Win32:Trojan-gen. / Win32:Myspch - Page 2
Résolu
Précédent
- 1
- 2
-
-
ComboFix 09-02-10.01 - Moi 2009-02-10 22:38:08.2 - [color=red][b]FAT32/b/colorx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.511.296 [GMT 1:00]
Lancé depuis: c:\documents and settings\Giorgetti Laurent\Bureau\C-Fix.exe
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated)
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-01-10 au 2009-02-10 ))))))))))))))))))))))))))))))))))))
.
2009-02-10 21:07 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\mqtgsvc.exe
2009-02-10 21:06 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\cisvc.exe
2009-02-10 20:54 . 2009-01-18 20:05 81,920 --a------ c:\windows\system\clipsrv.exe
2009-02-10 20:50 . 2009-01-18 20:05 81,920 --a------ c:\documents and settings\Giorgetti Laurent\Application Data\mstsc.exe
2009-02-10 20:47 . 2009-01-18 20:05 81,920 --a------ c:\windows\system\esentutl.exe
2009-02-10 20:41 . 2009-01-18 20:05 81,920 --a------ c:\windows\rsvp.exe
2009-02-10 20:36 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\rsvp.exe
2009-02-10 20:30 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\sessmgr.exe
2009-02-10 20:28 . 2009-01-18 20:05 81,920 --a------ c:\windows\dllhst3g.exe
2009-02-10 20:23 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\mstsc.exe
2009-02-10 20:18 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\dllhst3g.exe
2009-02-10 20:18 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\comrepl.exe
2009-02-10 20:14 . 2009-01-18 20:05 81,920 --a------ c:\windows\cisvc.exe
2009-02-10 20:13 . 2009-01-18 20:05 81,920 --a------ c:\windows\system\cmstp.exe
2009-02-10 20:11 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\mstinit.exe
2009-02-10 20:09 . 2009-01-18 20:05 81,920 --a------ c:\windows\system\logman.exe
2009-02-10 20:03 . 2009-01-18 20:05 81,920 --a------ c:\documents and settings\Giorgetti Laurent\Application Data\cmstp.exe
2009-02-10 19:47 . 2009-01-18 20:05 81,920 --a------ c:\windows\system\rsvp.exe
2009-02-10 19:47 . 2009-01-18 20:05 81,920 --a------ c:\documents and settings\Giorgetti Laurent\Application Data\spoolsv.exe
2009-02-10 19:46 . 2009-01-18 20:05 81,920 --a------ c:\windows\system\dllhst3g.exe
2009-02-10 19:43 . 2009-01-18 20:05 81,920 --a------ c:\windows\logman.exe
2009-02-10 19:42 . 2009-01-18 20:05 81,920 --------- c:\windows\system32\drivers\logman.exe
2009-02-10 19:42 . 2009-01-18 20:05 81,920 --a------ c:\documents and settings\Giorgetti Laurent\Application Data\cisvc.exe
2009-02-10 19:41 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\cmstp.exe
2009-02-10 19:41 . 2009-01-18 20:05 81,920 --a------ c:\windows\system\mstsc.exe
2009-02-10 19:40 . 2009-01-18 20:05 81,920 --a------ c:\windows\mqtgsvc.exe
2009-02-10 19:37 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\ieudinit.exe
2009-02-10 19:37 . 2009-01-18 20:05 81,920 --a------ c:\documents and settings\Giorgetti Laurent\Application Data\mstinit.exe
2009-02-10 19:36 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\clipsrv.exe
2009-02-10 19:34 . 2009-01-18 20:05 81,920 --a------ c:\windows\system\mstinit.exe
2009-02-10 19:31 . 2009-01-18 20:05 81,920 --a------ c:\windows\system\cisvc.exe
2009-02-10 19:21 . 2009-01-18 20:05 81,920 --a------ c:\documents and settings\Giorgetti Laurent\Application Data\clipsrv.exe
2009-02-10 18:25 . 2009-02-10 18:25 <REP> d-------- c:\documents and settings\NetworkService\Bureau
2009-02-10 17:14 . 2003-01-21 03:00 13,112,456 -ra------ c:\documents and settings\Administrateur\MpSetup.exe
2009-02-10 17:13 . 2004-02-19 01:38 <REP> d--h----- c:\documents and settings\Administrateur\Voisinage réseau
2009-02-10 17:13 . 2004-02-19 01:38 <REP> d--h----- c:\documents and settings\Administrateur\Voisinage d'impression
2009-02-10 17:13 . 2004-02-19 01:38 <REP> d--h----- c:\documents and settings\Administrateur\Modèles
2009-02-10 17:13 . 2004-02-19 01:48 <REP> dr------- c:\documents and settings\Administrateur\Mes documents
2009-02-10 17:13 . 2004-02-19 01:38 <REP> dr------- c:\documents and settings\Administrateur\Menu Démarrer
2009-02-10 17:13 . 2004-02-19 01:48 <REP> dr------- c:\documents and settings\Administrateur\Favoris
2009-02-10 17:13 . 2004-02-19 01:38 <REP> d-------- c:\documents and settings\Administrateur\Bureau
2009-02-10 17:13 . 2009-02-10 17:13 <REP> d-------- c:\documents and settings\Administrateur
2009-02-10 08:05 . 2009-01-18 20:05 81,920 --a------ c:\windows\mstsc.exe
2009-02-10 02:35 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\esentutl.exe
2009-02-10 02:35 . 2009-01-18 20:05 81,920 --a------ c:\windows\system\comrepl.exe
2009-02-10 02:15 . 2009-01-18 20:05 81,920 --a------ c:\windows\system\sessmgr.exe
2009-02-10 01:54 . 2009-02-10 01:54 <REP> d-------- C:\rsit
2009-02-10 01:48 . 2009-02-10 01:48 <REP> d-------- c:\program files\Avira
2009-02-10 01:48 . 2009-02-10 01:48 <REP> d-------- c:\documents and settings\All Users\Application Data\Avira
2009-02-10 01:14 . 2009-02-10 01:14 <REP> d-------- c:\documents and settings\Giorgetti Laurent\Application Data\Malwarebytes
2009-02-10 01:14 . 2009-02-10 01:14 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-10 01:14 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-10 01:14 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-10 00:47 . 2009-02-10 00:47 <REP> d-------- C:\Lop SD
2009-02-09 23:46 . 2009-02-09 23:46 <REP> d-------- c:\documents and settings\All Users\Application Data\TEMP
2009-02-03 00:17 . 2009-02-02 23:54 15,688 --a------ c:\windows\system32\lsdelete.exe
2009-02-03 00:03 . 2009-02-03 00:03 <REP> d-------- c:\documents and settings\LocalService\Bureau
2009-02-02 23:54 . 2009-02-02 23:54 64,160 --a------ c:\windows\system32\drivers\Lbd.sys
2009-02-02 23:03 . 2009-02-02 23:03 <REP> d-------- c:\program files\Lavasoft
2009-02-02 23:03 . 2009-02-02 23:03 <REP> d-------- c:\documents and settings\All Users\Application Data\Lavasoft
2009-02-02 23:03 . 2009-02-02 23:03 <REP> d--h----- c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-01-24 15:01 . 2009-01-24 15:01 <REP> d-------- c:\program files\iPod
2009-01-24 15:01 . 2009-01-24 15:01 <REP> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-01-24 14:58 . 2009-01-24 14:58 <REP> d-------- c:\program files\QuickTime
2009-01-24 14:53 . 2009-01-24 14:53 <REP> d-------- c:\program files\Bonjour
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-17 17:26 --------- d-----w c:\program files\Microsoft Silverlight
2008-12-17 17:25 --------- d-----w c:\program files\Microsoft
2008-12-17 17:24 --------- d-----w c:\program files\Windows Live SkyDrive
2008-12-17 17:17 --------- d-----w c:\program files\Fichiers communs\Windows Live
2008-12-13 06:37 3,593,216 ------w c:\windows\system32\dllcache\mshtml.dll
2008-12-12 10:18 87,336 ----a-w c:\windows\system32\dns-sd.exe
2008-12-12 10:11 61,440 ----a-w c:\windows\system32\dnssd.dll
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-12-11 10:57 333,952 ------w c:\windows\system32\dllcache\srv.sys
2008-12-02 21:37 49,480 ----a-w c:\windows\system32\sirenacm.dll
2008-11-21 21:47 524,288 ----a-w c:\windows\system32\DivXsm.exe
2008-11-21 21:47 3,596,288 ----a-w c:\windows\system32\qt-dx331.dll
2008-11-21 21:46 200,704 ----a-w c:\windows\system32\ssldivx.dll
2008-11-21 21:46 1,044,480 ----a-w c:\windows\system32\libdivx.dll
2008-11-21 21:45 823,296 ----a-w c:\windows\system32\divx_xx0c.dll
2008-11-21 21:45 823,296 ----a-w c:\windows\system32\divx_xx07.dll
2008-11-21 21:45 815,104 ----a-w c:\windows\system32\divx_xx0a.dll
2008-11-21 21:45 81,920 ----a-w c:\windows\system32\dpl100.dll
2008-11-21 21:45 802,816 ----a-w c:\windows\system32\divx_xx11.dll
2008-11-21 21:45 593,920 ----a-w c:\windows\system32\dpuGUI11.dll
2008-11-21 21:45 57,344 ----a-w c:\windows\system32\dpv11.dll
2008-11-21 21:45 53,248 ----a-w c:\windows\system32\dpuGUI10.dll
2008-11-21 21:45 344,064 ----a-w c:\windows\system32\dpus11.dll
2008-11-21 21:45 294,912 ----a-w c:\windows\system32\dpu11.dll
2008-11-21 21:45 294,912 ----a-w c:\windows\system32\dpu10.dll
2008-11-21 21:45 196,608 ----a-w c:\windows\system32\dtu100.dll
2008-11-21 21:44 161,096 ----a-w c:\windows\system32\DivXCodecVersionChecker.exe
2008-11-21 21:44 12,288 ----a-w c:\windows\system32\DivXWMPExtType.dll
2008-11-10 04:43 410,984 ----a-w c:\windows\system32\deploytk.dll
2003-01-21 02:00 13,112,456 ----a-r c:\windows\system32\config\systemprofile\MpSetup.exe
2003-01-21 02:00 13,112,456 ----a-r c:\documents and settings\Giorgetti Laurent\MpSetup.exe
2003-01-21 02:00 13,112,456 ----a-r c:\documents and settings\Default User\MpSetup.exe
2008-10-04 00:53 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008100420081005\index.dat
.
((((((((((((((((((((((((((((( SnapShot@2009-02-10_21.29.11,10 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-02-10 19:08:14 195,368 ----a-w c:\windows\system32\FNTCACHE.DAT
+ 2009-02-10 21:25:12 195,368 ----a-w c:\windows\system32\FNTCACHE.DAT
+ 2009-02-10 21:25:30 16,384 ----a-w c:\windows\Temp\Perflib_Perfdata_a0.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2008-12-02 3882312]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Google Update"="c:\documents and settings\Giorgetti Laurent\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-05 133104]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="LaunApp" [X]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-01-27 335872]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2003-11-20 98304]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2003-11-20 499712]
"LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2003-04-28 184320]
"RemoteControl"="c:\sysinfo\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-21 40960]
"LaunchAp"="c:\program files\Launch Manager\LaunchAp.exe" [2004-01-28 32768]
"PowerKey"="c:\program files\Launch Manager\PowerKey.exe" [2002-08-30 94208]
"LManager"="c:\program files\Launch Manager\HotkeyApp.exe" [2004-02-04 45056]
"CtrlVol"="c:\program files\Launch Manager\CtrlVol.exe" [2004-01-28 184320]
"LMgrOSD"="c:\program files\Launch Manager\OSDCtrl.exe" [2004-02-03 49152]
"Wbutton"="c:\program files\Launch Manager\Wbutton.exe" [2004-01-30 65536]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Easy-PrintToolBox"="c:\program files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2004-01-14 409600]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="d:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-02-02 509784]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 c:\windows\system32\Ati2mdxx.exe]
"AGRSMMSG"="AGRSMMSG.exe" [2003-11-19 c:\windows\AGRSMMSG.exe]
"SoundMan"="SOUNDMAN.EXE" [2003-12-19 c:\windows\soundman.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
"Cisvc"="c:\windows\System\cisvc.exe" [2009-01-18 81920]
[HKEY_CURRENT_USER\software\microsoft\windows\Currentversion\policies\explorer\Run]
"Logman"="c:\docume~1\GIORGE~1\LOCALS~1\APPLIC~1\logman.exe" [2009-01-18 81920]
[HKEY_USERS\.DEFAULT\software\microsoft\windows\Currentversion\policies\explorer\Run]
"ComRepl"="c:\windows\System\comrepl.exe" [2009-01-18 81920]
[HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\windows]
"load"=c:\docume~1\GIORGE~1\LOCALS~1\APPLIC~1\MICROS~1\esentutl.exe
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\eMule\\emule.exe"=
"d:\\Program Files\\BitTorrent\\btdownloadgui.exe"=
"d:\\Program Files\\uTorrent\\uTorrent.exe"=
"d:\\Program Files\\Zattoo\\zattood.exe"=
"d:\\Program Files\\Zattoo\\Zattoo1.exe"=
"c:\\WINDOWS\\System32\\rtcshare.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"d:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-02-02 64160]
R1 Hotkey;Hotkey;c:\windows\system32\drivers\HOTKEY.sys [2004-02-20 9867]
R3 POWERKEY;POWERKEY;c:\program files\Launch Manager\POWERKEY.SYS [2008-08-16 2343]
S1 mailKmd;mailKmd; [x]
S1 Wbutton;Wbutton;c:\windows\system32\drivers\Wbutton.sys --> c:\windows\system32\drivers\Wbutton.sys [?]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 950096]
.
Contenu du dossier 'Tâches planifiées'
2009-01-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
2009-02-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4271046019-2757734838-2015800038-1005.job
- c:\documents and settings\Giorgetti Laurent\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-05 00:12]
2009-02-09 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-02-02 23:54]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.ch/
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Easy-WebPrint Ajouter à la liste d'impressions - d:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint Impression rapide - d:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Imprimer - d:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: Easy-WebPrint Prévisualiser - d:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-10 22:39:44
Windows 5.1.2600 Service Pack 3 FAT NTAPI
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\•€|ÿÿÿÿ"•€|þ»Ñw*]
"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(568)
c:\windows\system32\Ati2evxx.dll
.
Heure de fin: 2009-02-10 22:40:41
ComboFix-quarantined-files.txt 2009-02-10 21:40:40
ComboFix2.txt 2009-02-10 20:29:58
Avant-CF: 3 150 872 576 octets libres
Après-CF: 3,138,486,272 octets libres
227 --- E O F --- 2009-01-15 02:03:47
-
-
Re,
---> Clique sur Démarrer, Exécuter, tape notepad clique sur OK.
---> Copie le texte en gras ci-dessous par sélection puis Ctrl+C :
KillAll::
File::
c:\windows\system32\drivers\rsvp.exe
c:\windows\system\cmstp.exe
c:\windows\system\rsvp.exe
c:\windows\system\mstsc.exe
c:\windows\system32\drivers\esentutl.exe
c:\windows\system\sessmgr.exe
---> Colle la sélection dans le bloc-notes
---> Enregistre ce fichier sur le bureau (Impératif)
---> Nom du fichier : CFScript
---> Type du fichier : tous les fichiers
---> Clique sur Enregistrer
---> Quitte le bloc-notes
---> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :http://www.searchengines.pl/phpbb203/pliki/picasso/virus/programs/combofix/combofix_cfscript.gif
[*] Une fenêtre bleue va apparaître : au message qui apparaît, tu acceptes.
[*] Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal !
Ne touche à rien tant que le scan n'est pas terminé.
[*] Une fois le scan achevé, un rapport va s'afficher : poste-le
[*] Si le fichier ne s'ouvre pas, il se trouve ici C:\ComboFix.txt-
Me revoila :P
ComboFix 09-02-10.01 - Moi 2009-02-10 22:51:26.3 - [color=red][b]FAT32/b/colorx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.511.275 [GMT 1:00]
Lancé depuis: c:\documents and settings\Giorgetti Laurent\Bureau\C-Fix.exe
Commutateurs utilisés :: c:\documents and settings\Giorgetti Laurent\Bureau\CFScript.txt
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated)
* Un nouveau point de restauration a été créé
FILE ::
c:\windows\system\cmstp.exe
c:\windows\system\mstsc.exe
c:\windows\system\rsvp.exe
c:\windows\system\sessmgr.exe
c:\windows\system32\drivers\esentutl.exe
c:\windows\system32\drivers\rsvp.exe
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system\cmstp.exe
c:\windows\system\mstsc.exe
c:\windows\system\rsvp.exe
c:\windows\system\sessmgr.exe
c:\windows\system32\drivers\esentutl.exe
c:\windows\system32\drivers\rsvp.exe
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-01-10 au 2009-02-10 ))))))))))))))))))))))))))))))))))))
.
