Infection ! Comment se débarrasser de NTBS...
Résolu
Uenyan
-
chimay8 Messages postés 7947 Statut Contributeur sécurité -
chimay8 Messages postés 7947 Statut Contributeur sécurité -
Salut à tous ! ! !
Il y a un programme (NTBS investigators flight recorder (black box) analyzer)
qui empêche l'exécution de mon antivirus (Antivir Personnal Edition Classic), même celle de HijackThis. Il bloque aussi l'installation d'un quelconque antivirus...
Je suis donc passé par RSIT qui a produit ce log HijackThis...
Vous êtes mon dernier espoir :'(
_____________________________________________________________________________________________
Logfile of random's system information tool 1.05 (written by random/random)
Run by Mr KONE D at 2008-12-28 11:43:57
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 31 GB (52%) free of 60 GB
Total RAM: 503 MB (39% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:55:03, on 15/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\StkASv2K.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Topro\tppoll.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Microsoft Office\Office12\WINWORD.EXE
D:\nakados\NAKI (F)\log\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ci/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\2.bin\MWSSRCAS.DLL
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\2.bin\MWSSRCAS.DLL
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: UrlHelper Class - {6D023EBF-70B8-45A6-9ED5-556515FA0FE4} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: HP Smart Web Printing 1.0 - {AE84A6AA-A333-4B92-B276-C11E2212E4FE} - C:\Program Files\HP\Smart Web Printing\SmartWebPrinting.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BSMediaBar.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [tppoll] C:\Program Files\Topro\tppoll.exe
O4 - HKLM\..\Run: [UVS10 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio SE DVD\uvPL.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [messengerskinner] C:\Documents and Settings\Mr KONE D\Bureau\poupou\MessengerSkinner\MessengerSkinner.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: SYSTRAN: &Effacer le cache de traduction - C:\Program Files\Systran\Premium\menuClearCache.html
O8 - Extra context menu item: SYSTRAN: &Options - C:\Program Files\Systran\Premium\menuConfigure.html
O8 - Extra context menu item: SYSTRAN: &Traduire - C:\Program Files\Systran\Premium\menuTranslate.html
O8 - Extra context menu item: SYSTRAN: En®istrement - C:\Program Files\Systran\Premium\menuRegister.html
O8 - Extra context menu item: SYSTRAN: Rechercher les &mises à jour - C:\Program Files\Systran\Premium\menuUpdate.html
O8 - Extra context menu item: SYSTRAN: Traduire les &cadres - C:\Program Files\Systran\Premium\menuTranslateAll.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: @sysiecom.dll,-2100 - {703436F1-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program Files\Systran\Premium\MenuTranslate.html
O9 - Extra 'Tools' menuitem: @sysiecom.dll,-2102 - {703436F1-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program Files\Systran\Premium\MenuTranslate.html
O9 - Extra button: @sysiecom.dll,-2103 - {703436F2-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program Files\Systran\Premium\MenuTranslateAll.html
O9 - Extra 'Tools' menuitem: @sysiecom.dll,-2105 - {703436F2-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program Files\Systran\Premium\MenuTranslateAll.html
O9 - Extra button: @sysiecom.dll,-2115 - {703436F3-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program Files\Systran\Premium\MenuConfigure.html
O9 - Extra 'Tools' menuitem: @sysiecom.dll,-2117 - {703436F3-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program Files\Systran\Premium\MenuConfigure.html
O9 - Extra button: (no name) - {703436F4-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program Files\Systran\Premium\MenuClearCache.html
O9 - Extra 'Tools' menuitem: @sysiecom.dll,-2108 - {703436F4-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program Files\Systran\Premium\MenuClearCache.html
O9 - Extra button: (no name) - {703436F5-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program Files\Systran\Premium\MenuRegister.html
O9 - Extra 'Tools' menuitem: @sysiecom.dll,-2111 - {703436F5-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program Files\Systran\Premium\MenuRegister.html
O9 - Extra button: (no name) - {703436F6-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program Files\Systran\Premium\MenuUpdates.html (file missing)
O9 - Extra 'Tools' menuitem: @sysiecom.dll,-2114 - {703436F6-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program Files\Systran\Premium\MenuUpdates.html (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} (CPlayFirstddfotgControl Object) - file:///C:/Documents%20and%20Settings/Mr%20KONE%20D/Local%20Settings/Application%20Data/Oberon%20Media/Oberon%20Games%20Host/ddfotg.1.0.0.37.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://gamenextfr.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{56DF2432-5DF6-45C3-B07C-4E2EF8479C95}: NameServer = 213.136.96.2 213.136.96.37
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: Syntek STK1160 Service (StkASSrv) - Syntek America Inc. - C:\WINDOWS\System32\StkASv2K.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
Il y a un programme (NTBS investigators flight recorder (black box) analyzer)
qui empêche l'exécution de mon antivirus (Antivir Personnal Edition Classic), même celle de HijackThis. Il bloque aussi l'installation d'un quelconque antivirus...
Je suis donc passé par RSIT qui a produit ce log HijackThis...
Vous êtes mon dernier espoir :'(
_____________________________________________________________________________________________
Logfile of random's system information tool 1.05 (written by random/random)
Run by Mr KONE D at 2008-12-28 11:43:57
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 31 GB (52%) free of 60 GB
Total RAM: 503 MB (39% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:55:03, on 15/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\StkASv2K.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Topro\tppoll.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Microsoft Office\Office12\WINWORD.EXE
D:\nakados\NAKI (F)\log\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ci/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\2.bin\MWSSRCAS.DLL
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\2.bin\MWSSRCAS.DLL
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: UrlHelper Class - {6D023EBF-70B8-45A6-9ED5-556515FA0FE4} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: HP Smart Web Printing 1.0 - {AE84A6AA-A333-4B92-B276-C11E2212E4FE} - C:\Program Files\HP\Smart Web Printing\SmartWebPrinting.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BSMediaBar.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [tppoll] C:\Program Files\Topro\tppoll.exe
O4 - HKLM\..\Run: [UVS10 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio SE DVD\uvPL.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [messengerskinner] C:\Documents and Settings\Mr KONE D\Bureau\poupou\MessengerSkinner\MessengerSkinner.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: SYSTRAN: &Effacer le cache de traduction - C:\Program Files\Systran\Premium\menuClearCache.html
O8 - Extra context menu item: SYSTRAN: &Options - C:\Program Files\Systran\Premium\menuConfigure.html
O8 - Extra context menu item: SYSTRAN: &Traduire - C:\Program Files\Systran\Premium\menuTranslate.html
O8 - Extra context menu item: SYSTRAN: En®istrement - C:\Program Files\Systran\Premium\menuRegister.html
O8 - Extra context menu item: SYSTRAN: Rechercher les &mises à jour - C:\Program Files\Systran\Premium\menuUpdate.html
O8 - Extra context menu item: SYSTRAN: Traduire les &cadres - C:\Program Files\Systran\Premium\menuTranslateAll.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: @sysiecom.dll,-2100 - {703436F1-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program Files\Systran\Premium\MenuTranslate.html
O9 - Extra 'Tools' menuitem: @sysiecom.dll,-2102 - {703436F1-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program Files\Systran\Premium\MenuTranslate.html
O9 - Extra button: @sysiecom.dll,-2103 - {703436F2-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program Files\Systran\Premium\MenuTranslateAll.html
O9 - Extra 'Tools' menuitem: @sysiecom.dll,-2105 - {703436F2-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program Files\Systran\Premium\MenuTranslateAll.html
O9 - Extra button: @sysiecom.dll,-2115 - {703436F3-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program Files\Systran\Premium\MenuConfigure.html
O9 - Extra 'Tools' menuitem: @sysiecom.dll,-2117 - {703436F3-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program Files\Systran\Premium\MenuConfigure.html
O9 - Extra button: (no name) - {703436F4-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program Files\Systran\Premium\MenuClearCache.html
O9 - Extra 'Tools' menuitem: @sysiecom.dll,-2108 - {703436F4-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program Files\Systran\Premium\MenuClearCache.html
O9 - Extra button: (no name) - {703436F5-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program Files\Systran\Premium\MenuRegister.html
O9 - Extra 'Tools' menuitem: @sysiecom.dll,-2111 - {703436F5-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program Files\Systran\Premium\MenuRegister.html
O9 - Extra button: (no name) - {703436F6-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program Files\Systran\Premium\MenuUpdates.html (file missing)
O9 - Extra 'Tools' menuitem: @sysiecom.dll,-2114 - {703436F6-3E1F-11d3-8F6B-00105A2A1D59} - C:\Program Files\Systran\Premium\MenuUpdates.html (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} (CPlayFirstddfotgControl Object) - file:///C:/Documents%20and%20Settings/Mr%20KONE%20D/Local%20Settings/Application%20Data/Oberon%20Media/Oberon%20Games%20Host/ddfotg.1.0.0.37.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://gamenextfr.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{56DF2432-5DF6-45C3-B07C-4E2EF8479C95}: NameServer = 213.136.96.2 213.136.96.37
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: Syntek STK1160 Service (StkASSrv) - Syntek America Inc. - C:\WINDOWS\System32\StkASv2K.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
A voir également:
- Infection ! Comment se débarrasser de NTBS...
