zlob) -> No action taken.
C:\Program Files\WebMediaViewer\qttaskm.exe (Trojan.Zlob) -> No action taken.
C:\Program Files\WebMediaViewer\qttasku.exe (Trojan.Zlob) -> No action taken.
C:\Program Files\WebMediaViewer\ts.ico (Trojan.Zlob) -> No action taken.
C:\WINDOWS\fmark2.dat (Malware.Trace) -> No action taken.
C:\Documents and Settings\All Users\Menu Démarrer\Online Spyware Test.url (Trojan.Zlob) -> No action taken.
C:\WINDOWS\system32\nvs2.inf (Adware.EGDAccess) -> No action taken.
C:\Documents and Settings\Sébastien Habillon\Local Settings\Temp\tt_1229715533.exe (Trojan.FakeAlert) -> No action taken.
Malwarebytes' Anti-Malware 1.31
Version de la base de données: 1456
Windows 5.1.2600 Service Pack 3
22/12/2008 22:39:49
mbam-log-2008-12-22 (22-28-13).txt
Type de recherche: Examen rapide
Eléments examinés: 61252
Temps écoulé: 8 minute(s), 3 second(s)
Processus mémoire infecté(s): 2
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 13
Valeur(s) du Registre infectée(s): 3
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 2
Fichier(s) infecté(s): 19
Processus mémoire infecté(s):
C:\Program Files\WebMediaViewer\qttask.exe (Trojan.Zlob) -> No action taken.
C:\Program Files\WebMediaViewer\qttaskm.exe (Trojan.Zlob) -> No action taken.
Module(s) mémoire infecté(s):
C:\WINDOWS\system32\900053\900053.dll (Trojan.BHO) -> No action taken.
Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\TypeLib\{e63648f7-3933-440e-b4f6-a8584dd7b7eb} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{f7d09218-46d7-4d3d-9b7f-315204cd0836} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{94fea8c1-0d9c-4d8d-a411-33da3c2c567a} (Trojan.BHO) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{94fea8c1-0d9c-4d8d-a411-33da3c2c567a} (Trojan.BHO) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{94fea8c1-0d9c-4d8d-a411-33da3c2c567a} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\setup.player (Spyware.MarketScore) -> No action taken.
HKEY_CLASSES_ROOT\setup.player.2k2 (Spyware.MarketScore) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{35b7e48b-9d81-4c6c-9578-5fd4f620d886} (Spyware.MarketScore) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3b8fb116-d358-48a3-a5c7-db84f15cbb04} (Trojan.Zlob) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{3b8fb116-d358-48a3-a5c7-db84f15cbb04} (Trojan.Zlob) -> No action taken.
HKEY_CLASSES_ROOT\webmedia.chl (Trojan.Zlob) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Online Alert Manager (Trojan.Zlob) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Browser Toolbar (Trojan.Zlob) -> No action taken.
Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{3b8fb116-d358-48a3-a5c7-db84f15cbb04} (Trojan.Zlob) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\quicktime task (Trojan.Zlob) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysftray2 (Trojan.Agent) -> No action taken.
Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> No action taken.
Dossier(s) infecté(s):
C:\Program Files\WebMediaViewer (Trojan.Zlob) -> No action taken.
C:\Program Files\TinyProxy (Trojan.Proxy) -> No action taken.
Fichier(s) infecté(s):
C:\Documents and Settings\Sébastien Habillon\Local Settings\Application Data\iymaeyu_navps.dat (Adware.Navipromo.H) -> No action taken.
C:\Documents and Settings\Sébastien Habillon\Local Settings\Application Data\iymaeyu_nav.dat (Adware.Navipromo.H) -> No action taken.
C:\Documents and Settings\Sébastien Habillon\Local Settings\Application Data\iymaeyu.dat (Adware.Navipromo.H) -> No action taken.
C:\WINDOWS\system32\900053\900053.dll (Trojan.BHO) -> No action taken.
C:\Program Files\WebMediaViewer\browseu.exe (Trojan.Zlob) -> No action taken.
C:\Program Files\WebMediaViewer\myc.ico (Trojan.Zlob) -> No action taken.
C:\Program Files\WebMediaViewer\myd.ico (Trojan.Zlob) -> No action taken.
C:\Program Files\WebMediaViewer\mym.ico (Trojan.Zlob) -> No action taken.
C:\Program Files\WebMediaViewer\myp.ico (Trojan.Zlob) -> No action taken.
C:\Program Files\WebMediaViewer\myv.ico (Trojan.Zlob) -> No action taken.
C:\Program Files\WebMediaViewer\ot.ico (Trojan.Zlob) -> No action taken.
C:\Program Files\WebMediaViewer\qttask.exe (Trojan.Zlob) -> No action taken.
C:\Program Files\WebMediaViewer\qttaskm.exe (Trojan.Zlob) -> No action taken.
C:\Program Files\WebMediaViewer\qttasku.exe (Trojan.Zlob) -> No action taken.
C:\Program Files\WebMediaViewer\ts.ico (Trojan.Zlob) -> No action taken.
C:\WINDOWS\fmark2.dat (Malware.Trace) -> No action taken.
C:\Documents and Settings\All Users\Menu Démarrer\Online Spyware Test.url (Trojan.Zlob) -> No action taken.
C:\WINDOWS\system32\nvs2.inf (Adware.EGDAccess) -> No action taken.
C:\Documents and Settings\Sébastien Habillon\Local Settings\Temp\tt_1229715533.exe (Trojan.FakeAlert) -> No action taken.
TRES BIEN...
mais je vois ''no action taken''...
reprend mbam :
Si des elements on ete trouvés > click sur supprimer la selection.
si il t´es demandé de redemarrer > click sur "yes".
poste le rapport
ensuite:
reprend hijackthis et fais 1 nouveau scan...
poste le rapport...
j attends les 2 rapports...
a+
mais je vois ''no action taken''...
reprend mbam :
Si des elements on ete trouvés > click sur supprimer la selection.
si il t´es demandé de redemarrer > click sur "yes".
poste le rapport
ensuite:
reprend hijackthis et fais 1 nouveau scan...
poste le rapport...
j attends les 2 rapports...
a+
oublie l illuminé du post 14....
---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
/!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\
---> Double-clique sur Combofix.exe
Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
Accepte en cliquant sur "Oui"
---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.
/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\
En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.
Une fois le scan achevé, un rapport va s'afficher : Poste son contenu
/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\
Note : Le rapport se trouve également là : C:\ComboFix.txt
a+
---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
/!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\
---> Double-clique sur Combofix.exe
Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
Accepte en cliquant sur "Oui"
---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.
/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\
En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.
Une fois le scan achevé, un rapport va s'afficher : Poste son contenu
/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\
Note : Le rapport se trouve également là : C:\ComboFix.txt
a+
Voilà le rapport, je l'ai fait en mose sans echec
ComboFix 08-12-21.04 - Sébastien Habillon 2008-12-23 19:41:42.1 - NTFSx86 MINIMAL
Lancé depuis: F:\ComboFix.exe
[COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR]
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\S‚bastien Habillon\BF23435CC30B9CE8\BF23435CC30B9CE8
c:\documents and settings\Sébastien Habillon\BF23435CC30B9CE8\
c:\documents and settings\Sébastien Habillon\BF23435CC30B9CE8\\BF23435CC30B9CE8
c:\documents and settings\Sébastien Habillon\Local Settings\Application Data\iymaeyu.dat
c:\documents and settings\Sébastien Habillon\Local Settings\Application Data\iymaeyu_nav.dat
c:\documents and settings\Sébastien Habillon\Local Settings\Application Data\iymaeyu_navps.dat
c:\documents and settings\Sébastien Habillon\real.txt
c:\program files\TinyProxy
c:\program files\webmediaviewer
c:\program files\webmediaviewer\browseu.exe
c:\program files\webmediaviewer\myc.ico
c:\program files\webmediaviewer\myd.ico
c:\program files\webmediaviewer\mym.ico
c:\program files\webmediaviewer\myp.ico
c:\program files\webmediaviewer\myv.ico
c:\program files\webmediaviewer\ot.ico
c:\program files\webmediaviewer\qttask.exe
c:\program files\webmediaviewer\qttaskm.exe
c:\program files\webmediaviewer\qttasku.exe
c:\program files\webmediaviewer\ts.ico
c:\windows\bolivar29.exe
c:\windows\f49f4daa.dat
c:\windows\fmark2.dat
c:\windows\system32\900053
c:\windows\system32\900053\900053.dll
c:\windows\system32\nvs2.inf
.
((((((((((((((((((((((((((((( Fichiers créés du 2008-11-23 au 2008-12-23 ))))))))))))))))))))))))))))))))))))
.
2008-12-23 19:13 . 2008-12-23 19:13 <REP> d-------- c:\program files\Softwin
2008-12-23 19:12 . 2008-12-23 19:13 <REP> d-------- c:\program files\Fichiers communs\Softwin
2008-12-22 20:14 . 2008-12-22 20:14 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-22 20:14 . 2008-12-22 20:14 <REP> d-------- c:\documents and settings\Sébastien Habillon\Application Data\Malwarebytes
2008-12-22 20:14 . 2008-12-22 20:14 <REP> d-------- c:\documents and settings\Sébastien Habillon\Application Data\Malwarebytes
2008-12-22 20:14 . 2008-12-22 20:14 <REP> d-------- c:\documents and settings\Sébastien Habillon\Application Data\Malwarebytes
2008-12-22 20:14 . 2008-12-22 20:14 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-22 20:14 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-22 20:14 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-22 19:27 . 2008-12-22 19:27 <REP> d-------- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2008-12-22 19:24 . 2008-12-22 19:58 <REP> d-------- c:\program files\Navilog1
2008-12-21 20:49 . 2008-12-21 22:44 <REP> d-------- c:\program files\Spyware Doctor
2008-12-21 20:49 . 2008-12-21 20:49 <REP> d-------- c:\documents and settings\Sébastien Habillon\Application Data\PC Tools
2008-12-21 20:49 . 2008-12-21 20:49 <REP> d-------- c:\documents and settings\Sébastien Habillon\Application Data\PC Tools
2008-12-21 20:49 . 2008-12-21 20:49 <REP> d-------- c:\documents and settings\Sébastien Habillon\Application Data\PC Tools
2008-12-21 20:49 . 2008-12-23 19:58 <REP> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2008-12-21 20:49 . 2008-08-25 12:36 81,288 --a------ c:\windows\system32\drivers\iksyssec.sys
2008-12-21 20:49 . 2008-08-25 12:36 66,952 --a------ c:\windows\system32\drivers\iksysflt.sys
2008-12-21 20:49 . 2008-08-25 12:36 40,840 --a------ c:\windows\system32\drivers\ikfilesec.sys
2008-12-21 20:49 . 2008-06-02 16:19 29,576 --a------ c:\windows\system32\drivers\kcom.sys
2008-12-19 20:39 . 2008-12-19 20:39 5,632 --a------ c:\windows\fd.dll
2008-12-13 00:55 . 2008-12-13 00:55 <REP> d-------- c:\program files\Tukanas Poker Tournament Timer
2008-12-12 22:14 . 2008-12-12 22:14 <REP> d-------- c:\windows\system32\fr-fr
2008-12-12 22:14 . 2008-12-12 22:14 <REP> d-------- c:\windows\system32\fr
2008-12-12 22:14 . 2008-12-12 22:14 <REP> d-------- c:\windows\system32\bits
2008-12-12 22:14 . 2008-12-12 22:14 <REP> d-------- c:\windows\l2schemas
2008-12-12 22:11 . 2008-12-12 22:14 <REP> d-------- c:\windows\ServicePackFiles
2008-12-12 22:05 . 2008-12-12 22:05 <REP> d-------- c:\windows\EHome
2008-12-12 21:48 . 2008-12-12 21:48 1 ---h----- c:\windows\fm123.dat
2008-12-09 21:23 . 2008-12-11 23:47 <REP> d-------- c:\program files\monAlbumPhoto
2008-12-09 21:23 . 2008-12-09 22:03 <REP> d-------- c:\documents and settings\All Users\Application Data\albumphoto
2008-12-09 20:09 . 2008-12-09 20:10 <REP> d-------- c:\windows\system32\351631
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-23 11:34 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\U3
2008-12-23 11:34 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\U3
2008-12-23 11:34 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\U3
2008-12-22 18:13 --------- d-----w c:\program files\Yahoo!
2008-12-22 06:24 --------- d-----w c:\program files\HPQ
2008-12-21 22:30 --------- d-----w c:\program files\Windows Live
2008-12-19 21:46 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\LimeWire
2008-12-19 21:46 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\LimeWire
2008-12-19 21:46 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\LimeWire
2008-12-19 16:51 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Azureus
2008-12-19 16:51 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Azureus
2008-12-19 16:51 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Azureus
2008-12-18 13:20 --------- d-----w c:\program files\eMule
2008-12-11 22:56 --------- d-----w c:\program files\NCH Swift Sound
2008-12-11 22:52 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\NCH Swift Sound
2008-12-11 22:52 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\NCH Swift Sound
2008-12-11 22:52 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\NCH Swift Sound
2008-12-10 10:09 --------- d-----w c:\program files\Windows Live Safety Center
2008-11-27 22:11 --------- d-----w c:\program files\Azureus
2008-11-27 00:00 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Apple Computer
2008-11-27 00:00 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Apple Computer
2008-11-27 00:00 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Apple Computer
2008-11-26 16:09 --------- d-----w c:\program files\QuickTime
2008-11-26 12:33 --------- d-----w c:\program files\iTunes
2008-11-21 22:50 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-11-21 22:49 --------- d-----w c:\program files\iPod
2008-11-21 22:49 --------- d-----w c:\program files\Fichiers communs\Apple
2008-11-18 21:28 --------- d-----w c:\program files\Bonjour
2008-11-18 21:23 --------- d-----w c:\program files\Apple Software Update
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-23 22:27 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Media Player Classic
2008-10-23 22:27 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Media Player Classic
2008-10-23 22:27 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Media Player Classic
2008-10-23 22:26 --------- d-----w c:\program files\K-Lite Codec Pack
2008-10-23 22:25 --------- d-----w c:\program files\DivX
2006-12-08 17:02 4,096 ----a-w c:\documents and settings\Sébastien Habillon\log.dat
2006-12-08 17:02 4,096 ----a-w c:\documents and settings\Sébastien Habillon\log.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Ahead\lib\NMBgMonitor.exe" [2006-02-01 98304]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2005-11-15 1204224]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-04 68856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-22 339968]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-02-02 102492]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-02-02 692316]
"eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-12-03 290816]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 253952]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2005-02-17 233534]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2006-01-12 155648]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-11-07 111936]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2008-08-25 1168264]
"BDMCon"="c:\program files\Softwin\BitDefender9\bdmcon.exe" [2005-08-23 360448]
"BDOESRV"="c:\program files\Softwin\BitDefender9\bdoesrv.exe" [2005-03-11 90112]
"BDNewsAgent"="c:\program files\Softwin\BitDefender9\bdnagent.exe" [2005-06-09 9728]
"MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2008-04-14 172544]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 c:\windows\system32\bthprops.cpl]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"<NO NAME>"=
"c:\\Program Files\\Azureus\\Azureus.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
S1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-09-19 111184]
S1 navigator;navigator;\systemroot\fd.dll []
S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-09-19 20560]
S3 HSFHWATI;HSFHWATI;c:\windows\system32\DRIVERS\HSFHWATI.sys [2005-03-22 200192]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys [2008-12-22 38496]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a1553392-7ffa-11dd-badd-0014a52d67c8}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a
.
Contenu du dossier 'Tâches planifiées'
2008-12-15 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
2008-12-22 c:\windows\Tasks\B1AC27E098CBA560.job
- c:\docume~1\sbasti~1\applic~1\oncedo~1\LongDoesMove.exe []
.
- - - - ORPHELINS SUPPRIMES - - - -
BHO-{10B294F2-F790-A3F0-54A6-6005D1C61B79} - c:\docume~1\SBASTI~1\APPLIC~1\[u]0[/u]1JOY\COOLFACE.exe
BHO-{94FEA8C1-0D9C-4D8D-A411-33DA3C2C567A} - c:\windows\system32\900053\900053.dll
HKCU-Run-ViewMode - c:\docume~1\SBASTI~1\APPLIC~1\ONCEDO~1\Inside Readme.exe
HKCU-Run-iymaeyu - c:\documents and settings\sébastien habillon\local settings\application data\iymaeyu.exe
HKLM-Run-2 creative chin cake - c:\documents and settings\All Users\Application Data\1 proc 2 creative\sect ping.exe
HKU-Default-Run-msnmsgr - c:\program files\MSN Messenger\msnmsgr.exe
HKLM-Explorer_Run-QuickTime Task - c:\program files\WebMediaViewer\qttask.exe
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.prevhomepage.com/?q=http://www.prevhomepage.com/?q=http://www.prevhomepage.com/?q=http://www.prevhomepage.com/?q=http://www.prevhomepage.com/?q=http://www.prevhomepage.com/?q=http://www.prevhomepage.com/?q=
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=Q305&bd=pavilion&pf=laptop
uInternet Settings,ProxyOverride = *.local;<local>
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: {{3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.servicemenutool.com/redirect.php
IE: {{3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.servicemenutool.com/redirect.php -
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-23 19:56:33
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????0?3?7?1??????? ???B?????????????hLC? ??????
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(204)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Spyware Doctor\pctsAuxs.exe
c:\program files\Spyware Doctor\pctsSvc.exe
.
**************************************************************************
.
Heure de fin: 2008-12-23 20:04:19 - La machine a redémarré [Sébastien Habillon]
ComboFix-quarantined-files.txt 2008-12-23 19:03:35
Avant-CF: 27,288,805,376 octets libres
Après-CF: 28,229,152,768 octets libres
227 --- E O F --- 2008-12-19 02:01:22
ComboFix 08-12-21.04 - Sébastien Habillon 2008-12-23 19:41:42.1 - NTFSx86 MINIMAL
Lancé depuis: F:\ComboFix.exe
[COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR]
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\S‚bastien Habillon\BF23435CC30B9CE8\BF23435CC30B9CE8
c:\documents and settings\Sébastien Habillon\BF23435CC30B9CE8\
c:\documents and settings\Sébastien Habillon\BF23435CC30B9CE8\\BF23435CC30B9CE8
c:\documents and settings\Sébastien Habillon\Local Settings\Application Data\iymaeyu.dat
c:\documents and settings\Sébastien Habillon\Local Settings\Application Data\iymaeyu_nav.dat
c:\documents and settings\Sébastien Habillon\Local Settings\Application Data\iymaeyu_navps.dat
c:\documents and settings\Sébastien Habillon\real.txt
c:\program files\TinyProxy
c:\program files\webmediaviewer
c:\program files\webmediaviewer\browseu.exe
c:\program files\webmediaviewer\myc.ico
c:\program files\webmediaviewer\myd.ico
c:\program files\webmediaviewer\mym.ico
c:\program files\webmediaviewer\myp.ico
c:\program files\webmediaviewer\myv.ico
c:\program files\webmediaviewer\ot.ico
c:\program files\webmediaviewer\qttask.exe
c:\program files\webmediaviewer\qttaskm.exe
c:\program files\webmediaviewer\qttasku.exe
c:\program files\webmediaviewer\ts.ico
c:\windows\bolivar29.exe
c:\windows\f49f4daa.dat
c:\windows\fmark2.dat
c:\windows\system32\900053
c:\windows\system32\900053\900053.dll
c:\windows\system32\nvs2.inf
.