2009-02-10 22:54 . 2009-01-18 20:05 81,920 --a------ c:\windows\clipsrv.exe
2009-02-10 21:07 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\mqtgsvc.exe
2009-02-10 21:06 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\cisvc.exe
2009-02-10 20:54 . 2009-01-18 20:05 81,920 --a------ c:\windows\system\clipsrv.exe
2009-02-10 20:50 . 2009-01-18 20:05 81,920 --a------ c:\documents and settings\Giorgetti Laurent\Application Data\mstsc.exe
2009-02-10 20:47 . 2009-01-18 20:05 81,920 --a------ c:\windows\system\esentutl.exe
2009-02-10 20:41 . 2009-01-18 20:05 81,920 --a------ c:\windows\rsvp.exe
2009-02-10 20:30 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\sessmgr.exe
2009-02-10 20:28 . 2009-01-18 20:05 81,920 --a------ c:\windows\dllhst3g.exe
2009-02-10 20:23 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\mstsc.exe
2009-02-10 20:18 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\dllhst3g.exe
2009-02-10 20:18 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\comrepl.exe
2009-02-10 20:14 . 2009-01-18 20:05 81,920 --a------ c:\windows\cisvc.exe
2009-02-10 20:11 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\mstinit.exe
2009-02-10 20:09 . 2009-01-18 20:05 81,920 --a------ c:\windows\system\logman.exe
2009-02-10 20:03 . 2009-01-18 20:05 81,920 --a------ c:\documents and settings\Giorgetti Laurent\Application Data\cmstp.exe
2009-02-10 19:47 . 2009-01-18 20:05 81,920 --a------ c:\documents and settings\Giorgetti Laurent\Application Data\spoolsv.exe
2009-02-10 19:46 . 2009-01-18 20:05 81,920 --a------ c:\windows\system\dllhst3g.exe
2009-02-10 19:43 . 2009-01-18 20:05 81,920 --a------ c:\windows\logman.exe
2009-02-10 19:42 . 2009-01-18 20:05 81,920 --------- c:\windows\system32\drivers\logman.exe
2009-02-10 19:42 . 2009-01-18 20:05 81,920 --a------ c:\documents and settings\Giorgetti Laurent\Application Data\cisvc.exe
2009-02-10 19:41 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\cmstp.exe
2009-02-10 19:40 . 2009-01-18 20:05 81,920 --a------ c:\windows\mqtgsvc.exe
2009-02-10 19:37 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\ieudinit.exe
2009-02-10 19:37 . 2009-01-18 20:05 81,920 --a------ c:\documents and settings\Giorgetti Laurent\Application Data\mstinit.exe
2009-02-10 19:36 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\clipsrv.exe
2009-02-10 19:34 . 2009-01-18 20:05 81,920 --a------ c:\windows\system\mstinit.exe
2009-02-10 19:31 . 2009-01-18 20:05 81,920 --a------ c:\windows\system\cisvc.exe
2009-02-10 19:21 . 2009-01-18 20:05 81,920 --a------ c:\documents and settings\Giorgetti Laurent\Application Data\clipsrv.exe
2009-02-10 18:25 . 2009-02-10 18:25 <REP> d-------- c:\documents and settings\NetworkService\Bureau
2009-02-10 17:14 . 2003-01-21 03:00 13,112,456 -ra------ c:\documents and settings\Administrateur\MpSetup.exe
2009-02-10 17:13 . 2004-02-19 01:38 <REP> d--h----- c:\documents and settings\Administrateur\Voisinage réseau
2009-02-10 17:13 . 2004-02-19 01:38 <REP> d--h----- c:\documents and settings\Administrateur\Voisinage d'impression
2009-02-10 17:13 . 2004-02-19 01:38 <REP> d--h----- c:\documents and settings\Administrateur\Modèles
2009-02-10 17:13 . 2004-02-19 01:48 <REP> dr------- c:\documents and settings\Administrateur\Mes documents
2009-02-10 17:13 . 2004-02-19 01:38 <REP> dr------- c:\documents and settings\Administrateur\Menu Démarrer
2009-02-10 17:13 . 2004-02-19 01:48 <REP> dr------- c:\documents and settings\Administrateur\Favoris
2009-02-10 17:13 . 2004-02-19 01:38 <REP> d-------- c:\documents and settings\Administrateur\Bureau
2009-02-10 17:13 . 2009-02-10 17:13 <REP> d-------- c:\documents and settings\Administrateur
2009-02-10 08:05 . 2009-01-18 20:05 81,920 --a------ c:\windows\mstsc.exe
2009-02-10 02:35 . 2009-01-18 20:05 81,920 --a------ c:\windows\system\comrepl.exe
2009-02-10 01:54 . 2009-02-10 01:54 <REP> d-------- C:\rsit
2009-02-10 01:48 . 2009-02-10 01:48 <REP> d-------- c:\program files\Avira
2009-02-10 01:48 . 2009-02-10 01:48 <REP> d-------- c:\documents and settings\All Users\Application Data\Avira
2009-02-10 01:14 . 2009-02-10 01:14 <REP> d-------- c:\documents and settings\Giorgetti Laurent\Application Data\Malwarebytes
2009-02-10 01:14 . 2009-02-10 01:14 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-10 01:14 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-10 01:14 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-10 00:47 . 2009-02-10 00:47 <REP> d-------- C:\Lop SD
2009-02-09 23:46 . 2009-02-09 23:46 <REP> d-------- c:\documents and settings\All Users\Application Data\TEMP
2009-02-03 00:17 . 2009-02-02 23:54 15,688 --a------ c:\windows\system32\lsdelete.exe
2009-02-03 00:03 . 2009-02-03 00:03 <REP> d-------- c:\documents and settings\LocalService\Bureau
2009-02-02 23:54 . 2009-02-02 23:54 64,160 --a------ c:\windows\system32\drivers\Lbd.sys
2009-02-02 23:03 . 2009-02-02 23:03 <REP> d-------- c:\program files\Lavasoft
2009-02-02 23:03 . 2009-02-02 23:03 <REP> d-------- c:\documents and settings\All Users\Application Data\Lavasoft
2009-02-02 23:03 . 2009-02-02 23:03 <REP> d--h----- c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-01-24 15:01 . 2009-01-24 15:01 <REP> d-------- c:\program files\iPod
2009-01-24 15:01 . 2009-01-24 15:01 <REP> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-01-24 14:58 . 2009-01-24 14:58 <REP> d-------- c:\program files\QuickTime
2009-01-24 14:53 . 2009-01-24 14:53 <REP> d-------- c:\program files\Bonjour
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-17 17:26 --------- d-----w c:\program files\Microsoft Silverlight
2008-12-17 17:25 --------- d-----w c:\program files\Microsoft
2008-12-17 17:24 --------- d-----w c:\program files\Windows Live SkyDrive
2008-12-17 17:17 --------- d-----w c:\program files\Fichiers communs\Windows Live
2008-12-13 06:37 3,593,216 ------w c:\windows\system32\dllcache\mshtml.dll
2008-12-12 10:18 87,336 ----a-w c:\windows\system32\dns-sd.exe
2008-12-12 10:11 61,440 ----a-w c:\windows\system32\dnssd.dll
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-12-11 10:57 333,952 ------w c:\windows\system32\dllcache\srv.sys
2008-12-02 21:37 49,480 ----a-w c:\windows\system32\sirenacm.dll
2008-11-21 21:47 524,288 ----a-w c:\windows\system32\DivXsm.exe
2008-11-21 21:47 3,596,288 ----a-w c:\windows\system32\qt-dx331.dll
2008-11-21 21:46 200,704 ----a-w c:\windows\system32\ssldivx.dll
2008-11-21 21:46 1,044,480 ----a-w c:\windows\system32\libdivx.dll
2008-11-21 21:45 823,296 ----a-w c:\windows\system32\divx_xx0c.dll
2008-11-21 21:45 823,296 ----a-w c:\windows\system32\divx_xx07.dll
2008-11-21 21:45 815,104 ----a-w c:\windows\system32\divx_xx0a.dll
2008-11-21 21:45 81,920 ----a-w c:\windows\system32\dpl100.dll
2008-11-21 21:45 802,816 ----a-w c:\windows\system32\divx_xx11.dll
2008-11-21 21:45 593,920 ----a-w c:\windows\system32\dpuGUI11.dll
2008-11-21 21:45 57,344 ----a-w c:\windows\system32\dpv11.dll
2008-11-21 21:45 53,248 ----a-w c:\windows\system32\dpuGUI10.dll
2008-11-21 21:45 344,064 ----a-w c:\windows\system32\dpus11.dll
2008-11-21 21:45 294,912 ----a-w c:\windows\system32\dpu11.dll
2008-11-21 21:45 294,912 ----a-w c:\windows\system32\dpu10.dll
2008-11-21 21:45 196,608 ----a-w c:\windows\system32\dtu100.dll
2008-11-21 21:44 161,096 ----a-w c:\windows\system32\DivXCodecVersionChecker.exe
2008-11-21 21:44 12,288 ----a-w c:\windows\system32\DivXWMPExtType.dll
2008-11-10 04:43 410,984 ----a-w c:\windows\system32\deploytk.dll
2003-01-21 02:00 13,112,456 ----a-r c:\windows\system32\config\systemprofile\MpSetup.exe
2003-01-21 02:00 13,112,456 ----a-r c:\documents and settings\Giorgetti Laurent\MpSetup.exe
2003-01-21 02:00 13,112,456 ----a-r c:\documents and settings\Default User\MpSetup.exe
2008-10-04 00:53 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008100420081005\index.dat
.
((((((((((((((((((((((((((((( SnapShot@2009-02-10_21.29.11,10 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-02-10 19:08:14 195,368 ----a-w c:\windows\system32\FNTCACHE.DAT
+ 2009-02-10 21:25:12 195,368 ----a-w c:\windows\system32\FNTCACHE.DAT
+ 2009-02-10 21:53:50 16,384 ----a-w c:\windows\temp\Perflib_Perfdata_2e8.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2008-12-02 3882312]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Google Update"="c:\documents and settings\Giorgetti Laurent\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-05 133104]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="LaunApp" [X]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-01-27 335872]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2003-11-20 98304]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2003-11-20 499712]
"LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2003-04-28 184320]
"RemoteControl"="c:\sysinfo\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-21 40960]
"LaunchAp"="c:\program files\Launch Manager\LaunchAp.exe" [2004-01-28 32768]
"PowerKey"="c:\program files\Launch Manager\PowerKey.exe" [2002-08-30 94208]
"LManager"="c:\program files\Launch Manager\HotkeyApp.exe" [2004-02-04 45056]
"CtrlVol"="c:\program files\Launch Manager\CtrlVol.exe" [2004-01-28 184320]
"LMgrOSD"="c:\program files\Launch Manager\OSDCtrl.exe" [2004-02-03 49152]
"Wbutton"="c:\program files\Launch Manager\Wbutton.exe" [2004-01-30 65536]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Easy-PrintToolBox"="c:\program files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2004-01-14 409600]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="d:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-02-02 509784]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 c:\windows\system32\Ati2mdxx.exe]
"AGRSMMSG"="AGRSMMSG.exe" [2003-11-19 c:\windows\AGRSMMSG.exe]
"SoundMan"="SOUNDMAN.EXE" [2003-12-19 c:\windows\soundman.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
"Cisvc"="c:\windows\System\cisvc.exe" [2009-01-18 81920]
[HKEY_CURRENT_USER\software\microsoft\windows\Currentversion\policies\explorer\Run]
"Logman"="c:\docume~1\GIORGE~1\LOCALS~1\APPLIC~1\logman.exe" [2009-01-18 81920]
[HKEY_USERS\.DEFAULT\software\microsoft\windows\Currentversion\policies\explorer\Run]
"ComRepl"="c:\windows\System\comrepl.exe" [2009-01-18 81920]
[HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\windows]
"load"=c:\windows\clipsrv.exe
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\eMule\\emule.exe"=
"d:\\Program Files\\BitTorrent\\btdownloadgui.exe"=
"d:\\Program Files\\uTorrent\\uTorrent.exe"=
"d:\\Program Files\\Zattoo\\zattood.exe"=
"d:\\Program Files\\Zattoo\\Zattoo1.exe"=
"c:\\WINDOWS\\System32\\rtcshare.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"d:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-02-02 64160]
R1 Hotkey;Hotkey;c:\windows\system32\drivers\HOTKEY.sys [2004-02-20 9867]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 950096]
R3 POWERKEY;POWERKEY;c:\program files\Launch Manager\POWERKEY.SYS [2008-08-16 2343]
S1 mailKmd;mailKmd; [x]
S1 Wbutton;Wbutton;c:\windows\system32\drivers\Wbutton.sys --> c:\windows\system32\drivers\Wbutton.sys [?]
.
Contenu du dossier 'Tâches planifiées'
2009-01-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
2009-02-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4271046019-2757734838-2015800038-1005.job
- c:\documents and settings\Giorgetti Laurent\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-05 00:12]
2009-02-09 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-02-02 23:54]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.ch/
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Easy-WebPrint Ajouter à la liste d'impressions - d:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint Impression rapide - d:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Imprimer - d:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: Easy-WebPrint Prévisualiser - d:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-10 22:54:10
Windows 5.1.2600 Service Pack 3 FAT NTAPI
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\•€|ÿÿÿÿ"•€|þ»Ñw*]
"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(568)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\SYSTEM32\ATI2EVXX.EXE
c:\windows\SYSTEM32\ATI2EVXX.EXE
c:\program files\AVIRA\ANTIVIR PERSONALEDITION CLASSIC\SCHED.EXE
c:\program files\AVIRA\ANTIVIR PERSONALEDITION CLASSIC\AVGUARD.EXE
c:\program files\FICHIERS COMMUNS\APPLE\MOBILE DEVICE SUPPORT\BIN\APPLEMOBILEDEVICESERVICE.EXE
c:\program files\BONJOUR\MDNSRESPONDER.EXE
c:\program files\JAVA\JRE6\BIN\JQS.EXE
c:\windows\SYSTEM32\WBEM\UNSECAPP.EXE
c:\program files\iPod\bin\iPodService.exe
c:\windows\System32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Heure de fin: 2009-02-10 22:57:59 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-02-10 21:57:54
ComboFix3.txt 2009-02-10 20:29:58
ComboFix2.txt 2009-02-10 21:40:44
Avant-CF: 3 104 210 944 octets libres
Après-CF: 3,101,130,752 octets libres
256 --- E O F --- 2009-01-15 02:03:47
-
-
Re,
Il en reste.
---> Clique sur Démarrer, Exécuter, tape notepad clique sur OK.
---> Copie le texte en gras ci-dessous par sélection puis Ctrl+C :
KillAll::
File::
c:\windows\clipsrv.exe
c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
c:\windows\System\cisvc.exe
c:\docume~1\GIORGE~1\LOCALS~1\APPLIC~1\logman.exe
---> Colle la sélection dans le bloc-notes
---> Enregistre ce fichier sur le bureau (Impératif)
---> Nom du fichier : CFScript
---> Type du fichier : tous les fichiers
---> Clique sur Enregistrer
---> Quitte le bloc-notes
---> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :http://www.searchengines.pl/phpbb203/pliki/picasso/virus/programs/combofix/combofix_cfscript.gif
[*] Une fenêtre bleue va apparaître : au message qui apparaît, tu acceptes.
[*] Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal !
Ne touche à rien tant que le scan n'est pas terminé.
[*] Une fois le scan achevé, un rapport va s'afficher : poste-le
[*] Si le fichier ne s'ouvre pas, il se trouve ici C:\ComboFix.txt-
Y en a encore ? lol
ComboFix 09-02-10.01 - Moi 2009-02-10 23:15:00.4 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.511.289 [GMT 1:00]
Lancé depuis: c:\documents and settings\Moi\Bureau\C-Fix.exe
Commutateurs utilisés :: c:\documents and settings\Moi\Bureau\CFScript.txt
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated)
* Un nouveau point de restauration a été créé
FILE ::
c:\docume~1\GIORGE~1\LOCALS~1\APPLIC~1\logman.exe
c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
c:\windows\clipsrv.exe
c:\windows\System\cisvc.exe
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\docume~1\GIORGE~1\LOCALS~1\APPLIC~1\logman.exe
c:\windows\clipsrv.exe
c:\windows\System\cisvc.exe
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-01-10 au 2009-02-10 ))))))))))))))))))))))))))))))))))))
.
2009-02-10 21:07 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\mqtgsvc.exe
2009-02-10 21:06 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\cisvc.exe
2009-02-10 20:54 . 2009-01-18 20:05 81,920 --a------ c:\windows\system\clipsrv.exe
2009-02-10 20:50 . 2009-01-18 20:05 81,920 --a------ c:\documents and settings\Giorgetti Laurent\Application Data\mstsc.exe
2009-02-10 20:47 . 2009-01-18 20:05 81,920 --a------ c:\windows\system\esentutl.exe
2009-02-10 20:41 . 2009-01-18 20:05 81,920 --a------ c:\windows\rsvp.exe
2009-02-10 20:30 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\sessmgr.exe
2009-02-10 20:28 . 2009-01-18 20:05 81,920 --a------ c:\windows\dllhst3g.exe
2009-02-10 20:23 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\mstsc.exe
2009-02-10 20:18 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\dllhst3g.exe
2009-02-10 20:18 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\comrepl.exe
2009-02-10 20:14 . 2009-01-18 20:05 81,920 --a------ c:\windows\cisvc.exe
2009-02-10 20:11 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\mstinit.exe
2009-02-10 20:09 . 2009-01-18 20:05 81,920 --a------ c:\windows\system\logman.exe
2009-02-10 20:03 . 2009-01-18 20:05 81,920 --a------ c:\documents and settings\Giorgetti Laurent\Application Data\cmstp.exe
2009-02-10 19:47 . 2009-01-18 20:05 81,920 --a------ c:\documents and settings\Giorgetti Laurent\Application Data\spoolsv.exe
2009-02-10 19:46 . 2009-01-18 20:05 81,920 --a------ c:\windows\system\dllhst3g.exe
2009-02-10 19:43 . 2009-01-18 20:05 81,920 --a------ c:\windows\logman.exe
2009-02-10 19:42 . 2009-01-18 20:05 81,920 --------- c:\windows\system32\drivers\logman.exe
2009-02-10 19:42 . 2009-01-18 20:05 81,920 --a------ c:\documents and settings\Giorgetti Laurent\Application Data\cisvc.exe
2009-02-10 19:41 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\cmstp.exe
2009-02-10 19:40 . 2009-01-18 20:05 81,920 --a------ c:\windows\mqtgsvc.exe
2009-02-10 19:37 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\ieudinit.exe
2009-02-10 19:37 . 2009-01-18 20:05 81,920 --a------ c:\documents and settings\Giorgetti Laurent\Application Data\mstinit.exe
2009-02-10 19:36 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\clipsrv.exe
2009-02-10 19:34 . 2009-01-18 20:05 81,920 --a------ c:\windows\system\mstinit.exe
2009-02-10 19:21 . 2009-01-18 20:05 81,920 --a------ c:\documents and settings\Giorgetti Laurent\Application Data\clipsrv.exe
2009-02-10 18:25 . 2009-02-10 18:25 <REP> d-------- c:\documents and settings\NetworkService\Bureau
2009-02-10 17:14 . 2003-01-21 03:00 13,112,456 -ra------ c:\documents and settings\Administrateur\MpSetup.exe
2009-02-10 17:13 . 2004-02-19 01:38 <REP> d--h----- c:\documents and settings\Administrateur\Voisinage réseau
2009-02-10 17:13 . 2004-02-19 01:38 <REP> d--h----- c:\documents and settings\Administrateur\Voisinage d'impression
2009-02-10 17:13 . 2004-02-19 01:38 <REP> d--h----- c:\documents and settings\Administrateur\Modèles
2009-02-10 17:13 . 2004-02-19 01:48 <REP> dr------- c:\documents and settings\Administrateur\Mes documents
2009-02-10 17:13 . 2004-02-19 01:38 <REP> dr------- c:\documents and settings\Administrateur\Menu Démarrer
2009-02-10 17:13 . 2004-02-19 01:48 <REP> dr------- c:\documents and settings\Administrateur\Favoris
2009-02-10 17:13 . 2004-02-19 01:38 <REP> d-------- c:\documents and settings\Administrateur\Bureau
2009-02-10 17:13 . 2009-02-10 17:13 <REP> d-------- c:\documents and settings\Administrateur
2009-02-10 08:05 . 2009-01-18 20:05 81,920 --a------ c:\windows\mstsc.exe
2009-02-10 02:35 . 2009-01-18 20:05 81,920 --a------ c:\windows\system\comrepl.exe
2009-02-10 01:54 . 2009-02-10 01:54 <REP> d-------- C:\rsit
2009-02-10 01:48 . 2009-02-10 01:48 <REP> d-------- c:\program files\Avira
2009-02-10 01:48 . 2009-02-10 01:48 <REP> d-------- c:\documents and settings\All Users\Application Data\Avira
2009-02-10 01:14 . 2009-02-10 01:14 <REP> d-------- c:\documents and settings\Giorgetti Laurent\Application Data\Malwarebytes
2009-02-10 01:14 . 2009-02-10 01:14 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-10 01:14 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-10 01:14 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-10 00:47 . 2009-02-10 00:47 <REP> d-------- C:\Lop SD
2009-02-09 23:46 . 2009-02-09 23:46 <REP> d-------- c:\documents and settings\All Users\Application Data\TEMP
2009-02-03 00:17 . 2009-02-02 23:54 15,688 --a------ c:\windows\system32\lsdelete.exe
2009-02-03 00:03 . 2009-02-03 00:03 <REP> d-------- c:\documents and settings\LocalService\Bureau
2009-02-02 23:54 . 2009-02-02 23:54 64,160 --a------ c:\windows\system32\drivers\Lbd.sys
2009-02-02 23:03 . 2009-02-02 23:03 <REP> d-------- c:\program files\Lavasoft
2009-02-02 23:03 . 2009-02-02 23:03 <REP> d-------- c:\documents and settings\All Users\Application Data\Lavasoft
2009-02-02 23:03 . 2009-02-02 23:03 <REP> d--h----- c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-01-24 15:01 . 2009-01-24 15:01 <REP> d-------- c:\program files\iPod
2009-01-24 15:01 . 2009-01-24 15:01 <REP> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-01-24 14:58 . 2009-01-24 14:58 <REP> d-------- c:\program files\QuickTime
2009-01-24 14:53 . 2009-01-24 14:53 <REP> d-------- c:\program files\Bonjour
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-17 17:26 --------- d-----w c:\program files\Microsoft Silverlight
2008-12-17 17:25 --------- d-----w c:\program files\Microsoft
2008-12-17 17:24 --------- d-----w c:\program files\Windows Live SkyDrive
2008-12-17 17:17 --------- d-----w c:\program files\Fichiers communs\Windows Live
2008-12-13 06:37 3,593,216 ------w c:\windows\system32\dllcache\mshtml.dll
2008-12-12 10:18 87,336 ----a-w c:\windows\system32\dns-sd.exe
2008-12-12 10:11 61,440 ----a-w c:\windows\system32\dnssd.dll
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-12-11 10:57 333,952 ------w c:\windows\system32\dllcache\srv.sys
2008-12-02 21:37 49,480 ----a-w c:\windows\system32\sirenacm.dll
2008-11-21 21:47 524,288 ----a-w c:\windows\system32\DivXsm.exe
2008-11-21 21:47 3,596,288 ----a-w c:\windows\system32\qt-dx331.dll
2008-11-21 21:46 200,704 ----a-w c:\windows\system32\ssldivx.dll
2008-11-21 21:46 1,044,480 ----a-w c:\windows\system32\libdivx.dll
2008-11-21 21:45 823,296 ----a-w c:\windows\system32\divx_xx0c.dll
2008-11-21 21:45 823,296 ----a-w c:\windows\system32\divx_xx07.dll
2008-11-21 21:45 815,104 ----a-w c:\windows\system32\divx_xx0a.dll
2008-11-21 21:45 81,920 ----a-w c:\windows\system32\dpl100.dll
2008-11-21 21:45 802,816 ----a-w c:\windows\system32\divx_xx11.dll
2008-11-21 21:45 593,920 ----a-w c:\windows\system32\dpuGUI11.dll
2008-11-21 21:45 57,344 ----a-w c:\windows\system32\dpv11.dll
2008-11-21 21:45 53,248 ----a-w c:\windows\system32\dpuGUI10.dll
2008-11-21 21:45 344,064 ----a-w c:\windows\system32\dpus11.dll
2008-11-21 21:45 294,912 ----a-w c:\windows\system32\dpu11.dll
2008-11-21 21:45 294,912 ----a-w c:\windows\system32\dpu10.dll
2008-11-21 21:45 196,608 ----a-w c:\windows\system32\dtu100.dll
2008-11-21 21:44 161,096 ----a-w c:\windows\system32\DivXCodecVersionChecker.exe
2008-11-21 21:44 12,288 ----a-w c:\windows\system32\DivXWMPExtType.dll
2008-11-10 04:43 410,984 ----a-w c:\windows\system32\deploytk.dll
2003-01-21 02:00 13,112,456 ----a-r c:\windows\system32\config\systemprofile\MpSetup.exe
2003-01-21 02:00 13,112,456 ----a-r c:\documents and settings\Giorgetti Laurent\MpSetup.exe
2003-01-21 02:00 13,112,456 ----a-r c:\documents and settings\Default User\MpSetup.exe
2008-10-04 00:53 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008100420081005\index.dat
.