- Comment se débarrasser de copilot - Accueil - Intelligence artificielle
- Comment se débarrasser de mcafee - Guide
- Comment se débarrasser du rond bleu sur whatsapp - Guide
- Comment se débarrasser des publicités - Guide
- Comment se débarrasser de onedrive - Guide
53 réponses
Ok pour ToolsCleaner
[ Rapport ToolsCleaner version 2.2.9 (par A.Rothstein & dj QUIOU) ]
-->- Recherche:
C:\fixnavi.txt: trouvé !
C:\cleannavi.txt: trouvé !
C:\lopR.txt: trouvé !
C:\FindyKill.txt: trouvé !
C:\UsbFix.txt: trouvé !
C:\avenger: trouvé !
C:\Lop SD: trouvé !
C:\Qoobox: trouvé !
C:\Rsit: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1\Navilog1.lnk: trouvé !
C:\Documents and Settings\Mr KONE D\Bureau\logo\LopSD.exe: trouvé !
C:\Documents and Settings\Mr KONE D\Bureau\logo\Clean.zip: trouvé !
C:\Documents and Settings\Mr KONE D\Bureau\logo\Navilog1.exe: trouvé !
C:\Documents and Settings\Mr KONE D\Bureau\logo\Navilog1.lnk: trouvé !
C:\Documents and Settings\Mr KONE D\Bureau\logo\hijackthis.log: trouvé !
C:\Documents and Settings\Mr KONE D\Bureau\logo\OAD.exe: trouvé !
C:\Documents and Settings\Mr KONE D\Bureau\logo\UsbFix.exe: trouvé !
C:\Documents and Settings\Mr KONE D\Bureau\logo\UsbFix.lnk: trouvé !
C:\Documents and Settings\Mr KONE D\Bureau\logo\Rsit.exe: trouvé !
C:\Documents and Settings\Mr KONE D\Menu Démarrer\Programmes\UsbFix: trouvé !
C:\Documents and Settings\Mr KONE D\Menu Démarrer\Programmes\FindyKill: trouvé !
C:\Documents and Settings\Mr KONE D\Menu Démarrer\Programmes\UsbFix\UsbFix.lnk: trouvé !
C:\Program Files\HijackThis: trouvé !
C:\Program Files\Navilog1: trouvé !
C:\Program Files\UsbFix: trouvé !
C:\Program Files\FindyKill: trouvé !
C:\Program Files\HiJackThis\HijackThis.exe: trouvé !
C:\Program Files\HiJackThis\hijackthis.log: trouvé !
C:\Program Files\Navilog1\Navilog1.bat: trouvé !
C:\Program Files\UsbFix\Tools\NIRCMD.exe: trouvé !
---------------------------------
-->- Suppression:
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1\Navilog1.lnk: supprimé !
C:\Documents and Settings\Mr KONE D\Bureau\logo\LopSD.exe: supprimé !
C:\Documents and Settings\Mr KONE D\Bureau\logo\Clean.zip: supprimé !
C:\Documents and Settings\Mr KONE D\Bureau\logo\Navilog1.exe: supprimé !
C:\Documents and Settings\Mr KONE D\Bureau\logo\Navilog1.lnk: supprimé !
C:\Program Files\HiJackThis\HijackThis.exe: supprimé !
C:\Program Files\Navilog1\Navilog1.bat: supprimé !
C:\fixnavi.txt: supprimé !
C:\cleannavi.txt: supprimé !
C:\lopR.txt: supprimé !
C:\FindyKill.txt: supprimé !
C:\UsbFix.txt: supprimé !
C:\Documents and Settings\Mr KONE D\Bureau\logo\hijackthis.log: supprimé !
C:\Documents and Settings\Mr KONE D\Bureau\logo\OAD.exe: supprimé !
C:\Documents and Settings\Mr KONE D\Bureau\logo\UsbFix.exe: supprimé !
C:\Documents and Settings\Mr KONE D\Bureau\logo\UsbFix.lnk: supprimé !
C:\Documents and Settings\Mr KONE D\Bureau\logo\Rsit.exe: supprimé !
C:\Documents and Settings\Mr KONE D\Menu Démarrer\Programmes\UsbFix\UsbFix.lnk: supprimé !
C:\Program Files\HiJackThis\hijackthis.log: supprimé !
C:\Program Files\UsbFix\Tools\NIRCMD.exe: supprimé !
C:\avenger: ERREUR DE SUPPRESSION !!
C:\Lop SD: supprimé !
C:\Qoobox: supprimé !
C:\Rsit: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1: supprimé !
C:\Documents and Settings\Mr KONE D\Menu Démarrer\Programmes\UsbFix: supprimé !
C:\Documents and Settings\Mr KONE D\Menu Démarrer\Programmes\FindyKill: supprimé !
C:\Program Files\HijackThis: supprimé !
C:\Program Files\Navilog1: ERREUR DE SUPPRESSION !!
C:\Program Files\UsbFix: supprimé !
C:\Program Files\FindyKill: supprimé !
Fichiers temporaires nettoyés !
Corbeille vidée!
[ Rapport ToolsCleaner version 2.2.9 (par A.Rothstein & dj QUIOU) ]
-->- Recherche:
C:\fixnavi.txt: trouvé !
C:\cleannavi.txt: trouvé !
C:\lopR.txt: trouvé !
C:\FindyKill.txt: trouvé !
C:\UsbFix.txt: trouvé !
C:\avenger: trouvé !
C:\Lop SD: trouvé !
C:\Qoobox: trouvé !
C:\Rsit: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1\Navilog1.lnk: trouvé !
C:\Documents and Settings\Mr KONE D\Bureau\logo\LopSD.exe: trouvé !
C:\Documents and Settings\Mr KONE D\Bureau\logo\Clean.zip: trouvé !
C:\Documents and Settings\Mr KONE D\Bureau\logo\Navilog1.exe: trouvé !
C:\Documents and Settings\Mr KONE D\Bureau\logo\Navilog1.lnk: trouvé !
C:\Documents and Settings\Mr KONE D\Bureau\logo\hijackthis.log: trouvé !
C:\Documents and Settings\Mr KONE D\Bureau\logo\OAD.exe: trouvé !
C:\Documents and Settings\Mr KONE D\Bureau\logo\UsbFix.exe: trouvé !
C:\Documents and Settings\Mr KONE D\Bureau\logo\UsbFix.lnk: trouvé !
C:\Documents and Settings\Mr KONE D\Bureau\logo\Rsit.exe: trouvé !
C:\Documents and Settings\Mr KONE D\Menu Démarrer\Programmes\UsbFix: trouvé !
C:\Documents and Settings\Mr KONE D\Menu Démarrer\Programmes\FindyKill: trouvé !
C:\Documents and Settings\Mr KONE D\Menu Démarrer\Programmes\UsbFix\UsbFix.lnk: trouvé !
C:\Program Files\HijackThis: trouvé !
C:\Program Files\Navilog1: trouvé !
C:\Program Files\UsbFix: trouvé !
C:\Program Files\FindyKill: trouvé !
C:\Program Files\HiJackThis\HijackThis.exe: trouvé !
C:\Program Files\HiJackThis\hijackthis.log: trouvé !
C:\Program Files\Navilog1\Navilog1.bat: trouvé !
C:\Program Files\UsbFix\Tools\NIRCMD.exe: trouvé !
---------------------------------
-->- Suppression:
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1\Navilog1.lnk: supprimé !
C:\Documents and Settings\Mr KONE D\Bureau\logo\LopSD.exe: supprimé !
C:\Documents and Settings\Mr KONE D\Bureau\logo\Clean.zip: supprimé !
C:\Documents and Settings\Mr KONE D\Bureau\logo\Navilog1.exe: supprimé !
C:\Documents and Settings\Mr KONE D\Bureau\logo\Navilog1.lnk: supprimé !
C:\Program Files\HiJackThis\HijackThis.exe: supprimé !
C:\Program Files\Navilog1\Navilog1.bat: supprimé !
C:\fixnavi.txt: supprimé !
C:\cleannavi.txt: supprimé !
C:\lopR.txt: supprimé !