((((((((((((((((((((((((((((( Fichiers créés du 2008-11-23 au 2008-12-23 ))))))))))))))))))))))))))))))))))))
.
2008-12-23 19:13 . 2008-12-23 19:13 <REP> d-------- c:\program files\Softwin
2008-12-23 19:12 . 2008-12-23 19:13 <REP> d-------- c:\program files\Fichiers communs\Softwin
2008-12-22 20:14 . 2008-12-22 20:14 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-22 20:14 . 2008-12-22 20:14 <REP> d-------- c:\documents and settings\Sébastien Habillon\Application Data\Malwarebytes
2008-12-22 20:14 . 2008-12-22 20:14 <REP> d-------- c:\documents and settings\Sébastien Habillon\Application Data\Malwarebytes
2008-12-22 20:14 . 2008-12-22 20:14 <REP> d-------- c:\documents and settings\Sébastien Habillon\Application Data\Malwarebytes
2008-12-22 20:14 . 2008-12-22 20:14 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-22 20:14 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-22 20:14 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-22 19:27 . 2008-12-22 19:27 <REP> d-------- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2008-12-22 19:24 . 2008-12-22 19:58 <REP> d-------- c:\program files\Navilog1
2008-12-21 20:49 . 2008-12-21 22:44 <REP> d-------- c:\program files\Spyware Doctor
2008-12-21 20:49 . 2008-12-21 20:49 <REP> d-------- c:\documents and settings\Sébastien Habillon\Application Data\PC Tools
2008-12-21 20:49 . 2008-12-21 20:49 <REP> d-------- c:\documents and settings\Sébastien Habillon\Application Data\PC Tools
2008-12-21 20:49 . 2008-12-21 20:49 <REP> d-------- c:\documents and settings\Sébastien Habillon\Application Data\PC Tools
2008-12-21 20:49 . 2008-12-23 19:58 <REP> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2008-12-21 20:49 . 2008-08-25 12:36 81,288 --a------ c:\windows\system32\drivers\iksyssec.sys
2008-12-21 20:49 . 2008-08-25 12:36 66,952 --a------ c:\windows\system32\drivers\iksysflt.sys
2008-12-21 20:49 . 2008-08-25 12:36 40,840 --a------ c:\windows\system32\drivers\ikfilesec.sys
2008-12-21 20:49 . 2008-06-02 16:19 29,576 --a------ c:\windows\system32\drivers\kcom.sys
2008-12-19 20:39 . 2008-12-19 20:39 5,632 --a------ c:\windows\fd.dll
2008-12-13 00:55 . 2008-12-13 00:55 <REP> d-------- c:\program files\Tukanas Poker Tournament Timer
2008-12-12 22:14 . 2008-12-12 22:14 <REP> d-------- c:\windows\system32\fr-fr
2008-12-12 22:14 . 2008-12-12 22:14 <REP> d-------- c:\windows\system32\fr
2008-12-12 22:14 . 2008-12-12 22:14 <REP> d-------- c:\windows\system32\bits
2008-12-12 22:14 . 2008-12-12 22:14 <REP> d-------- c:\windows\l2schemas
2008-12-12 22:11 . 2008-12-12 22:14 <REP> d-------- c:\windows\ServicePackFiles
2008-12-12 22:05 . 2008-12-12 22:05 <REP> d-------- c:\windows\EHome
2008-12-12 21:48 . 2008-12-12 21:48 1 ---h----- c:\windows\fm123.dat
2008-12-09 21:23 . 2008-12-11 23:47 <REP> d-------- c:\program files\monAlbumPhoto
2008-12-09 21:23 . 2008-12-09 22:03 <REP> d-------- c:\documents and settings\All Users\Application Data\albumphoto
2008-12-09 20:09 . 2008-12-09 20:10 <REP> d-------- c:\windows\system32\351631
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-23 11:34 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\U3
2008-12-23 11:34 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\U3
2008-12-23 11:34 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\U3
2008-12-22 18:13 --------- d-----w c:\program files\Yahoo!
2008-12-22 06:24 --------- d-----w c:\program files\HPQ
2008-12-21 22:30 --------- d-----w c:\program files\Windows Live
2008-12-19 21:46 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\LimeWire
2008-12-19 21:46 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\LimeWire
2008-12-19 21:46 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\LimeWire
2008-12-19 16:51 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Azureus
2008-12-19 16:51 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Azureus
2008-12-19 16:51 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Azureus
2008-12-18 13:20 --------- d-----w c:\program files\eMule
2008-12-11 22:56 --------- d-----w c:\program files\NCH Swift Sound
2008-12-11 22:52 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\NCH Swift Sound
2008-12-11 22:52 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\NCH Swift Sound
2008-12-11 22:52 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\NCH Swift Sound
2008-12-10 10:09 --------- d-----w c:\program files\Windows Live Safety Center
2008-11-27 22:11 --------- d-----w c:\program files\Azureus
2008-11-27 00:00 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Apple Computer
2008-11-27 00:00 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Apple Computer
2008-11-27 00:00 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Apple Computer
2008-11-26 16:09 --------- d-----w c:\program files\QuickTime
2008-11-26 12:33 --------- d-----w c:\program files\iTunes
2008-11-21 22:50 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-11-21 22:49 --------- d-----w c:\program files\iPod
2008-11-21 22:49 --------- d-----w c:\program files\Fichiers communs\Apple
2008-11-18 21:28 --------- d-----w c:\program files\Bonjour
2008-11-18 21:23 --------- d-----w c:\program files\Apple Software Update
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-23 22:27 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Media Player Classic
2008-10-23 22:27 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Media Player Classic
2008-10-23 22:27 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Media Player Classic
2008-10-23 22:26 --------- d-----w c:\program files\K-Lite Codec Pack
2008-10-23 22:25 --------- d-----w c:\program files\DivX
2006-12-08 17:02 4,096 ----a-w c:\documents and settings\Sébastien Habillon\log.dat
2006-12-08 17:02 4,096 ----a-w c:\documents and settings\Sébastien Habillon\log.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Ahead\lib\NMBgMonitor.exe" [2006-02-01 98304]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2005-11-15 1204224]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-04 68856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-22 339968]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-02-02 102492]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-02-02 692316]
"eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-12-03 290816]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 253952]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2005-02-17 233534]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2006-01-12 155648]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-11-07 111936]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2008-08-25 1168264]
"BDMCon"="c:\program files\Softwin\BitDefender9\bdmcon.exe" [2005-08-23 360448]
"BDOESRV"="c:\program files\Softwin\BitDefender9\bdoesrv.exe" [2005-03-11 90112]
"BDNewsAgent"="c:\program files\Softwin\BitDefender9\bdnagent.exe" [2005-06-09 9728]
"MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2008-04-14 172544]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 c:\windows\system32\bthprops.cpl]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"<NO NAME>"=
"c:\\Program Files\\Azureus\\Azureus.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
S1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-09-19 111184]
S1 navigator;navigator;\systemroot\fd.dll []
S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-09-19 20560]
S3 HSFHWATI;HSFHWATI;c:\windows\system32\DRIVERS\HSFHWATI.sys [2005-03-22 200192]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys [2008-12-22 38496]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a1553392-7ffa-11dd-badd-0014a52d67c8}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a
.
Contenu du dossier 'Tâches planifiées'
2008-12-15 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
2008-12-22 c:\windows\Tasks\B1AC27E098CBA560.job
- c:\docume~1\sbasti~1\applic~1\oncedo~1\LongDoesMove.exe []
.
- - - - ORPHELINS SUPPRIMES - - - -
BHO-{10B294F2-F790-A3F0-54A6-6005D1C61B79} - c:\docume~1\SBASTI~1\APPLIC~1\[u]0[/u]1JOY\COOLFACE.exe
BHO-{94FEA8C1-0D9C-4D8D-A411-33DA3C2C567A} - c:\windows\system32\900053\900053.dll
HKCU-Run-ViewMode - c:\docume~1\SBASTI~1\APPLIC~1\ONCEDO~1\Inside Readme.exe
HKCU-Run-iymaeyu - c:\documents and settings\sébastien habillon\local settings\application data\iymaeyu.exe
HKLM-Run-2 creative chin cake - c:\documents and settings\All Users\Application Data\1 proc 2 creative\sect ping.exe
HKU-Default-Run-msnmsgr - c:\program files\MSN Messenger\msnmsgr.exe
HKLM-Explorer_Run-QuickTime Task - c:\program files\WebMediaViewer\qttask.exe
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.prevhomepage.com/?q=http://www.prevhomepage.com/?q=http://www.prevhomepage.com/?q=http://www.prevhomepage.com/?q=http://www.prevhomepage.com/?q=http://www.prevhomepage.com/?q=http://www.prevhomepage.com/?q=
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=Q305&bd=pavilion&pf=laptop
uInternet Settings,ProxyOverride = *.local;<local>
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: {{3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.servicemenutool.com/redirect.php
IE: {{3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.servicemenutool.com/redirect.php -
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-23 19:56:33
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????0?3?7?1??????? ???B?????????????hLC? ??????
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(204)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Spyware Doctor\pctsAuxs.exe
c:\program files\Spyware Doctor\pctsSvc.exe
.
**************************************************************************
.
Heure de fin: 2008-12-23 20:04:19 - La machine a redémarré [Sébastien Habillon]
ComboFix-quarantined-files.txt 2008-12-23 19:03:35
Avant-CF: 27,288,805,376 octets libres
Après-CF: 28,229,152,768 octets libres
227 --- E O F --- 2008-12-19 02:01:22
Voilà le rapport, je l'ai fait en mose sans echec
ComboFix 08-12-21.04 - Sébastien Habillon 2008-12-23 19:41:42.1 - NTFSx86 MINIMAL
Lancé depuis: F:\ComboFix.exe
[COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR]
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\S‚bastien Habillon\BF23435CC30B9CE8\BF23435CC30B9CE8
c:\documents and settings\Sébastien Habillon\BF23435CC30B9CE8\
c:\documents and settings\Sébastien Habillon\BF23435CC30B9CE8\\BF23435CC30B9CE8
c:\documents and settings\Sébastien Habillon\Local Settings\Application Data\iymaeyu.dat
c:\documents and settings\Sébastien Habillon\Local Settings\Application Data\iymaeyu_nav.dat
c:\documents and settings\Sébastien Habillon\Local Settings\Application Data\iymaeyu_navps.dat
c:\documents and settings\Sébastien Habillon\real.txt
c:\program files\TinyProxy
c:\program files\webmediaviewer
c:\program files\webmediaviewer\browseu.exe
c:\program files\webmediaviewer\myc.ico
c:\program files\webmediaviewer\myd.ico
c:\program files\webmediaviewer\mym.ico
c:\program files\webmediaviewer\myp.ico
c:\program files\webmediaviewer\myv.ico
c:\program files\webmediaviewer\ot.ico
c:\program files\webmediaviewer\qttask.exe
c:\program files\webmediaviewer\qttaskm.exe
c:\program files\webmediaviewer\qttasku.exe
c:\program files\webmediaviewer\ts.ico
c:\windows\bolivar29.exe
c:\windows\f49f4daa.dat
c:\windows\fmark2.dat
c:\windows\system32\900053
c:\windows\system32\900053\900053.dll
c:\windows\system32\nvs2.inf
.
((((((((((((((((((((((((((((( Fichiers créés du 2008-11-23 au 2008-12-23 ))))))))))))))))))))))))))))))))))))
.
2008-12-23 19:13 . 2008-12-23 19:13 <REP> d-------- c:\program files\Softwin
2008-12-23 19:12 . 2008-12-23 19:13 <REP> d-------- c:\program files\Fichiers communs\Softwin
2008-12-22 20:14 . 2008-12-22 20:14 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-22 20:14 . 2008-12-22 20:14 <REP> d-------- c:\documents and settings\Sébastien Habillon\Application Data\Malwarebytes
2008-12-22 20:14 . 2008-12-22 20:14 <REP> d-------- c:\documents and settings\Sébastien Habillon\Application Data\Malwarebytes
2008-12-22 20:14 . 2008-12-22 20:14 <REP> d-------- c:\documents and settings\Sébastien Habillon\Application Data\Malwarebytes
2008-12-22 20:14 . 2008-12-22 20:14 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-22 20:14 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-22 20:14 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-22 19:27 . 2008-12-22 19:27 <REP> d-------- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2008-12-22 19:24 . 2008-12-22 19:58 <REP> d-------- c:\program files\Navilog1
2008-12-21 20:49 . 2008-12-21 22:44 <REP> d-------- c:\program files\Spyware Doctor
2008-12-21 20:49 . 2008-12-21 20:49 <REP> d-------- c:\documents and settings\Sébastien Habillon\Application Data\PC Tools
2008-12-21 20:49 . 2008-12-21 20:49 <REP> d-------- c:\documents and settings\Sébastien Habillon\Application Data\PC Tools
2008-12-21 20:49 . 2008-12-21 20:49 <REP> d-------- c:\documents and settings\Sébastien Habillon\Application Data\PC Tools
2008-12-21 20:49 . 2008-12-23 19:58 <REP> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2008-12-21 20:49 . 2008-08-25 12:36 81,288 --a------ c:\windows\system32\drivers\iksyssec.sys
2008-12-21 20:49 . 2008-08-25 12:36 66,952 --a------ c:\windows\system32\drivers\iksysflt.sys
2008-12-21 20:49 . 2008-08-25 12:36 40,840 --a------ c:\windows\system32\drivers\ikfilesec.sys
2008-12-21 20:49 . 2008-06-02 16:19 29,576 --a------ c:\windows\system32\drivers\kcom.sys
2008-12-19 20:39 . 2008-12-19 20:39 5,632 --a------ c:\windows\fd.dll
2008-12-13 00:55 . 2008-12-13 00:55 <REP> d-------- c:\program files\Tukanas Poker Tournament Timer
2008-12-12 22:14 . 2008-12-12 22:14 <REP> d-------- c:\windows\system32\fr-fr
2008-12-12 22:14 . 2008-12-12 22:14 <REP> d-------- c:\windows\system32\fr
2008-12-12 22:14 . 2008-12-12 22:14 <REP> d-------- c:\windows\system32\bits
2008-12-12 22:14 . 2008-12-12 22:14 <REP> d-------- c:\windows\l2schemas
2008-12-12 22:11 . 2008-12-12 22:14 <REP> d-------- c:\windows\ServicePackFiles
2008-12-12 22:05 . 2008-12-12 22:05 <REP> d-------- c:\windows\EHome
2008-12-12 21:48 . 2008-12-12 21:48 1 ---h----- c:\windows\fm123.dat
2008-12-09 21:23 . 2008-12-11 23:47 <REP> d-------- c:\program files\monAlbumPhoto
2008-12-09 21:23 . 2008-12-09 22:03 <REP> d-------- c:\documents and settings\All Users\Application Data\albumphoto
2008-12-09 20:09 . 2008-12-09 20:10 <REP> d-------- c:\windows\system32\351631
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-23 11:34 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\U3
2008-12-23 11:34 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\U3
2008-12-23 11:34 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\U3
2008-12-22 18:13 --------- d-----w c:\program files\Yahoo!
2008-12-22 06:24 --------- d-----w c:\program files\HPQ
2008-12-21 22:30 --------- d-----w c:\program files\Windows Live
2008-12-19 21:46 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\LimeWire
2008-12-19 21:46 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\LimeWire
2008-12-19 21:46 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\LimeWire
2008-12-19 16:51 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Azureus
2008-12-19 16:51 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Azureus
2008-12-19 16:51 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Azureus
2008-12-18 13:20 --------- d-----w c:\program files\eMule
2008-12-11 22:56 --------- d-----w c:\program files\NCH Swift Sound
2008-12-11 22:52 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\NCH Swift Sound
2008-12-11 22:52 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\NCH Swift Sound
2008-12-11 22:52 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\NCH Swift Sound
2008-12-10 10:09 --------- d-----w c:\program files\Windows Live Safety Center
2008-11-27 22:11 --------- d-----w c:\program files\Azureus
2008-11-27 00:00 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Apple Computer
2008-11-27 00:00 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Apple Computer
2008-11-27 00:00 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Apple Computer
2008-11-26 16:09 --------- d-----w c:\program files\QuickTime
2008-11-26 12:33 --------- d-----w c:\program files\iTunes
2008-11-21 22:50 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-11-21 22:49 --------- d-----w c:\program files\iPod
2008-11-21 22:49 --------- d-----w c:\program files\Fichiers communs\Apple
2008-11-18 21:28 --------- d-----w c:\program files\Bonjour
2008-11-18 21:23 --------- d-----w c:\program files\Apple Software Update
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-23 22:27 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Media Player Classic
2008-10-23 22:27 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Media Player Classic
2008-10-23 22:27 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Media Player Classic
2008-10-23 22:26 --------- d-----w c:\program files\K-Lite Codec Pack
2008-10-23 22:25 --------- d-----w c:\program files\DivX
2006-12-08 17:02 4,096 ----a-w c:\documents and settings\Sébastien Habillon\log.dat
2006-12-08 17:02 4,096 ----a-w c:\documents and settings\Sébastien Habillon\log.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Ahead\lib\NMBgMonitor.exe" [2006-02-01 98304]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2005-11-15 1204224]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-04 68856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-22 339968]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-02-02 102492]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-02-02 692316]
"eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-12-03 290816]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 253952]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2005-02-17 233534]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2006-01-12 155648]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-11-07 111936]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2008-08-25 1168264]
"BDMCon"="c:\program files\Softwin\BitDefender9\bdmcon.exe" [2005-08-23 360448]
"BDOESRV"="c:\program files\Softwin\BitDefender9\bdoesrv.exe" [2005-03-11 90112]
"BDNewsAgent"="c:\program files\Softwin\BitDefender9\bdnagent.exe" [2005-06-09 9728]
"MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2008-04-14 172544]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 c:\windows\system32\bthprops.cpl]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"<NO NAME>"=
"c:\\Program Files\\Azureus\\Azureus.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
S1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-09-19 111184]
S1 navigator;navigator;\systemroot\fd.dll []
S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-09-19 20560]
S3 HSFHWATI;HSFHWATI;c:\windows\system32\DRIVERS\HSFHWATI.sys [2005-03-22 200192]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys [2008-12-22 38496]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a1553392-7ffa-11dd-badd-0014a52d67c8}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a
.