((((((((((((((((((((((((((((( SnapShot@2009-02-10_21.29.11,10 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-02-10 19:08:14 195,368 ----a-w c:\windows\system32\FNTCACHE.DAT
+ 2009-02-10 21:25:12 195,368 ----a-w c:\windows\system32\FNTCACHE.DAT
+ 2009-02-10 22:17:42 16,384 ----a-w c:\windows\temp\Perflib_Perfdata_6b4.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2008-12-02 3882312]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Google Update"="c:\documents and settings\Giorgetti Laurent\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-05 133104]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="LaunApp" [X]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-01-27 335872]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2003-11-20 98304]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2003-11-20 499712]
"LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2003-04-28 184320]
"RemoteControl"="c:\sysinfo\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-21 40960]
"LaunchAp"="c:\program files\Launch Manager\LaunchAp.exe" [2004-01-28 32768]
"PowerKey"="c:\program files\Launch Manager\PowerKey.exe" [2002-08-30 94208]
"LManager"="c:\program files\Launch Manager\HotkeyApp.exe" [2004-02-04 45056]
"CtrlVol"="c:\program files\Launch Manager\CtrlVol.exe" [2004-01-28 184320]
"LMgrOSD"="c:\program files\Launch Manager\OSDCtrl.exe" [2004-02-03 49152]
"Wbutton"="c:\program files\Launch Manager\Wbutton.exe" [2004-01-30 65536]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Easy-PrintToolBox"="c:\program files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2004-01-14 409600]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="d:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-02-02 509784]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 c:\windows\system32\Ati2mdxx.exe]
"AGRSMMSG"="AGRSMMSG.exe" [2003-11-19 c:\windows\AGRSMMSG.exe]
"SoundMan"="SOUNDMAN.EXE" [2003-12-19 c:\windows\soundman.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_USERS\.DEFAULT\software\microsoft\windows\Currentversion\policies\explorer\Run]
"ComRepl"="c:\windows\System\comrepl.exe" [2009-01-18 81920]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\eMule\\emule.exe"=
"d:\\Program Files\\BitTorrent\\btdownloadgui.exe"=
"d:\\Program Files\\uTorrent\\uTorrent.exe"=
"d:\\Program Files\\Zattoo\\zattood.exe"=
"d:\\Program Files\\Zattoo\\Zattoo1.exe"=
"c:\\WINDOWS\\System32\\rtcshare.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"d:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-02-02 64160]
R1 Hotkey;Hotkey;c:\windows\system32\drivers\HOTKEY.sys [2004-02-20 9867]
R3 POWERKEY;POWERKEY;c:\program files\Launch Manager\POWERKEY.SYS [2008-08-16 2343]
S1 mailKmd;mailKmd; [x]
S1 Wbutton;Wbutton;c:\windows\system32\drivers\Wbutton.sys --> c:\windows\system32\drivers\Wbutton.sys [?]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 950096]
.
Contenu du dossier 'Tâches planifiées'
2009-01-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
2009-02-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4271046019-2757734838-2015800038-1005.job
- c:\documents and settings\Giorgetti Laurent\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-05 00:12]
2009-02-09 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-02-02 23:54]
.
- - - - ORPHELINS SUPPRIMES - - - -
HKLM-Explorer_Run-Cisvc - c:\windows\System\cisvc.exe
HKCU-Explorer_Run-Logman - c:\docume~1\GIORGE~1\LOCALS~1\APPLIC~1\logman.exe
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.ch/
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Easy-WebPrint Ajouter à la liste d'impressions - d:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint Impression rapide - d:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Imprimer - d:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: Easy-WebPrint Prévisualiser - d:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-10 23:18:34
Windows 5.1.2600 Service Pack 3 FAT NTAPI
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\•€|ÿÿÿÿ"•€|þ»Ñw*]
"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(568)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\SYSTEM32\ATI2EVXX.EXE
c:\windows\SYSTEM32\ATI2EVXX.EXE
c:\program files\AVIRA\ANTIVIR PERSONALEDITION CLASSIC\SCHED.EXE
c:\program files\AVIRA\ANTIVIR PERSONALEDITION CLASSIC\AVGUARD.EXE
c:\program files\FICHIERS COMMUNS\APPLE\MOBILE DEVICE SUPPORT\BIN\APPLEMOBILEDEVICESERVICE.EXE
c:\program files\BONJOUR\MDNSRESPONDER.EXE
c:\program files\JAVA\JRE6\BIN\JQS.EXE
c:\windows\SYSTEM32\WBEM\WMIAPSRV.EXE
c:\windows\SYSTEM32\WSCNTFY.EXE
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Heure de fin: 2009-02-10 23:21:22 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-02-10 22:21:20
ComboFix4.txt 2009-02-10 20:29:58
ComboFix3.txt 2009-02-10 21:40:44
ComboFix2.txt 2009-02-10 21:58:02
Avant-CF: 3 065 544 704 octets libres
Après-CF: 3,051,651,072 octets libres
247 --- E O F --- 2009-01-15 02:03:47
-
-
-
Logfile of random's system information tool 1.05 (written by random/random)
Run by Giorgetti Laurent at 2009-02-10 23:33:02
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 3 GB (24%) free of 12 GB
Total RAM: 511 MB (46% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:33:16, on 10/02/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\SYSINFO\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Launch Manager\PowerKey.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\CtrlVol.exe
C:\Program Files\Launch Manager\OSDCtrl.exe
C:\Program Files\Launch Manager\Wbutton.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Java\jre6\bin\jusched.exe
D:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Giorgetti Laurent\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
D:\Program Files\eMule\Divers\RSIT.exe
D:\Program Files\eMule\Divers\Giorgetti Laurent.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ch/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - D:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [RemoteControl] C:\SYSINFO\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [LaunchApp] LaunApp
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe
O4 - HKLM\..\Run: [PowerKey] "C:\Program Files\Launch Manager\PowerKey.exe"
O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\HotkeyApp.exe
O4 - HKLM\..\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol.exe
O4 - HKLM\..\Run: [LMgrOSD] C:\Program Files\Launch Manager\OSDCtrl.exe
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Giorgetti Laurent\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [ComRepl] C:\WINDOWS\System\comrepl.exe /waitservice (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [ComRepl] C:\WINDOWS\System\comrepl.exe /waitservice (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
-
-
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question -
Re,
---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau :
http://oldtimer.geekstogo.com/OTMoveIt3.exe
---> Double-clique sur OTMoveIt3.exe afin de le lancer.
---> Copie (Ctrl+C) le texte suivant en gras ci-dessous :
:files
C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
C:\WINDOWS\system32\drivers\mailKmd.sys []
---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.
---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3.
Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
Accepte en cliquant sur YES.
---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
Le nom du rapport correspond au moment de sa création : date_heure.log-
========== FILES ==========
C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}\x86\x86 moved successfully.
C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}\x86 moved successfully.
C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} moved successfully.
File/Folder C:\WINDOWS\system32\drivers\mailKmd.sys [] not found.
OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 02102009_234036
-
-
Re,
OKI.
▶ Télécharge et installe MalwareByte's Anti-Malware
Malwarebyte
▶ Mets le à jour
▶ Double clique sur le raccourci de MalwareByte's Anti-Malware qui est sur le bureau.
▶ Sélectionne Exécuter un examen complet si ce n'est pas déjà fait
▶ clique sur Rechercher
▶ Une fois le scan terminé, une fenêtre s'ouvre, clique sur sur Ok
▶ Si MalwareByte's n'a rien détecté, clique sur Ok Un rapport va apparaître ferme-le.
▶ Si MalwareByte's a détecté des infections, clique sur Afficher les résultats ensuite sur Supprimer la sélection
▶ Enregistre le rapport sur ton Bureau comme cela il sera plus facile à retrouver, poste ensuite ce rapport.
Note : Si MalwareByte's a besoin de redémarrer pour terminer la suppression, accepte en cliquant sur Ok
Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.
Tutoriel pour MalwareByte's-
Malwarebytes' Anti-Malware 1.33
Version de la base de données: 1742
Windows 5.1.2600 Service Pack 3
11/02/2009 00:21:21
mbam-log-2009-02-11 (00-21-21).txt
Type de recherche: Examen complet (C:\|D:\|Z:\|)
Eléments examinés: 104762
Temps écoulé: 34 minute(s), 56 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 17
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
C:\WINDOWS\system32\drivers\mstinit.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\cisvc.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\logman.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\cmstp.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\mqtgsvc.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\comrepl.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Giorgetti Laurent\Application Data\Microsoft\mstsc.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Giorgetti Laurent\Local Settings\Application Data\comrepl.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Giorgetti Laurent\Application Data\Microsoft\mstinit.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Giorgetti Laurent\Application Data\Microsoft\sessmgr.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Giorgetti Laurent\Application Data\mstsc.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Giorgetti Laurent\Local Settings\Application Data\Microsoft\sessmgr.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Giorgetti Laurent\Local Settings\Application Data\Microsoft\spoolsv.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Giorgetti Laurent\Application Data\Microsoft\rsvp.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Giorgetti Laurent\Local Settings\Application Data\spoolsv.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Giorgetti Laurent\Application Data\spoolsv.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Giorgetti Laurent\Application Data\Microsoft\spoolsv.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
-
-
Re,
▶ Télécharge CCleaner (N'installe pas la Yahoo Toolbar) :
CCLEANER
▶ Lance-le. Va dans "Options" puis "Avancé",
▶ Tu décoches la case "Effacer uniquement les fichiers etc...".
▶ Tu vas dans "Nettoyeur", tu fais "Analyse". Une fois terminé, tu lances le nettoyage.
▶ Tu vas dans "Registre", tu fais "Chercher des erreurs".
Une fois terminé, tu répares toutes les erreurs sans sauvegarder la base de registre.
▶ Un tuto ( aide )
Refait après un redémarrage un log avec rsit.-
Logfile of random's system information tool 1.05 (written by random/random)
Run by Moi at 2009-02-11 00:40:14
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 3 GB (26%) free of 12 GB
Total RAM: 511 MB (36% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:40:41, on 11/02/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\SYSINFO\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Launch Manager\PowerKey.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\CtrlVol.exe
C:\Program Files\Launch Manager\OSDCtrl.exe
C:\Program Files\Launch Manager\Wbutton.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Java\jre6\bin\jusched.exe
D:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Giorgetti Laurent\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Documents and Settings\Giorgetti Laurent\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Giorgetti Laurent\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
D:\Program Files\eMule\Divers\RSIT.exe
D:\Program Files\eMule\Divers\Giorgetti Laurent.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avwsc.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ch/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - D:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [RemoteControl] C:\SYSINFO\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [LaunchApp] LaunApp
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe
O4 - HKLM\..\Run: [PowerKey] "C:\Program Files\Launch Manager\PowerKey.exe"
O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\HotkeyApp.exe
O4 - HKLM\..\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol.exe
O4 - HKLM\..\Run: [LMgrOSD] C:\Program Files\Launch Manager\OSDCtrl.exe
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Giorgetti Laurent\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [ComRepl] C:\WINDOWS\System\comrepl.exe /waitservice (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [ComRepl] C:\WINDOWS\System\comrepl.exe /waitservice (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
-
-
Bonjour,
à la demande de V-X.
==============================================
Copie ou imprime les instructions avant
Déconnecte toi d'internet et ferme toutes tes applications.
Désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)
Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :
Dirlook::
C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
driver::
mailKmd
Rootkit::
C:\WINDOWS\system32\drivers\mailKmd.sys
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-4271046019-2757734838-2015800038-1005.job
Enregistre ce fichier sous le nom CFscript
Fait un glisser/déposer de ce fichier CFscript sur le fichier ComboFix.exe
Clique sur le fichier CFscript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFscrïpt vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.
Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
Réactive ton parefeu, ton antivirus, la garde de ton antispyware
Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
Remets aussi un rapport Hijackthis
Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt
Attention : cette manip a été fait pour cet ordi. Tout réutilisation peut endommager sévèrement le système d'exploitation.
===============================================
->Affiche tous les fichiers et dossiers :
clique sur démarrer/panneau de configuration (en affichage classique)/option des dossiers/affichage
[Coche] « afficher les dossiers et fichiers cachés »
[Décoche] la case « Masquer les fichiers protégés du système d'exploitation (recommandé) »
[Décoche] « masquer les extensions dont le type est connu »
Puis fais [appliquer] pour valider les changements.
Et [Ok]
=============================================
Rends toi sur ce site :
https://www.virustotal.com/gui/
Clique sur parcourir et cherche ce fichier : C:\Documents and Settings\Giorgetti Laurent\Application Data\mstsc.exe
Clique sur Send File.
Un rapport va s'élaborer ligne à ligne.
Attends la fin. Il doit comprendre la taille du fichier envoyé.
Sauvegarde le rapport avec le bloc-note.
Copie le dans ta réponse.
Si VirusTotal indique que le fichier a déjà été analysé, cliquer sur le bouton Reanalyse le fichier maintenant
=====================
Fais de même avec :
C:\WINDOWS\rsvp.exe
C:\WINDOWS\dllhst3g.exe
C:\WINDOWS\cisvc.exe
C:\Documents and Settings\Giorgetti Laurent\Application Data\cmstp.exe
C:\Documents and Settings\Giorgetti Laurent\Application Data\spoolsv.exe
C:\WINDOWS\logman.exe
C:\Documents and Settings\Giorgetti Laurent\Application Data\cisvc.exe
C:\WINDOWS\mqtgsvc.exe
C:\Documents and Settings\Giorgetti Laurent\Application Data\mstinit.exe
C:\Documents and Settings\Giorgetti Laurent\Application Data\clipsrv.exe
C:\WINDOWS\mstsc.exe
-
Bonjour,
Voici deja le rapport combofix :
ComboFix 09-02-10.01 - Giorgetti Laurent 2009-02-11 17:25:49.5 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.511.285 [GMT 1:00]
Lancé depuis: c:\documents and settings\Giorgetti Laurent\Bureau\C-Fix.exe
Commutateurs utilisés :: c:\documents and settings\Giorgetti Laurent\Bureau\CFScript.txt
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated)
* Un nouveau point de restauration a été créé
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-4271046019-2757734838-2015800038-1005.job
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_mailKmd
((((((((((((((((((((((((((((( Fichiers créés du 2009-01-11 au 2009-02-11 ))))))))))))))))))))))))))))))))))))
.