C:\FindyKill.txt: supprimé !
C:\UsbFix.txt: supprimé !
C:\Documents and Settings\Mr KONE D\Bureau\logo\hijackthis.log: supprimé !
C:\Documents and Settings\Mr KONE D\Bureau\logo\OAD.exe: supprimé !
C:\Documents and Settings\Mr KONE D\Bureau\logo\UsbFix.exe: supprimé !
C:\Documents and Settings\Mr KONE D\Bureau\logo\UsbFix.lnk: supprimé !
C:\Documents and Settings\Mr KONE D\Bureau\logo\Rsit.exe: supprimé !
C:\Documents and Settings\Mr KONE D\Menu Démarrer\Programmes\UsbFix\UsbFix.lnk: supprimé !
C:\Program Files\HiJackThis\hijackthis.log: supprimé !
C:\Program Files\UsbFix\Tools\NIRCMD.exe: supprimé !
C:\avenger: ERREUR DE SUPPRESSION !!
C:\Lop SD: supprimé !
C:\Qoobox: supprimé !
C:\Rsit: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1: supprimé !
C:\Documents and Settings\Mr KONE D\Menu Démarrer\Programmes\UsbFix: supprimé !
C:\Documents and Settings\Mr KONE D\Menu Démarrer\Programmes\FindyKill: supprimé !
C:\Program Files\HijackThis: supprimé !
C:\Program Files\Navilog1: ERREUR DE SUPPRESSION !!
C:\Program Files\UsbFix: supprimé !
C:\Program Files\FindyKill: supprimé !
Fichiers temporaires nettoyés !
Corbeille vidée!
Pour la 2ème étape
(Supprime Combofix ainsi :
~>Clique sur " Démarrer " ~> " Exécuter "( ou combine la touche Windows + R ) -> copie/colle cette ligne :
ComboFix /u
( laisse l'espace entre Combofix et /u )
~>Valide .)
On dit que ComboFix n'est pas une application Win32 valide...
_________________________________________
voici le rapport FindyKill
----------------- FindyKill V4.710 ------------------
* User : Mr KONE D - KONE
* executed from : C:\Program Files\FindyKill
* Update on 21/12/08 par Chiquitine29
* Start at 12:39:02 the 31/12/2008
* Windows XP - Internet Explorer 7.0.5730.13
((((((((((((((( *** deleting *** ))))))))))))))))))
--------------- [ Active Processes ] ----------------
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Family Safety\fsssvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\StkASv2K.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
--------------- [ Infected files / folders ] ----------------
»»»» Supression files in C:
»»»» Supression files in C:\WINDOWS
»»»» Supression files in C:\WINDOWS\Prefetch
»»»» Supression files in C:\WINDOWS\system32
»»»» Supression files in C:\WINDOWS\system32\config\systemprofile\AppData\Roaming
»»»» Supression files in C:\WINDOWS\system32\drivers
Not deleted !! - C:\WINDOWS\system32\drivers\srosa.sys
Deleted ! - C:\WINDOWS\system32\drivers\srosa2.sys
»»»» Supression files in C:\Documents and Settings\Mr KONE D\Application Data
Not deleted !! - "C:\Documents and Settings\Mr KONE D\Application Data\m\flec006.exe"
Not deleted !! - "C:\Documents and Settings\Mr KONE D\Application Data\m"
Not deleted !! - "C:\Documents and Settings\Mr KONE D\Application Data\drivers\srosa.sys"
Deleted ! - "C:\Documents and Settings\Mr KONE D\Application Data\drivers\downld"
Not deleted !! - "C:\Documents and Settings\Mr KONE D\Application Data\drivers"
»»»» Supression files in C:\DOCUME~1\MRKONE~1\LOCALS~1\Temp
»»»» Supression files in C:\Documents and Settings\Mr KONE D\Local Settings\Temporary Internet Files\Content.IE5
--------------- [ Registry / Infected keys ] ----------------
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srosa
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\srosa
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA
Deleted ! - HKEY_CURRENT_CONFIG\System\CurrentControlSet\Enum\ROOT\LEGACY_SROSA
--------------- [ States / Restarting of services ] ----------------
+- Services : [ Auto=2 / Request=3 / Disable=4 ]
Ndisuio - Type of startup = 3
EapHost - Type of startup = 2
Ip6Fw - Type of startup = 2
SharedAccess - Type of startup = 2
wuauserv - Type of startup = 2
wscsvc - Type of startup = 2
--------------- [ Cleaning removable drives ] ----------------
+- Informations :
C: - Lecteur fixe
D: - Lecteur fixe
+- deleting files :
--------------- [ Registry / Mountpoint2 ] ----------------
-> Not found !
--------------- [ Searching Cracks / Keygen ] ----------------
---------------- ! End of report ! ------------------
(Supprime Combofix ainsi :
~>Clique sur " Démarrer " ~> " Exécuter "( ou combine la touche Windows + R ) -> copie/colle cette ligne :
ComboFix /u
( laisse l'espace entre Combofix et /u )
~>Valide .)
On dit que ComboFix n'est pas une application Win32 valide...
_________________________________________
voici le rapport FindyKill
----------------- FindyKill V4.710 ------------------
* User : Mr KONE D - KONE
* executed from : C:\Program Files\FindyKill
* Update on 21/12/08 par Chiquitine29
* Start at 12:39:02 the 31/12/2008
* Windows XP - Internet Explorer 7.0.5730.13
((((((((((((((( *** deleting *** ))))))))))))))))))
--------------- [ Active Processes ] ----------------
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Family Safety\fsssvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\StkASv2K.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
--------------- [ Infected files / folders ] ----------------
»»»» Supression files in C:
»»»» Supression files in C:\WINDOWS
»»»» Supression files in C:\WINDOWS\Prefetch
»»»» Supression files in C:\WINDOWS\system32
»»»» Supression files in C:\WINDOWS\system32\config\systemprofile\AppData\Roaming
»»»» Supression files in C:\WINDOWS\system32\drivers
Not deleted !! - C:\WINDOWS\system32\drivers\srosa.sys
Deleted ! - C:\WINDOWS\system32\drivers\srosa2.sys
»»»» Supression files in C:\Documents and Settings\Mr KONE D\Application Data
Not deleted !! - "C:\Documents and Settings\Mr KONE D\Application Data\m\flec006.exe"
Not deleted !! - "C:\Documents and Settings\Mr KONE D\Application Data\m"
Not deleted !! - "C:\Documents and Settings\Mr KONE D\Application Data\drivers\srosa.sys"
Deleted ! - "C:\Documents and Settings\Mr KONE D\Application Data\drivers\downld"
Not deleted !! - "C:\Documents and Settings\Mr KONE D\Application Data\drivers"
»»»» Supression files in C:\DOCUME~1\MRKONE~1\LOCALS~1\Temp
»»»» Supression files in C:\Documents and Settings\Mr KONE D\Local Settings\Temporary Internet Files\Content.IE5
--------------- [ Registry / Infected keys ] ----------------
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srosa
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\srosa
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA
Deleted ! - HKEY_CURRENT_CONFIG\System\CurrentControlSet\Enum\ROOT\LEGACY_SROSA
--------------- [ States / Restarting of services ] ----------------
+- Services : [ Auto=2 / Request=3 / Disable=4 ]
Ndisuio - Type of startup = 3
EapHost - Type of startup = 2
Ip6Fw - Type of startup = 2
SharedAccess - Type of startup = 2
wuauserv - Type of startup = 2
wscsvc - Type of startup = 2
--------------- [ Cleaning removable drives ] ----------------
+- Informations :
C: - Lecteur fixe
D: - Lecteur fixe
+- deleting files :
--------------- [ Registry / Mountpoint2 ] ----------------
-> Not found !
--------------- [ Searching Cracks / Keygen ] ----------------
---------------- ! End of report ! ------------------
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
Voici le rapport Combofix
ComboFix 08-12-30.02 - Mr KONE D 2008-12-31 16:53:36.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.503.278 [GMT 0:00]
Lancé depuis: C:\Documents and Settings\Mr KONE D\Bureau\logo\MaSauce3.exe
Commutateurs utilisés :: C:\Documents and Settings\Mr KONE D\Bureau\logo\WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
* Un nouveau point de restauration a été créé
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Mr KONE D\Application Data\drivers\srosa.sys
C:\Documents and Settings\Mr KONE D\Application Data\m
C:\Documents and Settings\Mr KONE D\Application Data\m\flec006.exe
C:\Documents
C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\drivers\srosa.sys
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_SROSA
-------\Legacy_SROSA
-------\Legacy_BOONTY_GAMES
-------\Service_Boonty Games
((((((((((((((((((((((((((((( Fichiers créés du 2008-11-28 au 2008-12-31 ))))))))))))))))))))))))))))))))))))
.