Contenu du dossier 'Tâches planifiées'
2008-12-15 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
2008-12-22 c:\windows\Tasks\B1AC27E098CBA560.job
- c:\docume~1\sbasti~1\applic~1\oncedo~1\LongDoesMove.exe []
.
- - - - ORPHELINS SUPPRIMES - - - -
BHO-{10B294F2-F790-A3F0-54A6-6005D1C61B79} - c:\docume~1\SBASTI~1\APPLIC~1\[u]0[/u]1JOY\COOLFACE.exe
BHO-{94FEA8C1-0D9C-4D8D-A411-33DA3C2C567A} - c:\windows\system32\900053\900053.dll
HKCU-Run-ViewMode - c:\docume~1\SBASTI~1\APPLIC~1\ONCEDO~1\Inside Readme.exe
HKCU-Run-iymaeyu - c:\documents and settings\sébastien habillon\local settings\application data\iymaeyu.exe
HKLM-Run-2 creative chin cake - c:\documents and settings\All Users\Application Data\1 proc 2 creative\sect ping.exe
HKU-Default-Run-msnmsgr - c:\program files\MSN Messenger\msnmsgr.exe
HKLM-Explorer_Run-QuickTime Task - c:\program files\WebMediaViewer\qttask.exe
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.prevhomepage.com/?q=http://www.prevhomepage.com/?q=http://www.prevhomepage.com/?q=http://www.prevhomepage.com/?q=http://www.prevhomepage.com/?q=http://www.prevhomepage.com/?q=http://www.prevhomepage.com/?q=
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=Q305&bd=pavilion&pf=laptop
uInternet Settings,ProxyOverride = *.local;<local>
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: {{3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.servicemenutool.com/redirect.php
IE: {{3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.servicemenutool.com/redirect.php -
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-23 19:56:33
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????0?3?7?1??????? ???B?????????????hLC? ??????
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(204)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Spyware Doctor\pctsAuxs.exe
c:\program files\Spyware Doctor\pctsSvc.exe
.
**************************************************************************
.
Heure de fin: 2008-12-23 20:04:19 - La machine a redémarré [Sébastien Habillon]
ComboFix-quarantined-files.txt 2008-12-23 19:03:35
Avant-CF: 27,288,805,376 octets libres
Après-CF: 28,229,152,768 octets libres
227 --- E O F --- 2008-12-19 02:01:22
ComboFix 08-12-21.04 - Sébastien Habillon 2008-12-23 19:41:42.1 - NTFSx86 MINIMAL
Lancé depuis: F:\ComboFix.exe
[COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR]
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\S‚bastien Habillon\BF23435CC30B9CE8\BF23435CC30B9CE8
c:\documents and settings\Sébastien Habillon\BF23435CC30B9CE8\
c:\documents and settings\Sébastien Habillon\BF23435CC30B9CE8\\BF23435CC30B9CE8
c:\documents and settings\Sébastien Habillon\Local Settings\Application Data\iymaeyu.dat
c:\documents and settings\Sébastien Habillon\Local Settings\Application Data\iymaeyu_nav.dat
c:\documents and settings\Sébastien Habillon\Local Settings\Application Data\iymaeyu_navps.dat
c:\documents and settings\Sébastien Habillon\real.txt
c:\program files\TinyProxy
c:\program files\webmediaviewer
c:\program files\webmediaviewer\browseu.exe
c:\program files\webmediaviewer\myc.ico
c:\program files\webmediaviewer\myd.ico
c:\program files\webmediaviewer\mym.ico
c:\program files\webmediaviewer\myp.ico
c:\program files\webmediaviewer\myv.ico
c:\program files\webmediaviewer\ot.ico
c:\program files\webmediaviewer\qttask.exe
c:\program files\webmediaviewer\qttaskm.exe
c:\program files\webmediaviewer\qttasku.exe
c:\program files\webmediaviewer\ts.ico
c:\windows\bolivar29.exe
c:\windows\f49f4daa.dat
c:\windows\fmark2.dat
c:\windows\system32\900053
c:\windows\system32\900053\900053.dll
c:\windows\system32\nvs2.inf
.
((((((((((((((((((((((((((((( Fichiers créés du 2008-11-23 au 2008-12-23 ))))))))))))))))))))))))))))))))))))
.
2008-12-23 19:13 . 2008-12-23 19:13 <REP> d-------- c:\program files\Softwin
2008-12-23 19:12 . 2008-12-23 19:13 <REP> d-------- c:\program files\Fichiers communs\Softwin
2008-12-22 20:14 . 2008-12-22 20:14 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-22 20:14 . 2008-12-22 20:14 <REP> d-------- c:\documents and settings\Sébastien Habillon\Application Data\Malwarebytes
2008-12-22 20:14 . 2008-12-22 20:14 <REP> d-------- c:\documents and settings\Sébastien Habillon\Application Data\Malwarebytes
2008-12-22 20:14 . 2008-12-22 20:14 <REP> d-------- c:\documents and settings\Sébastien Habillon\Application Data\Malwarebytes
2008-12-22 20:14 . 2008-12-22 20:14 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-22 20:14 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-22 20:14 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-22 19:27 . 2008-12-22 19:27 <REP> d-------- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2008-12-22 19:24 . 2008-12-22 19:58 <REP> d-------- c:\program files\Navilog1
2008-12-21 20:49 . 2008-12-21 22:44 <REP> d-------- c:\program files\Spyware Doctor
2008-12-21 20:49 . 2008-12-21 20:49 <REP> d-------- c:\documents and settings\Sébastien Habillon\Application Data\PC Tools
2008-12-21 20:49 . 2008-12-21 20:49 <REP> d-------- c:\documents and settings\Sébastien Habillon\Application Data\PC Tools
2008-12-21 20:49 . 2008-12-21 20:49 <REP> d-------- c:\documents and settings\Sébastien Habillon\Application Data\PC Tools
2008-12-21 20:49 . 2008-12-23 19:58 <REP> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2008-12-21 20:49 . 2008-08-25 12:36 81,288 --a------ c:\windows\system32\drivers\iksyssec.sys
2008-12-21 20:49 . 2008-08-25 12:36 66,952 --a------ c:\windows\system32\drivers\iksysflt.sys
2008-12-21 20:49 . 2008-08-25 12:36 40,840 --a------ c:\windows\system32\drivers\ikfilesec.sys
2008-12-21 20:49 . 2008-06-02 16:19 29,576 --a------ c:\windows\system32\drivers\kcom.sys
2008-12-19 20:39 . 2008-12-19 20:39 5,632 --a------ c:\windows\fd.dll
2008-12-13 00:55 . 2008-12-13 00:55 <REP> d-------- c:\program files\Tukanas Poker Tournament Timer
2008-12-12 22:14 . 2008-12-12 22:14 <REP> d-------- c:\windows\system32\fr-fr
2008-12-12 22:14 . 2008-12-12 22:14 <REP> d-------- c:\windows\system32\fr
2008-12-12 22:14 . 2008-12-12 22:14 <REP> d-------- c:\windows\system32\bits
2008-12-12 22:14 . 2008-12-12 22:14 <REP> d-------- c:\windows\l2schemas
2008-12-12 22:11 . 2008-12-12 22:14 <REP> d-------- c:\windows\ServicePackFiles
2008-12-12 22:05 . 2008-12-12 22:05 <REP> d-------- c:\windows\EHome
2008-12-12 21:48 . 2008-12-12 21:48 1 ---h----- c:\windows\fm123.dat
2008-12-09 21:23 . 2008-12-11 23:47 <REP> d-------- c:\program files\monAlbumPhoto
2008-12-09 21:23 . 2008-12-09 22:03 <REP> d-------- c:\documents and settings\All Users\Application Data\albumphoto
2008-12-09 20:09 . 2008-12-09 20:10 <REP> d-------- c:\windows\system32\351631
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-23 11:34 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\U3
2008-12-23 11:34 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\U3
2008-12-23 11:34 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\U3
2008-12-22 18:13 --------- d-----w c:\program files\Yahoo!
2008-12-22 06:24 --------- d-----w c:\program files\HPQ
2008-12-21 22:30 --------- d-----w c:\program files\Windows Live
2008-12-19 21:46 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\LimeWire
2008-12-19 21:46 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\LimeWire
2008-12-19 21:46 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\LimeWire
2008-12-19 16:51 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Azureus
2008-12-19 16:51 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Azureus
2008-12-19 16:51 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Azureus
2008-12-18 13:20 --------- d-----w c:\program files\eMule
2008-12-11 22:56 --------- d-----w c:\program files\NCH Swift Sound
2008-12-11 22:52 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\NCH Swift Sound
2008-12-11 22:52 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\NCH Swift Sound
2008-12-11 22:52 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\NCH Swift Sound
2008-12-10 10:09 --------- d-----w c:\program files\Windows Live Safety Center
2008-11-27 22:11 --------- d-----w c:\program files\Azureus
2008-11-27 00:00 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Apple Computer
2008-11-27 00:00 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Apple Computer
2008-11-27 00:00 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Apple Computer
2008-11-26 16:09 --------- d-----w c:\program files\QuickTime
2008-11-26 12:33 --------- d-----w c:\program files\iTunes
2008-11-21 22:50 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-11-21 22:49 --------- d-----w c:\program files\iPod
2008-11-21 22:49 --------- d-----w c:\program files\Fichiers communs\Apple
2008-11-18 21:28 --------- d-----w c:\program files\Bonjour
2008-11-18 21:23 --------- d-----w c:\program files\Apple Software Update
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-23 22:27 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Media Player Classic
2008-10-23 22:27 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Media Player Classic
2008-10-23 22:27 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Media Player Classic
2008-10-23 22:26 --------- d-----w c:\program files\K-Lite Codec Pack
2008-10-23 22:25 --------- d-----w c:\program files\DivX
2006-12-08 17:02 4,096 ----a-w c:\documents and settings\Sébastien Habillon\log.dat
2006-12-08 17:02 4,096 ----a-w c:\documents and settings\Sébastien Habillon\log.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Ahead\lib\NMBgMonitor.exe" [2006-02-01 98304]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2005-11-15 1204224]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-04 68856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-22 339968]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-02-02 102492]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-02-02 692316]
"eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-12-03 290816]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 253952]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2005-02-17 233534]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2006-01-12 155648]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-11-07 111936]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2008-08-25 1168264]
"BDMCon"="c:\program files\Softwin\BitDefender9\bdmcon.exe" [2005-08-23 360448]
"BDOESRV"="c:\program files\Softwin\BitDefender9\bdoesrv.exe" [2005-03-11 90112]
"BDNewsAgent"="c:\program files\Softwin\BitDefender9\bdnagent.exe" [2005-06-09 9728]
"MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2008-04-14 172544]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 c:\windows\system32\bthprops.cpl]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"<NO NAME>"=
"c:\\Program Files\\Azureus\\Azureus.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
S1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-09-19 111184]
S1 navigator;navigator;\systemroot\fd.dll []
S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-09-19 20560]
S3 HSFHWATI;HSFHWATI;c:\windows\system32\DRIVERS\HSFHWATI.sys [2005-03-22 200192]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys [2008-12-22 38496]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a1553392-7ffa-11dd-badd-0014a52d67c8}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a
.
Contenu du dossier 'Tâches planifiées'
2008-12-15 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
2008-12-22 c:\windows\Tasks\B1AC27E098CBA560.job
- c:\docume~1\sbasti~1\applic~1\oncedo~1\LongDoesMove.exe []
.
- - - - ORPHELINS SUPPRIMES - - - -
BHO-{10B294F2-F790-A3F0-54A6-6005D1C61B79} - c:\docume~1\SBASTI~1\APPLIC~1\[u]0[/u]1JOY\COOLFACE.exe
BHO-{94FEA8C1-0D9C-4D8D-A411-33DA3C2C567A} - c:\windows\system32\900053\900053.dll
HKCU-Run-ViewMode - c:\docume~1\SBASTI~1\APPLIC~1\ONCEDO~1\Inside Readme.exe
HKCU-Run-iymaeyu - c:\documents and settings\sébastien habillon\local settings\application data\iymaeyu.exe
HKLM-Run-2 creative chin cake - c:\documents and settings\All Users\Application Data\1 proc 2 creative\sect ping.exe
HKU-Default-Run-msnmsgr - c:\program files\MSN Messenger\msnmsgr.exe
HKLM-Explorer_Run-QuickTime Task - c:\program files\WebMediaViewer\qttask.exe
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.prevhomepage.com/?q=http://www.prevhomepage.com/?q=http://www.prevhomepage.com/?q=http://www.prevhomepage.com/?q=http://www.prevhomepage.com/?q=http://www.prevhomepage.com/?q=http://www.prevhomepage.com/?q=
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=Q305&bd=pavilion&pf=laptop
uInternet Settings,ProxyOverride = *.local;<local>
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: {{3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.servicemenutool.com/redirect.php
IE: {{3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.servicemenutool.com/redirect.php -
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-23 19:56:33
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????0?3?7?1??????? ???B?????????????hLC? ??????
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(204)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Spyware Doctor\pctsAuxs.exe
c:\program files\Spyware Doctor\pctsSvc.exe
.
**************************************************************************
.
Heure de fin: 2008-12-23 20:04:19 - La machine a redémarré [Sébastien Habillon]
ComboFix-quarantined-files.txt 2008-12-23 19:03:35
Avant-CF: 27,288,805,376 octets libres
Après-CF: 28,229,152,768 octets libres
227 --- E O F --- 2008-12-19 02:01:22
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:01, on 2008-12-24
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\MICROS~2\rapimgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Documents and Settings\Sébastien Habillon\Application Data\U3\000018394773E8B1\LaunchPad.exe
C:\DOCUME~1\SBASTI~1\LOCALS~1\Temp\Rar$EX00.766\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:9090
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {10B294F2-F790-A3F0-54A6-6005D1C61B79} - C:\DOCUME~1\SBASTI~1\APPLIC~1\01JOY\COOLFACE.exe (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [2 creative chin cake] C:\Documents and Settings\All Users\Application Data\1 proc 2 creative\sect ping.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [sysftray2] C:\windows\bolivar30.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ViewMode] C:\DOCUME~1\SBASTI~1\APPLIC~1\ONCEDO~1\Inside Readme.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [iymaeyu] "c:\documents and settings\sébastien habillon\local settings\application data\iymaeyu.exe" iymaeyu
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.servicemenutool.com/redirect.php (file missing)
O9 - Extra 'Tools' menuitem: Explorer Security - {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.servicemenutool.com/redirect.php (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
Scan saved at 12:01, on 2008-12-24
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\MICROS~2\rapimgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Documents and Settings\Sébastien Habillon\Application Data\U3\000018394773E8B1\LaunchPad.exe
C:\DOCUME~1\SBASTI~1\LOCALS~1\Temp\Rar$EX00.766\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:9090
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {10B294F2-F790-A3F0-54A6-6005D1C61B79} - C:\DOCUME~1\SBASTI~1\APPLIC~1\01JOY\COOLFACE.exe (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [2 creative chin cake] C:\Documents and Settings\All Users\Application Data\1 proc 2 creative\sect ping.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [sysftray2] C:\windows\bolivar30.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ViewMode] C:\DOCUME~1\SBASTI~1\APPLIC~1\ONCEDO~1\Inside Readme.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [iymaeyu] "c:\documents and settings\sébastien habillon\local settings\application data\iymaeyu.exe" iymaeyu
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.servicemenutool.com/redirect.php (file missing)
O9 - Extra 'Tools' menuitem: Explorer Security - {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.servicemenutool.com/redirect.php (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
Voilà:
Malwarebytes' Anti-Malware 1.31
Version de la base de données: 1456
Windows 5.1.2600 Service Pack 3
2008-12-24 14:07:10
mbam-log-2008-12-24 (14-07-10).txt
Type de recherche: Examen complet (C:\|)
Eléments examinés: 94462
Temps écoulé: 31 minute(s), 4 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 8
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 5
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\setup.player (Spyware.MarketScore) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\setup.player.2k2 (Spyware.MarketScore) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{35b7e48b-9d81-4c6c-9578-5fd4f620d886} (Spyware.MarketScore) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3b8fb116-d358-48a3-a5c7-db84f15cbb04} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{3b8fb116-d358-48a3-a5c7-db84f15cbb04} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\webmedia.chl (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Online Alert Manager (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Browser Toolbar (Trojan.Zlob) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{3b8fb116-d358-48a3-a5c7-db84f15cbb04} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysftray2 (Trojan.Agent) -> Quarantined and deleted successfully.
Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Dossier(s) infecté(s):
C:\Program Files\TinyProxy (Trojan.Proxy) -> Quarantined and deleted successfully.
Fichier(s) infecté(s):
C:\Qoobox\Quarantine\C\WINDOWS\system32\900053\900053.dll.vir (Trojan.BHO) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP3\A0002070.dll (Trojan.BHO) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP4\A0002470.dll (Trojan.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Menu Démarrer\Online Spyware Test.url (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\nvs2.inf (Adware.EGDAccess) -> Quarantined and de
Malwarebytes' Anti-Malware 1.31
Version de la base de données: 1456
Windows 5.1.2600 Service Pack 3
2008-12-24 14:07:10
mbam-log-2008-12-24 (14-07-10).txt
Type de recherche: Examen complet (C:\|)
Eléments examinés: 94462
Temps écoulé: 31 minute(s), 4 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 8
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 5
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\setup.player (Spyware.MarketScore) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\setup.player.2k2 (Spyware.MarketScore) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{35b7e48b-9d81-4c6c-9578-5fd4f620d886} (Spyware.MarketScore) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3b8fb116-d358-48a3-a5c7-db84f15cbb04} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{3b8fb116-d358-48a3-a5c7-db84f15cbb04} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\webmedia.chl (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Online Alert Manager (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Browser Toolbar (Trojan.Zlob) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{3b8fb116-d358-48a3-a5c7-db84f15cbb04} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysftray2 (Trojan.Agent) -> Quarantined and deleted successfully.
Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Dossier(s) infecté(s):
C:\Program Files\TinyProxy (Trojan.Proxy) -> Quarantined and deleted successfully.
Fichier(s) infecté(s):
C:\Qoobox\Quarantine\C\WINDOWS\system32\900053\900053.dll.vir (Trojan.BHO) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP3\A0002070.dll (Trojan.BHO) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP4\A0002470.dll (Trojan.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Menu Démarrer\Online Spyware Test.url (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\nvs2.inf (Adware.EGDAccess) -> Quarantined and de
Malwarebytes' Anti-Malware 1.31
Version de la base de données: 1456
Windows 5.1.2600 Service Pack 3
2008-12-24 14:07:10
mbam-log-2008-12-24 (14-07-10).txt
Type de recherche: Examen complet (C:\|)
Eléments examinés: 94462
Temps écoulé: 31 minute(s), 4 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 8
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 5
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\setup.player (Spyware.MarketScore) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\setup.player.2k2 (Spyware.MarketScore) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{35b7e48b-9d81-4c6c-9578-5fd4f620d886} (Spyware.MarketScore) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3b8fb116-d358-48a3-a5c7-db84f15cbb04} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{3b8fb116-d358-48a3-a5c7-db84f15cbb04} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\webmedia.chl (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Online Alert Manager (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Browser Toolbar (Trojan.Zlob) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{3b8fb116-d358-48a3-a5c7-db84f15cbb04} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysftray2 (Trojan.Agent) -> Quarantined and deleted successfully.
Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Dossier(s) infecté(s):
C:\Program Files\TinyProxy (Trojan.Proxy) -> Quarantined and deleted successfully.
Fichier(s) infecté(s):
C:\Qoobox\Quarantine\C\WINDOWS\system32\900053\900053.dll.vir (Trojan.BHO) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP3\A0002070.dll (Trojan.BHO) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP4\A0002470.dll (Trojan.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Menu Démarrer\Online Spyware Test.url (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\nvs2.inf (Adware.EGDAccess) -> Quarantined and deleted successfully.
Version de la base de données: 1456
Windows 5.1.2600 Service Pack 3
2008-12-24 14:07:10
mbam-log-2008-12-24 (14-07-10).txt
Type de recherche: Examen complet (C:\|)
Eléments examinés: 94462
Temps écoulé: 31 minute(s), 4 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 8
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 5
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\setup.player (Spyware.MarketScore) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\setup.player.2k2 (Spyware.MarketScore) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{35b7e48b-9d81-4c6c-9578-5fd4f620d886} (Spyware.MarketScore) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3b8fb116-d358-48a3-a5c7-db84f15cbb04} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{3b8fb116-d358-48a3-a5c7-db84f15cbb04} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\webmedia.chl (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Online Alert Manager (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Browser Toolbar (Trojan.Zlob) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{3b8fb116-d358-48a3-a5c7-db84f15cbb04} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysftray2 (Trojan.Agent) -> Quarantined and deleted successfully.
Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Dossier(s) infecté(s):
C:\Program Files\TinyProxy (Trojan.Proxy) -> Quarantined and deleted successfully.
Fichier(s) infecté(s):
C:\Qoobox\Quarantine\C\WINDOWS\system32\900053\900053.dll.vir (Trojan.BHO) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP3\A0002070.dll (Trojan.BHO) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP4\A0002470.dll (Trojan.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Menu Démarrer\Online Spyware Test.url (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\nvs2.inf (Adware.EGDAccess) -> Quarantined and deleted successfully.
nouveau scan hijack stp....
ensuite:
Telecharge GENPROC
lien +tuto :
http://ww11.genproc.com/tutorial_genproc/tutorial_genproc.html
Copie et colle le rapport stp
a+
ensuite:
Telecharge GENPROC
lien +tuto :
http://ww11.genproc.com/tutorial_genproc/tutorial_genproc.html
Copie et colle le rapport stp
a+
voilà les 2
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:08, on 2008-12-24
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\MICROS~2\rapimgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Documents and Settings\Sébastien Habillon\Application Data\U3\000018394773E8B1\LaunchPad.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\SBASTI~1\LOCALS~1\Temp\Rar$EX00.875\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:9090
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {10B294F2-F790-A3F0-54A6-6005D1C61B79} - C:\DOCUME~1\SBASTI~1\APPLIC~1\01JOY\COOLFACE.exe (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [2 creative chin cake] C:\Documents and Settings\All Users\Application Data\1 proc 2 creative\sect ping.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ViewMode] C:\DOCUME~1\SBASTI~1\APPLIC~1\ONCEDO~1\Inside Readme.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [iymaeyu] "c:\documents and settings\sébastien habillon\local settings\application data\iymaeyu.exe" iymaeyu
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:08, on 2008-12-24
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\MICROS~2\rapimgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Documents and Settings\Sébastien Habillon\Application Data\U3\000018394773E8B1\LaunchPad.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\SBASTI~1\LOCALS~1\Temp\Rar$EX00.875\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:9090
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {10B294F2-F790-A3F0-54A6-6005D1C61B79} - C:\DOCUME~1\SBASTI~1\APPLIC~1\01JOY\COOLFACE.exe (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [2 creative chin cake] C:\Documents and Settings\All Users\Application Data\1 proc 2 creative\sect ping.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ViewMode] C:\DOCUME~1\SBASTI~1\APPLIC~1\ONCEDO~1\Inside Readme.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [iymaeyu] "c:\documents and settings\sébastien habillon\local settings\application data\iymaeyu.exe" iymaeyu
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
--------------------\\ Lop S&D 4.2.5-0 XP/Vista
Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : AMD Athlon(tm) 64 Processor 3200+ )
BIOS : Ver 1.00PARTTBL
USER : Sébastien Habillon ( Administrator )
BOOT : Fail-safe boot
Antivirus : avast! antivirus 4.8.1296 [VPS 081224-0] 4.8.1296 (Not Activated)
C:\ (Local Disk) - NTFS - Total:74 Go (Free:26 Go)
D:\ (CD or DVD)
E:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
F:\ (USB) - FAT - Total:971 Mo (Free:0 Go)
"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [2] ( 2008-12-24|17:51 )
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION
Supprime! - C:\WINDOWS\Tasks\B1AC27E098CBA560.job
Supprime! - C:\DOCUME~1\SBASTI~1\APPLIC~1\oncedo~1
Supprime! - C:\Program Files\oncedo~1
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
--------------------\\ Listing des dossiers dans APPLIC~1
[2008-11-21|23:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
[2006-06-19|21:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\1 proc 2 creative
[2007-03-06|00:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[2008-12-09|22:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\albumphoto
[2008-05-15|23:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
[2008-05-15|23:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
[2008-03-24|20:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Azureus
[2008-03-31|12:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[2005-05-17|04:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\hpqwmi
[2005-05-17|04:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
[2008-12-22|20:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
[2006-04-19|16:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[2008-10-03|12:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NCH Swift Sound
[2006-06-20|16:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
[2005-05-17|11:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
[2006-04-15|12:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBT
[2006-02-01|19:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
[2008-12-24|12:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
[2006-08-07|14:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[2008-03-21|12:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
[2008-12-22|19:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion
[2005-05-17|04:32] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Apple Computer
[2005-05-17|11:51] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
[2005-05-17|04:03] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
[2005-05-17|04:34] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Symantec
[2006-03-20|22:00] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
[2006-03-20|22:00] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
[2008-03-12|20:06] C:\DOCUME~1\SBASTI~2\APPLIC~1\Macromedia
[2006-05-21|12:00] C:\DOCUME~1\SBASTI~1\APPLIC~1\01JOY
[2008-03-19|22:51] C:\DOCUME~1\SBASTI~1\APPLIC~1\Adobe
[2007-03-06|00:26] C:\DOCUME~1\SBASTI~1\APPLIC~1\AdobeUM
[2006-02-19|18:12] C:\DOCUME~1\SBASTI~1\APPLIC~1\Ahead
[2008-11-27|01:00] C:\DOCUME~1\SBASTI~1\APPLIC~1\Apple Computer
[2008-12-19|17:51] C:\DOCUME~1\SBASTI~1\APPLIC~1\Azureus
[2006-02-03|20:02] C:\DOCUME~1\SBASTI~1\APPLIC~1\Google
[2005-05-17|11:51] C:\DOCUME~1\SBASTI~1\APPLIC~1\Identities
[2006-02-02|17:08] C:\DOCUME~1\SBASTI~1\APPLIC~1\InterVideo
[2006-03-20|22:05] C:\DOCUME~1\SBASTI~1\APPLIC~1\Lavasoft
[2008-12-19|22:46] C:\DOCUME~1\SBASTI~1\APPLIC~1\LimeWire
[2006-01-13|12:00] C:\DOCUME~1\SBASTI~1\APPLIC~1\Macromedia
[2008-12-22|20:14] C:\DOCUME~1\SBASTI~1\APPLIC~1\Malwarebytes
[2008-10-23|23:27] C:\DOCUME~1\SBASTI~1\APPLIC~1\Media Player Classic
[2007-02-08|09:15] C:\DOCUME~1\SBASTI~1\APPLIC~1\Microgaming
[2007-07-31|23:45] C:\DOCUME~1\SBASTI~1\APPLIC~1\Microsoft
[2006-02-09|21:36] C:\DOCUME~1\SBASTI~1\APPLIC~1\Microsoft Web Folders
[2008-12-11|23:52] C:\DOCUME~1\SBASTI~1\APPLIC~1\NCH Swift Sound
[2008-12-21|20:49] C:\DOCUME~1\SBASTI~1\APPLIC~1\PC Tools
[2007-02-01|00:29] C:\DOCUME~1\SBASTI~1\APPLIC~1\Real
[2008-10-03|12:00] C:\DOCUME~1\SBASTI~1\APPLIC~1\Recordpad
[2006-04-10|17:40] C:\DOCUME~1\SBASTI~1\APPLIC~1\Sphinx
[2006-01-14|18:13] C:\DOCUME~1\SBASTI~1\APPLIC~1\Sun
[2006-01-19|20:00] C:\DOCUME~1\SBASTI~1\APPLIC~1\Symantec
[2008-12-24|16:23] C:\DOCUME~1\SBASTI~1\APPLIC~1\U3
--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks
[2008-12-15 17:24][--a------] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2008-12-24 16:27][--ah-----] C:\WINDOWS\tasks\SA.DAT
[2004-08-05 09:00][-rah-----] C:\WINDOWS\tasks\desktop.ini
--------------------\\ Listing des dossiers dans C:\Program Files
[2007-03-06|00:24] C:\Program Files\Adobe
[2006-03-01|11:32] C:\Program Files\Ahead
[2007-01-05|22:47] C:\Program Files\Alwil Software
[2005-05-17|04:13] C:\Program Files\AMD
[2008-11-18|22:23] C:\Program Files\Apple Software Update
[2005-05-17|04:03] C:\Program Files\ATI Technologies
[2008-11-27|23:11] C:\Program Files\Azureus
[2008-11-18|22:28] C:\Program Files\Bonjour
[2008-12-24|16:20] C:\Program Files\CCleaner
[2005-05-17|11:51] C:\Program Files\ComPlus Applications
[2005-05-17|02:54] C:\Program Files\CONEXANT
[2006-03-28|11:00] C:\Program Files\directx
[2008-10-23|23:25] C:\Program Files\DivX
[2006-01-17|23:45] C:\Program Files\EA Games
[2006-03-07|10:24] C:\Program Files\Easy Internet signup
[2008-12-18|14:20] C:\Program Files\eMule
[2008-12-23|19:45] C:\Program Files\Fichiers communs
[2008-04-02|14:08] C:\Program Files\Google
[2008-02-18|20:53] C:\Program Files\Grisoft
[2007-05-12|23:04] C:\Program Files\HP
[2008-12-22|07:24] C:\Program Files\HPQ
[2006-12-08|18:04] C:\Program Files\InstallShield Installation Information
[2008-12-12|22:29] C:\Program Files\Internet Explorer
[2005-05-17|04:28] C:\Program Files\InterVideo
[2008-11-21|23:49] C:\Program Files\iPod
[2008-11-26|13:33] C:\Program Files\iTunes
[2008-08-24|00:36] C:\Program Files\Java
[2008-10-23|23:26] C:\Program Files\K-Lite Codec Pack
[2006-03-20|22:05] C:\Program Files\Lavasoft
[2008-03-29|13:16] C:\Program Files\LimeWire
[2008-12-24|13:34] C:\Program Files\Malwarebytes' Anti-Malware
[2008-12-12|22:18] C:\Program Files\Messenger
[2007-05-12|23:22] C:\Program Files\Microsoft ActiveSync
[2006-04-15|12:52] C:\Program Files\microsoft frontpage
[2007-05-12|23:06] C:\Program Files\Microsoft Office
[2006-04-19|16:15] C:\Program Files\Microsoft.NET
[2008-12-11|23:47] C:\Program Files\monAlbumPhoto
[2008-12-12|22:14] C:\Program Files\Movie Maker
[2006-10-30|13:15] C:\Program Files\MSN
[2005-05-17|11:51] C:\Program Files\MSN Gaming Zone
[2008-12-24|17:09] C:\Program Files\Navilog1
[2008-07-09|15:04] C:\Program Files\NCH Software
[2008-12-11|23:56] C:\Program Files\NCH Swift Sound
[2006-02-13|23:56] C:\Program Files\Nero
[2008-12-12|22:11] C:\Program Files\NetMeeting
[2005-05-17|11:51] C:\Program Files\Online Services
[2008-12-12|22:11] C:\Program Files\Outlook Express
[2008-11-26|17:09] C:\Program Files\QuickTime
[2006-11-01|12:40] C:\Program Files\Real
[2005-05-17|04:31] C:\Program Files\Services en ligne
[2007-05-27|19:45] C:\Program Files\SLD Codec Pack
[2006-04-15|12:53] C:\Program Files\Snapshot Viewer
[2008-12-23|19:13] C:\Program Files\Softwin
[2006-03-05|15:32] C:\Program Files\Sonic
[2008-12-23|20:57] C:\Program Files\Spyware Doctor
[2008-08-24|00:37] C:\Program Files\Sun
[2006-02-02|21:50] C:\Program Files\Symantec
[2005-05-17|04:28] C:\Program Files\Synaptics
[2008-12-13|00:55] C:\Program Files\Tukanas Poker Tournament Timer
[2005-05-17|11:51] C:\Program Files\Uninstall Information
[2008-12-21|23:30] C:\Program Files\Windows Live
[2008-12-10|11:09] C:\Program Files\Windows Live Safety Center
[2007-05-12|23:19] C:\Program Files\Windows Media Connect 2
[2008-12-12|22:11] C:\Program Files\Windows Media Player
[2008-12-12|22:11] C:\Program Files\Windows NT
[2005-05-17|11:51] C:\Program Files\WindowsUpdate
[2006-01-29|19:26] C:\Program Files\WinRAR
[2005-05-17|11:51] C:\Program Files\xerox
[2008-12-22|19:13] C:\Program Files\Yahoo!
[2006-04-03|12:11] C:\Program Files\Zero G Registry
--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs
[2006-02-03|00:11] C:\Program Files\Fichiers communs\Adobe
[2006-03-01|11:42] C:\Program Files\Fichiers communs\Ahead
[2008-11-21|23:49] C:\Program Files\Fichiers communs\Apple
[2006-02-09|21:38] C:\Program Files\Fichiers communs\Designer
[2006-03-05|15:32] C:\Program Files\Fichiers communs\InstallShield
[2005-05-17|04:06] C:\Program Files\Fichiers communs\Java
[2005-05-17|04:33] C:\Program Files\Fichiers communs\LightScribe
[2008-10-31|23:55] C:\Program Files\Fichiers communs\Microsoft Shared
[2005-05-17|11:51] C:\Program Files\Fichiers communs\MSSoap
[2005-05-17|11:51] C:\Program Files\Fichiers communs\ODBC
[2007-02-01|00:29] C:\Program Files\Fichiers communs\Real
[2005-05-17|11:51] C:\Program Files\Fichiers communs\Services
[2008-12-23|19:13] C:\Program Files\Fichiers communs\Softwin
[2006-03-05|15:34] C:\Program Files\Fichiers communs\Sonic Shared
[2005-05-17|11:51] C:\Program Files\Fichiers communs\SpeechEngines
[2006-02-01|20:05] C:\Program Files\Fichiers communs\Symantec Shared
[2008-12-12|22:11] C:\Program Files\Fichiers communs\System
[2008-03-21|12:48] C:\Program Files\Fichiers communs\WindowsLiveInstaller
--------------------\\ Process
( 14 Processes )
... OK !
--------------------\\ Recherche avec S_Lop
Aucun fichier / dossier Lop trouvé !
--------------------\\ Recherche de Fichiers / Dossiers Lop
Aucun fichier / dossier Lop trouvé !
--------------------\\ Verification du Registre
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
..... OK !
--------------------\\ Verification du fichier Hosts
Fichier Hosts PROPRE
--------------------\\ Recherche de fichiers avec Catchme
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-24 17:53:28
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 947
--------------------\\ Recherche d'autres infections
Aucune autre infection trouvée !
[F:1][D:0]-> C:\DOCUME~1\SBASTI~1\LOCALS~1\Temp
[F:15][D:0]-> C:\DOCUME~1\SBASTI~1\Cookies
[F:6][D:4]-> C:\DOCUME~1\SBASTI~1\LOCALS~1\TEMPOR~1\content.IE5
1 - "C:\Lop SD\LopR_1.txt" - 2008-12-24|17:56 - Option : [2]
--------------------\\ Fin du rapport a 17:56:52
Clean Navipromo version 3.7.0 commencé le 2008-12-24 à 17:06:54.57
Outil exécuté depuis C:\Program Files\navilog1
Mise à jour le 10.12.2008 à 21h00 par IL-MAFIOSO
Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : AMD Athlon(tm) 64 Processor 3200+ )
BIOS : Ver 1.00PARTTBL
USER : Sébastien Habillon ( Administrator )
BOOT : Fail-safe boot
Antivirus : avast! antivirus 4.8.1296 [VPS 081224-0] 4.8.1296 (Not Activated)
C:\ (Local Disk) - NTFS - Total:74 Go (Free:26 Go)
D:\ (CD or DVD)
E:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
F:\ (USB) - FAT - Total:971 Mo (Free:0 Go)
Mode suppression automatique
avec prise en charge résultats Catchme et GNS
Nettoyage executé en mode sans échec
*** fsbl1.txt non trouvé ***
(Assurez-vous que Catchme n'avait rien trouvé lors de la recherche)
*** Suppression avec sauvegardes résultats GenericNaviSearch ***
* Suppression dans "C:\WINDOWS\System32" *
* Suppression dans "C:\Documents and Settings\SÚbastien Habillon\locals~1\applic~1" *
*** Suppression dossiers dans "C:\WINDOWS" ***
*** Suppression dossiers dans "C:\Program Files" ***
*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***
*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***
*** Suppression dossiers dans "c:\docume~1\alluse~1\applic~1" ***
*** Suppression dossiers dans "C:\Documents and Settings\SÚbastien Habillon\applic~1" ***
*** Suppression dossiers dans "C:\DOCUME~1\SBASTI~2\applic~1" ***
*** Suppression dossiers dans "C:\Documents and Settings\SÚbastien Habillon\locals~1\applic~1" ***
*** Suppression dossiers dans "C:\Documents and Settings\SÚbastien Habillon\menudm~1\progra~1" ***
*** Suppression fichiers ***
*** Suppression fichiers temporaires ***
Nettoyage contenu C:\WINDOWS\Temp effectué !
Nettoyage contenu C:\Documents and Settings\Sébastien Habillon\locals~1\Temp effectué !
*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)
1)Suppression avec sauvegardes nouveaux fichiers Instant Access :
2)Recherche, création sauvegardes et suppression Heuristique :
* Dans "C:\WINDOWS\system32" *
* Dans "C:\Documents and Settings\SÚbastien Habillon\locals~1\applic~1" *
*** Sauvegarde du Registre vers dossier Safebackup ***
sauvegarde du Registre réalisée avec succès !