2009-02-11 17:06 . 2009-02-11 17:07 1,374 --a------ c:\windows\imsins.BAK
2009-02-10 20:54 . 2009-01-18 20:05 81,920 --a------ c:\windows\system\clipsrv.exe
2009-02-10 20:47 . 2009-01-18 20:05 81,920 --a------ c:\windows\system\esentutl.exe
2009-02-10 20:41 . 2009-01-18 20:05 81,920 --a------ c:\windows\rsvp.exe
2009-02-10 20:30 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\sessmgr.exe
2009-02-10 20:28 . 2009-01-18 20:05 81,920 --a------ c:\windows\dllhst3g.exe
2009-02-10 20:23 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\mstsc.exe
2009-02-10 20:18 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\dllhst3g.exe
2009-02-10 20:14 . 2009-01-18 20:05 81,920 --a------ c:\windows\cisvc.exe
2009-02-10 20:09 . 2009-01-18 20:05 81,920 --a------ c:\windows\system\logman.exe
2009-02-10 20:03 . 2009-01-18 20:05 81,920 --a------ c:\documents and settings\Giorgetti Laurent\Application Data\cmstp.exe
2009-02-10 19:46 . 2009-01-18 20:05 81,920 --a------ c:\windows\system\dllhst3g.exe
2009-02-10 19:43 . 2009-01-18 20:05 81,920 --a------ c:\windows\logman.exe
2009-02-10 19:42 . 2009-01-18 20:05 81,920 --a------ c:\documents and settings\Giorgetti Laurent\Application Data\cisvc.exe
2009-02-10 19:40 . 2009-01-18 20:05 81,920 --a------ c:\windows\mqtgsvc.exe
2009-02-10 19:37 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\ieudinit.exe
2009-02-10 19:37 . 2009-01-18 20:05 81,920 --a------ c:\documents and settings\Giorgetti Laurent\Application Data\mstinit.exe
2009-02-10 19:36 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\clipsrv.exe
2009-02-10 19:34 . 2009-01-18 20:05 81,920 --a------ c:\windows\system\mstinit.exe
2009-02-10 19:21 . 2009-01-18 20:05 81,920 --a------ c:\documents and settings\Giorgetti Laurent\Application Data\clipsrv.exe
2009-02-10 18:25 . 2009-02-10 18:25 <REP> d-------- c:\documents and settings\NetworkService\Bureau
2009-02-10 17:14 . 2003-01-21 03:00 13,112,456 -ra------ c:\documents and settings\Administrateur\MpSetup.exe
2009-02-10 17:13 . 2004-02-19 01:38 <REP> d--h----- c:\documents and settings\Administrateur\Voisinage réseau
2009-02-10 17:13 . 2004-02-19 01:38 <REP> d--h----- c:\documents and settings\Administrateur\Voisinage d'impression
2009-02-10 17:13 . 2004-02-19 01:38 <REP> d--h----- c:\documents and settings\Administrateur\Modèles
2009-02-10 17:13 . 2004-02-19 01:48 <REP> dr------- c:\documents and settings\Administrateur\Mes documents
2009-02-10 17:13 . 2004-02-19 01:38 <REP> dr------- c:\documents and settings\Administrateur\Menu Démarrer
2009-02-10 17:13 . 2004-02-19 01:48 <REP> dr------- c:\documents and settings\Administrateur\Favoris
2009-02-10 17:13 . 2004-02-19 01:38 <REP> d-------- c:\documents and settings\Administrateur\Bureau
2009-02-10 17:13 . 2009-02-10 17:13 <REP> d-------- c:\documents and settings\Administrateur
2009-02-10 08:05 . 2009-01-18 20:05 81,920 --a------ c:\windows\mstsc.exe
2009-02-10 02:35 . 2009-01-18 20:05 81,920 --a------ c:\windows\system\comrepl.exe
2009-02-10 01:54 . 2009-02-10 01:54 <REP> d-------- C:\rsit
2009-02-10 01:48 . 2009-02-10 01:48 <REP> d-------- c:\program files\Avira
2009-02-10 01:48 . 2009-02-10 01:48 <REP> d-------- c:\documents and settings\All Users\Application Data\Avira
2009-02-10 01:14 . 2009-02-10 01:14 <REP> d-------- c:\documents and settings\Giorgetti Laurent\Application Data\Malwarebytes
2009-02-10 01:14 . 2009-02-10 01:14 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-10 01:14 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-10 01:14 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-10 00:47 . 2009-02-10 00:47 <REP> d-------- C:\Lop SD
2009-02-09 23:46 . 2009-02-09 23:46 <REP> d-------- c:\documents and settings\All Users\Application Data\TEMP
2009-02-03 00:17 . 2009-02-02 23:54 15,688 --a------ c:\windows\system32\lsdelete.exe
2009-02-03 00:03 . 2009-02-03 00:03 <REP> d-------- c:\documents and settings\LocalService\Bureau
2009-02-02 23:54 . 2009-02-02 23:54 64,160 --a------ c:\windows\system32\drivers\Lbd.sys
2009-02-02 23:03 . 2009-02-02 23:03 <REP> d-------- c:\program files\Lavasoft
2009-02-02 23:03 . 2009-02-02 23:03 <REP> d-------- c:\documents and settings\All Users\Application Data\Lavasoft
2009-02-02 23:03 . 2009-02-02 23:03 <REP> d--h----- c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-01-24 15:01 . 2009-01-24 15:01 <REP> d-------- c:\program files\iPod
2009-01-24 14:58 . 2009-01-24 14:58 <REP> d-------- c:\program files\QuickTime
2009-01-24 14:53 . 2009-01-24 14:53 <REP> d-------- c:\program files\Bonjour
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-16 20:15 3,594,752 ------w c:\windows\system32\dllcache\mshtml.dll
2008-12-20 22:47 826,368 ----a-w c:\windows\system32\wininet.dll
2008-12-20 22:47 826,368 ------w c:\windows\system32\dllcache\wininet.dll
2008-12-20 22:47 671,232 ------w c:\windows\system32\dllcache\mstime.dll
2008-12-20 22:47 477,696 ------w c:\windows\system32\dllcache\mshtmled.dll
2008-12-20 22:47 44,544 ------w c:\windows\system32\dllcache\pngfilt.dll
2008-12-20 22:47 233,472 ------w c:\windows\system32\dllcache\webcheck.dll
2008-12-20 22:47 193,024 ------w c:\windows\system32\dllcache\msrating.dll
2008-12-20 22:47 105,984 ------w c:\windows\system32\dllcache\url.dll
2008-12-20 22:47 102,912 ------w c:\windows\system32\dllcache\occache.dll
2008-12-20 22:47 1,160,192 ------w c:\windows\system32\dllcache\urlmon.dll
2008-12-19 09:11 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe
2008-12-19 09:10 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe
2008-12-19 05:25 634,024 ------w c:\windows\system32\dllcache\iexplore.exe
2008-12-19 05:23 161,792 ------w c:\windows\system32\dllcache\ieakui.dll
2008-12-17 17:26 --------- d-----w c:\program files\Microsoft Silverlight
2008-12-17 17:25 --------- d-----w c:\program files\Microsoft
2008-12-17 17:24 --------- d-----w c:\program files\Windows Live SkyDrive
2008-12-17 17:17 --------- d-----w c:\program files\Fichiers communs\Windows Live
2008-12-12 10:18 87,336 ----a-w c:\windows\system32\dns-sd.exe
2008-12-12 10:11 61,440 ----a-w c:\windows\system32\dnssd.dll
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-12-11 10:57 333,952 ------w c:\windows\system32\dllcache\srv.sys
2008-12-02 21:37 49,480 ----a-w c:\windows\system32\sirenacm.dll
2008-11-21 21:47 524,288 ----a-w c:\windows\system32\DivXsm.exe
2008-11-21 21:47 3,596,288 ----a-w c:\windows\system32\qt-dx331.dll
2008-11-21 21:46 200,704 ----a-w c:\windows\system32\ssldivx.dll
2008-11-21 21:46 1,044,480 ----a-w c:\windows\system32\libdivx.dll
2008-11-21 21:45 823,296 ----a-w c:\windows\system32\divx_xx0c.dll
2008-11-21 21:45 823,296 ----a-w c:\windows\system32\divx_xx07.dll
2008-11-21 21:45 815,104 ----a-w c:\windows\system32\divx_xx0a.dll
2008-11-21 21:45 81,920 ----a-w c:\windows\system32\dpl100.dll
2008-11-21 21:45 802,816 ----a-w c:\windows\system32\divx_xx11.dll
2008-11-21 21:45 593,920 ----a-w c:\windows\system32\dpuGUI11.dll
2008-11-21 21:45 57,344 ----a-w c:\windows\system32\dpv11.dll
2008-11-21 21:45 53,248 ----a-w c:\windows\system32\dpuGUI10.dll
2008-11-21 21:45 344,064 ----a-w c:\windows\system32\dpus11.dll
2008-11-21 21:45 294,912 ----a-w c:\windows\system32\dpu11.dll
2008-11-21 21:45 294,912 ----a-w c:\windows\system32\dpu10.dll
2008-11-21 21:45 196,608 ----a-w c:\windows\system32\dtu100.dll
2008-11-21 21:44 161,096 ----a-w c:\windows\system32\DivXCodecVersionChecker.exe
2008-11-21 21:44 12,288 ----a-w c:\windows\system32\DivXWMPExtType.dll
2003-01-21 02:00 13,112,456 ----a-r c:\windows\system32\config\systemprofile\MpSetup.exe
2003-01-21 02:00 13,112,456 ----a-r c:\documents and settings\Giorgetti Laurent\MpSetup.exe
2003-01-21 02:00 13,112,456 ----a-r c:\documents and settings\Default User\MpSetup.exe
2008-10-04 00:53 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008100420081005\index.dat
.
(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} ----
c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}\
((((((((((((((((((((((((((((( SnapShot@2009-02-10_21.29.11,10 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-20 19:02:28 163,328 ----a-w c:\windows\ERDNT\subs\ERDNT.EXE
+ 2008-10-16 20:18:32 124,928 ------w c:\windows\ie7updates\KB961260-IE7\advpack.dll
+ 2008-10-16 20:18:32 347,136 ------w c:\windows\ie7updates\KB961260-IE7\dxtmsft.dll
+ 2008-10-16 20:18:32 214,528 ------w c:\windows\ie7updates\KB961260-IE7\dxtrans.dll
+ 2008-10-16 20:18:32 133,120 ------w c:\windows\ie7updates\KB961260-IE7\extmgr.dll
+ 2008-10-16 20:18:32 63,488 ------w c:\windows\ie7updates\KB961260-IE7\icardie.dll
+ 2008-10-16 13:12:20 70,656 ------w c:\windows\ie7updates\KB961260-IE7\ie4uinit.exe
+ 2008-10-16 20:18:32 153,088 ------w c:\windows\ie7updates\KB961260-IE7\ieakeng.dll
+ 2008-10-16 20:18:32 230,400 ------w c:\windows\ie7updates\KB961260-IE7\ieaksie.dll
+ 2008-10-15 07:04:54 161,792 ------w c:\windows\ie7updates\KB961260-IE7\ieakui.dll
+ 2008-10-16 20:18:32 383,488 ------w c:\windows\ie7updates\KB961260-IE7\ieapfltr.dll
+ 2008-10-16 20:18:32 384,512 ------w c:\windows\ie7updates\KB961260-IE7\iedkcs32.dll
+ 2008-10-16 20:18:36 6,066,176 ------w c:\windows\ie7updates\KB961260-IE7\ieframe.dll
+ 2008-10-16 20:18:36 44,544 ------w c:\windows\ie7updates\KB961260-IE7\iernonce.dll
+ 2008-10-16 20:18:36 267,776 ------w c:\windows\ie7updates\KB961260-IE7\iertutil.dll
+ 2008-10-16 13:11:10 13,824 ------w c:\windows\ie7updates\KB961260-IE7\ieudinit.exe
+ 2008-10-15 07:06:26 633,632 ------w c:\windows\ie7updates\KB961260-IE7\iexplore.exe
+ 2008-10-16 20:18:36 27,648 ------w c:\windows\ie7updates\KB961260-IE7\jsproxy.dll
+ 2008-10-16 20:18:38 459,264 ------w c:\windows\ie7updates\KB961260-IE7\msfeeds.dll
+ 2008-10-16 20:18:38 52,224 ------w c:\windows\ie7updates\KB961260-IE7\msfeedsbs.dll
+ 2008-12-13 06:37:56 3,593,216 ------w c:\windows\ie7updates\KB961260-IE7\mshtml.dll
+ 2008-10-16 20:18:40 477,696 ------w c:\windows\ie7updates\KB961260-IE7\mshtmled.dll
+ 2008-10-16 20:18:40 193,024 ------w c:\windows\ie7updates\KB961260-IE7\msrating.dll
+ 2008-10-16 20:18:42 671,232 ------w c:\windows\ie7updates\KB961260-IE7\mstime.dll
+ 2008-10-16 20:18:42 102,912 ------w c:\windows\ie7updates\KB961260-IE7\occache.dll
+ 2008-10-16 20:18:42 44,544 ------w c:\windows\ie7updates\KB961260-IE7\pngfilt.dll
+ 2007-03-06 01:34:38 216,800 ------w c:\windows\ie7updates\KB961260-IE7\spuninst\spuninst.exe
+ 2007-03-06 01:35:48 394,976 ------w c:\windows\ie7updates\KB961260-IE7\spuninst\updspapi.dll
+ 2008-10-16 20:18:42 105,984 ------w c:\windows\ie7updates\KB961260-IE7\url.dll
+ 2008-10-16 20:18:42 1,160,192 ------w c:\windows\ie7updates\KB961260-IE7\urlmon.dll
+ 2008-10-16 20:18:42 233,472 ------w c:\windows\ie7updates\KB961260-IE7\webcheck.dll
+ 2008-10-16 20:18:44 826,368 ------w c:\windows\ie7updates\KB961260-IE7\wininet.dll
- 2009-01-15 02:03:40 593,920 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\accicons.exe
+ 2009-02-11 16:08:06 593,920 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\accicons.exe
- 2009-01-15 02:03:40 12,288 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2009-02-11 16:08:06 12,288 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\cagicon.exe
- 2009-01-15 02:03:40 86,016 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\inficon.exe
+ 2009-02-11 16:08:06 86,016 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\inficon.exe
- 2009-01-15 02:03:40 135,168 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2009-02-11 16:08:06 135,168 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2009-01-15 02:03:40 11,264 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2009-02-11 16:08:06 11,264 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\mspicons.exe
- 2009-01-15 02:03:40 27,136 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2009-02-11 16:08:06 27,136 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2009-01-15 02:03:40 4,096 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2009-02-11 16:08:06 4,096 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\opwicon.exe
- 2009-01-15 02:03:40 794,624 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2009-02-11 16:08:06 794,624 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\outicon.exe
- 2009-01-15 02:03:40 249,856 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\pptico.exe
+ 2009-02-11 16:08:06 249,856 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2009-01-15 02:03:40 61,440 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\pubs.exe
+ 2009-02-11 16:08:06 61,440 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\pubs.exe
- 2009-01-15 02:03:40 23,040 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2009-02-11 16:08:06 23,040 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\unbndico.exe
- 2009-01-15 02:03:40 286,720 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2009-02-11 16:08:06 286,720 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\wordicon.exe
- 2009-01-15 02:03:40 409,600 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2009-02-11 16:08:06 409,600 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\xlicons.exe
- 2008-10-16 20:18:32 124,928 ----a-w c:\windows\system32\advpack.dll
+ 2008-12-20 22:46:48 124,928 ----a-w c:\windows\system32\advpack.dll
- 2008-10-16 20:18:32 124,928 ------w c:\windows\system32\dllcache\advpack.dll
+ 2008-12-20 22:46:48 124,928 ------w c:\windows\system32\dllcache\advpack.dll
- 2008-10-16 20:18:32 347,136 ------w c:\windows\system32\dllcache\dxtmsft.dll
+ 2008-12-20 22:46:48 347,136 ------w c:\windows\system32\dllcache\dxtmsft.dll
- 2008-10-16 20:18:32 214,528 ------w c:\windows\system32\dllcache\dxtrans.dll
+ 2008-12-20 22:46:48 214,528 ------w c:\windows\system32\dllcache\dxtrans.dll
- 2008-10-16 20:18:32 133,120 ------w c:\windows\system32\dllcache\extmgr.dll
+ 2008-12-20 22:46:50 133,120 ------w c:\windows\system32\dllcache\extmgr.dll
- 2008-10-16 20:18:32 63,488 ------w c:\windows\system32\dllcache\icardie.dll
+ 2008-12-20 22:46:50 63,488 ------w c:\windows\system32\dllcache\icardie.dll
- 2008-10-16 20:18:32 153,088 ------w c:\windows\system32\dllcache\ieakeng.dll
+ 2008-12-20 22:46:50 153,088 ------w c:\windows\system32\dllcache\ieakeng.dll
- 2008-10-16 20:18:32 230,400 ------w c:\windows\system32\dllcache\ieaksie.dll
+ 2008-12-20 22:46:50 230,400 ------w c:\windows\system32\dllcache\ieaksie.dll
- 2008-10-16 20:18:32 383,488 ------w c:\windows\system32\dllcache\ieapfltr.dll
+ 2008-12-20 22:46:50 383,488 ------w c:\windows\system32\dllcache\ieapfltr.dll
- 2008-10-16 20:18:32 384,512 ------w c:\windows\system32\dllcache\iedkcs32.dll
+ 2008-12-20 22:46:50 384,512 ------w c:\windows\system32\dllcache\iedkcs32.dll
- 2008-10-16 20:18:36 6,066,176 ------w c:\windows\system32\dllcache\ieframe.dll
+ 2008-12-20 22:46:54 6,066,688 ------w c:\windows\system32\dllcache\ieframe.dll
- 2008-10-16 20:18:36 44,544 ------w c:\windows\system32\dllcache\iernonce.dll
+ 2008-12-20 22:46:54 44,544 ------w c:\windows\system32\dllcache\iernonce.dll
- 2008-10-16 20:18:36 267,776 ------w c:\windows\system32\dllcache\iertutil.dll
+ 2008-12-20 22:46:54 267,776 ------w c:\windows\system32\dllcache\iertutil.dll
- 2008-10-16 20:18:36 27,648 ------w c:\windows\system32\dllcache\jsproxy.dll
+ 2008-12-20 22:46:56 27,648 ------w c:\windows\system32\dllcache\jsproxy.dll
- 2008-10-16 20:18:38 459,264 ------w c:\windows\system32\dllcache\msfeeds.dll
+ 2008-12-20 22:46:56 459,264 ------w c:\windows\system32\dllcache\msfeeds.dll
- 2008-10-16 20:18:38 52,224 ------w c:\windows\system32\dllcache\msfeedsbs.dll
+ 2008-12-20 22:46:58 52,224 ------w c:\windows\system32\dllcache\msfeedsbs.dll
- 2008-10-16 20:18:32 347,136 ----a-w c:\windows\system32\dxtmsft.dll
+ 2008-12-20 22:46:48 347,136 ----a-w c:\windows\system32\dxtmsft.dll
- 2008-10-16 20:18:32 214,528 ----a-w c:\windows\system32\dxtrans.dll
+ 2008-12-20 22:46:48 214,528 ----a-w c:\windows\system32\dxtrans.dll
- 2008-10-16 20:18:32 133,120 ------w c:\windows\system32\extmgr.dll
+ 2008-12-20 22:46:50 133,120 ------w c:\windows\system32\extmgr.dll
- 2009-02-10 19:08:14 195,368 ----a-w c:\windows\system32\FNTCACHE.DAT
+ 2009-02-10 21:25:12 195,368 ----a-w c:\windows\system32\FNTCACHE.DAT
- 2008-10-16 20:18:32 63,488 ----a-w c:\windows\system32\icardie.dll
+ 2008-12-20 22:46:50 63,488 ----a-w c:\windows\system32\icardie.dll
- 2008-10-16 13:12:20 70,656 ------w c:\windows\system32\ie4uinit.exe
+ 2008-12-19 09:11:12 70,656 ------w c:\windows\system32\ie4uinit.exe
- 2008-10-16 20:18:32 153,088 ------w c:\windows\system32\ieakeng.dll
+ 2008-12-20 22:46:50 153,088 ------w c:\windows\system32\ieakeng.dll
- 2008-10-16 20:18:32 230,400 ------w c:\windows\system32\ieaksie.dll
+ 2008-12-20 22:46:50 230,400 ------w c:\windows\system32\ieaksie.dll
- 2008-10-15 07:04:54 161,792 ------w c:\windows\system32\ieakui.dll
+ 2008-12-19 05:23:56 161,792 ------w c:\windows\system32\ieakui.dll
- 2008-10-16 20:18:32 383,488 ----a-w c:\windows\system32\ieapfltr.dll
+ 2008-12-20 22:46:50 383,488 ----a-w c:\windows\system32\ieapfltr.dll
- 2008-10-16 20:18:32 384,512 ------w c:\windows\system32\iedkcs32.dll
+ 2008-12-20 22:46:50 384,512 ------w c:\windows\system32\iedkcs32.dll
- 2008-10-16 20:18:36 6,066,176 ----a-w c:\windows\system32\ieframe.dll
+ 2008-12-20 22:46:54 6,066,688 ----a-w c:\windows\system32\ieframe.dll
- 2008-10-16 20:18:36 44,544 ------w c:\windows\system32\iernonce.dll
+ 2008-12-20 22:46:54 44,544 ------w c:\windows\system32\iernonce.dll
- 2008-10-16 20:18:36 267,776 ----a-w c:\windows\system32\iertutil.dll
+ 2008-12-20 22:46:54 267,776 ----a-w c:\windows\system32\iertutil.dll
- 2008-10-16 13:11:10 13,824 ----a-w c:\windows\system32\ieudinit.exe
+ 2008-12-19 09:10:16 13,824 ----a-w c:\windows\system32\ieudinit.exe
- 2008-10-16 20:18:36 27,648 ------w c:\windows\system32\jsproxy.dll
+ 2008-12-20 22:46:56 27,648 ------w c:\windows\system32\jsproxy.dll
- 2009-01-10 01:35:28 20,853,704 ----a-w c:\windows\system32\MRT.exe
+ 2009-02-03 23:21:12 21,244,864 ----a-w c:\windows\system32\MRT.exe
- 2008-10-16 20:18:38 459,264 ----a-w c:\windows\system32\msfeeds.dll
+ 2008-12-20 22:46:56 459,264 ----a-w c:\windows\system32\msfeeds.dll
- 2008-10-16 20:18:38 52,224 ----a-w c:\windows\system32\msfeedsbs.dll
+ 2008-12-20 22:46:58 52,224 ----a-w c:\windows\system32\msfeedsbs.dll
- 2008-12-13 06:37:56 3,593,216 ----a-w c:\windows\system32\mshtml.dll
+ 2009-01-16 20:15:42 3,594,752 ----a-w c:\windows\system32\mshtml.dll
- 2008-10-16 20:18:40 477,696 ----a-w c:\windows\system32\mshtmled.dll
+ 2008-12-20 22:47:02 477,696 ----a-w c:\windows\system32\mshtmled.dll
- 2008-10-16 20:18:40 193,024 ------w c:\windows\system32\msrating.dll
+ 2008-12-20 22:47:02 193,024 ------w c:\windows\system32\msrating.dll
- 2008-10-16 20:18:42 671,232 ------w c:\windows\system32\mstime.dll
+ 2008-12-20 22:47:02 671,232 ------w c:\windows\system32\mstime.dll
- 2008-10-16 20:18:42 102,912 ------w c:\windows\system32\occache.dll
+ 2008-12-20 22:47:02 102,912 ------w c:\windows\system32\occache.dll
- 2008-10-16 20:18:42 44,544 ----a-w c:\windows\system32\pngfilt.dll
+ 2008-12-20 22:47:02 44,544 ----a-w c:\windows\system32\pngfilt.dll
- 2007-11-30 11:19:06 18,296 ------w c:\windows\system32\spmsg.dll
+ 2008-07-09 07:40:22 18,296 ------w c:\windows\system32\spmsg.dll
- 2008-10-16 20:18:42 105,984 ----a-w c:\windows\system32\url.dll
+ 2008-12-20 22:47:02 105,984 ----a-w c:\windows\system32\url.dll
- 2008-10-16 20:18:42 1,160,192 ----a-w c:\windows\system32\urlmon.dll
+ 2008-12-20 22:47:04 1,160,192 ----a-w c:\windows\system32\urlmon.dll
- 2008-10-16 20:18:42 233,472 ----a-w c:\windows\system32\webcheck.dll
+ 2008-12-20 22:47:04 233,472 ----a-w c:\windows\system32\webcheck.dll
+ 2009-02-11 16:29:18 16,384 ----a-w c:\windows\temp\Perflib_Perfdata_6e0.dat
.