2008-12-31 12:34 . 2008-12-31 12:41 <REP> d-------- C:\Program Files\FindyKill
2008-12-30 16:50 . 2008-12-30 16:50 <REP> d-------- C:\Program Files\CCleaner
2008-12-30 15:35 . 2008-12-31 16:39 <REP> d-------- C:\MaSauce1
2008-12-30 14:00 . 2008-12-30 14:08 <REP> d-------- C:\Program Files\SecondLife
2008-12-28 17:44 . 2008-12-27 13:18 81,920 --a------ C:\WINDOWS\system\clipsrv.exe
2008-12-28 16:43 . 2008-12-28 16:43 <REP> d-------- C:\Documents and Settings\Mr KONE D\Application Data\Malwarebytes
2008-12-28 16:42 . 2008-12-28 16:42 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-12-28 16:42 . 2008-12-28 16:42 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-12-28 16:42 . 2008-12-03 19:52 38,496 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-12-28 16:42 . 2008-12-03 19:52 15,504 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-12-28 14:05 . 2008-12-31 12:25 <REP> d-------- C:\Program Files\Navilog1
2008-12-27 20:01 . 2008-12-27 13:18 81,920 --a------ C:\WINDOWS\logman.exe
2008-12-27 13:31 . 2008-12-31 16:51 <REP> d--h----- C:\Documents and Settings\Mr KONE D\Application Data\drivers
2008-12-27 13:18 . 2008-12-27 13:18 81,920 --a------ C:\WINDOWS\system\logman.exe
2008-12-27 13:18 . 2008-12-27 13:18 81,920 --a------ C:\Documents and Settings\Mr KONE D\Application Data\logman.exe
2008-12-25 23:20 . 2008-12-25 23:20 <REP> d-------- C:\Documents and Settings\Mr KONE D\Application Data\KompoZer
2008-12-23 09:33 . 2008-12-25 03:12 <REP> d-------- C:\Program Files\Angels Online
2008-12-19 19:54 . 2008-12-19 19:54 <REP> d-------- C:\Program Files\Microsoft Office Outlook Connector
2008-12-19 19:53 . 2008-12-08 17:01 55,136 --a------ C:\WINDOWS\system32\drivers\fssfltr_tdi.sys
2008-12-19 19:51 . 2008-12-19 19:54 <REP> d-------- C:\Program Files\Microsoft
2008-12-19 19:50 . 2008-12-19 19:50 <REP> d-------- C:\Program Files\Windows Live SkyDrive
2008-12-15 01:17 . 2008-12-15 01:17 <REP> d-------- C:\Documents and Settings\Mr KONE D\Application Data\Livestation
2008-12-15 01:15 . 2008-12-15 01:15 <REP> d-------- C:\Documents and Settings\Mr KONE D\Livestation
2008-12-15 01:14 . 2008-12-15 01:14 <REP> d-------- C:\Program Files\OpenAL
2008-12-15 01:14 . 2008-12-22 23:18 <REP> d-------- C:\Program Files\Livestation
2008-12-15 01:14 . 2008-12-15 01:14 413,696 --a------ C:\WINDOWS\system32\wrap_oal.dll
2008-12-15 01:14 . 2008-12-15 01:14 110,592 --a------ C:\WINDOWS\system32\OpenAL32.dll
2008-12-14 20:04 . 2008-12-14 20:04 <REP> d-------- C:\WINDOWS\SQLTools9_KB954606_ENU
2008-12-14 20:01 . 2008-12-14 20:01 <REP> d-------- C:\WINDOWS\SQL9_KB954606_ENU
2008-12-13 21:15 . 2008-12-14 20:05 <REP> d-------- C:\Program Files\Microsoft SQL Server
2008-12-13 21:05 . 2008-12-13 21:05 <REP> d-------- C:\Program Files\Microsoft Synchronization Services
2008-12-13 21:05 . 2008-12-13 21:05 <REP> d-------- C:\Program Files\Microsoft SQL Server Compact Edition
2008-12-09 23:07 . 2008-12-14 13:32 <REP> d-------- C:\Documents and Settings\Mr KONE D\Application Data\vlc
2008-12-07 09:20 . 2008-12-07 09:20 <REP> d--h----- C:\WINDOWS\PIF
2008-12-02 22:37 . 2008-12-02 22:37 49,480 --a------ C:\WINDOWS\system32\sirenacm.dll
2008-11-29 11:36 . 2008-11-29 11:36 410,976 --a------ C:\WINDOWS\system32\deploytk.dll
2008-11-26 18:15 . 2008-12-13 14:53 <REP> d-------- C:\Documents and Settings\Mr KONE D\Application Data\FileZilla
2008-11-21 23:04 . 2008-12-20 21:27 <REP> d-------- C:\Program Files\Dofus
2008-11-21 16:33 . 2008-11-21 16:35 <REP> d-------- C:\Program Files\TeamSpeak3
2008-11-20 22:59 . 2008-11-20 22:59 <REP> d-------- C:\Program Files\Trymedia
2008-11-18 16:49 . 2008-12-27 14:19 <REP> d-------- C:\Program Files\eMule
2008-11-17 18:04 . 2008-12-31 16:58 <REP> d-------- C:\Documents and Settings\Mr KONE D\Tracing
2008-11-17 17:55 . 2008-09-04 22:03 56,344 --a------ C:\WINDOWS\system32\drivers\fssfltr.sys
2008-11-17 17:10 . 2008-11-17 17:10 <REP> d-------- C:\Program Files\Fichiers communs\Windows Live
2008-11-15 14:56 . 2008-11-15 14:56 0 --a------ C:\WINDOWS\popcinfo.dat
2008-11-15 12:16 . 2008-10-16 14:06 268,648 --a------ C:\WINDOWS\system32\mucltui.dll
2008-11-15 12:16 . 2008-10-16 14:06 208,744 --a------ C:\WINDOWS\system32\muweb.dll
2008-11-15 12:16 . 2008-10-16 14:06 27,496 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-11-15 09:21 . 2008-11-17 17:55 <REP> d-------- C:\Program Files\Windows Live
2008-11-15 09:21 . 2008-11-15 09:24 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-11-15 09:21 . 2008-11-15 09:21 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-11-15 08:55 . 2008-11-16 17:49 <REP> d-------- C:\Documents and Settings\Mr KONE D\Application Data\Ulead Systems
2008-11-14 20:52 . 2008-11-14 20:52 <REP> d-------- C:\WINDOWS\system32\windows media
2008-11-14 20:51 . 2008-11-14 20:52 <REP> d--h----- C:\WINDOWS\msdownld.tmp
2008-11-14 20:48 . 2008-11-14 20:48 <REP> d-------- C:\Documents and Settings\All Users\Application Data\InstallShield
2008-11-14 20:47 . 2008-11-14 20:47 <REP> d-------- C:\Program Files\Windows Media Components
2008-11-14 20:45 . 2008-11-14 20:45 <REP> d-------- C:\Program Files\Ulead Systems
2008-11-14 20:45 . 2008-11-14 20:45 <REP> d-------- C:\Program Files\Fichiers communs\Ulead Systems
2008-11-14 20:45 . 2008-11-15 08:55 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Ulead Systems
2008-11-14 20:10 . 2008-04-14 02:33 54,784 --a------ C:\WINDOWS\system32\vfwwdm32.dll
2008-11-14 20:10 . 2008-04-14 02:33 54,784 --a--c--- C:\WINDOWS\system32\dllcache\vfwwdm32.dll
2008-11-14 20:09 . 2008-04-14 02:34 92,160 --a------ C:\WINDOWS\system32\kswdmcap.ax
2008-11-14 20:09 . 2008-04-14 02:34 92,160 --a--c--- C:\WINDOWS\system32\dllcache\kswdmcap.ax
2008-11-14 20:09 . 2008-04-14 02:34 61,952 --a------ C:\WINDOWS\system32\kstvtune.ax
2008-11-14 20:09 . 2008-04-14 02:34 61,952 --a--c--- C:\WINDOWS\system32\dllcache\kstvtune.ax
2008-11-14 20:09 . 2008-04-14 02:34 43,008 --a------ C:\WINDOWS\system32\ksxbar.ax
2008-11-14 20:09 . 2008-04-14 02:34 43,008 --a--c--- C:\WINDOWS\system32\dllcache\ksxbar.ax
2008-11-14 20:09 . 2008-04-14 02:34 20,992 --a------ C:\WINDOWS\system32\dshowext.ax
2008-11-14 20:09 . 2008-04-14 02:34 20,992 --a--c--- C:\WINDOWS\system32\dllcache\dshowext.ax
2008-11-13 07:40 . 2008-11-13 07:40 <REP> d-------- C:\Documents and Settings\All Users\Application Data\HP Product Assistant
2008-11-12 14:16 . 2008-09-04 17:16 1,106,944 -----c--- C:\WINDOWS\system32\dllcache\msxml3.dll
2008-11-12 14:16 . 2008-10-24 11:21 455,296 -----c--- C:\WINDOWS\system32\dllcache\mrxsmb.sys
2008-11-12 10:44 . 2008-11-12 10:44 268 --ah----- C:\sqmdata00.sqm
2008-11-12 10:44 . 2008-11-12 10:44 244 --ah----- C:\sqmnoopt00.sqm
2008-11-07 18:24 . 2008-11-13 07:40 <REP> d-------- C:\Documents and Settings\Mr KONE D\Application Data\U3
2008-11-07 17:21 . 2008-11-13 07:40 <REP> d-------- C:\Program Files\solarus
2008-11-07 17:20 . 2008-11-07 17:20 <REP> dr-h----- C:\Documents and Settings\Mr KONE D\Application Data\SecuROM
2008-11-06 21:51 . 2008-04-14 02:33 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2008-11-06 21:51 . 2001-08-23 17:47 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-31 11:28 --------- d-----w C:\Program Files\Yahoo!