*** Nettoyage Registre ***
Nettoyage Registre Ok
*** Certificats ***
Certificat Egroup supprimé !
Certificat Electronic-Group supprimé !
Certificat Montorgueil absent !
Certificat OOO-Favorit supprimé !
Certificat Sunny-Day-Design-Ltdt absent !
*** Recherche autres dossiers et fichiers connus ***
B1AC27E098CBA560.job trouvé ! Infection Lop possible non traitée par cet outil !
*** Nettoyage terminé le 2008-12-24 à 17:09:05.95 ***
Search Navipromo version 3.7.0 commencé le 2008-12-24 à 16:32:04.39
!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!
Outil exécuté depuis C:\Program Files\navilog1
Mise à jour le 10.12.2008 à 21h00 par IL-MAFIOSO
Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : AMD Athlon(tm) 64 Processor 3200+ )
BIOS : Ver 1.00PARTTBL
USER : Sébastien Habillon ( Administrator )
BOOT : Fail-safe boot
Antivirus : avast! antivirus 4.8.1296 [VPS 081224-0] 4.8.1296 (Not Activated)
C:\ (Local Disk) - NTFS - Total:74 Go (Free:26 Go)
D:\ (CD or DVD)
E:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
F:\ (USB) - FAT - Total:971 Mo (Free:0 Go)
Recherche executé en mode sans échec
*** Recherche Programmes installés ***
*** Recherche dossiers dans "C:\WINDOWS" ***
*** Recherche dossiers dans "C:\Program Files" ***
*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***
*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***
*** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***
*** Recherche dossiers dans "C:\Documents and Settings\SÚbastien Habillon\applic~1" ***
*** Recherche dossiers dans "C:\DOCUME~1\SBASTI~2\applic~1" ***
*** Recherche dossiers dans "C:\Documents and Settings\SÚbastien Habillon\locals~1\applic~1" ***
*** Recherche dossiers dans "C:\Documents and Settings\SÚbastien Habillon\menudm~1\progra~1" ***
*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net
*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!
* Recherche dans "C:\WINDOWS\system32" *
* Recherche dans "C:\Documents and Settings\SÚbastien Habillon\locals~1\applic~1" *
*** Recherche fichiers ***
*** Recherche clés spécifiques dans le Registre ***
!! Les clés trouvées ne sont pas forcément infectées !!
HKEY_CURRENT_USER\Software\Lanconfig trouvé !
HKEY_CURRENT_USER\Software\mc trouvé !
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"iymaeyu"="\"c:\\documents and settings\\sébastien habillon\\local settings\\application data\\iymaeyu.exe\" iymaeyu"
*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)
1)Recherche nouveaux fichiers Instant Access :
2)Recherche Heuristique :
* Dans "C:\WINDOWS\system32" :
* Dans "C:\Documents and Settings\SÚbastien Habillon\locals~1\applic~1" :
3)Recherche Certificats :
Certificat Egroup trouvé !
Certificat Electronic-Group trouvé !
Certificat Montorgueil absent !
Certificat OOO-Favorit trouvé !
Certificat Sunny-Day-Design-Ltd absent !
4)Recherche autres dossiers et fichiers connus :
B1AC27E098CBA560.job trouvé ! Infection Lop possible non traitée par cet outil !
*** Analyse terminée le 2008-12-24 à 16:47:42.28 ***
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:54:20, on 2008-12-26
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\MICROS~2\rapimgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\SBASTI~1\LOCALS~1\Temp\Rar$EX00.234\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:9090
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {10B294F2-F790-A3F0-54A6-6005D1C61B79} - C:\DOCUME~1\SBASTI~1\APPLIC~1\01JOY\COOLFACE.exe (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [2 creative chin cake] C:\Documents and Settings\All Users\Application Data\1 proc 2 creative\sect ping.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : AMD Athlon(tm) 64 Processor 3200+ )
BIOS : Ver 1.00PARTTBL
USER : Sébastien Habillon ( Administrator )
BOOT : Fail-safe boot
Antivirus : avast! antivirus 4.8.1296 [VPS 081224-0] 4.8.1296 (Not Activated)
C:\ (Local Disk) - NTFS - Total:74 Go (Free:26 Go)
D:\ (CD or DVD)
E:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
F:\ (USB) - FAT - Total:971 Mo (Free:0 Go)
"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [2] ( 2008-12-24|17:51 )
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION
Supprime! - C:\WINDOWS\Tasks\B1AC27E098CBA560.job
Supprime! - C:\DOCUME~1\SBASTI~1\APPLIC~1\oncedo~1
Supprime! - C:\Program Files\oncedo~1
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
--------------------\\ Listing des dossiers dans APPLIC~1
[2008-11-21|23:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
[2006-06-19|21:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\1 proc 2 creative
[2007-03-06|00:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[2008-12-09|22:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\albumphoto
[2008-05-15|23:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
[2008-05-15|23:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
[2008-03-24|20:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Azureus
[2008-03-31|12:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[2005-05-17|04:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\hpqwmi
[2005-05-17|04:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
[2008-12-22|20:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
[2006-04-19|16:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[2008-10-03|12:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NCH Swift Sound
[2006-06-20|16:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
[2005-05-17|11:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
[2006-04-15|12:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBT
[2006-02-01|19:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
[2008-12-24|12:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
[2006-08-07|14:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[2008-03-21|12:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
[2008-12-22|19:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion
[2005-05-17|04:32] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Apple Computer
[2005-05-17|11:51] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
[2005-05-17|04:03] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
[2005-05-17|04:34] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Symantec
[2006-03-20|22:00] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
[2006-03-20|22:00] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
[2008-03-12|20:06] C:\DOCUME~1\SBASTI~2\APPLIC~1\Macromedia
[2006-05-21|12:00] C:\DOCUME~1\SBASTI~1\APPLIC~1\01JOY
[2008-03-19|22:51] C:\DOCUME~1\SBASTI~1\APPLIC~1\Adobe
[2007-03-06|00:26] C:\DOCUME~1\SBASTI~1\APPLIC~1\AdobeUM
[2006-02-19|18:12] C:\DOCUME~1\SBASTI~1\APPLIC~1\Ahead
[2008-11-27|01:00] C:\DOCUME~1\SBASTI~1\APPLIC~1\Apple Computer
[2008-12-19|17:51] C:\DOCUME~1\SBASTI~1\APPLIC~1\Azureus
[2006-02-03|20:02] C:\DOCUME~1\SBASTI~1\APPLIC~1\Google
[2005-05-17|11:51] C:\DOCUME~1\SBASTI~1\APPLIC~1\Identities
[2006-02-02|17:08] C:\DOCUME~1\SBASTI~1\APPLIC~1\InterVideo
[2006-03-20|22:05] C:\DOCUME~1\SBASTI~1\APPLIC~1\Lavasoft
[2008-12-19|22:46] C:\DOCUME~1\SBASTI~1\APPLIC~1\LimeWire
[2006-01-13|12:00] C:\DOCUME~1\SBASTI~1\APPLIC~1\Macromedia
[2008-12-22|20:14] C:\DOCUME~1\SBASTI~1\APPLIC~1\Malwarebytes
[2008-10-23|23:27] C:\DOCUME~1\SBASTI~1\APPLIC~1\Media Player Classic
[2007-02-08|09:15] C:\DOCUME~1\SBASTI~1\APPLIC~1\Microgaming
[2007-07-31|23:45] C:\DOCUME~1\SBASTI~1\APPLIC~1\Microsoft
[2006-02-09|21:36] C:\DOCUME~1\SBASTI~1\APPLIC~1\Microsoft Web Folders
[2008-12-11|23:52] C:\DOCUME~1\SBASTI~1\APPLIC~1\NCH Swift Sound
[2008-12-21|20:49] C:\DOCUME~1\SBASTI~1\APPLIC~1\PC Tools
[2007-02-01|00:29] C:\DOCUME~1\SBASTI~1\APPLIC~1\Real
[2008-10-03|12:00] C:\DOCUME~1\SBASTI~1\APPLIC~1\Recordpad
[2006-04-10|17:40] C:\DOCUME~1\SBASTI~1\APPLIC~1\Sphinx
[2006-01-14|18:13] C:\DOCUME~1\SBASTI~1\APPLIC~1\Sun
[2006-01-19|20:00] C:\DOCUME~1\SBASTI~1\APPLIC~1\Symantec
[2008-12-24|16:23] C:\DOCUME~1\SBASTI~1\APPLIC~1\U3
--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks
[2008-12-15 17:24][--a------] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2008-12-24 16:27][--ah-----] C:\WINDOWS\tasks\SA.DAT
[2004-08-05 09:00][-rah-----] C:\WINDOWS\tasks\desktop.ini
--------------------\\ Listing des dossiers dans C:\Program Files
[2007-03-06|00:24] C:\Program Files\Adobe
[2006-03-01|11:32] C:\Program Files\Ahead
[2007-01-05|22:47] C:\Program Files\Alwil Software
[2005-05-17|04:13] C:\Program Files\AMD
[2008-11-18|22:23] C:\Program Files\Apple Software Update
[2005-05-17|04:03] C:\Program Files\ATI Technologies
[2008-11-27|23:11] C:\Program Files\Azureus
[2008-11-18|22:28] C:\Program Files\Bonjour
[2008-12-24|16:20] C:\Program Files\CCleaner
[2005-05-17|11:51] C:\Program Files\ComPlus Applications
[2005-05-17|02:54] C:\Program Files\CONEXANT
[2006-03-28|11:00] C:\Program Files\directx
[2008-10-23|23:25] C:\Program Files\DivX
[2006-01-17|23:45] C:\Program Files\EA Games
[2006-03-07|10:24] C:\Program Files\Easy Internet signup
[2008-12-18|14:20] C:\Program Files\eMule
[2008-12-23|19:45] C:\Program Files\Fichiers communs
[2008-04-02|14:08] C:\Program Files\Google
[2008-02-18|20:53] C:\Program Files\Grisoft
[2007-05-12|23:04] C:\Program Files\HP
[2008-12-22|07:24] C:\Program Files\HPQ
[2006-12-08|18:04] C:\Program Files\InstallShield Installation Information
[2008-12-12|22:29] C:\Program Files\Internet Explorer
[2005-05-17|04:28] C:\Program Files\InterVideo
[2008-11-21|23:49] C:\Program Files\iPod
[2008-11-26|13:33] C:\Program Files\iTunes
[2008-08-24|00:36] C:\Program Files\Java
[2008-10-23|23:26] C:\Program Files\K-Lite Codec Pack
[2006-03-20|22:05] C:\Program Files\Lavasoft
[2008-03-29|13:16] C:\Program Files\LimeWire
[2008-12-24|13:34] C:\Program Files\Malwarebytes' Anti-Malware
[2008-12-12|22:18] C:\Program Files\Messenger
[2007-05-12|23:22] C:\Program Files\Microsoft ActiveSync
[2006-04-15|12:52] C:\Program Files\microsoft frontpage
[2007-05-12|23:06] C:\Program Files\Microsoft Office
[2006-04-19|16:15] C:\Program Files\Microsoft.NET
[2008-12-11|23:47] C:\Program Files\monAlbumPhoto
[2008-12-12|22:14] C:\Program Files\Movie Maker
[2006-10-30|13:15] C:\Program Files\MSN
[2005-05-17|11:51] C:\Program Files\MSN Gaming Zone
[2008-12-24|17:09] C:\Program Files\Navilog1
[2008-07-09|15:04] C:\Program Files\NCH Software
[2008-12-11|23:56] C:\Program Files\NCH Swift Sound
[2006-02-13|23:56] C:\Program Files\Nero
[2008-12-12|22:11] C:\Program Files\NetMeeting
[2005-05-17|11:51] C:\Program Files\Online Services
[2008-12-12|22:11] C:\Program Files\Outlook Express
[2008-11-26|17:09] C:\Program Files\QuickTime
[2006-11-01|12:40] C:\Program Files\Real
[2005-05-17|04:31] C:\Program Files\Services en ligne
[2007-05-27|19:45] C:\Program Files\SLD Codec Pack
[2006-04-15|12:53] C:\Program Files\Snapshot Viewer
[2008-12-23|19:13] C:\Program Files\Softwin
[2006-03-05|15:32] C:\Program Files\Sonic
[2008-12-23|20:57] C:\Program Files\Spyware Doctor
[2008-08-24|00:37] C:\Program Files\Sun
[2006-02-02|21:50] C:\Program Files\Symantec
[2005-05-17|04:28] C:\Program Files\Synaptics
[2008-12-13|00:55] C:\Program Files\Tukanas Poker Tournament Timer
[2005-05-17|11:51] C:\Program Files\Uninstall Information
[2008-12-21|23:30] C:\Program Files\Windows Live
[2008-12-10|11:09] C:\Program Files\Windows Live Safety Center
[2007-05-12|23:19] C:\Program Files\Windows Media Connect 2
[2008-12-12|22:11] C:\Program Files\Windows Media Player
[2008-12-12|22:11] C:\Program Files\Windows NT
[2005-05-17|11:51] C:\Program Files\WindowsUpdate
[2006-01-29|19:26] C:\Program Files\WinRAR
[2005-05-17|11:51] C:\Program Files\xerox
[2008-12-22|19:13] C:\Program Files\Yahoo!
[2006-04-03|12:11] C:\Program Files\Zero G Registry
--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs
[2006-02-03|00:11] C:\Program Files\Fichiers communs\Adobe
[2006-03-01|11:42] C:\Program Files\Fichiers communs\Ahead
[2008-11-21|23:49] C:\Program Files\Fichiers communs\Apple
[2006-02-09|21:38] C:\Program Files\Fichiers communs\Designer
[2006-03-05|15:32] C:\Program Files\Fichiers communs\InstallShield
[2005-05-17|04:06] C:\Program Files\Fichiers communs\Java
[2005-05-17|04:33] C:\Program Files\Fichiers communs\LightScribe
[2008-10-31|23:55] C:\Program Files\Fichiers communs\Microsoft Shared
[2005-05-17|11:51] C:\Program Files\Fichiers communs\MSSoap
[2005-05-17|11:51] C:\Program Files\Fichiers communs\ODBC
[2007-02-01|00:29] C:\Program Files\Fichiers communs\Real
[2005-05-17|11:51] C:\Program Files\Fichiers communs\Services
[2008-12-23|19:13] C:\Program Files\Fichiers communs\Softwin
[2006-03-05|15:34] C:\Program Files\Fichiers communs\Sonic Shared
[2005-05-17|11:51] C:\Program Files\Fichiers communs\SpeechEngines
[2006-02-01|20:05] C:\Program Files\Fichiers communs\Symantec Shared
[2008-12-12|22:11] C:\Program Files\Fichiers communs\System
[2008-03-21|12:48] C:\Program Files\Fichiers communs\WindowsLiveInstaller
--------------------\\ Process
( 14 Processes )
... OK !
--------------------\\ Recherche avec S_Lop
Aucun fichier / dossier Lop trouvé !
--------------------\\ Recherche de Fichiers / Dossiers Lop
Aucun fichier / dossier Lop trouvé !
--------------------\\ Verification du Registre
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
..... OK !
--------------------\\ Verification du fichier Hosts
Fichier Hosts PROPRE
--------------------\\ Recherche de fichiers avec Catchme
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-24 17:53:28
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 947
--------------------\\ Recherche d'autres infections
Aucune autre infection trouvée !
[F:1][D:0]-> C:\DOCUME~1\SBASTI~1\LOCALS~1\Temp
[F:15][D:0]-> C:\DOCUME~1\SBASTI~1\Cookies
[F:6][D:4]-> C:\DOCUME~1\SBASTI~1\LOCALS~1\TEMPOR~1\content.IE5
1 - "C:\Lop SD\LopR_1.txt" - 2008-12-24|17:56 - Option : [2]
--------------------\\ Fin du rapport a 17:56:52
Clean Navipromo version 3.7.0 commencé le 2008-12-24 à 17:06:54.57
Outil exécuté depuis C:\Program Files\navilog1
Mise à jour le 10.12.2008 à 21h00 par IL-MAFIOSO
Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : AMD Athlon(tm) 64 Processor 3200+ )
BIOS : Ver 1.00PARTTBL
USER : Sébastien Habillon ( Administrator )
BOOT : Fail-safe boot
Antivirus : avast! antivirus 4.8.1296 [VPS 081224-0] 4.8.1296 (Not Activated)
C:\ (Local Disk) - NTFS - Total:74 Go (Free:26 Go)
D:\ (CD or DVD)
E:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
F:\ (USB) - FAT - Total:971 Mo (Free:0 Go)
Mode suppression automatique
avec prise en charge résultats Catchme et GNS
Nettoyage executé en mode sans échec
*** fsbl1.txt non trouvé ***
(Assurez-vous que Catchme n'avait rien trouvé lors de la recherche)
*** Suppression avec sauvegardes résultats GenericNaviSearch ***
* Suppression dans "C:\WINDOWS\System32" *
* Suppression dans "C:\Documents and Settings\SÚbastien Habillon\locals~1\applic~1" *
*** Suppression dossiers dans "C:\WINDOWS" ***
*** Suppression dossiers dans "C:\Program Files" ***
*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***
*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***
*** Suppression dossiers dans "c:\docume~1\alluse~1\applic~1" ***
*** Suppression dossiers dans "C:\Documents and Settings\SÚbastien Habillon\applic~1" ***
*** Suppression dossiers dans "C:\DOCUME~1\SBASTI~2\applic~1" ***
*** Suppression dossiers dans "C:\Documents and Settings\SÚbastien Habillon\locals~1\applic~1" ***
*** Suppression dossiers dans "C:\Documents and Settings\SÚbastien Habillon\menudm~1\progra~1" ***
*** Suppression fichiers ***
*** Suppression fichiers temporaires ***
Nettoyage contenu C:\WINDOWS\Temp effectué !
Nettoyage contenu C:\Documents and Settings\Sébastien Habillon\locals~1\Temp effectué !
*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)
1)Suppression avec sauvegardes nouveaux fichiers Instant Access :
2)Recherche, création sauvegardes et suppression Heuristique :
* Dans "C:\WINDOWS\system32" *
* Dans "C:\Documents and Settings\SÚbastien Habillon\locals~1\applic~1" *
*** Sauvegarde du Registre vers dossier Safebackup ***
sauvegarde du Registre réalisée avec succès !
*** Nettoyage Registre ***
Nettoyage Registre Ok
*** Certificats ***
Certificat Egroup supprimé !
Certificat Electronic-Group supprimé !
Certificat Montorgueil absent !
Certificat OOO-Favorit supprimé !
Certificat Sunny-Day-Design-Ltdt absent !
*** Recherche autres dossiers et fichiers connus ***
B1AC27E098CBA560.job trouvé ! Infection Lop possible non traitée par cet outil !
*** Nettoyage terminé le 2008-12-24 à 17:09:05.95 ***
Search Navipromo version 3.7.0 commencé le 2008-12-24 à 16:32:04.39
!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!