-- Instantané actualisé --
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2008-12-02 3882312]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Google Update"="c:\documents and settings\Giorgetti Laurent\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-05 133104]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="LaunApp" [X]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-01-27 335872]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2003-11-20 98304]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2003-11-20 499712]
"LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2003-04-28 184320]
"RemoteControl"="c:\sysinfo\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-21 40960]
"LaunchAp"="c:\program files\Launch Manager\LaunchAp.exe" [2004-01-28 32768]
"PowerKey"="c:\program files\Launch Manager\PowerKey.exe" [2002-08-30 94208]
"LManager"="c:\program files\Launch Manager\HotkeyApp.exe" [2004-02-04 45056]
"CtrlVol"="c:\program files\Launch Manager\CtrlVol.exe" [2004-01-28 184320]
"LMgrOSD"="c:\program files\Launch Manager\OSDCtrl.exe" [2004-02-03 49152]
"Wbutton"="c:\program files\Launch Manager\Wbutton.exe" [2004-01-30 65536]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Easy-PrintToolBox"="c:\program files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2004-01-14 409600]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="d:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-02-02 509784]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 c:\windows\system32\Ati2mdxx.exe]
"AGRSMMSG"="AGRSMMSG.exe" [2003-11-19 c:\windows\AGRSMMSG.exe]
"SoundMan"="SOUNDMAN.EXE" [2003-12-19 c:\windows\soundman.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_USERS\.DEFAULT\software\microsoft\windows\Currentversion\policies\explorer\Run]
"ComRepl"="c:\windows\System\comrepl.exe" [2009-01-18 81920]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\eMule\\emule.exe"=
"d:\\Program Files\\BitTorrent\\btdownloadgui.exe"=
"d:\\Program Files\\uTorrent\\uTorrent.exe"=
"d:\\Program Files\\Zattoo\\zattood.exe"=
"d:\\Program Files\\Zattoo\\Zattoo1.exe"=
"c:\\WINDOWS\\System32\\rtcshare.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"d:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-02-02 64160]
R1 Hotkey;Hotkey;c:\windows\system32\drivers\HOTKEY.sys [2004-02-20 9867]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 950096]
R3 POWERKEY;POWERKEY;c:\program files\Launch Manager\POWERKEY.SYS [2008-08-16 2343]
S1 Wbutton;Wbutton;c:\windows\system32\drivers\Wbutton.sys --> c:\windows\system32\drivers\Wbutton.sys [?]
.
Contenu du dossier 'Tâches planifiées'
2009-01-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
2009-02-09 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-02-02 23:54]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.ch/
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Easy-WebPrint Ajouter à la liste d'impressions - d:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint Impression rapide - d:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Imprimer - d:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: Easy-WebPrint Prévisualiser - d:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-11 17:29:31
Windows 5.1.2600 Service Pack 3 FAT NTAPI
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\•€|ÿÿÿÿ"•€|þ»Ñw*]
"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(568)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\SYSTEM32\ATI2EVXX.EXE
c:\windows\SYSTEM32\ATI2EVXX.EXE
c:\program files\AVIRA\ANTIVIR PERSONALEDITION CLASSIC\SCHED.EXE
c:\program files\AVIRA\ANTIVIR PERSONALEDITION CLASSIC\AVGUARD.EXE
c:\program files\FICHIERS COMMUNS\APPLE\MOBILE DEVICE SUPPORT\BIN\APPLEMOBILEDEVICESERVICE.EXE
c:\program files\BONJOUR\MDNSRESPONDER.EXE
c:\program files\JAVA\JRE6\BIN\JQS.EXE
c:\windows\SYSTEM32\WBEM\UNSECAPP.EXE
c:\windows\SYSTEM32\WBEM\WMIAPSRV.EXE
c:\program files\iPod\bin\iPodService.exe
c:\windows\SYSTEM32\WSCNTFY.EXE
c:\program files\Avira\AntiVir PersonalEdition Classic\avwsc.exe
.
**************************************************************************
.
Heure de fin: 2009-02-11 17:32:48 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-02-11 16:32:44
ComboFix4.txt 2009-02-10 21:40:44
ComboFix3.txt 2009-02-10 21:58:02
ComboFix5.txt 2009-02-11 16:25:18
ComboFix2.txt 2009-02-10 22:21:26
Avant-CF: 3 068 657 664 octets libres
Après-CF: 2,998,075,392 octets libres
399 --- E O F --- 2009-02-11 16:10:51- et voici le Hijackthis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:37:48, on 11/02/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\SYSINFO\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Launch Manager\PowerKey.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\CtrlVol.exe
C:\Program Files\Launch Manager\OSDCtrl.exe
C:\Program Files\Launch Manager\Wbutton.exe
C:\Program Files\Java\jre6\bin\jusched.exe
D:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Giorgetti Laurent\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\Giorgetti Laurent\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Giorgetti Laurent\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
D:\Program Files\eMule\Divers\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ch/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - D:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [RemoteControl] C:\SYSINFO\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [LaunchApp] LaunApp
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe
O4 - HKLM\..\Run: [PowerKey] "C:\Program Files\Launch Manager\PowerKey.exe"
O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\HotkeyApp.exe
O4 - HKLM\..\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol.exe
O4 - HKLM\..\Run: [LMgrOSD] C:\Program Files\Launch Manager\OSDCtrl.exe
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Giorgetti Laurent\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [ComRepl] C:\WINDOWS\System\comrepl.exe /waitservice (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [ComRepl] C:\WINDOWS\System\comrepl.exe /waitservice (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
- Et voici les rapports virustotal (j'ai mis mis les virus scannés en gras pour les séparer et que ca soit + lisible)
mstsc.exe : introuvable (D&S)
rsvp.exe : (Windows)
Antivirus Version Dernière mise à jour Résultat
a-squared 4.0.0.93 2009.02.11 Trojan-Downloader.Win32.Calac!IK
AhnLab-V3 5.0.0.2 2009.02.11 -
AntiVir 7.9.0.76 2009.02.11 -
Authentium 5.1.0.4 2009.02.11 -
Avast 4.8.1335.0 2009.02.11 -
AVG 8.0.0.229 2009.02.11 BackDoor.Generic_r.EK
BitDefender 7.2 2009.02.11 -
CAT-QuickHeal 10.00 2009.02.11 -
ClamAV 0.94.1 2009.02.11 -
Comodo 974 2009.02.11 -
DrWeb 4.44.0.09170 2009.02.11 -
eSafe 7.0.17.0 2009.02.11 -
eTrust-Vet 31.6.6350 2009.02.11 -
F-Prot 4.4.4.56 2009.02.11 W32/Horst.C.gen!Eldorado
F-Secure 8.0.14470.0 2009.02.11 -
Fortinet 3.117.0.0 2009.02.11 -
GData 19 2009.02.11 -
Ikarus T3.1.1.45.0 2009.02.11 Trojan-Downloader.Win32.Calac
K7AntiVirus 7.10.627 2009.02.11 -
Kaspersky 7.0.0.125 2009.02.11 -
McAfee 5522 2009.02.10 -
McAfee+Artemis 5522 2009.02.10 -
Microsoft 1.4306 2009.02.11 -
NOD32 3846 2009.02.11 -
Norman 6.00.02 2009.02.11 -
nProtect 2009.1.8.0 2009.02.11 -
Panda 10.0.0.10 2009.02.11 Suspicious file
PCTools 4.4.2.0 2009.02.11 -
Prevx1 V2 2009.02.11 Malicious Software
Rising 21.16.22.00 2009.02.11 -
SecureWeb-Gateway 6.7.6 2009.02.11 -
Sophos 4.38.0 2009.02.11 -
Sunbelt 3.2.1851.2 2009.02.11 -
Symantec 10 2009.02.11 -
TheHacker 6.3.1.85.252 2009.02.11 -
TrendMicro 8.700.0.1004 2009.02.11 -
VBA32 3.12.8.12 2009.02.11 -
ViRobot 2009.2.11.1600 2009.02.11 -
VirusBuster 4.5.11.0 2009.02.11 -
Information additionnelle
File size: 81920 bytes
MD5...: e3cbaeb32ace3b1bddc88505a14cf07b
SHA1..: 88297bb8b72b96af7a1ee1235bb19e71f9876362
SHA256: 1d18798809ea2456a970715679ff4b2d33d4a0992bd432983a2edb0340e090b8
SHA512: ca5a9f21f6ee837d16f85e512a433bb0c3dbed7d2b68cb1d400b0e5dd57766d8
a21d2675c19339fbb6a1bd6a97b8630a1085ded5bb4bb62d7fbd55cb2a9835bd
ssdeep: 1536:aM5stUDRrC6WBfkSjJbRN7Y/efkrGYDgRwqwQGcmt:4tARe62XNbRrkQGcm
t
PEiD..: -
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0xa966
timedatestamp.....: 0x49737c7a (Sun Jan 18 19:01:14 2009)
machinetype.......: 0x14c (I386)
( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xf1ef 0x10000 6.16 f1ffe9bddded1a072d3f7a25b961edd9
.rdata 0x11000 0x1e62 0x2000 5.20 7ad75fb56c36f172a03f8c33b5e5fd10
.data 0x13000 0x3798 0x1000 1.44 df0487c473064a21f0e13cb4563eab51
( 6 imports )
> USER32.dll: LoadImageA
> ADVAPI32.dll: RegCloseKey, RegEnumValueA, RegOpenKeyExA, RegGetKeySecurity, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, LookupAccountSidA, GetTokenInformation, OpenProcessToken
> WS2_32.dll: -, -
> WININET.dll: InternetReadFile, HttpQueryInfoA, InternetCloseHandle, InternetOpenUrlA, InternetOpenA
> NETAPI32.dll: NetUserGetInfo, NetApiBufferFree
> KERNEL32.dll: GetCurrentProcess, GetSystemInfo, VirtualProtect, GetLocaleInfoA, FlushFileBuffers, GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, SetStdHandle, GetCPInfo, GetOEMCP, GetACP, GetVolumeInformationA, GetFileTime, GetProcessPriorityBoost, GetSystemDirectoryA, OpenProcess, GetStartupInfoA, GetFileType, CreateDirectoryA, OpenMutexA, CreateMutexA, CloseHandle, GetDriveTypeA, GetLogicalDriveStringsA, Sleep, GetLastError, GetLocalTime, GetEnvironmentVariableA, SetEnvironmentVariableA, GetShortPathNameA, ExitProcess, SetFileAttributesA, CreateFileA, CreateProcessA, GlobalFree, CreateThread, GlobalAlloc, MultiByteToWideChar, GetModuleFileNameA, CopyFileA, WriteFile, RtlUnwind, GetSystemTimeAsFileTime, GetProcAddress, GetModuleHandleA, TerminateProcess, GetCommandLineA, GetVersionExA, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, HeapReAlloc, HeapAlloc, HeapSize, GetStdHandle, UnhandledExceptionFilter, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, HeapDestroy, HeapCreate, VirtualFree, HeapFree, SetFilePointer, LoadLibraryA, InterlockedExchange, VirtualQuery, SetUnhandledExceptionFilter, IsBadReadPtr, IsBadWritePtr, IsBadCodePtr, VirtualAlloc
( 0 exports )
Prevx info: <a href='http://info.prevx.com/aboutprogramtext.asp?PX5=E63C122900256817408B01E065B9C30059FE32D8' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=E63C122900256817408B01E065B9C30059FE32D8</a>
dllhst3g.exe : (Windows)
Antivirus Version Dernière mise à jour Résultat
a-squared 4.0.0.93 2009.02.11 Trojan-Downloader.Win32.Calac!IK
AhnLab-V3 5.0.0.2 2009.02.11 -
AntiVir 7.9.0.76 2009.02.11 -
Authentium 5.1.0.4 2009.02.11 -
Avast 4.8.1335.0 2009.02.11 -
AVG 8.0.0.229 2009.02.11 BackDoor.Generic_r.EK
BitDefender 7.2 2009.02.11 -
CAT-QuickHeal 10.00 2009.02.11 -
ClamAV 0.94.1 2009.02.11 -
Comodo 974 2009.02.11 -
DrWeb 4.44.0.09170 2009.02.11 -
eSafe 7.0.17.0 2009.02.11 -
eTrust-Vet 31.6.6350 2009.02.11 -
F-Prot 4.4.4.56 2009.02.11 W32/Horst.C.gen!Eldorado
F-Secure 8.0.14470.0 2009.02.11 -
Fortinet 3.117.0.0 2009.02.11 -
GData 19 2009.02.11 -
Ikarus T3.1.1.45.0 2009.02.11 Trojan-Downloader.Win32.Calac
K7AntiVirus 7.10.627 2009.02.11 -
Kaspersky 7.0.0.125 2009.02.11 -
McAfee 5522 2009.02.10 -
McAfee+Artemis 5522 2009.02.10 -
Microsoft 1.4306 2009.02.11 -
NOD32 3846 2009.02.11 -
Norman 6.00.02 2009.02.11 -
nProtect 2009.1.8.0 2009.02.11 -
Panda 10.0.0.10 2009.02.11 Suspicious file
PCTools 4.4.2.0 2009.02.11 -
Prevx1 V2 2009.02.11 Malicious Software
Rising 21.16.22.00 2009.02.11 -
SecureWeb-Gateway 6.7.6 2009.02.11 -
Sophos 4.38.0 2009.02.11 -
Sunbelt 3.2.1851.2 2009.02.11 -
Symantec 10 2009.02.11 -
TheHacker 6.3.1.85.252 2009.02.11 -
TrendMicro 8.700.0.1004 2009.02.11 -
VBA32 3.12.8.12 2009.02.11 -
ViRobot 2009.2.11.1600 2009.02.11 -
VirusBuster 4.5.11.0 2009.02.11 -
Information additionnelle
File size: 81920 bytes
MD5...: e3cbaeb32ace3b1bddc88505a14cf07b
SHA1..: 88297bb8b72b96af7a1ee1235bb19e71f9876362
SHA256: 1d18798809ea2456a970715679ff4b2d33d4a0992bd432983a2edb0340e090b8
SHA512: ca5a9f21f6ee837d16f85e512a433bb0c3dbed7d2b68cb1d400b0e5dd57766d8
a21d2675c19339fbb6a1bd6a97b8630a1085ded5bb4bb62d7fbd55cb2a9835bd
ssdeep: 1536:aM5stUDRrC6WBfkSjJbRN7Y/efkrGYDgRwqwQGcmt:4tARe62XNbRrkQGcm
t
PEiD..: -
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0xa966
timedatestamp.....: 0x49737c7a (Sun Jan 18 19:01:14 2009)
machinetype.......: 0x14c (I386)
( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xf1ef 0x10000 6.16 f1ffe9bddded1a072d3f7a25b961edd9
.rdata 0x11000 0x1e62 0x2000 5.20 7ad75fb56c36f172a03f8c33b5e5fd10
.data 0x13000 0x3798 0x1000 1.44 df0487c473064a21f0e13cb4563eab51
( 6 imports )
> USER32.dll: LoadImageA
> ADVAPI32.dll: RegCloseKey, RegEnumValueA, RegOpenKeyExA, RegGetKeySecurity, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, LookupAccountSidA, GetTokenInformation, OpenProcessToken
> WS2_32.dll: -, -
> WININET.dll: InternetReadFile, HttpQueryInfoA, InternetCloseHandle, InternetOpenUrlA, InternetOpenA
> NETAPI32.dll: NetUserGetInfo, NetApiBufferFree