2008-12-30 22:03 --------- d-----w C:\Documents and Settings\Mr KONE D\Application Data\gtk-2.0
2008-12-30 14:07 --------- d-----w C:\Documents and Settings\Mr KONE D\Application Data\SecondLife
2008-12-30 11:49 --------- d-----w C:\Documents and Settings\Mr KONE D\Application Data\Zylom
2008-12-23 22:16 --------- d-----w C:\Program Files\Google
2008-12-14 14:34 --------- d-----w C:\Documents and Settings\Mr KONE D\Application Data\dvdcss
2008-12-13 21:24 --------- d-----w C:\Program Files\Microsoft.NET
2008-12-13 21:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-12-13 21:06 --------- d-----w C:\Program Files\Microsoft Visual Studio 9.0
2008-12-11 18:19 --------- d-----w C:\Program Files\Zylom Games
2008-12-09 21:37 --------- d-----w C:\Program Files\FileZilla FTP Client
2008-12-03 22:25 --------- d-----w C:\Documents and Settings\Mr KONE D\Application Data\Image Zone Express
2008-11-29 11:35 --------- d-----w C:\Program Files\Java
2008-11-26 18:35 --------- d-----w C:\Documents and Settings\Mr KONE D\Application Data\codeblocks
2008-11-24 11:28 --------- d-----w C:\Program Files\Zelda Return of the Hylian
2008-11-23 14:42 --------- d-----w C:\Program Files\Zelda Oni Link Begins
2008-11-15 21:50 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-11-15 19:34 --------- d-----w C:\Program Files\Fichiers communs\Teleca Shared
2008-11-15 13:11 --------- d-----w C:\Program Files\Fichiers communs\Autodesk Shared
2008-11-15 13:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Autodesk
2008-11-14 20:48 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-11-14 20:45 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-11-13 14:31 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-11-13 07:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\BigFishGamesCache
2008-11-12 20:28 --------- d-----w C:\Program Files\CodeBlocks
2008-10-01 00:23 74,752 ----a-w C:\WINDOWS\ST6UNST.EXE
2008-10-01 00:23 253,952 ------w C:\WINDOWS\Setup1.exe
2008-08-30 08:28 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008081820080825\index.dat
2008-08-30 08:28 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008083020080831\index.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 02:33 15360]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2008-12-02 22:41 3882312]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [2007-08-30 17:43 4670704]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-09-16 13:56 68856]
"Livestation"="C:\Program Files\Livestation\Livestation.exe" [2008-11-11 15:36 2019328]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 02:32 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 02:36 114688]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2007-03-01 14:57 153136]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-09-20 08:51 1836328]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 21:52 49152]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-12-31 12:40 266497]
"SunJavaUpdateSched"="C:\Program Files\Java\jre6\bin\jusched.exe" [2008-11-29 11:36 136600]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 02:38 34672]
"tppoll"="C:\Program Files\Topro\tppoll.exe" [2005-03-02 17:12 24576]
"UVS10 Preload"="C:\Program Files\Ulead Systems\Ulead VideoStudio SE DVD\uvPL.exe" [2006-08-09 13:27 36864]
"fssui"="C:\Program Files\Windows Live\Family Safety\fsui.exe" [2008-12-08 17:01 453984]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 02:33 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
"Logman"="C:\WINDOWS\System\logman.exe" [2008-12-27 13:18 81920]
[HKEY_CURRENT_USER\software\microsoft\windows\Currentversion\policies\explorer\Run]
"DllHst"="C:\DOCUME~1\MRKONE~1\LOCALS~1\APPLIC~1\dllhst3g.exe" [2008-12-27 13:18 81920]
[HKEY_USERS\.DEFAULT\software\microsoft\windows\Currentversion\policies\explorer\Run]
"ClipSrv"="C:\WINDOWS\System\clipsrv.exe" [2008-12-27 13:18 81920]
C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-08-22 19:54:03 1205840]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2007-01-02 21:40:10 210520]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.dvacm"= C:\PROGRA~1\FICHIE~1\ULEADS~1\Vio\Dvacm.acm
"msacm.MPEGacm"= C:\PROGRA~1\FICHIE~1\ULEADS~1\MPEG\MPEGacm.acm
"msacm.ulmp3acm"= C:\PROGRA~1\FICHIE~1\ULEADS~1\MPEG\ulmp3acm.acm
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
-ra------ 2005-09-20 02:35 94208 C:\WINDOWS\system32\igfxtray.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Fichiers communs\\Nero\\Nero Web\\SetupX.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
R2 fssfltr;FssFltr;C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys [2008-12-19 19:53:00 55136]
R2 fsssvc;Windows Live Contrôle parental;"C:\Program Files\Windows Live\Family Safety\fsssvc.exe" [2008-12-08 17:01:58 533344]
R3 DCamUSBIntel;120 Video Camera;C:\WINDOWS\system32\Drivers\TP6800.sys [2008-10-02 12:28:15 197556]
R3 e4usbaw;USB ADSL2 WAN Adapter;C:\WINDOWS\system32\DRIVERS\e4usbaw.sys [2008-08-22 19:54:04 104344]
S2 E4LOADER;General Purpose USB Driver (e4ldr.sys);C:\WINDOWS\system32\Drivers\e4ldr.sys [2008-08-22 19:54:01 69656]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contenu du dossier 'Tâches planifiées'
2008-12-31 C:\WINDOWS\Tasks\20080822_160400_Mr KONE D.job
- C:\Program Files\Nero\Nero8\Nero BackItUp\BackItUp.exe [2007-09-20 08:50]
.
- - - - ORPHELINS SUPPRIMES - - - -
HKCU-Run-BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
HKLM-Run-Cmaudio - cmicnfg.cpl
.
------- Examen supplémentaire -------
.
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xporter vers Microsoft Excel - C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: SYSTRAN: &Effacer le cache de traduction - C:\Program Files\Systran\Premium\menuClearCache.html
IE: SYSTRAN: &Options - C:\Program Files\Systran\Premium\menuConfigure.html
IE: SYSTRAN: &Traduire - C:\Program Files\Systran\Premium\menuTranslate.html
IE: SYSTRAN: En®istrement - C:\Program Files\Systran\Premium\menuRegister.html
IE: SYSTRAN: Rechercher les &mises à jour - C:\Program Files\Systran\Premium\menuUpdate.html
IE: SYSTRAN: Traduire les &cadres - C:\Program Files\Systran\Premium\menuTranslateAll.html
FF - ProfilePath - C:\Documents and Settings\Mr KONE D\Application Data\Mozilla\Firefox\Profiles\t46wcuca.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.ci
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt=fr-FR&FORM=MIMWA2&q=
FF - plugin: C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - plugin: C:\Documents and Settings\Mr KONE D\Application Data\Mozilla\Firefox\Profiles\t46wcuca.default\extensions\OberonGameHost@OberonGames.com\platform\WINNT_x86-msvc\plugins\npOberonGameHost.dll
FF - plugin: C:\Program Files\Microsoft Silverlight\2.0.31005.0\npctrl.1.0.20926.0.dll
FF - plugin: C:\Program Files\Microsoft Silverlight\2.0.31005.0\npctrl.dll
FF - plugin: C:\Program Files\Microsoft\Office Live\npOLW.dll
FF - plugin: C:\Program Files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
FF - plugin: C:\Program Files\Yahoo!\Shared\npYState.dll
.