Outil exécuté depuis C:\Program Files\navilog1
Mise à jour le 10.12.2008 à 21h00 par IL-MAFIOSO
Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : AMD Athlon(tm) 64 Processor 3200+ )
BIOS : Ver 1.00PARTTBL
USER : Sébastien Habillon ( Administrator )
BOOT : Fail-safe boot
Antivirus : avast! antivirus 4.8.1296 [VPS 081224-0] 4.8.1296 (Not Activated)
C:\ (Local Disk) - NTFS - Total:74 Go (Free:26 Go)
D:\ (CD or DVD)
E:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
F:\ (USB) - FAT - Total:971 Mo (Free:0 Go)
Recherche executé en mode sans échec
*** Recherche Programmes installés ***
*** Recherche dossiers dans "C:\WINDOWS" ***
*** Recherche dossiers dans "C:\Program Files" ***
*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***
*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***
*** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***
*** Recherche dossiers dans "C:\Documents and Settings\SÚbastien Habillon\applic~1" ***
*** Recherche dossiers dans "C:\DOCUME~1\SBASTI~2\applic~1" ***
*** Recherche dossiers dans "C:\Documents and Settings\SÚbastien Habillon\locals~1\applic~1" ***
*** Recherche dossiers dans "C:\Documents and Settings\SÚbastien Habillon\menudm~1\progra~1" ***
*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net
*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!
* Recherche dans "C:\WINDOWS\system32" *
* Recherche dans "C:\Documents and Settings\SÚbastien Habillon\locals~1\applic~1" *
*** Recherche fichiers ***
*** Recherche clés spécifiques dans le Registre ***
!! Les clés trouvées ne sont pas forcément infectées !!
HKEY_CURRENT_USER\Software\Lanconfig trouvé !
HKEY_CURRENT_USER\Software\mc trouvé !
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"iymaeyu"="\"c:\\documents and settings\\sébastien habillon\\local settings\\application data\\iymaeyu.exe\" iymaeyu"
*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)
1)Recherche nouveaux fichiers Instant Access :
2)Recherche Heuristique :
* Dans "C:\WINDOWS\system32" :
* Dans "C:\Documents and Settings\SÚbastien Habillon\locals~1\applic~1" :
3)Recherche Certificats :
Certificat Egroup trouvé !
Certificat Electronic-Group trouvé !
Certificat Montorgueil absent !
Certificat OOO-Favorit trouvé !
Certificat Sunny-Day-Design-Ltd absent !
4)Recherche autres dossiers et fichiers connus :
B1AC27E098CBA560.job trouvé ! Infection Lop possible non traitée par cet outil !
*** Analyse terminée le 2008-12-24 à 16:47:42.28 ***
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:54:20, on 2008-12-26
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\MICROS~2\rapimgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\SBASTI~1\LOCALS~1\Temp\Rar$EX00.234\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:9090
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {10B294F2-F790-A3F0-54A6-6005D1C61B79} - C:\DOCUME~1\SBASTI~1\APPLIC~1\01JOY\COOLFACE.exe (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [2 creative chin cake] C:\Documents and Settings\All Users\Application Data\1 proc 2 creative\sect ping.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
voilà les 2
--------------------\\ Lop S&D 4.2.5-0 XP/Vista
Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : AMD Athlon(tm) 64 Processor 3200+ )
BIOS : Ver 1.00PARTTBL
USER : Sébastien Habillon ( Administrator )
BOOT : Fail-safe boot
Antivirus : avast! antivirus 4.8.1296 [VPS 081226-0] 4.8.1296 (Not Activated)
C:\ (Local Disk) - NTFS - Total:74 Go (Free:26 Go)
D:\ (CD or DVD)
E:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
F:\ (USB) - FAT - Total:971 Mo (Free:0 Go)
"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [2] ( 2008-12-26|21:40 )
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
--------------------\\ Listing des dossiers dans APPLIC~1
[2008-11-21|23:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
[2006-06-19|21:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\1 proc 2 creative
[2007-03-06|00:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[2008-12-09|22:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\albumphoto
[2008-05-15|23:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
[2008-05-15|23:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
[2008-03-24|20:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Azureus
[2008-03-31|12:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[2005-05-17|04:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\hpqwmi
[2005-05-17|04:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
[2008-12-22|20:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
[2006-04-19|16:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[2008-10-03|12:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NCH Swift Sound
[2008-12-26|10:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PC Tools
[2006-06-20|16:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
[2005-05-17|11:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
[2006-04-15|12:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBT
[2006-02-01|19:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
[2008-12-26|21:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
[2006-08-07|14:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[2008-03-21|12:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
[2008-12-22|19:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion
[2005-05-17|04:32] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Apple Computer
[2005-05-17|11:51] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
[2005-05-17|04:03] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
[2005-05-17|04:34] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Symantec
[2006-03-20|22:00] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
[2006-03-20|22:00] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
[2008-03-12|20:06] C:\DOCUME~1\SBASTI~2\APPLIC~1\Macromedia
[2006-05-21|12:00] C:\DOCUME~1\SBASTI~1\APPLIC~1\01JOY
[2008-03-19|22:51] C:\DOCUME~1\SBASTI~1\APPLIC~1\Adobe
[2007-03-06|00:26] C:\DOCUME~1\SBASTI~1\APPLIC~1\AdobeUM
[2006-02-19|18:12] C:\DOCUME~1\SBASTI~1\APPLIC~1\Ahead
[2008-11-27|01:00] C:\DOCUME~1\SBASTI~1\APPLIC~1\Apple Computer
[2008-12-19|17:51] C:\DOCUME~1\SBASTI~1\APPLIC~1\Azureus
[2006-02-03|20:02] C:\DOCUME~1\SBASTI~1\APPLIC~1\Google
[2005-05-17|11:51] C:\DOCUME~1\SBASTI~1\APPLIC~1\Identities
[2006-02-02|17:08] C:\DOCUME~1\SBASTI~1\APPLIC~1\InterVideo
[2006-03-20|22:05] C:\DOCUME~1\SBASTI~1\APPLIC~1\Lavasoft
[2008-12-19|22:46] C:\DOCUME~1\SBASTI~1\APPLIC~1\LimeWire
[2006-01-13|12:00] C:\DOCUME~1\SBASTI~1\APPLIC~1\Macromedia
[2008-12-22|20:14] C:\DOCUME~1\SBASTI~1\APPLIC~1\Malwarebytes
[2008-10-23|23:27] C:\DOCUME~1\SBASTI~1\APPLIC~1\Media Player Classic
[2007-02-08|09:15] C:\DOCUME~1\SBASTI~1\APPLIC~1\Microgaming
[2007-07-31|23:45] C:\DOCUME~1\SBASTI~1\APPLIC~1\Microsoft
[2006-02-09|21:36] C:\DOCUME~1\SBASTI~1\APPLIC~1\Microsoft Web Folders
[2008-12-26|10:47] C:\DOCUME~1\SBASTI~1\APPLIC~1\Mozilla
[2008-12-11|23:52] C:\DOCUME~1\SBASTI~1\APPLIC~1\NCH Swift Sound
[2008-12-21|20:49] C:\DOCUME~1\SBASTI~1\APPLIC~1\PC Tools
[2007-02-01|00:29] C:\DOCUME~1\SBASTI~1\APPLIC~1\Real
[2008-10-03|12:00] C:\DOCUME~1\SBASTI~1\APPLIC~1\Recordpad
[2006-04-10|17:40] C:\DOCUME~1\SBASTI~1\APPLIC~1\Sphinx
[2006-01-14|18:13] C:\DOCUME~1\SBASTI~1\APPLIC~1\Sun
[2006-01-19|20:00] C:\DOCUME~1\SBASTI~1\APPLIC~1\Symantec
[2008-12-26|10:14] C:\DOCUME~1\SBASTI~1\APPLIC~1\U3
--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks
[2008-12-15 17:24][--a------] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2008-12-26 21:31][--ah-----] C:\WINDOWS\tasks\SA.DAT
[2004-08-05 09:00][-rah-----] C:\WINDOWS\tasks\desktop.ini
--------------------\\ Listing des dossiers dans C:\Program Files
[2007-03-06|00:24] C:\Program Files\Adobe
[2006-03-01|11:32] C:\Program Files\Ahead
[2007-01-05|22:47] C:\Program Files\Alwil Software
[2005-05-17|04:13] C:\Program Files\AMD
[2008-11-18|22:23] C:\Program Files\Apple Software Update
[2005-05-17|04:03] C:\Program Files\ATI Technologies
[2008-11-27|23:11] C:\Program Files\Azureus
[2008-11-18|22:28] C:\Program Files\Bonjour
[2008-12-24|16:20] C:\Program Files\CCleaner
[2005-05-17|11:51] C:\Program Files\ComPlus Applications
[2005-05-17|02:54] C:\Program Files\CONEXANT
[2006-03-28|11:00] C:\Program Files\directx
[2008-10-23|23:25] C:\Program Files\DivX
[2006-01-17|23:45] C:\Program Files\EA Games
[2006-03-07|10:24] C:\Program Files\Easy Internet signup
[2008-12-18|14:20] C:\Program Files\eMule
[2008-12-26|10:17] C:\Program Files\Fichiers communs
[2008-04-02|14:08] C:\Program Files\Google
[2008-02-18|20:53] C:\Program Files\Grisoft
[2007-05-12|23:04] C:\Program Files\HP
[2008-12-22|07:24] C:\Program Files\HPQ
[2006-12-08|18:04] C:\Program Files\InstallShield Installation Information
[2008-12-12|22:29] C:\Program Files\Internet Explorer
[2005-05-17|04:28] C:\Program Files\InterVideo
[2008-11-21|23:49] C:\Program Files\iPod
[2008-11-26|13:33] C:\Program Files\iTunes
[2008-08-24|00:36] C:\Program Files\Java
[2008-10-23|23:26] C:\Program Files\K-Lite Codec Pack
[2006-03-20|22:05] C:\Program Files\Lavasoft
[2008-03-29|13:16] C:\Program Files\LimeWire
[2008-12-24|13:34] C:\Program Files\Malwarebytes' Anti-Malware
[2008-12-12|22:18] C:\Program Files\Messenger
[2007-05-12|23:22] C:\Program Files\Microsoft ActiveSync
[2006-04-15|12:52] C:\Program Files\microsoft frontpage
[2007-05-12|23:06] C:\Program Files\Microsoft Office
[2006-04-19|16:15] C:\Program Files\Microsoft.NET
[2008-12-11|23:47] C:\Program Files\monAlbumPhoto
[2008-12-12|22:14] C:\Program Files\Movie Maker
[2008-12-26|21:29] C:\Program Files\Mozilla Firefox
[2006-10-30|13:15] C:\Program Files\MSN
[2005-05-17|11:51] C:\Program Files\MSN Gaming Zone
[2008-12-24|17:09] C:\Program Files\Navilog1
[2008-07-09|15:04] C:\Program Files\NCH Software
[2008-12-11|23:56] C:\Program Files\NCH Swift Sound
[2006-02-13|23:56] C:\Program Files\Nero
[2008-12-12|22:11] C:\Program Files\NetMeeting
[2005-05-17|11:51] C:\Program Files\Online Services
[2008-12-12|22:11] C:\Program Files\Outlook Express
[2008-11-26|17:09] C:\Program Files\QuickTime
[2006-11-01|12:40] C:\Program Files\Real
[2005-05-17|04:31] C:\Program Files\Services en ligne
[2007-05-27|19:45] C:\Program Files\SLD Codec Pack
[2006-04-15|12:53] C:\Program Files\Snapshot Viewer
[2008-12-23|19:13] C:\Program Files\Softwin
[2006-03-05|15:32] C:\Program Files\Sonic
[2008-12-26|21:35] C:\Program Files\Spyware Doctor
[2008-08-24|00:37] C:\Program Files\Sun
[2006-02-02|21:50] C:\Program Files\Symantec
[2005-05-17|04:28] C:\Program Files\Synaptics
[2008-12-13|00:55] C:\Program Files\Tukanas Poker Tournament Timer
[2005-05-17|11:51] C:\Program Files\Uninstall Information
[2008-12-21|23:30] C:\Program Files\Windows Live
[2008-12-10|11:09] C:\Program Files\Windows Live Safety Center
[2007-05-12|23:19] C:\Program Files\Windows Media Connect 2
[2008-12-12|22:11] C:\Program Files\Windows Media Player
[2008-12-12|22:11] C:\Program Files\Windows NT
[2005-05-17|11:51] C:\Program Files\WindowsUpdate
[2006-01-29|19:26] C:\Program Files\WinRAR
[2005-05-17|11:51] C:\Program Files\xerox
[2008-12-22|19:13] C:\Program Files\Yahoo!
[2006-04-03|12:11] C:\Program Files\Zero G Registry
--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs
[2006-02-03|00:11] C:\Program Files\Fichiers communs\Adobe
[2006-03-01|11:42] C:\Program Files\Fichiers communs\Ahead
[2008-11-21|23:49] C:\Program Files\Fichiers communs\Apple
[2006-02-09|21:38] C:\Program Files\Fichiers communs\Designer
[2006-03-05|15:32] C:\Program Files\Fichiers communs\InstallShield
[2005-05-17|04:06] C:\Program Files\Fichiers communs\Java
[2005-05-17|04:33] C:\Program Files\Fichiers communs\LightScribe
[2008-10-31|23:55] C:\Program Files\Fichiers communs\Microsoft Shared
[2005-05-17|11:51] C:\Program Files\Fichiers communs\MSSoap
[2005-05-17|11:51] C:\Program Files\Fichiers communs\ODBC
[2008-12-26|10:19] C:\Program Files\Fichiers communs\PC Tools
[2007-02-01|00:29] C:\Program Files\Fichiers communs\Real
[2005-05-17|11:51] C:\Program Files\Fichiers communs\Services
[2008-12-23|19:13] C:\Program Files\Fichiers communs\Softwin
[2006-03-05|15:34] C:\Program Files\Fichiers communs\Sonic Shared
[2005-05-17|11:51] C:\Program Files\Fichiers communs\SpeechEngines
[2006-02-01|20:05] C:\Program Files\Fichiers communs\Symantec Shared
[2008-12-12|22:11] C:\Program Files\Fichiers communs\System
[2008-03-21|12:48] C:\Program Files\Fichiers communs\WindowsLiveInstaller
--------------------\\ Process
( 15 Processes )
... OK !
--------------------\\ Recherche avec S_Lop
Aucun fichier / dossier Lop trouvé !
--------------------\\ Recherche de Fichiers / Dossiers Lop
Aucun fichier / dossier Lop trouvé !
--------------------\\ Verification du Registre
..... OK !