> KERNEL32.dll: GetCurrentProcess, GetSystemInfo, VirtualProtect, GetLocaleInfoA, FlushFileBuffers, GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, SetStdHandle, GetCPInfo, GetOEMCP, GetACP, GetVolumeInformationA, GetFileTime, GetProcessPriorityBoost, GetSystemDirectoryA, OpenProcess, GetStartupInfoA, GetFileType, CreateDirectoryA, OpenMutexA, CreateMutexA, CloseHandle, GetDriveTypeA, GetLogicalDriveStringsA, Sleep, GetLastError, GetLocalTime, GetEnvironmentVariableA, SetEnvironmentVariableA, GetShortPathNameA, ExitProcess, SetFileAttributesA, CreateFileA, CreateProcessA, GlobalFree, CreateThread, GlobalAlloc, MultiByteToWideChar, GetModuleFileNameA, CopyFileA, WriteFile, RtlUnwind, GetSystemTimeAsFileTime, GetProcAddress, GetModuleHandleA, TerminateProcess, GetCommandLineA, GetVersionExA, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, HeapReAlloc, HeapAlloc, HeapSize, GetStdHandle, UnhandledExceptionFilter, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, HeapDestroy, HeapCreate, VirtualFree, HeapFree, SetFilePointer, LoadLibraryA, InterlockedExchange, VirtualQuery, SetUnhandledExceptionFilter, IsBadReadPtr, IsBadWritePtr, IsBadCodePtr, VirtualAlloc
( 0 exports )
Prevx info: <a href='http://info.prevx.com/aboutprogramtext.asp?PX5=E63C122900256817408B01E065B9C30059FE32D8' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=E63C122900256817408B01E065B9C30059FE32D8</a>
cisvc.exe : (Windows)
Antivirus Version Dernière mise à jour Résultat
a-squared 4.0.0.93 2009.02.11 Trojan-Downloader.Win32.Calac!IK
AhnLab-V3 5.0.0.2 2009.02.11 -
AntiVir 7.9.0.76 2009.02.11 -
Authentium 5.1.0.4 2009.02.11 -
Avast 4.8.1335.0 2009.02.11 -
AVG 8.0.0.229 2009.02.11 BackDoor.Generic_r.EK
BitDefender 7.2 2009.02.11 -
CAT-QuickHeal 10.00 2009.02.11 -
ClamAV 0.94.1 2009.02.11 -
Comodo 974 2009.02.11 -
DrWeb 4.44.0.09170 2009.02.11 -
eSafe 7.0.17.0 2009.02.11 -
eTrust-Vet 31.6.6350 2009.02.11 -
F-Prot 4.4.4.56 2009.02.11 W32/Horst.C.gen!Eldorado
F-Secure 8.0.14470.0 2009.02.11 -
Fortinet 3.117.0.0 2009.02.11 -
GData 19 2009.02.11 -
Ikarus T3.1.1.45.0 2009.02.11 Trojan-Downloader.Win32.Calac
K7AntiVirus 7.10.627 2009.02.11 -
Kaspersky 7.0.0.125 2009.02.11 -
McAfee 5522 2009.02.10 -
McAfee+Artemis 5522 2009.02.10 -
Microsoft 1.4306 2009.02.11 -
NOD32 3846 2009.02.11 -
Norman 6.00.02 2009.02.11 -
nProtect 2009.1.8.0 2009.02.11 -
Panda 10.0.0.10 2009.02.11 Suspicious file
PCTools 4.4.2.0 2009.02.11 -
Prevx1 V2 2009.02.11 Malicious Software
Rising 21.16.22.00 2009.02.11 -
SecureWeb-Gateway 6.7.6 2009.02.11 -
Sophos 4.38.0 2009.02.11 -
Sunbelt 3.2.1851.2 2009.02.11 -
Symantec 10 2009.02.11 -
TheHacker 6.3.1.85.252 2009.02.11 -
TrendMicro 8.700.0.1004 2009.02.11 -
VBA32 3.12.8.12 2009.02.11 -
ViRobot 2009.2.11.1600 2009.02.11 -
VirusBuster 4.5.11.0 2009.02.11 -
Information additionnelle
File size: 81920 bytes
MD5...: e3cbaeb32ace3b1bddc88505a14cf07b
SHA1..: 88297bb8b72b96af7a1ee1235bb19e71f9876362
SHA256: 1d18798809ea2456a970715679ff4b2d33d4a0992bd432983a2edb0340e090b8
SHA512: ca5a9f21f6ee837d16f85e512a433bb0c3dbed7d2b68cb1d400b0e5dd57766d8
a21d2675c19339fbb6a1bd6a97b8630a1085ded5bb4bb62d7fbd55cb2a9835bd
ssdeep: 1536:aM5stUDRrC6WBfkSjJbRN7Y/efkrGYDgRwqwQGcmt:4tARe62XNbRrkQGcm
t
PEiD..: -
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0xa966
timedatestamp.....: 0x49737c7a (Sun Jan 18 19:01:14 2009)
machinetype.......: 0x14c (I386)
( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xf1ef 0x10000 6.16 f1ffe9bddded1a072d3f7a25b961edd9
.rdata 0x11000 0x1e62 0x2000 5.20 7ad75fb56c36f172a03f8c33b5e5fd10
.data 0x13000 0x3798 0x1000 1.44 df0487c473064a21f0e13cb4563eab51
( 6 imports )
> USER32.dll: LoadImageA
> ADVAPI32.dll: RegCloseKey, RegEnumValueA, RegOpenKeyExA, RegGetKeySecurity, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, LookupAccountSidA, GetTokenInformation, OpenProcessToken
> WS2_32.dll: -, -
> WININET.dll: InternetReadFile, HttpQueryInfoA, InternetCloseHandle, InternetOpenUrlA, InternetOpenA
> NETAPI32.dll: NetUserGetInfo, NetApiBufferFree
> KERNEL32.dll: GetCurrentProcess, GetSystemInfo, VirtualProtect, GetLocaleInfoA, FlushFileBuffers, GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, SetStdHandle, GetCPInfo, GetOEMCP, GetACP, GetVolumeInformationA, GetFileTime, GetProcessPriorityBoost, GetSystemDirectoryA, OpenProcess, GetStartupInfoA, GetFileType, CreateDirectoryA, OpenMutexA, CreateMutexA, CloseHandle, GetDriveTypeA, GetLogicalDriveStringsA, Sleep, GetLastError, GetLocalTime, GetEnvironmentVariableA, SetEnvironmentVariableA, GetShortPathNameA, ExitProcess, SetFileAttributesA, CreateFileA, CreateProcessA, GlobalFree, CreateThread, GlobalAlloc, MultiByteToWideChar, GetModuleFileNameA, CopyFileA, WriteFile, RtlUnwind, GetSystemTimeAsFileTime, GetProcAddress, GetModuleHandleA, TerminateProcess, GetCommandLineA, GetVersionExA, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, HeapReAlloc, HeapAlloc, HeapSize, GetStdHandle, UnhandledExceptionFilter, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, HeapDestroy, HeapCreate, VirtualFree, HeapFree, SetFilePointer, LoadLibraryA, InterlockedExchange, VirtualQuery, SetUnhandledExceptionFilter, IsBadReadPtr, IsBadWritePtr, IsBadCodePtr, VirtualAlloc
( 0 exports )
Prevx info: <a href='http://info.prevx.com/aboutprogramtext.asp?PX5=E63C122900256817408B01E065B9C30059FE32D8' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=E63C122900256817408B01E065B9C30059FE32D8</a>
cmstp.exe (D&S) :
Antivirus Version Dernière mise à jour Résultat
a-squared 4.0.0.93 2009.02.11 Trojan-Downloader.Win32.Calac!IK
AhnLab-V3 2009.2.11.0 2009.02.11 -
AntiVir 7.9.0.76 2009.02.11 -
Authentium 5.1.0.4 2009.02.11 -
Avast 4.8.1335.0 2009.02.11 -
AVG 8.0.0.229 2009.02.11 BackDoor.Generic_r.EK
BitDefender 7.2 2009.02.11 -
CAT-QuickHeal 10.00 2009.02.11 -
ClamAV 0.94.1 2009.02.11 -
Comodo 973 2009.02.11 -
DrWeb 4.44.0.09170 2009.02.11 -
eSafe 7.0.17.0 2009.02.11 -
eTrust-Vet 31.6.6350 2009.02.11 -
F-Prot 4.4.4.56 2009.02.11 W32/Horst.C.gen!Eldorado
F-Secure 8.0.14470.0 2009.02.11 -
Fortinet 3.117.0.0 2009.02.11 -
GData 19 2009.02.11 -
Ikarus T3.1.1.45.0 2009.02.11 Trojan-Downloader.Win32.Calac
K7AntiVirus 7.10.582 2009.01.09 -
Kaspersky 7.0.0.125 2009.02.11 -
McAfee 5522 2009.02.10 -
McAfee+Artemis 5522 2009.02.10 -
Microsoft 1.4306 2009.02.11 -
NOD32 3845 2009.02.11 -
Norman 6.00.02 2009.02.11 -
nProtect 2009.1.8.0 2009.02.11 -
Panda 9.4.3.20 2009.02.11 -
PCTools 4.4.2.0 2009.02.11 -
Prevx1 V2 2009.02.11 Malicious Software
Rising 21.16.22.00 2009.02.11 -
SecureWeb-Gateway 6.7.6 2009.02.11 -
Sophos 4.38.0 2009.02.11 -
Sunbelt 3.2.1851.2 2009.02.11 -
Symantec 10 2009.02.11 -
TheHacker 6.3.1.85.252 2009.02.11 -
TrendMicro 8.700.0.1004 2009.02.11 -
VBA32 3.12.8.12 2009.02.11 -
ViRobot 2009.2.11.1600 2009.02.11 -
VirusBuster 4.5.11.0 2009.02.11 -
Information additionnelle
File size: 81920 bytes
MD5...: e3cbaeb32ace3b1bddc88505a14cf07b
SHA1..: 88297bb8b72b96af7a1ee1235bb19e71f9876362
SHA256: 1d18798809ea2456a970715679ff4b2d33d4a0992bd432983a2edb0340e090b8
SHA512: ca5a9f21f6ee837d16f85e512a433bb0c3dbed7d2b68cb1d400b0e5dd57766d8
a21d2675c19339fbb6a1bd6a97b8630a1085ded5bb4bb62d7fbd55cb2a9835bd
ssdeep: 1536:aM5stUDRrC6WBfkSjJbRN7Y/efkrGYDgRwqwQGcmt:4tARe62XNbRrkQGcm
t
PEiD..: -
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x40a966
timedatestamp.....: 0x49737c7a (Sun Jan 18 19:01:14 2009)
machinetype.......: 0x14c (I386)
( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xf1ef 0x10000 6.16 f1ffe9bddded1a072d3f7a25b961edd9
.rdata 0x11000 0x1e62 0x2000 5.20 7ad75fb56c36f172a03f8c33b5e5fd10
.data 0x13000 0x3798 0x1000 1.44 df0487c473064a21f0e13cb4563eab51
( 6 imports )
> USER32.dll: LoadImageA
> ADVAPI32.dll: RegCloseKey, RegEnumValueA, RegOpenKeyExA, RegGetKeySecurity, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, LookupAccountSidA, GetTokenInformation, OpenProcessToken
> WS2_32.dll: -, -
> WININET.dll: InternetReadFile, HttpQueryInfoA, InternetCloseHandle, InternetOpenUrlA, InternetOpenA
> NETAPI32.dll: NetUserGetInfo, NetApiBufferFree
> KERNEL32.dll: GetCurrentProcess, GetSystemInfo, VirtualProtect, GetLocaleInfoA, FlushFileBuffers, GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, SetStdHandle, GetCPInfo, GetOEMCP, GetACP, GetVolumeInformationA, GetFileTime, GetProcessPriorityBoost, GetSystemDirectoryA, OpenProcess, GetStartupInfoA, GetFileType, CreateDirectoryA, OpenMutexA, CreateMutexA, CloseHandle, GetDriveTypeA, GetLogicalDriveStringsA, Sleep, GetLastError, GetLocalTime, GetEnvironmentVariableA, SetEnvironmentVariableA, GetShortPathNameA, ExitProcess, SetFileAttributesA, CreateFileA, CreateProcessA, GlobalFree, CreateThread, GlobalAlloc, MultiByteToWideChar, GetModuleFileNameA, CopyFileA, WriteFile, RtlUnwind, GetSystemTimeAsFileTime, GetProcAddress, GetModuleHandleA, TerminateProcess, GetCommandLineA, GetVersionExA, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, HeapReAlloc, HeapAlloc, HeapSize, GetStdHandle, UnhandledExceptionFilter, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, HeapDestroy, HeapCreate, VirtualFree, HeapFree, SetFilePointer, LoadLibraryA, InterlockedExchange, VirtualQuery, SetUnhandledExceptionFilter, IsBadReadPtr, IsBadWritePtr, IsBadCodePtr, VirtualAlloc
( 0 exports )
Prevx info: <a href='http://info.prevx.com/aboutprogramtext.asp?PX5=E63C122900256817408B01E065B9C30059FE32D8' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=E63C122900256817408B01E065B9C30059FE32D8</a>
spoolsv.exe : (D&S) introuvable
logman.exe (Windows) :
Antivirus Version Dernière mise à jour Résultat
a-squared 4.0.0.93 2009.02.11 Trojan-Downloader.Win32.Calac!IK
AhnLab-V3 2009.2.11.0 2009.02.11 -
AntiVir 7.9.0.76 2009.02.11 -
Authentium 5.1.0.4 2009.02.11 -
Avast 4.8.1335.0 2009.02.11 -
AVG 8.0.0.229 2009.02.11 BackDoor.Generic_r.EK
BitDefender 7.2 2009.02.11 -
CAT-QuickHeal 10.00 2009.02.11 -
ClamAV 0.94.1 2009.02.11 -
Comodo 973 2009.02.11 -
DrWeb 4.44.0.09170 2009.02.11 -
eSafe 7.0.17.0 2009.02.11 -
eTrust-Vet 31.6.6350 2009.02.11 -
F-Prot 4.4.4.56 2009.02.11 W32/Horst.C.gen!Eldorado
F-Secure 8.0.14470.0 2009.02.11 -
Fortinet 3.117.0.0 2009.02.11 -
GData 19 2009.02.11 -
Ikarus T3.1.1.45.0 2009.02.11 Trojan-Downloader.Win32.Calac
K7AntiVirus 7.10.582 2009.01.09 -
Kaspersky 7.0.0.125 2009.02.11 -
McAfee 5522 2009.02.10 -
McAfee+Artemis 5522 2009.02.10 -
Microsoft 1.4306 2009.02.11 -
NOD32 3845 2009.02.11 -
Norman 6.00.02 2009.02.11 -
nProtect 2009.1.8.0 2009.02.11 -
Panda 9.4.3.20 2009.02.11 -
Prevx1 V2 2009.02.11 Malicious Software
Rising 21.16.22.00 2009.02.11 -
SecureWeb-Gateway 6.7.6 2009.02.11 -
Sophos 4.38.0 2009.02.11 -
Sunbelt 3.2.1851.2 2009.02.11 -
Symantec 10 2009.02.11 -
TheHacker 6.3.1.85.252 2009.02.11 -
TrendMicro 8.700.0.1004 2009.02.11 -
VBA32 3.12.8.12 2009.02.11 -
ViRobot 2009.2.11.1600 2009.02.11 -
VirusBuster 4.5.11.0 2009.02.11 -
Information additionnelle
File size: 81920 bytes
MD5...: e3cbaeb32ace3b1bddc88505a14cf07b
SHA1..: 88297bb8b72b96af7a1ee1235bb19e71f9876362
SHA256: 1d18798809ea2456a970715679ff4b2d33d4a0992bd432983a2edb0340e090b8
SHA512: ca5a9f21f6ee837d16f85e512a433bb0c3dbed7d2b68cb1d400b0e5dd57766d8
a21d2675c19339fbb6a1bd6a97b8630a1085ded5bb4bb62d7fbd55cb2a9835bd
ssdeep: 1536:aM5stUDRrC6WBfkSjJbRN7Y/efkrGYDgRwqwQGcmt:4tARe62XNbRrkQGcm
t
PEiD..: -
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x40a966
timedatestamp.....: 0x49737c7a (Sun Jan 18 19:01:14 2009)
machinetype.......: 0x14c (I386)
( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xf1ef 0x10000 6.16 f1ffe9bddded1a072d3f7a25b961edd9
.rdata 0x11000 0x1e62 0x2000 5.20 7ad75fb56c36f172a03f8c33b5e5fd10
.data 0x13000 0x3798 0x1000 1.44 df0487c473064a21f0e13cb4563eab51
( 6 imports )
> USER32.dll: LoadImageA
> ADVAPI32.dll: RegCloseKey, RegEnumValueA, RegOpenKeyExA, RegGetKeySecurity, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, LookupAccountSidA, GetTokenInformation, OpenProcessToken
> WS2_32.dll: -, -
> WININET.dll: InternetReadFile, HttpQueryInfoA, InternetCloseHandle, InternetOpenUrlA, InternetOpenA
> NETAPI32.dll: NetUserGetInfo, NetApiBufferFree
> KERNEL32.dll: GetCurrentProcess, GetSystemInfo, VirtualProtect, GetLocaleInfoA, FlushFileBuffers, GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, SetStdHandle, GetCPInfo, GetOEMCP, GetACP, GetVolumeInformationA, GetFileTime, GetProcessPriorityBoost, GetSystemDirectoryA, OpenProcess, GetStartupInfoA, GetFileType, CreateDirectoryA, OpenMutexA, CreateMutexA, CloseHandle, GetDriveTypeA, GetLogicalDriveStringsA, Sleep, GetLastError, GetLocalTime, GetEnvironmentVariableA, SetEnvironmentVariableA, GetShortPathNameA, ExitProcess, SetFileAttributesA, CreateFileA, CreateProcessA, GlobalFree, CreateThread, GlobalAlloc, MultiByteToWideChar, GetModuleFileNameA, CopyFileA, WriteFile, RtlUnwind, GetSystemTimeAsFileTime, GetProcAddress, GetModuleHandleA, TerminateProcess, GetCommandLineA, GetVersionExA, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, HeapReAlloc, HeapAlloc, HeapSize, GetStdHandle, UnhandledExceptionFilter, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, HeapDestroy, HeapCreate, VirtualFree, HeapFree, SetFilePointer, LoadLibraryA, InterlockedExchange, VirtualQuery, SetUnhandledExceptionFilter, IsBadReadPtr, IsBadWritePtr, IsBadCodePtr, VirtualAlloc
( 0 exports )
Prevx info: <a href='http://info.prevx.com/aboutprogramtext.asp?PX5=E63C122900256817408B01E065B9C30059FE32D8' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=E63C122900256817408B01E065B9C30059FE32D8</a>
cisvc.exe (D&S) :
a-squared 4.0.0.93 2009.02.11 Trojan-Downloader.Win32.Calac!IK
AhnLab-V3 5.0.0.2 2009.02.11 -