ComboFix 08-12-30.02 - Mr KONE D 2008-12-31 16:53:36.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.503.278 [GMT 0:00]
Lancé depuis: C:\Documents and Settings\Mr KONE D\Bureau\logo\MaSauce3.exe
Commutateurs utilisés :: C:\Documents and Settings\Mr KONE D\Bureau\logo\WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
* Un nouveau point de restauration a été créé
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Mr KONE D\Application Data\drivers\srosa.sys
C:\Documents and Settings\Mr KONE D\Application Data\m
C:\Documents and Settings\Mr KONE D\Application Data\m\flec006.exe
C:\Documents
C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\drivers\srosa.sys
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_SROSA
-------\Legacy_SROSA
-------\Legacy_BOONTY_GAMES
-------\Service_Boonty Games
((((((((((((((((((((((((((((( Fichiers créés du 2008-11-28 au 2008-12-31 ))))))))))))))))))))))))))))))))))))
.
2008-12-31 12:34 . 2008-12-31 12:41 <REP> d-------- C:\Program Files\FindyKill
2008-12-30 16:50 . 2008-12-30 16:50 <REP> d-------- C:\Program Files\CCleaner
2008-12-30 15:35 . 2008-12-31 16:39 <REP> d-------- C:\MaSauce1
2008-12-30 14:00 . 2008-12-30 14:08 <REP> d-------- C:\Program Files\SecondLife
2008-12-28 17:44 . 2008-12-27 13:18 81,920 --a------ C:\WINDOWS\system\clipsrv.exe
2008-12-28 16:43 . 2008-12-28 16:43 <REP> d-------- C:\Documents and Settings\Mr KONE D\Application Data\Malwarebytes
2008-12-28 16:42 . 2008-12-28 16:42 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-12-28 16:42 . 2008-12-28 16:42 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-12-28 16:42 . 2008-12-03 19:52 38,496 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-12-28 16:42 . 2008-12-03 19:52 15,504 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-12-28 14:05 . 2008-12-31 12:25 <REP> d-------- C:\Program Files\Navilog1
2008-12-27 20:01 . 2008-12-27 13:18 81,920 --a------ C:\WINDOWS\logman.exe
2008-12-27 13:31 . 2008-12-31 16:51 <REP> d--h----- C:\Documents and Settings\Mr KONE D\Application Data\drivers
2008-12-27 13:18 . 2008-12-27 13:18 81,920 --a------ C:\WINDOWS\system\logman.exe
2008-12-27 13:18 . 2008-12-27 13:18 81,920 --a------ C:\Documents and Settings\Mr KONE D\Application Data\logman.exe
2008-12-25 23:20 . 2008-12-25 23:20 <REP> d-------- C:\Documents and Settings\Mr KONE D\Application Data\KompoZer
2008-12-23 09:33 . 2008-12-25 03:12 <REP> d-------- C:\Program Files\Angels Online
2008-12-19 19:54 . 2008-12-19 19:54 <REP> d-------- C:\Program Files\Microsoft Office Outlook Connector
2008-12-19 19:53 . 2008-12-08 17:01 55,136 --a------ C:\WINDOWS\system32\drivers\fssfltr_tdi.sys
2008-12-19 19:51 . 2008-12-19 19:54 <REP> d-------- C:\Program Files\Microsoft
2008-12-19 19:50 . 2008-12-19 19:50 <REP> d-------- C:\Program Files\Windows Live SkyDrive
2008-12-15 01:17 . 2008-12-15 01:17 <REP> d-------- C:\Documents and Settings\Mr KONE D\Application Data\Livestation
2008-12-15 01:15 . 2008-12-15 01:15 <REP> d-------- C:\Documents and Settings\Mr KONE D\Livestation
2008-12-15 01:14 . 2008-12-15 01:14 <REP> d-------- C:\Program Files\OpenAL
2008-12-15 01:14 . 2008-12-22 23:18 <REP> d-------- C:\Program Files\Livestation
2008-12-15 01:14 . 2008-12-15 01:14 413,696 --a------ C:\WINDOWS\system32\wrap_oal.dll
2008-12-15 01:14 . 2008-12-15 01:14 110,592 --a------ C:\WINDOWS\system32\OpenAL32.dll
2008-12-14 20:04 . 2008-12-14 20:04 <REP> d-------- C:\WINDOWS\SQLTools9_KB954606_ENU
2008-12-14 20:01 . 2008-12-14 20:01 <REP> d-------- C:\WINDOWS\SQL9_KB954606_ENU
2008-12-13 21:15 . 2008-12-14 20:05 <REP> d-------- C:\Program Files\Microsoft SQL Server
2008-12-13 21:05 . 2008-12-13 21:05 <REP> d-------- C:\Program Files\Microsoft Synchronization Services
2008-12-13 21:05 . 2008-12-13 21:05 <REP> d-------- C:\Program Files\Microsoft SQL Server Compact Edition
2008-12-09 23:07 . 2008-12-14 13:32 <REP> d-------- C:\Documents and Settings\Mr KONE D\Application Data\vlc
2008-12-07 09:20 . 2008-12-07 09:20 <REP> d--h----- C:\WINDOWS\PIF
2008-12-02 22:37 . 2008-12-02 22:37 49,480 --a------ C:\WINDOWS\system32\sirenacm.dll
2008-11-29 11:36 . 2008-11-29 11:36 410,976 --a------ C:\WINDOWS\system32\deploytk.dll
2008-11-26 18:15 . 2008-12-13 14:53 <REP> d-------- C:\Documents and Settings\Mr KONE D\Application Data\FileZilla
2008-11-21 23:04 . 2008-12-20 21:27 <REP> d-------- C:\Program Files\Dofus
2008-11-21 16:33 . 2008-11-21 16:35 <REP> d-------- C:\Program Files\TeamSpeak3
2008-11-20 22:59 . 2008-11-20 22:59 <REP> d-------- C:\Program Files\Trymedia
2008-11-18 16:49 . 2008-12-27 14:19 <REP> d-------- C:\Program Files\eMule
2008-11-17 18:04 . 2008-12-31 16:58 <REP> d-------- C:\Documents and Settings\Mr KONE D\Tracing
2008-11-17 17:55 . 2008-09-04 22:03 56,344 --a------ C:\WINDOWS\system32\drivers\fssfltr.sys
2008-11-17 17:10 . 2008-11-17 17:10 <REP> d-------- C:\Program Files\Fichiers communs\Windows Live
2008-11-15 14:56 . 2008-11-15 14:56 0 --a------ C:\WINDOWS\popcinfo.dat
2008-11-15 12:16 . 2008-10-16 14:06 268,648 --a------ C:\WINDOWS\system32\mucltui.dll
2008-11-15 12:16 . 2008-10-16 14:06 208,744 --a------ C:\WINDOWS\system32\muweb.dll
2008-11-15 12:16 . 2008-10-16 14:06 27,496 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-11-15 09:21 . 2008-11-17 17:55 <REP> d-------- C:\Program Files\Windows Live
2008-11-15 09:21 . 2008-11-15 09:24 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-11-15 09:21 . 2008-11-15 09:21 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-11-15 08:55 . 2008-11-16 17:49 <REP> d-------- C:\Documents and Settings\Mr KONE D\Application Data\Ulead Systems
2008-11-14 20:52 . 2008-11-14 20:52 <REP> d-------- C:\WINDOWS\system32\windows media
2008-11-14 20:51 . 2008-11-14 20:52 <REP> d--h----- C:\WINDOWS\msdownld.tmp
2008-11-14 20:48 . 2008-11-14 20:48 <REP> d-------- C:\Documents and Settings\All Users\Application Data\InstallShield
2008-11-14 20:47 . 2008-11-14 20:47 <REP> d-------- C:\Program Files\Windows Media Components
2008-11-14 20:45 . 2008-11-14 20:45 <REP> d-------- C:\Program Files\Ulead Systems
2008-11-14 20:45 . 2008-11-14 20:45 <REP> d-------- C:\Program Files\Fichiers communs\Ulead Systems
2008-11-14 20:45 . 2008-11-15 08:55 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Ulead Systems
2008-11-14 20:10 . 2008-04-14 02:33 54,784 --a------ C:\WINDOWS\system32\vfwwdm32.dll
2008-11-14 20:10 . 2008-04-14 02:33 54,784 --a--c--- C:\WINDOWS\system32\dllcache\vfwwdm32.dll
2008-11-14 20:09 . 2008-04-14 02:34 92,160 --a------ C:\WINDOWS\system32\kswdmcap.ax
2008-11-14 20:09 . 2008-04-14 02:34 92,160 --a--c--- C:\WINDOWS\system32\dllcache\kswdmcap.ax
2008-11-14 20:09 . 2008-04-14 02:34 61,952 --a------ C:\WINDOWS\system32\kstvtune.ax
2008-11-14 20:09 . 2008-04-14 02:34 61,952 --a--c--- C:\WINDOWS\system32\dllcache\kstvtune.ax
2008-11-14 20:09 . 2008-04-14 02:34 43,008 --a------ C:\WINDOWS\system32\ksxbar.ax
2008-11-14 20:09 . 2008-04-14 02:34 43,008 --a--c--- C:\WINDOWS\system32\dllcache\ksxbar.ax
2008-11-14 20:09 . 2008-04-14 02:34 20,992 --a------ C:\WINDOWS\system32\dshowext.ax
2008-11-14 20:09 . 2008-04-14 02:34 20,992 --a--c--- C:\WINDOWS\system32\dllcache\dshowext.ax
2008-11-13 07:40 . 2008-11-13 07:40 <REP> d-------- C:\Documents and Settings\All Users\Application Data\HP Product Assistant
2008-11-12 14:16 . 2008-09-04 17:16 1,106,944 -----c--- C:\WINDOWS\system32\dllcache\msxml3.dll
2008-11-12 14:16 . 2008-10-24 11:21 455,296 -----c--- C:\WINDOWS\system32\dllcache\mrxsmb.sys
2008-11-12 10:44 . 2008-11-12 10:44 268 --ah----- C:\sqmdata00.sqm
2008-11-12 10:44 . 2008-11-12 10:44 244 --ah----- C:\sqmnoopt00.sqm
2008-11-07 18:24 . 2008-11-13 07:40 <REP> d-------- C:\Documents and Settings\Mr KONE D\Application Data\U3
2008-11-07 17:21 . 2008-11-13 07:40 <REP> d-------- C:\Program Files\solarus
2008-11-07 17:20 . 2008-11-07 17:20 <REP> dr-h----- C:\Documents and Settings\Mr KONE D\Application Data\SecuROM
2008-11-06 21:51 . 2008-04-14 02:33 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2008-11-06 21:51 . 2001-08-23 17:47 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-31 11:28 --------- d-----w C:\Program Files\Yahoo!