--------------------\\ Verification du fichier Hosts
Fichier Hosts PROPRE
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:49:55, on 2008-12-26
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Safe mode
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\SBASTI~1\LOCALS~1\Temp\Rar$EX00.797\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:9090
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {10B294F2-F790-A3F0-54A6-6005D1C61B79} - C:\DOCUME~1\SBASTI~1\APPLIC~1\01JOY\COOLFACE.exe (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [2 creative chin cake] C:\Documents and Settings\All Users\Application Data\1 proc 2 creative\sect ping.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\RunOnce: [ashMaiSv] C:\PROGRA~1\ALWILS~1\Avast4\ashMaiSv.exe /i
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
--------------------\\ Lop S&D 4.2.5-0 XP/Vista
Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : AMD Athlon(tm) 64 Processor 3200+ )
BIOS : Ver 1.00PARTTBL
USER : Sébastien Habillon ( Administrator )
BOOT : Fail-safe boot
Antivirus : avast! antivirus 4.8.1296 [VPS 081226-0] 4.8.1296 (Not Activated)
C:\ (Local Disk) - NTFS - Total:74 Go (Free:26 Go)
D:\ (CD or DVD)
E:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
F:\ (USB) - FAT - Total:971 Mo (Free:0 Go)
"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [2] ( 2008-12-26|21:40 )
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
--------------------\\ Listing des dossiers dans APPLIC~1
[2008-11-21|23:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
[2006-06-19|21:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\1 proc 2 creative
[2007-03-06|00:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[2008-12-09|22:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\albumphoto
[2008-05-15|23:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
[2008-05-15|23:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
[2008-03-24|20:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Azureus
[2008-03-31|12:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[2005-05-17|04:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\hpqwmi
[2005-05-17|04:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
[2008-12-22|20:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
[2006-04-19|16:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[2008-10-03|12:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NCH Swift Sound
[2008-12-26|10:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PC Tools
[2006-06-20|16:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
[2005-05-17|11:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
[2006-04-15|12:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBT
[2006-02-01|19:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
[2008-12-26|21:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
[2006-08-07|14:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[2008-03-21|12:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
[2008-12-22|19:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion
[2005-05-17|04:32] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Apple Computer
[2005-05-17|11:51] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
[2005-05-17|04:03] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
[2005-05-17|04:34] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Symantec
[2006-03-20|22:00] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
[2006-03-20|22:00] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
[2008-03-12|20:06] C:\DOCUME~1\SBASTI~2\APPLIC~1\Macromedia
[2006-05-21|12:00] C:\DOCUME~1\SBASTI~1\APPLIC~1\01JOY
[2008-03-19|22:51] C:\DOCUME~1\SBASTI~1\APPLIC~1\Adobe
[2007-03-06|00:26] C:\DOCUME~1\SBASTI~1\APPLIC~1\AdobeUM
[2006-02-19|18:12] C:\DOCUME~1\SBASTI~1\APPLIC~1\Ahead
[2008-11-27|01:00] C:\DOCUME~1\SBASTI~1\APPLIC~1\Apple Computer
[2008-12-19|17:51] C:\DOCUME~1\SBASTI~1\APPLIC~1\Azureus
[2006-02-03|20:02] C:\DOCUME~1\SBASTI~1\APPLIC~1\Google
[2005-05-17|11:51] C:\DOCUME~1\SBASTI~1\APPLIC~1\Identities
[2006-02-02|17:08] C:\DOCUME~1\SBASTI~1\APPLIC~1\InterVideo
[2006-03-20|22:05] C:\DOCUME~1\SBASTI~1\APPLIC~1\Lavasoft
[2008-12-19|22:46] C:\DOCUME~1\SBASTI~1\APPLIC~1\LimeWire
[2006-01-13|12:00] C:\DOCUME~1\SBASTI~1\APPLIC~1\Macromedia
[2008-12-22|20:14] C:\DOCUME~1\SBASTI~1\APPLIC~1\Malwarebytes
[2008-10-23|23:27] C:\DOCUME~1\SBASTI~1\APPLIC~1\Media Player Classic
[2007-02-08|09:15] C:\DOCUME~1\SBASTI~1\APPLIC~1\Microgaming
[2007-07-31|23:45] C:\DOCUME~1\SBASTI~1\APPLIC~1\Microsoft
[2006-02-09|21:36] C:\DOCUME~1\SBASTI~1\APPLIC~1\Microsoft Web Folders
[2008-12-26|10:47] C:\DOCUME~1\SBASTI~1\APPLIC~1\Mozilla
[2008-12-11|23:52] C:\DOCUME~1\SBASTI~1\APPLIC~1\NCH Swift Sound
[2008-12-21|20:49] C:\DOCUME~1\SBASTI~1\APPLIC~1\PC Tools
[2007-02-01|00:29] C:\DOCUME~1\SBASTI~1\APPLIC~1\Real
[2008-10-03|12:00] C:\DOCUME~1\SBASTI~1\APPLIC~1\Recordpad
[2006-04-10|17:40] C:\DOCUME~1\SBASTI~1\APPLIC~1\Sphinx
[2006-01-14|18:13] C:\DOCUME~1\SBASTI~1\APPLIC~1\Sun
[2006-01-19|20:00] C:\DOCUME~1\SBASTI~1\APPLIC~1\Symantec
[2008-12-26|10:14] C:\DOCUME~1\SBASTI~1\APPLIC~1\U3
--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks
[2008-12-15 17:24][--a------] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2008-12-26 21:31][--ah-----] C:\WINDOWS\tasks\SA.DAT
[2004-08-05 09:00][-rah-----] C:\WINDOWS\tasks\desktop.ini
--------------------\\ Listing des dossiers dans C:\Program Files
[2007-03-06|00:24] C:\Program Files\Adobe
[2006-03-01|11:32] C:\Program Files\Ahead
[2007-01-05|22:47] C:\Program Files\Alwil Software
[2005-05-17|04:13] C:\Program Files\AMD
[2008-11-18|22:23] C:\Program Files\Apple Software Update
[2005-05-17|04:03] C:\Program Files\ATI Technologies
[2008-11-27|23:11] C:\Program Files\Azureus
[2008-11-18|22:28] C:\Program Files\Bonjour
[2008-12-24|16:20] C:\Program Files\CCleaner
[2005-05-17|11:51] C:\Program Files\ComPlus Applications
[2005-05-17|02:54] C:\Program Files\CONEXANT
[2006-03-28|11:00] C:\Program Files\directx
[2008-10-23|23:25] C:\Program Files\DivX
[2006-01-17|23:45] C:\Program Files\EA Games
[2006-03-07|10:24] C:\Program Files\Easy Internet signup
[2008-12-18|14:20] C:\Program Files\eMule
[2008-12-26|10:17] C:\Program Files\Fichiers communs
[2008-04-02|14:08] C:\Program Files\Google
[2008-02-18|20:53] C:\Program Files\Grisoft
[2007-05-12|23:04] C:\Program Files\HP
[2008-12-22|07:24] C:\Program Files\HPQ
[2006-12-08|18:04] C:\Program Files\InstallShield Installation Information
[2008-12-12|22:29] C:\Program Files\Internet Explorer
[2005-05-17|04:28] C:\Program Files\InterVideo
[2008-11-21|23:49] C:\Program Files\iPod
[2008-11-26|13:33] C:\Program Files\iTunes
[2008-08-24|00:36] C:\Program Files\Java
[2008-10-23|23:26] C:\Program Files\K-Lite Codec Pack
[2006-03-20|22:05] C:\Program Files\Lavasoft
[2008-03-29|13:16] C:\Program Files\LimeWire
[2008-12-24|13:34] C:\Program Files\Malwarebytes' Anti-Malware
[2008-12-12|22:18] C:\Program Files\Messenger
[2007-05-12|23:22] C:\Program Files\Microsoft ActiveSync
[2006-04-15|12:52] C:\Program Files\microsoft frontpage
[2007-05-12|23:06] C:\Program Files\Microsoft Office
[2006-04-19|16:15] C:\Program Files\Microsoft.NET
[2008-12-11|23:47] C:\Program Files\monAlbumPhoto
[2008-12-12|22:14] C:\Program Files\Movie Maker
[2008-12-26|21:29] C:\Program Files\Mozilla Firefox
[2006-10-30|13:15] C:\Program Files\MSN
[2005-05-17|11:51] C:\Program Files\MSN Gaming Zone
[2008-12-24|17:09] C:\Program Files\Navilog1
[2008-07-09|15:04] C:\Program Files\NCH Software
[2008-12-11|23:56] C:\Program Files\NCH Swift Sound
[2006-02-13|23:56] C:\Program Files\Nero
[2008-12-12|22:11] C:\Program Files\NetMeeting
[2005-05-17|11:51] C:\Program Files\Online Services
[2008-12-12|22:11] C:\Program Files\Outlook Express
[2008-11-26|17:09] C:\Program Files\QuickTime
[2006-11-01|12:40] C:\Program Files\Real
[2005-05-17|04:31] C:\Program Files\Services en ligne
[2007-05-27|19:45] C:\Program Files\SLD Codec Pack
[2006-04-15|12:53] C:\Program Files\Snapshot Viewer
[2008-12-23|19:13] C:\Program Files\Softwin
[2006-03-05|15:32] C:\Program Files\Sonic
[2008-12-26|21:35] C:\Program Files\Spyware Doctor
[2008-08-24|00:37] C:\Program Files\Sun
[2006-02-02|21:50] C:\Program Files\Symantec
[2005-05-17|04:28] C:\Program Files\Synaptics
[2008-12-13|00:55] C:\Program Files\Tukanas Poker Tournament Timer
[2005-05-17|11:51] C:\Program Files\Uninstall Information
[2008-12-21|23:30] C:\Program Files\Windows Live
[2008-12-10|11:09] C:\Program Files\Windows Live Safety Center
[2007-05-12|23:19] C:\Program Files\Windows Media Connect 2
[2008-12-12|22:11] C:\Program Files\Windows Media Player
[2008-12-12|22:11] C:\Program Files\Windows NT
[2005-05-17|11:51] C:\Program Files\WindowsUpdate
[2006-01-29|19:26] C:\Program Files\WinRAR
[2005-05-17|11:51] C:\Program Files\xerox
[2008-12-22|19:13] C:\Program Files\Yahoo!
[2006-04-03|12:11] C:\Program Files\Zero G Registry
--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs
[2006-02-03|00:11] C:\Program Files\Fichiers communs\Adobe
[2006-03-01|11:42] C:\Program Files\Fichiers communs\Ahead
[2008-11-21|23:49] C:\Program Files\Fichiers communs\Apple
[2006-02-09|21:38] C:\Program Files\Fichiers communs\Designer
[2006-03-05|15:32] C:\Program Files\Fichiers communs\InstallShield
[2005-05-17|04:06] C:\Program Files\Fichiers communs\Java
[2005-05-17|04:33] C:\Program Files\Fichiers communs\LightScribe
[2008-10-31|23:55] C:\Program Files\Fichiers communs\Microsoft Shared
[2005-05-17|11:51] C:\Program Files\Fichiers communs\MSSoap
[2005-05-17|11:51] C:\Program Files\Fichiers communs\ODBC
[2008-12-26|10:19] C:\Program Files\Fichiers communs\PC Tools
[2007-02-01|00:29] C:\Program Files\Fichiers communs\Real
[2005-05-17|11:51] C:\Program Files\Fichiers communs\Services
[2008-12-23|19:13] C:\Program Files\Fichiers communs\Softwin
[2006-03-05|15:34] C:\Program Files\Fichiers communs\Sonic Shared
[2005-05-17|11:51] C:\Program Files\Fichiers communs\SpeechEngines
[2006-02-01|20:05] C:\Program Files\Fichiers communs\Symantec Shared
[2008-12-12|22:11] C:\Program Files\Fichiers communs\System
[2008-03-21|12:48] C:\Program Files\Fichiers communs\WindowsLiveInstaller
--------------------\\ Process
( 15 Processes )
... OK !
--------------------\\ Recherche avec S_Lop
Aucun fichier / dossier Lop trouvé !
--------------------\\ Recherche de Fichiers / Dossiers Lop
Aucun fichier / dossier Lop trouvé !
--------------------\\ Verification du Registre
..... OK !
--------------------\\ Verification du fichier Hosts
Fichier Hosts PROPRE
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:49:55, on 2008-12-26
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Safe mode
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\SBASTI~1\LOCALS~1\Temp\Rar$EX00.797\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:9090
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {10B294F2-F790-A3F0-54A6-6005D1C61B79} - C:\DOCUME~1\SBASTI~1\APPLIC~1\01JOY\COOLFACE.exe (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [2 creative chin cake] C:\Documents and Settings\All Users\Application Data\1 proc 2 creative\sect ping.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\RunOnce: [ashMaiSv] C:\PROGRA~1\ALWILS~1\Avast4\ashMaiSv.exe /i
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
re re re!!!
---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
/!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\
---> Double-clique sur Combofix.exe
Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
Accepte en cliquant sur "Oui"
---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.
/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\
En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.
Une fois le scan achevé, un rapport va s'afficher : Poste son contenu
/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\
Note : Le rapport se trouve également là : C:\ComboFix.txt
a+
---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
/!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\
---> Double-clique sur Combofix.exe
Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
Accepte en cliquant sur "Oui"
---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.
/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\
En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.
Une fois le scan achevé, un rapport va s'afficher : Poste son contenu
/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\
Note : Le rapport se trouve également là : C:\ComboFix.txt
a+
ComboFix 08-12-21.04 - 2008-12-26 22:32:31.1 - NTFSx86 MINIMAL
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.1022.790 [GMT 1:00]
Lancé depuis: F:\ComboFix.exe
[COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR]
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\bolivar29.exe
c:\windows\system32\404Fix.exe
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\o4Patch.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe
.
((((((((((((((((((((((((((((( Fichiers créés du 2008-11-26 au 2008-12-26 ))))))))))))))))))))))))))))))))))))
.
2008-12-26 10:47 . 2008-12-26 10:47 0 --a------ c:\windows\nsreg.dat
2008-12-26 10:20 . 2008-12-26 10:20 <REP> d-------- c:\documents and settings\All Users\Application Data\PC Tools
2008-12-26 10:20 . 2008-12-26 10:19 160,792 --a------ c:\windows\system32\drivers\pctfw2.sys
2008-12-26 10:17 . 2008-12-26 10:19 <REP> d-------- c:\program files\Fichiers communs\PC Tools
2008-12-24 17:50 . 2008-12-26 21:46 <REP> d-------- C:\Lop SD
2008-12-24 17:31 . 2008-12-24 17:31 359,851 --a------ C:\Pass2.cmd
2008-12-24 17:24 . 2008-12-12 00:57 78,336 --a------ c:\windows\system32\Agent.OMZ.Fix.exe
2008-12-24 16:20 . 2008-12-24 16:20 <REP> d-------- c:\program files\CCleaner
2008-12-24 13:34 . 2008-12-24 13:34 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-24 13:34 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-24 13:34 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-23 20:35 . 2008-12-23 21:05 <REP> d-------- c:\windows\system32\900053
2008-12-23 19:13 . 2008-12-23 19:13 <REP> d-------- c:\program files\Softwin
2008-12-23 19:12 . 2008-12-23 19:13 <REP> d-------- c:\program files\Fichiers communs\Softwin
2008-12-22 20:14 . 2008-12-22 20:14 <REP> d-------- c:\documents and settings\Sébastien Habillon\Application Data\Malwarebytes
2008-12-22 20:14 . 2008-12-22 20:14 <REP> d-------- c:\documents and settings\Sébastien Habillon\Application Data\Malwarebytes
2008-12-22 20:14 . 2008-12-22 20:14 <REP> d-------- c:\documents and settings\Sébastien Habillon\Application Data\Malwarebytes
2008-12-22 20:14 . 2008-12-22 20:14 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-22 19:27 . 2008-12-22 19:27 <REP> d-------- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2008-12-22 19:24 . 2008-12-24 17:09 <REP> d-------- c:\program files\Navilog1
2008-12-21 20:49 . 2008-12-26 21:53 <REP> d-------- c:\program files\Spyware Doctor
2008-12-21 20:49 . 2008-12-21 20:49 <REP> d-------- c:\documents and settings\Sébastien Habillon\Application Data\PC Tools
2008-12-21 20:49 . 2008-12-21 20:49 <REP> d-------- c:\documents and settings\Sébastien Habillon\Application Data\PC Tools
2008-12-21 20:49 . 2008-12-21 20:49 <REP> d-------- c:\documents and settings\Sébastien Habillon\Application Data\PC Tools
2008-12-21 20:49 . 2008-12-26 22:23 <REP> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2008-12-21 20:49 . 2008-08-25 12:36 81,288 --a------ c:\windows\system32\drivers\iksyssec.sys
2008-12-21 20:49 . 2008-08-25 12:36 66,952 --a------ c:\windows\system32\drivers\iksysflt.sys
2008-12-21 20:49 . 2008-08-25 12:36 40,840 --a------ c:\windows\system32\drivers\ikfilesec.sys
2008-12-21 20:49 . 2008-06-02 16:19 29,576 --a------ c:\windows\system32\drivers\kcom.sys
2008-12-13 00:55 . 2008-12-13 00:55 <REP> d-------- c:\program files\Tukanas Poker Tournament Timer
2008-12-12 22:14 . 2008-12-12 22:14 <REP> d-------- c:\windows\system32\fr-fr
2008-12-12 22:14 . 2008-12-12 22:14 <REP> d-------- c:\windows\system32\fr
2008-12-12 22:14 . 2008-12-12 22:14 <REP> d-------- c:\windows\system32\bits
2008-12-12 22:14 . 2008-12-12 22:14 <REP> d-------- c:\windows\l2schemas
2008-12-12 22:11 . 2008-12-12 22:14 <REP> d-------- c:\windows\ServicePackFiles
2008-12-12 22:05 . 2008-12-12 22:05 <REP> d-------- c:\windows\EHome
2008-12-12 21:48 . 2008-12-12 21:48 1 ---h----- c:\windows\fm123.dat
2008-12-09 21:23 . 2008-12-11 23:47 <REP> d-------- c:\program files\monAlbumPhoto
2008-12-09 21:23 . 2008-12-09 22:03 <REP> d-------- c:\documents and settings\All Users\Application Data\albumphoto
2008-12-09 20:09 . 2008-12-09 20:10 <REP> d-------- c:\windows\system32\351631
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-26 09:14 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\U3
2008-12-26 09:14 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\U3
2008-12-26 09:14 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\U3
2008-12-22 18:13 --------- d-----w c:\program files\Yahoo!
2008-12-22 06:24 --------- d-----w c:\program files\HPQ
2008-12-21 22:30 --------- d-----w c:\program files\Windows Live
2008-12-19 21:46 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\LimeWire
2008-12-19 21:46 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\LimeWire
2008-12-19 21:46 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\LimeWire
2008-12-19 16:51 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Azureus
2008-12-19 16:51 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Azureus
2008-12-19 16:51 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Azureus
2008-12-18 13:20 --------- d-----w c:\program files\eMule
2008-12-12 17:02 3,088,896 ------w c:\windows\system32\dllcache\mshtml.dll
2008-12-11 22:56 --------- d-----w c:\program files\NCH Swift Sound
2008-12-11 22:52 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\NCH Swift Sound
2008-12-11 22:52 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\NCH Swift Sound
2008-12-11 22:52 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\NCH Swift Sound
2008-12-10 10:09 --------- d-----w c:\program files\Windows Live Safety Center
2008-11-27 22:11 --------- d-----w c:\program files\Azureus
2008-11-27 00:00 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Apple Computer
2008-11-27 00:00 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Apple Computer
2008-11-27 00:00 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Apple Computer
2008-11-26 16:09 --------- d-----w c:\program files\QuickTime
2008-11-26 12:33 --------- d-----w c:\program files\iTunes
2008-11-21 22:50 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-11-21 22:49 --------- d-----w c:\program files\iPod
2008-11-21 22:49 --------- d-----w c:\program files\Fichiers communs\Apple
2008-11-18 21:28 --------- d-----w c:\program files\Bonjour
2008-11-18 21:23 --------- d-----w c:\program files\Apple Software Update
2008-10-24 11:21 455,296 ------w c:\windows\system32\dllcache\mrxsmb.sys
2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
2008-10-23 12:36 286,720 ------w c:\windows\system32\dllcache\gdi32.dll
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\dllcache\wuaueng.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\dllcache\wuapi.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\dllcache\wucltui.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\dllcache\cdm.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\dllcache\wuauclt.exe
2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\dllcache\wups.dll
2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-16 01:01 670,208 ----a-w c:\windows\system32\wininet.dll
2008-10-16 01:01 670,208 ------w c:\windows\system32\dllcache\wininet.dll
2008-10-16 01:01 620,544 ------w c:\windows\system32\dllcache\urlmon.dll
2008-10-16 01:01 1,499,648 ------w c:\windows\system32\dllcache\shdocvw.dll
2008-10-15 16:35 337,408 ------w c:\windows\system32\dllcache\netapi32.dll
2008-10-03 10:03 247,326 ----a-w c:\windows\system32\strmdll.dll
2008-10-03 10:03 247,326 ------w c:\windows\system32\dllcache\strmdll.dll
2006-12-08 17:02 4,096 ----a-w c:\documents and settings\Sébastien Habillon\log.dat
2006-12-08 17:02 4,096 ----a-w c:\documents and settings\Sébastien Habillon\log.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{10B294F2-F790-A3F0-54A6-6005D1C61B79}]
c:\docume~1\SBASTI~1\APPLIC~1\[u]0[/u]1JOY\COOLFACE.exe [BU]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Ahead\lib\NMBgMonitor.exe" [2006-02-01 98304]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2005-11-15 1204224]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-04 68856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-22 339968]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-02-02 102492]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-02-02 692316]
"eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-12-03 290816]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 253952]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2005-02-17 233534]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2006-01-12 155648]
"2 creative chin cake"="c:\documents and settings\All Users\Application Data\1 proc 2 creative\sect ping.exe" [BU]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-11-07 111936]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2008-08-25 1168264]
"MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2008-04-14 172544]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 c:\windows\system32\bthprops.cpl]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv"="grpconv -o" [X]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [BU]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"<NO NAME>"=
"c:\\Program Files\\Azureus\\Azureus.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2008-12-21 356920]
S1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-09-19 111184]
S1 navigator;navigator;\systemroot\fd.dll []
S1 pctfw2;pctfw2;\??\c:\windows\system32\drivers\pctfw2.sys [2008-12-26 160792]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-09-19 20560]
S3 HSFHWATI;HSFHWATI;c:\windows\system32\DRIVERS\HSFHWATI.sys [2005-03-22 200192]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\LaunchU3.exe -a
*Newly Created Service* - PROCEXP90
.
Contenu du dossier 'Tâches planifiées'
2008-12-15 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
- - - - ORPHELINS SUPPRIMES - - - -
HKLM-RunOnce-<NO NAME> - (no file)
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=Q305&bd=pavilion&pf=laptop
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=Q305&bd=pavilion&pf=laptop
uInternet Settings,ProxyOverride = *.local;<local>
uInternet Settings,ProxyServer = http=127.0.0.1:9090
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
LSP: c:\program files\Fichiers communs\PC Tools\LSP\PCTLsp.dll
FF - ProfilePath - c:\documents and settings\Sébastien Habillon\Application Data\Mozilla\Firefox\Profiles\6broo1pe.default\
FF - prefs.js: browser.startup.homepage - hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=Q305&bd=pavilion&pf=laptop
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 9090
FF - prefs.js: network.proxy.type - 1
FF - plugin: c:\program files\Yahoo!\Common\npyaxmpb.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-26 22:37:02
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????????P??|?????? ???B?????????????hLC? ??????