AntiVir 7.9.0.76 2009.02.11 -
Authentium 5.1.0.4 2009.02.11 -
Avast 4.8.1335.0 2009.02.11 -
AVG 8.0.0.229 2009.02.11 BackDoor.Generic_r.EK
BitDefender 7.2 2009.02.11 -
CAT-QuickHeal 10.00 2009.02.11 -
ClamAV 0.94.1 2009.02.11 -
Comodo 974 2009.02.11 -
DrWeb 4.44.0.09170 2009.02.11 -
eSafe 7.0.17.0 2009.02.11 -
eTrust-Vet 31.6.6350 2009.02.11 -
F-Prot 4.4.4.56 2009.02.11 W32/Horst.C.gen!Eldorado
F-Secure 8.0.14470.0 2009.02.11 -
Fortinet 3.117.0.0 2009.02.11 -
GData 19 2009.02.11 -
Ikarus T3.1.1.45.0 2009.02.11 Trojan-Downloader.Win32.Calac
K7AntiVirus 7.10.627 2009.02.11 -
Kaspersky 7.0.0.125 2009.02.11 -
McAfee 5522 2009.02.10 -
McAfee+Artemis 5522 2009.02.10 -
Microsoft 1.4306 2009.02.11 -
NOD32 3846 2009.02.11 -
Norman 6.00.02 2009.02.11 -
nProtect 2009.1.8.0 2009.02.11 -
Panda 10.0.0.10 2009.02.11 Suspicious file
PCTools 4.4.2.0 2009.02.11 -
Prevx1 V2 2009.02.11 Malicious Software
Rising 21.16.22.00 2009.02.11 -
SecureWeb-Gateway 6.7.6 2009.02.11 -
Sophos 4.38.0 2009.02.11 -
Sunbelt 3.2.1851.2 2009.02.11 -
Symantec 10 2009.02.11 -
TheHacker 6.3.1.85.252 2009.02.11 -
TrendMicro 8.700.0.1004 2009.02.11 -
VBA32 3.12.8.12 2009.02.11 -
ViRobot 2009.2.11.1600 2009.02.11 -
VirusBuster 4.5.11.0 2009.02.11 -
Information additionnelle
File size: 81920 bytes
MD5...: e3cbaeb32ace3b1bddc88505a14cf07b
SHA1..: 88297bb8b72b96af7a1ee1235bb19e71f9876362
SHA256: 1d18798809ea2456a970715679ff4b2d33d4a0992bd432983a2edb0340e090b8
SHA512: ca5a9f21f6ee837d16f85e512a433bb0c3dbed7d2b68cb1d400b0e5dd57766d8
a21d2675c19339fbb6a1bd6a97b8630a1085ded5bb4bb62d7fbd55cb2a9835bd
ssdeep: 1536:aM5stUDRrC6WBfkSjJbRN7Y/efkrGYDgRwqwQGcmt:4tARe62XNbRrkQGcm
t
PEiD..: -
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0xa966
timedatestamp.....: 0x49737c7a (Sun Jan 18 19:01:14 2009)
machinetype.......: 0x14c (I386)
( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xf1ef 0x10000 6.16 f1ffe9bddded1a072d3f7a25b961edd9
.rdata 0x11000 0x1e62 0x2000 5.20 7ad75fb56c36f172a03f8c33b5e5fd10
.data 0x13000 0x3798 0x1000 1.44 df0487c473064a21f0e13cb4563eab51
( 6 imports )
> USER32.dll: LoadImageA
> ADVAPI32.dll: RegCloseKey, RegEnumValueA, RegOpenKeyExA, RegGetKeySecurity, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, LookupAccountSidA, GetTokenInformation, OpenProcessToken
> WS2_32.dll: -, -
> WININET.dll: InternetReadFile, HttpQueryInfoA, InternetCloseHandle, InternetOpenUrlA, InternetOpenA
> NETAPI32.dll: NetUserGetInfo, NetApiBufferFree
> KERNEL32.dll: GetCurrentProcess, GetSystemInfo, VirtualProtect, GetLocaleInfoA, FlushFileBuffers, GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, SetStdHandle, GetCPInfo, GetOEMCP, GetACP, GetVolumeInformationA, GetFileTime, GetProcessPriorityBoost, GetSystemDirectoryA, OpenProcess, GetStartupInfoA, GetFileType, CreateDirectoryA, OpenMutexA, CreateMutexA, CloseHandle, GetDriveTypeA, GetLogicalDriveStringsA, Sleep, GetLastError, GetLocalTime, GetEnvironmentVariableA, SetEnvironmentVariableA, GetShortPathNameA, ExitProcess, SetFileAttributesA, CreateFileA, CreateProcessA, GlobalFree, CreateThread, GlobalAlloc, MultiByteToWideChar, GetModuleFileNameA, CopyFileA, WriteFile, RtlUnwind, GetSystemTimeAsFileTime, GetProcAddress, GetModuleHandleA, TerminateProcess, GetCommandLineA, GetVersionExA, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, HeapReAlloc, HeapAlloc, HeapSize, GetStdHandle, UnhandledExceptionFilter, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, HeapDestroy, HeapCreate, VirtualFree, HeapFree, SetFilePointer, LoadLibraryA, InterlockedExchange, VirtualQuery, SetUnhandledExceptionFilter, IsBadReadPtr, IsBadWritePtr, IsBadCodePtr, VirtualAlloc
( 0 exports )
Prevx info: <a href='http://info.prevx.com/aboutprogramtext.asp?PX5=E63C122900256817408B01E065B9C30059FE32D8' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=E63C122900256817408B01E065B9C30059FE32D8</a>
mqtgsvc.exe (Windows) :
Antivirus Version Dernière mise à jour Résultat
a-squared 4.0.0.93 2009.02.11 Trojan-Downloader.Win32.Calac!IK
AhnLab-V3 5.0.0.2 2009.02.11 -
AntiVir 7.9.0.76 2009.02.11 -
Authentium 5.1.0.4 2009.02.11 -
Avast 4.8.1335.0 2009.02.11 -
AVG 8.0.0.229 2009.02.11 BackDoor.Generic_r.EK
BitDefender 7.2 2009.02.11 -
CAT-QuickHeal 10.00 2009.02.11 -
ClamAV 0.94.1 2009.02.11 -
Comodo 974 2009.02.11 -
DrWeb 4.44.0.09170 2009.02.11 -
eSafe 7.0.17.0 2009.02.11 -
eTrust-Vet 31.6.6350 2009.02.11 -
F-Prot 4.4.4.56 2009.02.11 W32/Horst.C.gen!Eldorado
F-Secure 8.0.14470.0 2009.02.11 -
Fortinet 3.117.0.0 2009.02.11 -
GData 19 2009.02.11 -
Ikarus T3.1.1.45.0 2009.02.11 Trojan-Downloader.Win32.Calac
K7AntiVirus 7.10.627 2009.02.11 -
Kaspersky 7.0.0.125 2009.02.11 -
McAfee 5522 2009.02.10 -
McAfee+Artemis 5522 2009.02.10 -
Microsoft 1.4306 2009.02.11 -
NOD32 3846 2009.02.11 -
Norman 6.00.02 2009.02.11 -
nProtect 2009.1.8.0 2009.02.11 -
Panda 10.0.0.10 2009.02.11 Suspicious file
PCTools 4.4.2.0 2009.02.11 -
Prevx1 V2 2009.02.11 Malicious Software
Rising 21.16.22.00 2009.02.11 -
SecureWeb-Gateway 6.7.6 2009.02.11 -
Sophos 4.38.0 2009.02.11 -
Sunbelt 3.2.1851.2 2009.02.11 -
Symantec 10 2009.02.11 -
TheHacker 6.3.1.85.252 2009.02.11 -
TrendMicro 8.700.0.1004 2009.02.11 -
VBA32 3.12.8.12 2009.02.11 -
ViRobot 2009.2.11.1600 2009.02.11 -
VirusBuster 4.5.11.0 2009.02.11 -
Information additionnelle
File size: 81920 bytes
MD5...: e3cbaeb32ace3b1bddc88505a14cf07b
SHA1..: 88297bb8b72b96af7a1ee1235bb19e71f9876362
SHA256: 1d18798809ea2456a970715679ff4b2d33d4a0992bd432983a2edb0340e090b8
SHA512: ca5a9f21f6ee837d16f85e512a433bb0c3dbed7d2b68cb1d400b0e5dd57766d8
a21d2675c19339fbb6a1bd6a97b8630a1085ded5bb4bb62d7fbd55cb2a9835bd
ssdeep: 1536:aM5stUDRrC6WBfkSjJbRN7Y/efkrGYDgRwqwQGcmt:4tARe62XNbRrkQGcm
t
PEiD..: -
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0xa966
timedatestamp.....: 0x49737c7a (Sun Jan 18 19:01:14 2009)
machinetype.......: 0x14c (I386)
( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xf1ef 0x10000 6.16 f1ffe9bddded1a072d3f7a25b961edd9
.rdata 0x11000 0x1e62 0x2000 5.20 7ad75fb56c36f172a03f8c33b5e5fd10
.data 0x13000 0x3798 0x1000 1.44 df0487c473064a21f0e13cb4563eab51
( 6 imports )
> USER32.dll: LoadImageA
> ADVAPI32.dll: RegCloseKey, RegEnumValueA, RegOpenKeyExA, RegGetKeySecurity, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, LookupAccountSidA, GetTokenInformation, OpenProcessToken
> WS2_32.dll: -, -
> WININET.dll: InternetReadFile, HttpQueryInfoA, InternetCloseHandle, InternetOpenUrlA, InternetOpenA
> NETAPI32.dll: NetUserGetInfo, NetApiBufferFree
> KERNEL32.dll: GetCurrentProcess, GetSystemInfo, VirtualProtect, GetLocaleInfoA, FlushFileBuffers, GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, SetStdHandle, GetCPInfo, GetOEMCP, GetACP, GetVolumeInformationA, GetFileTime, GetProcessPriorityBoost, GetSystemDirectoryA, OpenProcess, GetStartupInfoA, GetFileType, CreateDirectoryA, OpenMutexA, CreateMutexA, CloseHandle, GetDriveTypeA, GetLogicalDriveStringsA, Sleep, GetLastError, GetLocalTime, GetEnvironmentVariableA, SetEnvironmentVariableA, GetShortPathNameA, ExitProcess, SetFileAttributesA, CreateFileA, CreateProcessA, GlobalFree, CreateThread, GlobalAlloc, MultiByteToWideChar, GetModuleFileNameA, CopyFileA, WriteFile, RtlUnwind, GetSystemTimeAsFileTime, GetProcAddress, GetModuleHandleA, TerminateProcess, GetCommandLineA, GetVersionExA, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, HeapReAlloc, HeapAlloc, HeapSize, GetStdHandle, UnhandledExceptionFilter, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, HeapDestroy, HeapCreate, VirtualFree, HeapFree, SetFilePointer, LoadLibraryA, InterlockedExchange, VirtualQuery, SetUnhandledExceptionFilter, IsBadReadPtr, IsBadWritePtr, IsBadCodePtr, VirtualAlloc
( 0 exports )
Prevx info: <a href='http://info.prevx.com/aboutprogramtext.asp?PX5=E63C122900256817408B01E065B9C30059FE32D8' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=E63C122900256817408B01E065B9C30059FE32D8</a>
mstinit.exe (D&S) :
Antivirus Version Dernière mise à jour Résultat
a-squared 4.0.0.93 2009.02.11 Trojan-Downloader.Win32.Calac!IK
AhnLab-V3 5.0.0.2 2009.02.11 -
AntiVir 7.9.0.76 2009.02.11 -
Authentium 5.1.0.4 2009.02.11 -
Avast 4.8.1335.0 2009.02.11 -
AVG 8.0.0.229 2009.02.11 BackDoor.Generic_r.EK
BitDefender 7.2 2009.02.11 -
CAT-QuickHeal 10.00 2009.02.11 -
ClamAV 0.94.1 2009.02.11 -
Comodo 974 2009.02.11 -
DrWeb 4.44.0.09170 2009.02.11 -
eSafe 7.0.17.0 2009.02.11 -
eTrust-Vet 31.6.6350 2009.02.11 -
F-Prot 4.4.4.56 2009.02.11 W32/Horst.C.gen!Eldorado
F-Secure 8.0.14470.0 2009.02.11 -
Fortinet 3.117.0.0 2009.02.11 -
GData 19 2009.02.11 -
Ikarus T3.1.1.45.0 2009.02.11 Trojan-Downloader.Win32.Calac
K7AntiVirus 7.10.627 2009.02.11 -
Kaspersky 7.0.0.125 2009.02.11 -
McAfee 5522 2009.02.10 -
McAfee+Artemis 5522 2009.02.10 -
Microsoft 1.4306 2009.02.11 -
NOD32 3846 2009.02.11 -
Norman 6.00.02 2009.02.11 -
nProtect 2009.1.8.0 2009.02.11 -
Panda 10.0.0.10 2009.02.11 Suspicious file
PCTools 4.4.2.0 2009.02.11 -
Prevx1 V2 2009.02.11 Malicious Software
Rising 21.16.22.00 2009.02.11 -
SecureWeb-Gateway 6.7.6 2009.02.11 -
Sophos 4.38.0 2009.02.11 -
Sunbelt 3.2.1851.2 2009.02.11 -
Symantec 10 2009.02.11 -
TheHacker 6.3.1.85.252 2009.02.11 -
TrendMicro 8.700.0.1004 2009.02.11 -
VBA32 3.12.8.12 2009.02.11 -
ViRobot 2009.2.11.1600 2009.02.11 -
VirusBuster 4.5.11.0 2009.02.11 -
Information additionnelle
File size: 81920 bytes
MD5...: e3cbaeb32ace3b1bddc88505a14cf07b
SHA1..: 88297bb8b72b96af7a1ee1235bb19e71f9876362
SHA256: 1d18798809ea2456a970715679ff4b2d33d4a0992bd432983a2edb0340e090b8
SHA512: ca5a9f21f6ee837d16f85e512a433bb0c3dbed7d2b68cb1d400b0e5dd57766d8
a21d2675c19339fbb6a1bd6a97b8630a1085ded5bb4bb62d7fbd55cb2a9835bd
ssdeep: 1536:aM5stUDRrC6WBfkSjJbRN7Y/efkrGYDgRwqwQGcmt:4tARe62XNbRrkQGcm
t
PEiD..: -
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0xa966
timedatestamp.....: 0x49737c7a (Sun Jan 18 19:01:14 2009)
machinetype.......: 0x14c (I386)
( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xf1ef 0x10000 6.16 f1ffe9bddded1a072d3f7a25b961edd9
.rdata 0x11000 0x1e62 0x2000 5.20 7ad75fb56c36f172a03f8c33b5e5fd10
.data 0x13000 0x3798 0x1000 1.44 df0487c473064a21f0e13cb4563eab51
( 6 imports )
> USER32.dll: LoadImageA
> ADVAPI32.dll: RegCloseKey, RegEnumValueA, RegOpenKeyExA, RegGetKeySecurity, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, LookupAccountSidA, GetTokenInformation, OpenProcessToken
> WS2_32.dll: -, -
> WININET.dll: InternetReadFile, HttpQueryInfoA, InternetCloseHandle, InternetOpenUrlA, InternetOpenA
> NETAPI32.dll: NetUserGetInfo, NetApiBufferFree
> KERNEL32.dll: GetCurrentProcess, GetSystemInfo, VirtualProtect, GetLocaleInfoA, FlushFileBuffers, GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, SetStdHandle, GetCPInfo, GetOEMCP, GetACP, GetVolumeInformationA, GetFileTime, GetProcessPriorityBoost, GetSystemDirectoryA, OpenProcess, GetStartupInfoA, GetFileType, CreateDirectoryA, OpenMutexA, CreateMutexA, CloseHandle, GetDriveTypeA, GetLogicalDriveStringsA, Sleep, GetLastError, GetLocalTime, GetEnvironmentVariableA, SetEnvironmentVariableA, GetShortPathNameA, ExitProcess, SetFileAttributesA, CreateFileA, CreateProcessA, GlobalFree, CreateThread, GlobalAlloc, MultiByteToWideChar, GetModuleFileNameA, CopyFileA, WriteFile, RtlUnwind, GetSystemTimeAsFileTime, GetProcAddress, GetModuleHandleA, TerminateProcess, GetCommandLineA, GetVersionExA, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, HeapReAlloc, HeapAlloc, HeapSize, GetStdHandle, UnhandledExceptionFilter, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, HeapDestroy, HeapCreate, VirtualFree, HeapFree, SetFilePointer, LoadLibraryA, InterlockedExchange, VirtualQuery, SetUnhandledExceptionFilter, IsBadReadPtr, IsBadWritePtr, IsBadCodePtr, VirtualAlloc
( 0 exports )
Prevx info: <a href='http://info.prevx.com/aboutprogramtext.asp?PX5=E63C122900256817408B01E065B9C30059FE32D8' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=E63C122900256817408B01E065B9C30059FE32D8</a>
clipsrv.exe : (D&S)
Antivirus Version Dernière mise à jour Résultat
a-squared 4.0.0.93 2009.02.11 Trojan-Downloader.Win32.Calac!IK
AhnLab-V3 5.0.0.2 2009.02.11 -
AntiVir 7.9.0.76 2009.02.11 -
Authentium 5.1.0.4 2009.02.11 -
Avast 4.8.1335.0 2009.02.11 -
AVG 8.0.0.229 2009.02.11 BackDoor.Generic_r.EK
BitDefender 7.2 2009.02.11 -
CAT-QuickHeal 10.00 2009.02.11 -
ClamAV 0.94.1 2009.02.11 -
Comodo 974 2009.02.11 -
DrWeb 4.44.0.09170 2009.02.11 -
eSafe 7.0.17.0 2009.02.11 -
eTrust-Vet 31.6.6350 2009.02.11 -
F-Prot 4.4.4.56 2009.02.11 W32/Horst.C.gen!Eldorado
F-Secure 8.0.14470.0 2009.02.11 -
Fortinet 3.117.0.0 2009.02.11 -
GData 19 2009.02.11 -
Ikarus T3.1.1.45.0 2009.02.11 Trojan-Downloader.Win32.Calac
K7AntiVirus 7.10.627 2009.02.11 -
Kaspersky 7.0.0.125 2009.02.11 -
McAfee 5522 2009.02.10 -
McAfee+Artemis 5522 2009.02.10 -
Microsoft 1.4306 2009.02.11 -
NOD32 3846 2009.02.11 -
Norman 6.00.02 2009.02.11 -
nProtect 2009.1.8.0 2009.02.11 -
Panda 10.0.0.10 2009.02.11 Suspicious file
PCTools 4.4.2.0 2009.02.11 -
Prevx1 V2 2009.02.11 Malicious Software
Rising 21.16.22.00 2009.02.11 -
SecureWeb-Gateway 6.7.6 2009.02.11 -
Sophos 4.38.0 2009.02.11 -
Sunbelt 3.2.1851.2 2009.02.11 -
Symantec 10 2009.02.11 -
TheHacker 6.3.1.85.252 2009.02.11 -
TrendMicro 8.700.0.1004 2009.02.11 -
VBA32 3.12.8.12 2009.02.11 -
ViRobot 2009.2.11.1600 2009.02.11 -