2008-12-30 22:03 --------- d-----w C:\Documents and Settings\Mr KONE D\Application Data\gtk-2.0
2008-12-30 14:07 --------- d-----w C:\Documents and Settings\Mr KONE D\Application Data\SecondLife
2008-12-30 11:49 --------- d-----w C:\Documents and Settings\Mr KONE D\Application Data\Zylom
2008-12-23 22:16 --------- d-----w C:\Program Files\Google
2008-12-14 14:34 --------- d-----w C:\Documents and Settings\Mr KONE D\Application Data\dvdcss
2008-12-13 21:24 --------- d-----w C:\Program Files\Microsoft.NET
2008-12-13 21:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-12-13 21:06 --------- d-----w C:\Program Files\Microsoft Visual Studio 9.0
2008-12-11 18:19 --------- d-----w C:\Program Files\Zylom Games
2008-12-09 21:37 --------- d-----w C:\Program Files\FileZilla FTP Client
2008-12-03 22:25 --------- d-----w C:\Documents and Settings\Mr KONE D\Application Data\Image Zone Express
2008-11-29 11:35 --------- d-----w C:\Program Files\Java
2008-11-26 18:35 --------- d-----w C:\Documents and Settings\Mr KONE D\Application Data\codeblocks
2008-11-24 11:28 --------- d-----w C:\Program Files\Zelda Return of the Hylian
2008-11-23 14:42 --------- d-----w C:\Program Files\Zelda Oni Link Begins
2008-11-15 21:50 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-11-15 19:34 --------- d-----w C:\Program Files\Fichiers communs\Teleca Shared
2008-11-15 13:11 --------- d-----w C:\Program Files\Fichiers communs\Autodesk Shared
2008-11-15 13:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Autodesk
2008-11-14 20:48 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-11-14 20:45 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-11-13 14:31 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-11-13 07:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\BigFishGamesCache
2008-11-12 20:28 --------- d-----w C:\Program Files\CodeBlocks
2008-10-01 00:23 74,752 ----a-w C:\WINDOWS\ST6UNST.EXE
2008-10-01 00:23 253,952 ------w C:\WINDOWS\Setup1.exe
2008-08-30 08:28 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008081820080825\index.dat
2008-08-30 08:28 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008083020080831\index.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 02:33 15360]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2008-12-02 22:41 3882312]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [2007-08-30 17:43 4670704]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-09-16 13:56 68856]
"Livestation"="C:\Program Files\Livestation\Livestation.exe" [2008-11-11 15:36 2019328]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 02:32 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 02:36 114688]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2007-03-01 14:57 153136]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-09-20 08:51 1836328]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 21:52 49152]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-12-31 12:40 266497]
"SunJavaUpdateSched"="C:\Program Files\Java\jre6\bin\jusched.exe" [2008-11-29 11:36 136600]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 02:38 34672]
"tppoll"="C:\Program Files\Topro\tppoll.exe" [2005-03-02 17:12 24576]
"UVS10 Preload"="C:\Program Files\Ulead Systems\Ulead VideoStudio SE DVD\uvPL.exe" [2006-08-09 13:27 36864]
"fssui"="C:\Program Files\Windows Live\Family Safety\fsui.exe" [2008-12-08 17:01 453984]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 02:33 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
"Logman"="C:\WINDOWS\System\logman.exe" [2008-12-27 13:18 81920]
[HKEY_CURRENT_USER\software\microsoft\windows\Currentversion\policies\explorer\Run]
"DllHst"="C:\DOCUME~1\MRKONE~1\LOCALS~1\APPLIC~1\dllhst3g.exe" [2008-12-27 13:18 81920]
[HKEY_USERS\.DEFAULT\software\microsoft\windows\Currentversion\policies\explorer\Run]
"ClipSrv"="C:\WINDOWS\System\clipsrv.exe" [2008-12-27 13:18 81920]
C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-08-22 19:54:03 1205840]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2007-01-02 21:40:10 210520]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.dvacm"= C:\PROGRA~1\FICHIE~1\ULEADS~1\Vio\Dvacm.acm
"msacm.MPEGacm"= C:\PROGRA~1\FICHIE~1\ULEADS~1\MPEG\MPEGacm.acm
"msacm.ulmp3acm"= C:\PROGRA~1\FICHIE~1\ULEADS~1\MPEG\ulmp3acm.acm
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
-ra------ 2005-09-20 02:35 94208 C:\WINDOWS\system32\igfxtray.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Fichiers communs\\Nero\\Nero Web\\SetupX.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
R2 fssfltr;FssFltr;C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys [2008-12-19 19:53:00 55136]
R2 fsssvc;Windows Live Contrôle parental;"C:\Program Files\Windows Live\Family Safety\fsssvc.exe" [2008-12-08 17:01:58 533344]
R3 DCamUSBIntel;120 Video Camera;C:\WINDOWS\system32\Drivers\TP6800.sys [2008-10-02 12:28:15 197556]
R3 e4usbaw;USB ADSL2 WAN Adapter;C:\WINDOWS\system32\DRIVERS\e4usbaw.sys [2008-08-22 19:54:04 104344]
S2 E4LOADER;General Purpose USB Driver (e4ldr.sys);C:\WINDOWS\system32\Drivers\e4ldr.sys [2008-08-22 19:54:01 69656]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contenu du dossier 'Tâches planifiées'
2008-12-31 C:\WINDOWS\Tasks\20080822_160400_Mr KONE D.job
- C:\Program Files\Nero\Nero8\Nero BackItUp\BackItUp.exe [2007-09-20 08:50]
.
- - - - ORPHELINS SUPPRIMES - - - -
HKCU-Run-BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
HKLM-Run-Cmaudio - cmicnfg.cpl
.
------- Examen supplémentaire -------
.