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(204)
c:\windows\system32\Ati2evxx.dll
.
Heure de fin: 2008-12-26 22:39:23
ComboFix-quarantined-files.txt 2008-12-26 21:38:16
ComboFix2.txt 2008-12-23 19:04:20
Avant-CF: 28,527,448,064 octets libres
Après-CF: 28,513,525,760 octets libres
239 --- E O F --- 2008-12-19 02:01:22
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.1022.790 [GMT 1:00]
Lancé depuis: F:\ComboFix.exe
[COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR]
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\bolivar29.exe
c:\windows\system32\404Fix.exe
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\o4Patch.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe
.
((((((((((((((((((((((((((((( Fichiers créés du 2008-11-26 au 2008-12-26 ))))))))))))))))))))))))))))))))))))
.
2008-12-26 10:47 . 2008-12-26 10:47 0 --a------ c:\windows\nsreg.dat
2008-12-26 10:20 . 2008-12-26 10:20 <REP> d-------- c:\documents and settings\All Users\Application Data\PC Tools
2008-12-26 10:20 . 2008-12-26 10:19 160,792 --a------ c:\windows\system32\drivers\pctfw2.sys
2008-12-26 10:17 . 2008-12-26 10:19 <REP> d-------- c:\program files\Fichiers communs\PC Tools
2008-12-24 17:50 . 2008-12-26 21:46 <REP> d-------- C:\Lop SD
2008-12-24 17:31 . 2008-12-24 17:31 359,851 --a------ C:\Pass2.cmd
2008-12-24 17:24 . 2008-12-12 00:57 78,336 --a------ c:\windows\system32\Agent.OMZ.Fix.exe
2008-12-24 16:20 . 2008-12-24 16:20 <REP> d-------- c:\program files\CCleaner
2008-12-24 13:34 . 2008-12-24 13:34 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-24 13:34 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-24 13:34 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-23 20:35 . 2008-12-23 21:05 <REP> d-------- c:\windows\system32\900053
2008-12-23 19:13 . 2008-12-23 19:13 <REP> d-------- c:\program files\Softwin
2008-12-23 19:12 . 2008-12-23 19:13 <REP> d-------- c:\program files\Fichiers communs\Softwin
2008-12-22 20:14 . 2008-12-22 20:14 <REP> d-------- c:\documents and settings\Sébastien Habillon\Application Data\Malwarebytes
2008-12-22 20:14 . 2008-12-22 20:14 <REP> d-------- c:\documents and settings\Sébastien Habillon\Application Data\Malwarebytes
2008-12-22 20:14 . 2008-12-22 20:14 <REP> d-------- c:\documents and settings\Sébastien Habillon\Application Data\Malwarebytes
2008-12-22 20:14 . 2008-12-22 20:14 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-22 19:27 . 2008-12-22 19:27 <REP> d-------- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2008-12-22 19:24 . 2008-12-24 17:09 <REP> d-------- c:\program files\Navilog1
2008-12-21 20:49 . 2008-12-26 21:53 <REP> d-------- c:\program files\Spyware Doctor
2008-12-21 20:49 . 2008-12-21 20:49 <REP> d-------- c:\documents and settings\Sébastien Habillon\Application Data\PC Tools
2008-12-21 20:49 . 2008-12-21 20:49 <REP> d-------- c:\documents and settings\Sébastien Habillon\Application Data\PC Tools
2008-12-21 20:49 . 2008-12-21 20:49 <REP> d-------- c:\documents and settings\Sébastien Habillon\Application Data\PC Tools
2008-12-21 20:49 . 2008-12-26 22:23 <REP> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2008-12-21 20:49 . 2008-08-25 12:36 81,288 --a------ c:\windows\system32\drivers\iksyssec.sys
2008-12-21 20:49 . 2008-08-25 12:36 66,952 --a------ c:\windows\system32\drivers\iksysflt.sys
2008-12-21 20:49 . 2008-08-25 12:36 40,840 --a------ c:\windows\system32\drivers\ikfilesec.sys
2008-12-21 20:49 . 2008-06-02 16:19 29,576 --a------ c:\windows\system32\drivers\kcom.sys
2008-12-13 00:55 . 2008-12-13 00:55 <REP> d-------- c:\program files\Tukanas Poker Tournament Timer
2008-12-12 22:14 . 2008-12-12 22:14 <REP> d-------- c:\windows\system32\fr-fr
2008-12-12 22:14 . 2008-12-12 22:14 <REP> d-------- c:\windows\system32\fr
2008-12-12 22:14 . 2008-12-12 22:14 <REP> d-------- c:\windows\system32\bits
2008-12-12 22:14 . 2008-12-12 22:14 <REP> d-------- c:\windows\l2schemas
2008-12-12 22:11 . 2008-12-12 22:14 <REP> d-------- c:\windows\ServicePackFiles
2008-12-12 22:05 . 2008-12-12 22:05 <REP> d-------- c:\windows\EHome
2008-12-12 21:48 . 2008-12-12 21:48 1 ---h----- c:\windows\fm123.dat
2008-12-09 21:23 . 2008-12-11 23:47 <REP> d-------- c:\program files\monAlbumPhoto
2008-12-09 21:23 . 2008-12-09 22:03 <REP> d-------- c:\documents and settings\All Users\Application Data\albumphoto
2008-12-09 20:09 . 2008-12-09 20:10 <REP> d-------- c:\windows\system32\351631
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-26 09:14 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\U3
2008-12-26 09:14 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\U3
2008-12-26 09:14 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\U3
2008-12-22 18:13 --------- d-----w c:\program files\Yahoo!
2008-12-22 06:24 --------- d-----w c:\program files\HPQ
2008-12-21 22:30 --------- d-----w c:\program files\Windows Live
2008-12-19 21:46 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\LimeWire
2008-12-19 21:46 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\LimeWire
2008-12-19 21:46 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\LimeWire
2008-12-19 16:51 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Azureus
2008-12-19 16:51 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Azureus
2008-12-19 16:51 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Azureus
2008-12-18 13:20 --------- d-----w c:\program files\eMule
2008-12-12 17:02 3,088,896 ------w c:\windows\system32\dllcache\mshtml.dll
2008-12-11 22:56 --------- d-----w c:\program files\NCH Swift Sound
2008-12-11 22:52 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\NCH Swift Sound
2008-12-11 22:52 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\NCH Swift Sound
2008-12-11 22:52 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\NCH Swift Sound
2008-12-10 10:09 --------- d-----w c:\program files\Windows Live Safety Center
2008-11-27 22:11 --------- d-----w c:\program files\Azureus
2008-11-27 00:00 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Apple Computer
2008-11-27 00:00 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Apple Computer
2008-11-27 00:00 --------- d-----w c:\documents and settings\Sébastien Habillon\Application Data\Apple Computer
2008-11-26 16:09 --------- d-----w c:\program files\QuickTime
2008-11-26 12:33 --------- d-----w c:\program files\iTunes
2008-11-21 22:50 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-11-21 22:49 --------- d-----w c:\program files\iPod
2008-11-21 22:49 --------- d-----w c:\program files\Fichiers communs\Apple
2008-11-18 21:28 --------- d-----w c:\program files\Bonjour
2008-11-18 21:23 --------- d-----w c:\program files\Apple Software Update
2008-10-24 11:21 455,296 ------w c:\windows\system32\dllcache\mrxsmb.sys
2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
2008-10-23 12:36 286,720 ------w c:\windows\system32\dllcache\gdi32.dll
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\dllcache\wuaueng.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\dllcache\wuapi.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\dllcache\wucltui.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\dllcache\cdm.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\dllcache\wuauclt.exe
2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\dllcache\wups.dll
2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-16 01:01 670,208 ----a-w c:\windows\system32\wininet.dll
2008-10-16 01:01 670,208 ------w c:\windows\system32\dllcache\wininet.dll
2008-10-16 01:01 620,544 ------w c:\windows\system32\dllcache\urlmon.dll
2008-10-16 01:01 1,499,648 ------w c:\windows\system32\dllcache\shdocvw.dll
2008-10-15 16:35 337,408 ------w c:\windows\system32\dllcache\netapi32.dll
2008-10-03 10:03 247,326 ----a-w c:\windows\system32\strmdll.dll
2008-10-03 10:03 247,326 ------w c:\windows\system32\dllcache\strmdll.dll
2006-12-08 17:02 4,096 ----a-w c:\documents and settings\Sébastien Habillon\log.dat
2006-12-08 17:02 4,096 ----a-w c:\documents and settings\Sébastien Habillon\log.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{10B294F2-F790-A3F0-54A6-6005D1C61B79}]
c:\docume~1\SBASTI~1\APPLIC~1\[u]0[/u]1JOY\COOLFACE.exe [BU]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Ahead\lib\NMBgMonitor.exe" [2006-02-01 98304]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2005-11-15 1204224]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-04 68856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-22 339968]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-02-02 102492]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-02-02 692316]
"eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-12-03 290816]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 253952]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2005-02-17 233534]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2006-01-12 155648]
"2 creative chin cake"="c:\documents and settings\All Users\Application Data\1 proc 2 creative\sect ping.exe" [BU]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-11-07 111936]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2008-08-25 1168264]
"MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2008-04-14 172544]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 c:\windows\system32\bthprops.cpl]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv"="grpconv -o" [X]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [BU]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"<NO NAME>"=
"c:\\Program Files\\Azureus\\Azureus.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2008-12-21 356920]
S1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-09-19 111184]
S1 navigator;navigator;\systemroot\fd.dll []
S1 pctfw2;pctfw2;\??\c:\windows\system32\drivers\pctfw2.sys [2008-12-26 160792]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-09-19 20560]
S3 HSFHWATI;HSFHWATI;c:\windows\system32\DRIVERS\HSFHWATI.sys [2005-03-22 200192]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\LaunchU3.exe -a
*Newly Created Service* - PROCEXP90
.
Contenu du dossier 'Tâches planifiées'
2008-12-15 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
- - - - ORPHELINS SUPPRIMES - - - -
HKLM-RunOnce-<NO NAME> - (no file)
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=Q305&bd=pavilion&pf=laptop
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=Q305&bd=pavilion&pf=laptop
uInternet Settings,ProxyOverride = *.local;<local>
uInternet Settings,ProxyServer = http=127.0.0.1:9090
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
LSP: c:\program files\Fichiers communs\PC Tools\LSP\PCTLsp.dll
FF - ProfilePath - c:\documents and settings\Sébastien Habillon\Application Data\Mozilla\Firefox\Profiles\6broo1pe.default\
FF - prefs.js: browser.startup.homepage - hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=Q305&bd=pavilion&pf=laptop
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 9090
FF - prefs.js: network.proxy.type - 1
FF - plugin: c:\program files\Yahoo!\Common\npyaxmpb.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-26 22:37:02
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????????P??|?????? ???B?????????????hLC? ??????
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(204)
c:\windows\system32\Ati2evxx.dll
.
Heure de fin: 2008-12-26 22:39:23
ComboFix-quarantined-files.txt 2008-12-26 21:38:16
ComboFix2.txt 2008-12-23 19:04:20
Avant-CF: 28,527,448,064 octets libres
Après-CF: 28,513,525,760 octets libres
239 --- E O F --- 2008-12-19 02:01:22
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:35:25, on 2008-12-27
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Safe mode
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\SBASTI~1\LOCALS~1\Temp\Rar$EX02.844\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/...
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:9090
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {10B294F2-F790-A3F0-54A6-6005D1C61B79} - C:\DOCUME~1\SBASTI~1\APPLIC~1\01JOY\COOLFACE.exe (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [2 creative chin cake] C:\Documents and Settings\All Users\Application Data\1 proc 2 creative\sect ping.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\RunOnce: [ashMaiSv] C:\PROGRA~1\ALWILS~1\Avast4\ashMaiSv.exe /i
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/...
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: PsExec (PSEXESVC) - Unknown owner - C:\WINDOWS\PSEXESVC.EXE (file missing)
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
Scan saved at 18:35:25, on 2008-12-27
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Safe mode
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\SBASTI~1\LOCALS~1\Temp\Rar$EX02.844\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/...
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:9090
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {10B294F2-F790-A3F0-54A6-6005D1C61B79} - C:\DOCUME~1\SBASTI~1\APPLIC~1\01JOY\COOLFACE.exe (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [2 creative chin cake] C:\Documents and Settings\All Users\Application Data\1 proc 2 creative\sect ping.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\RunOnce: [ashMaiSv] C:\PROGRA~1\ALWILS~1\Avast4\ashMaiSv.exe /i
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/...
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: PsExec (PSEXESVC) - Unknown owner - C:\WINDOWS\PSEXESVC.EXE (file missing)
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
Fais un scan en ligne avec Kaspersky
http://www.kaspersky.com/kos/eng/partner/default/languages/english/check.html?n=122493174237512345
Clique sur > Accept.
Il est possible qu’ une barre jaune te demande d’ installer le
Kavwebscan_Unicode.cab (ActiveX) ; installe-le.
Clique une nouvelle fois sur > Accept.
Les mises à jour vont s’ installer. Patiente un moment.
Clique sur > Next.
Clique sur > My Computer. Le scan va commencer.
Attends la fin du scan (ne ferme pas la fenêtre, sinon il va stopper).
Une fois le scan achevé, poste le rapport.
Utilise Internet Explorer pour le scan.
A+
http://www.kaspersky.com/kos/eng/partner/default/languages/english/check.html?n=122493174237512345
Clique sur > Accept.
Il est possible qu’ une barre jaune te demande d’ installer le
Kavwebscan_Unicode.cab (ActiveX) ; installe-le.
Clique une nouvelle fois sur > Accept.
Les mises à jour vont s’ installer. Patiente un moment.
Clique sur > Next.
Clique sur > My Computer. Le scan va commencer.
Attends la fin du scan (ne ferme pas la fenêtre, sinon il va stopper).
Une fois le scan achevé, poste le rapport.
Utilise Internet Explorer pour le scan.
A+
Je ne peux pas acceder à la page, ca me met:
Impossible d'afficher la page
La page que vous recherchez est actuellement indisponible. Le site Web rencontre peut-être des difficultés techniques, ou vous devez modifier les paramètres de votre navigateur.
Pour essayer de résoudre les problèmes de connexion réseau, cliquez sur Outils, puis sur "Diagnostiquer les problèmes de connexion..."
Autres options :
Cliquez sur le bouton Actualiser ou recommencez ultérieurement.
Si vous avez entré l'adresse de cette page dans la barre d'adresses, vérifiez qu'elle est correcte.
Pour vérifier vos paramètres de connexion, cliquez sur le menu Outils, puis sur Options Internet. Dans l'onglet Connexions, cliquez sur Paramètres. Les paramètres doivent correspondre à ceux fournis par votre administrateur réseau ou par votre fournisseur d'accès à Internet.
Vérifiez que vos paramètres de connexion Internet sont détectés. Vous pouvez configurer Microsoft Windows de façon à ce qu'il examine votre réseau et détecte automatiquement les paramètres de connexion (si votre administrateur réseau a activé ce paramètre).
Cliquez sur le menu Outils, puis cliquez sur Options Internet.
Dans l'onglet Connexions, cliquez sur Paramètres réseau.
Sélectionnez Détecter automatiquement les paramètres de connexion, puis cliquez sur OK.
Certains sites exigent une sécurité de connexion 128 bits. Cliquez sur le menu ? (Aide) puis sur À propos de Internet Explorer pour déterminer le niveau de cryptage installé.
Si vous tentez de joindre un site sécurisé, vérifiez que vos paramètres de sécurité le prennent en charge. Cliquez sur le menu Outils, puis cliquez sur Options Internet. Dans l'onglet Avancé, faites défiler les options jusqu'à la section de sécurité, et vérifiez les paramètres d'utilisation de SSL 2.0, SSL 3.0, TLS 1.0 et PCT 1.0.
Cliquez sur le bouton Précédente pour essayer un autre lien.
Le serveur est introuvable, ou une erreur DNS s'est produite
Internet Explorer
Impossible d'afficher la page
La page que vous recherchez est actuellement indisponible. Le site Web rencontre peut-être des difficultés techniques, ou vous devez modifier les paramètres de votre navigateur.
Pour essayer de résoudre les problèmes de connexion réseau, cliquez sur Outils, puis sur "Diagnostiquer les problèmes de connexion..."
Autres options :
Cliquez sur le bouton Actualiser ou recommencez ultérieurement.
Si vous avez entré l'adresse de cette page dans la barre d'adresses, vérifiez qu'elle est correcte.
Pour vérifier vos paramètres de connexion, cliquez sur le menu Outils, puis sur Options Internet. Dans l'onglet Connexions, cliquez sur Paramètres. Les paramètres doivent correspondre à ceux fournis par votre administrateur réseau ou par votre fournisseur d'accès à Internet.
Vérifiez que vos paramètres de connexion Internet sont détectés. Vous pouvez configurer Microsoft Windows de façon à ce qu'il examine votre réseau et détecte automatiquement les paramètres de connexion (si votre administrateur réseau a activé ce paramètre).
Cliquez sur le menu Outils, puis cliquez sur Options Internet.
Dans l'onglet Connexions, cliquez sur Paramètres réseau.
Sélectionnez Détecter automatiquement les paramètres de connexion, puis cliquez sur OK.
Certains sites exigent une sécurité de connexion 128 bits. Cliquez sur le menu ? (Aide) puis sur À propos de Internet Explorer pour déterminer le niveau de cryptage installé.
Si vous tentez de joindre un site sécurisé, vérifiez que vos paramètres de sécurité le prennent en charge. Cliquez sur le menu Outils, puis cliquez sur Options Internet. Dans l'onglet Avancé, faites défiler les options jusqu'à la section de sécurité, et vérifiez les paramètres d'utilisation de SSL 2.0, SSL 3.0, TLS 1.0 et PCT 1.0.
Cliquez sur le bouton Précédente pour essayer un autre lien.
Le serveur est introuvable, ou une erreur DNS s'est produite
Internet Explorer
essaye ici
--https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
Antonio Giacomo Stradivari, souvent appelé Stradivarius (Crémone, 1644 - Crémone, 18 décembre 1737
Le Soil (1714), considéré par beaucoup comme le meilleur instrument du monde.
peu de temps avant sa mort il cherchait encore...
--https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
Antonio Giacomo Stradivari, souvent appelé Stradivarius (Crémone, 1644 - Crémone, 18 décembre 1737
Le Soil (1714), considéré par beaucoup comme le meilleur instrument du monde.
peu de temps avant sa mort il cherchait encore...
je peux pas le telecharger sur cle usb donc ca va pas j'ai pas internet sur mon ordi portable qui a des virus