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xporter vers Microsoft Excel - C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: SYSTRAN: &Effacer le cache de traduction - C:\Program Files\Systran\Premium\menuClearCache.html
IE: SYSTRAN: &Options - C:\Program Files\Systran\Premium\menuConfigure.html
IE: SYSTRAN: &Traduire - C:\Program Files\Systran\Premium\menuTranslate.html
IE: SYSTRAN: En®istrement - C:\Program Files\Systran\Premium\menuRegister.html
IE: SYSTRAN: Rechercher les &mises à jour - C:\Program Files\Systran\Premium\menuUpdate.html
IE: SYSTRAN: Traduire les &cadres - C:\Program Files\Systran\Premium\menuTranslateAll.html
FF - ProfilePath - C:\Documents and Settings\Mr KONE D\Application Data\Mozilla\Firefox\Profiles\t46wcuca.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.ci
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt=fr-FR&FORM=MIMWA2&q=
FF - plugin: C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - plugin: C:\Documents and Settings\Mr KONE D\Application Data\Mozilla\Firefox\Profiles\t46wcuca.default\extensions\OberonGameHost@OberonGames.com\platform\WINNT_x86-msvc\plugins\npOberonGameHost.dll
FF - plugin: C:\Program Files\Microsoft Silverlight\2.0.31005.0\npctrl.1.0.20926.0.dll
FF - plugin: C:\Program Files\Microsoft Silverlight\2.0.31005.0\npctrl.dll
FF - plugin: C:\Program Files\Microsoft\Office Live\npOLW.dll
FF - plugin: C:\Program Files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
FF - plugin: C:\Program Files\Yahoo!\Shared\npYState.dll
.
super,
combo a bien travailler
Pour supprimer les outils/fix utilisés :
Télécharge ToolsCleaner sur ton bureau.
--> http://pc-system.fr/
# Clique sur "Recherche" et laisse le scan agir ...
# Clique sur "Suppression" pour finaliser.
# Tu peux, si tu le souhaites, te servir des Options facultatives.
# Clique sur Quitter pour obtenir le rapport.
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).
ensuite
**désactive ton antivirus, logiciels de protections et logiciels pouvant bloquer les popups (barres Google, barres Yahoo etc..).**
Ouvre internet explorer --> Outils --> Options internet --> onglet "sécurité" --> Valide "niveau par défaut".
Toujours sur Internet explorer --> Outils --> Options internet --> onglet "avancé" --> valide "Paramètres par défaut".
Scan en ligne avec Kaspersky :
- https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr en utilisant Internet Explorer et pas Firefox, ça ne marchera pas!.
- Si tu es perdu, tu peux suivre l'aide pour les scans en ligne https://www.malekal.com/scan-antivirus-ligne-nod32/#mozTocId291566
AIDE : Configurer le contrôle des ActiveX < http://www.inoculer.com/activex.php3 >
Tuto ici si problème : http://www.vista-xp.fr/forum/topic109.html , ou là : https://forum.pcastuces.com/sujet.asp?f=25&s=37641 (par Morgane & nico_dodo)
- Au moment de choisir la cible à analyser, clique sur le bouton Paramètres d'analyse
- Dans la nouvelle fenêtre, coche "étendu" au milieu puis clique sur OK.
- Choisis le poste de travail dans la cible à analyser
- Copie/colle le rapport du scan ici
NOTE : Si tu reçois le message "La licence de Kaspersky On-line Scanner est périmée", va dans Ajout/Suppression de programmes puis désinstalle On-Line Scanner,
reconnecte-toi sur le site de Kaspersky pour retenter le scan en ligne.
combo a bien travailler
Pour supprimer les outils/fix utilisés :
Télécharge ToolsCleaner sur ton bureau.
--> http://pc-system.fr/
# Clique sur "Recherche" et laisse le scan agir ...
# Clique sur "Suppression" pour finaliser.
# Tu peux, si tu le souhaites, te servir des Options facultatives.
# Clique sur Quitter pour obtenir le rapport.
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).
ensuite
**désactive ton antivirus, logiciels de protections et logiciels pouvant bloquer les popups (barres Google, barres Yahoo etc..).**
Ouvre internet explorer --> Outils --> Options internet --> onglet "sécurité" --> Valide "niveau par défaut".
Toujours sur Internet explorer --> Outils --> Options internet --> onglet "avancé" --> valide "Paramètres par défaut".
Scan en ligne avec Kaspersky :
- https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr en utilisant Internet Explorer et pas Firefox, ça ne marchera pas!.
- Si tu es perdu, tu peux suivre l'aide pour les scans en ligne https://www.malekal.com/scan-antivirus-ligne-nod32/#mozTocId291566
AIDE : Configurer le contrôle des ActiveX < http://www.inoculer.com/activex.php3 >
Tuto ici si problème : http://www.vista-xp.fr/forum/topic109.html , ou là : https://forum.pcastuces.com/sujet.asp?f=25&s=37641 (par Morgane & nico_dodo)
- Au moment de choisir la cible à analyser, clique sur le bouton Paramètres d'analyse
- Dans la nouvelle fenêtre, coche "étendu" au milieu puis clique sur OK.
- Choisis le poste de travail dans la cible à analyser
- Copie/colle le rapport du scan ici
NOTE : Si tu reçois le message "La licence de Kaspersky On-line Scanner est périmée", va dans Ajout/Suppression de programmes puis désinstalle On-Line Scanner,
reconnecte-toi sur le site de Kaspersky pour retenter le scan en ligne.
Le rapport de TCleaner
[ Rapport ToolsCleaner version 2.2.9 (par A.Rothstein & dj QUIOU) ]
-->- Recherche:
C:\FindyKill.txt: trouvé !
C:\avenger: trouvé !
C:\Qoobox: trouvé !
C:\Documents and Settings\Mr KONE D\Bureau\logo\hijackthis.log: trouvé !
C:\Documents and Settings\Mr KONE D\Menu Démarrer\Programmes\FindyKill: trouvé !
C:\MaSauce3\Combofix.txt: trouvé !
C:\Program Files\Navilog1: trouvé !
C:\Program Files\FindyKill: trouvé !
C:\WINDOWS\NIRCMD.exe: trouvé !
---------------------------------
-->- Suppression:
C:\FindyKill.txt: supprimé !
C:\Documents and Settings\Mr KONE D\Bureau\logo\hijackthis.log: supprimé !
C:\MaSauce3\Combofix.txt: supprimé !
C:\WINDOWS\NIRCMD.exe: supprimé !
C:\avenger: supprimé !
C:\Qoobox: supprimé !
C:\Documents and Settings\Mr KONE D\Menu Démarrer\Programmes\FindyKill: supprimé !
C:\Program Files\Navilog1: supprimé !
C:\Program Files\FindyKill: supprimé !
[ Rapport ToolsCleaner version 2.2.9 (par A.Rothstein & dj QUIOU) ]
-->- Recherche:
C:\FindyKill.txt: trouvé !
C:\avenger: trouvé !
C:\Qoobox: trouvé !
C:\Documents and Settings\Mr KONE D\Bureau\logo\hijackthis.log: trouvé !
C:\Documents and Settings\Mr KONE D\Menu Démarrer\Programmes\FindyKill: trouvé !
C:\MaSauce3\Combofix.txt: trouvé !
C:\Program Files\Navilog1: trouvé !
C:\Program Files\FindyKill: trouvé !
C:\WINDOWS\NIRCMD.exe: trouvé !
---------------------------------
-->- Suppression:
C:\FindyKill.txt: supprimé !
C:\Documents and Settings\Mr KONE D\Bureau\logo\hijackthis.log: supprimé !
C:\MaSauce3\Combofix.txt: supprimé !
C:\WINDOWS\NIRCMD.exe: supprimé !
C:\avenger: supprimé !
C:\Qoobox: supprimé !
C:\Documents and Settings\Mr KONE D\Menu Démarrer\Programmes\FindyKill: supprimé !
C:\Program Files\Navilog1: supprimé !
C:\Program Files\FindyKill: supprimé !
Désolé pour ce retard !
Je vais clore cette discussion car un s***** a formaté mon disque dur sans ma permission... sans même sauver mes données...
:'( :'( :'(
J'espère que les tentatives de résolution précédentes aideront une autre victime de ce bagle...
Merci de m'avoir accordé un peu de votre temps chimay8, ric025, T'Chiki et jimkiller.
Je vais clore cette discussion car un s***** a formaté mon disque dur sans ma permission... sans même sauver mes données...
:'( :'( :'(
J'espère que les tentatives de résolution précédentes aideront une autre victime de ce bagle...
Merci de m'avoir accordé un peu de votre temps chimay8, ric025, T'Chiki et jimkiller.
bin moi si
regarde
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Mr KONE D\Application Data\drivers\srosa.sys
C:\Documents and Settings\Mr KONE D\Application Data\m
C:\Documents and Settings\Mr KONE D\Application Data\m\flec006.exe
C:\Documents
C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\drivers\srosa.sys
c'est ce que findykill n'a pas su enlever...
enfin bon!!
ta formaté!!
voili,voila
regarde
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Mr KONE D\Application Data\drivers\srosa.sys
C:\Documents and Settings\Mr KONE D\Application Data\m
C:\Documents and Settings\Mr KONE D\Application Data\m\flec006.exe
C:\Documents
C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\drivers\srosa.sys
c'est ce que findykill n'a pas su enlever...
enfin bon!!
ta formaté!!
voili,voila