VirusBuster 4.5.11.0 2009.02.11 -
Information additionnelle
File size: 81920 bytes
MD5...: e3cbaeb32ace3b1bddc88505a14cf07b
SHA1..: 88297bb8b72b96af7a1ee1235bb19e71f9876362
SHA256: 1d18798809ea2456a970715679ff4b2d33d4a0992bd432983a2edb0340e090b8
SHA512: ca5a9f21f6ee837d16f85e512a433bb0c3dbed7d2b68cb1d400b0e5dd57766d8
a21d2675c19339fbb6a1bd6a97b8630a1085ded5bb4bb62d7fbd55cb2a9835bd
ssdeep: 1536:aM5stUDRrC6WBfkSjJbRN7Y/efkrGYDgRwqwQGcmt:4tARe62XNbRrkQGcm
t
PEiD..: -
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0xa966
timedatestamp.....: 0x49737c7a (Sun Jan 18 19:01:14 2009)
machinetype.......: 0x14c (I386)
( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xf1ef 0x10000 6.16 f1ffe9bddded1a072d3f7a25b961edd9
.rdata 0x11000 0x1e62 0x2000 5.20 7ad75fb56c36f172a03f8c33b5e5fd10
.data 0x13000 0x3798 0x1000 1.44 df0487c473064a21f0e13cb4563eab51
( 6 imports )
> USER32.dll: LoadImageA
> ADVAPI32.dll: RegCloseKey, RegEnumValueA, RegOpenKeyExA, RegGetKeySecurity, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, LookupAccountSidA, GetTokenInformation, OpenProcessToken
> WS2_32.dll: -, -
> WININET.dll: InternetReadFile, HttpQueryInfoA, InternetCloseHandle, InternetOpenUrlA, InternetOpenA
> NETAPI32.dll: NetUserGetInfo, NetApiBufferFree
> KERNEL32.dll: GetCurrentProcess, GetSystemInfo, VirtualProtect, GetLocaleInfoA, FlushFileBuffers, GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, SetStdHandle, GetCPInfo, GetOEMCP, GetACP, GetVolumeInformationA, GetFileTime, GetProcessPriorityBoost, GetSystemDirectoryA, OpenProcess, GetStartupInfoA, GetFileType, CreateDirectoryA, OpenMutexA, CreateMutexA, CloseHandle, GetDriveTypeA, GetLogicalDriveStringsA, Sleep, GetLastError, GetLocalTime, GetEnvironmentVariableA, SetEnvironmentVariableA, GetShortPathNameA, ExitProcess, SetFileAttributesA, CreateFileA, CreateProcessA, GlobalFree, CreateThread, GlobalAlloc, MultiByteToWideChar, GetModuleFileNameA, CopyFileA, WriteFile, RtlUnwind, GetSystemTimeAsFileTime, GetProcAddress, GetModuleHandleA, TerminateProcess, GetCommandLineA, GetVersionExA, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, HeapReAlloc, HeapAlloc, HeapSize, GetStdHandle, UnhandledExceptionFilter, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, HeapDestroy, HeapCreate, VirtualFree, HeapFree, SetFilePointer, LoadLibraryA, InterlockedExchange, VirtualQuery, SetUnhandledExceptionFilter, IsBadReadPtr, IsBadWritePtr, IsBadCodePtr, VirtualAlloc
( 0 exports )
Prevx info: <a href='http://info.prevx.com/aboutprogramtext.asp?PX5=E63C122900256817408B01E065B9C30059FE32D8' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=E63C122900256817408B01E065B9C30059FE32D8</a>
mstsc.exe (Windows) :
Antivirus Version Dernière mise à jour Résultat
a-squared 4.0.0.93 2009.02.11 Trojan-Downloader.Win32.Calac!IK
AhnLab-V3 5.0.0.2 2009.02.11 -
AntiVir 7.9.0.76 2009.02.11 -
Authentium 5.1.0.4 2009.02.11 -
Avast 4.8.1335.0 2009.02.11 -
AVG 8.0.0.229 2009.02.11 BackDoor.Generic_r.EK
BitDefender 7.2 2009.02.11 -
CAT-QuickHeal 10.00 2009.02.11 -
ClamAV 0.94.1 2009.02.11 -
Comodo 974 2009.02.11 -
DrWeb 4.44.0.09170 2009.02.11 -
eSafe 7.0.17.0 2009.02.11 -
eTrust-Vet 31.6.6350 2009.02.11 -
F-Prot 4.4.4.56 2009.02.11 W32/Horst.C.gen!Eldorado
F-Secure 8.0.14470.0 2009.02.11 -
Fortinet 3.117.0.0 2009.02.11 -
GData 19 2009.02.11 -
Ikarus T3.1.1.45.0 2009.02.11 Trojan-Downloader.Win32.Calac
K7AntiVirus 7.10.627 2009.02.11 -
Kaspersky 7.0.0.125 2009.02.11 -
McAfee 5522 2009.02.10 -
McAfee+Artemis 5522 2009.02.10 -
Microsoft 1.4306 2009.02.11 -
NOD32 3846 2009.02.11 -
Norman 6.00.02 2009.02.11 -
nProtect 2009.1.8.0 2009.02.11 -
Panda 10.0.0.10 2009.02.11 Suspicious file
PCTools 4.4.2.0 2009.02.11 -
Prevx1 V2 2009.02.11 Malicious Software
Rising 21.16.22.00 2009.02.11 -
SecureWeb-Gateway 6.7.6 2009.02.11 -
Sophos 4.38.0 2009.02.11 -
Sunbelt 3.2.1851.2 2009.02.11 -
Symantec 10 2009.02.11 -
TheHacker 6.3.1.85.252 2009.02.11 -
TrendMicro 8.700.0.1004 2009.02.11 -
VBA32 3.12.8.12 2009.02.11 -
ViRobot 2009.2.11.1600 2009.02.11 -
VirusBuster 4.5.11.0 2009.02.11 -
Information additionnelle
File size: 81920 bytes
MD5...: e3cbaeb32ace3b1bddc88505a14cf07b
SHA1..: 88297bb8b72b96af7a1ee1235bb19e71f9876362
SHA256: 1d18798809ea2456a970715679ff4b2d33d4a0992bd432983a2edb0340e090b8
SHA512: ca5a9f21f6ee837d16f85e512a433bb0c3dbed7d2b68cb1d400b0e5dd57766d8
a21d2675c19339fbb6a1bd6a97b8630a1085ded5bb4bb62d7fbd55cb2a9835bd
ssdeep: 1536:aM5stUDRrC6WBfkSjJbRN7Y/efkrGYDgRwqwQGcmt:4tARe62XNbRrkQGcm
t
PEiD..: -
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0xa966
timedatestamp.....: 0x49737c7a (Sun Jan 18 19:01:14 2009)
machinetype.......: 0x14c (I386)
( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xf1ef 0x10000 6.16 f1ffe9bddded1a072d3f7a25b961edd9
.rdata 0x11000 0x1e62 0x2000 5.20 7ad75fb56c36f172a03f8c33b5e5fd10
.data 0x13000 0x3798 0x1000 1.44 df0487c473064a21f0e13cb4563eab51
( 6 imports )
> USER32.dll: LoadImageA
> ADVAPI32.dll: RegCloseKey, RegEnumValueA, RegOpenKeyExA, RegGetKeySecurity, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, LookupAccountSidA, GetTokenInformation, OpenProcessToken
> WS2_32.dll: -, -
> WININET.dll: InternetReadFile, HttpQueryInfoA, InternetCloseHandle, InternetOpenUrlA, InternetOpenA
> NETAPI32.dll: NetUserGetInfo, NetApiBufferFree
> KERNEL32.dll: GetCurrentProcess, GetSystemInfo, VirtualProtect, GetLocaleInfoA, FlushFileBuffers, GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, SetStdHandle, GetCPInfo, GetOEMCP, GetACP, GetVolumeInformationA, GetFileTime, GetProcessPriorityBoost, GetSystemDirectoryA, OpenProcess, GetStartupInfoA, GetFileType, CreateDirectoryA, OpenMutexA, CreateMutexA, CloseHandle, GetDriveTypeA, GetLogicalDriveStringsA, Sleep, GetLastError, GetLocalTime, GetEnvironmentVariableA, SetEnvironmentVariableA, GetShortPathNameA, ExitProcess, SetFileAttributesA, CreateFileA, CreateProcessA, GlobalFree, CreateThread, GlobalAlloc, MultiByteToWideChar, GetModuleFileNameA, CopyFileA, WriteFile, RtlUnwind, GetSystemTimeAsFileTime, GetProcAddress, GetModuleHandleA, TerminateProcess, GetCommandLineA, GetVersionExA, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, HeapReAlloc, HeapAlloc, HeapSize, GetStdHandle, UnhandledExceptionFilter, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, HeapDestroy, HeapCreate, VirtualFree, HeapFree, SetFilePointer, LoadLibraryA, InterlockedExchange, VirtualQuery, SetUnhandledExceptionFilter, IsBadReadPtr, IsBadWritePtr, IsBadCodePtr, VirtualAlloc
( 0 exports )
Prevx info: <a href='http://info.prevx.com/aboutprogramtext.asp?PX5=E63C122900256817408B01E065B9C30059FE32D8' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=E63C122900256817408B01E065B9C30059FE32D8</a>
-
-
Bonsoir,
Copie ou imprime les instructions avant
Déconnecte toi d'internet et ferme toutes tes applications.
Désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)
Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :
Files::
c:\windows\system\clipsrv.exe
c:\windows\system\esentutl.exe
c:\windows\rsvp.exe
c:\windows\system32\drivers\sessmgr.exe
c:\windows\dllhst3g.exe
c:\windows\system32\drivers\mstsc.exe
c:\windows\system32\drivers\dllhst3g.exe
c:\windows\cisvc.exe
c:\windows\system\logman.exe
c:\documents and settings\Giorgetti Laurent\Application Data\cmstp.exe
c:\windows\system\dllhst3g.exe
c:\windows\logman.exe
c:\documents and settings\Giorgetti Laurent\Application Data\cisvc.exe
c:\windows\mqtgsvc.exe
c:\windows\system32\drivers\ieudinit.exe
c:\documents and settings\Giorgetti Laurent\Application Data\mstinit.exe
c:\windows\system32\drivers\clipsrv.exe
c:\windows\system\mstinit.exe
c:\documents and settings\Giorgetti Laurent\Application Data\clipsrv.exe
Enregistre ce fichier sous le nom CFscript
Fait un glisser/déposer de ce fichier CFscript sur le fichier ComboFix.exe
Clique sur le fichier CFscript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFscrïpt vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.
Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
Réactive ton parefeu, ton antivirus, la garde de ton antispyware
Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
Remets aussi un rapport Hijackthis
Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt
Attention : cette manip a été fait pour cet ordi. Tout réutilisation peut endommager sévèrement le système d'exploitation.-
ComboFix 09-02-10.01 - Giorgetti Laurent 2009-02-11 23:00:26.6 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.511.285 [GMT 1:00]
Lancé depuis: c:\documents and settings\Giorgetti Laurent\Bureau\C-Fix.exe
Commutateurs utilisés :: c:\documents and settings\Giorgetti Laurent\Bureau\CFScript.txt
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated)
* Un nouveau point de restauration a été créé
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-01-11 au 2009-02-11 ))))))))))))))))))))))))))))))))))))
.
2009-02-11 17:06 . 2009-02-11 17:07 1,374 --a------ c:\windows\imsins.BAK
2009-02-10 20:54 . 2009-01-18 20:05 81,920 --a------ c:\windows\system\clipsrv.exe
2009-02-10 20:47 . 2009-01-18 20:05 81,920 --a------ c:\windows\system\esentutl.exe
2009-02-10 20:41 . 2009-01-18 20:05 81,920 --a------ c:\windows\rsvp.exe
2009-02-10 20:30 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\sessmgr.exe
2009-02-10 20:28 . 2009-01-18 20:05 81,920 --a------ c:\windows\dllhst3g.exe
2009-02-10 20:23 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\mstsc.exe
2009-02-10 20:18 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\dllhst3g.exe
2009-02-10 20:14 . 2009-01-18 20:05 81,920 --a------ c:\windows\cisvc.exe
2009-02-10 20:09 . 2009-01-18 20:05 81,920 --a------ c:\windows\system\logman.exe
2009-02-10 20:03 . 2009-01-18 20:05 81,920 --a------ c:\documents and settings\Giorgetti Laurent\Application Data\cmstp.exe
2009-02-10 19:46 . 2009-01-18 20:05 81,920 --a------ c:\windows\system\dllhst3g.exe
2009-02-10 19:43 . 2009-01-18 20:05 81,920 --a------ c:\windows\logman.exe
2009-02-10 19:42 . 2009-01-18 20:05 81,920 --a------ c:\documents and settings\Giorgetti Laurent\Application Data\cisvc.exe
2009-02-10 19:40 . 2009-01-18 20:05 81,920 --a------ c:\windows\mqtgsvc.exe
2009-02-10 19:37 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\ieudinit.exe
2009-02-10 19:37 . 2009-01-18 20:05 81,920 --a------ c:\documents and settings\Giorgetti Laurent\Application Data\mstinit.exe
2009-02-10 19:36 . 2009-01-18 20:05 81,920 --a------ c:\windows\system32\drivers\clipsrv.exe
2009-02-10 19:34 . 2009-01-18 20:05 81,920 --a------ c:\windows\system\mstinit.exe
2009-02-10 19:21 . 2009-01-18 20:05 81,920 --a------ c:\documents and settings\Giorgetti Laurent\Application Data\clipsrv.exe
2009-02-10 18:25 . 2009-02-10 18:25 <REP> d-------- c:\documents and settings\NetworkService\Bureau
2009-02-10 17:14 . 2003-01-21 03:00 13,112,456 -ra------ c:\documents and settings\Administrateur\MpSetup.exe
2009-02-10 17:13 . 2004-02-19 01:38 <REP> d--h----- c:\documents and settings\Administrateur\Voisinage réseau
2009-02-10 17:13 . 2004-02-19 01:38 <REP> d--h----- c:\documents and settings\Administrateur\Voisinage d'impression
2009-02-10 17:13 . 2004-02-19 01:38 <REP> d--h----- c:\documents and settings\Administrateur\Modèles
2009-02-10 17:13 . 2004-02-19 01:48 <REP> dr------- c:\documents and settings\Administrateur\Mes documents
2009-02-10 17:13 . 2004-02-19 01:38 <REP> dr------- c:\documents and settings\Administrateur\Menu Démarrer
2009-02-10 17:13 . 2004-02-19 01:48 <REP> dr------- c:\documents and settings\Administrateur\Favoris
2009-02-10 17:13 . 2004-02-19 01:38 <REP> d-------- c:\documents and settings\Administrateur\Bureau
2009-02-10 17:13 . 2009-02-10 17:13 <REP> d-------- c:\documents and settings\Administrateur
2009-02-10 08:05 . 2009-01-18 20:05 81,920 --a------ c:\windows\mstsc.exe
2009-02-10 02:35 . 2009-01-18 20:05 81,920 --a------ c:\windows\system\comrepl.exe
2009-02-10 01:54 . 2009-02-10 01:54 <REP> d-------- C:\rsit
2009-02-10 01:48 . 2009-02-10 01:48 <REP> d-------- c:\program files\Avira
2009-02-10 01:48 . 2009-02-10 01:48 <REP> d-------- c:\documents and settings\All Users\Application Data\Avira
2009-02-10 01:14 . 2009-02-10 01:14 <REP> d-------- c:\documents and settings\Giorgetti Laurent\Application Data\Malwarebytes
2009-02-10 01:14 . 2009-02-10 01:14 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-10 01:14 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-10 01:14 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-10 00:47 . 2009-02-10 00:47 <REP> d-------- C:\Lop SD
2009-02-09 23:46 . 2009-02-09 23:46 <REP> d-------- c:\documents and settings\All Users\Application Data\TEMP
2009-02-03 00:17 . 2009-02-02 23:54 15,688 --a------ c:\windows\system32\lsdelete.exe
2009-02-03 00:03 . 2009-02-03 00:03 <REP> d-------- c:\documents and settings\LocalService\Bureau
2009-02-02 23:54 . 2009-02-02 23:54 64,160 --a------ c:\windows\system32\drivers\Lbd.sys
2009-02-02 23:03 . 2009-02-02 23:03 <REP> d-------- c:\program files\Lavasoft
2009-02-02 23:03 . 2009-02-02 23:03 <REP> d-------- c:\documents and settings\All Users\Application Data\Lavasoft
2009-02-02 23:03 . 2009-02-02 23:03 <REP> d--h----- c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-01-24 15:01 . 2009-01-24 15:01 <REP> d-------- c:\program files\iPod
2009-01-24 14:58 . 2009-01-24 14:58 <REP> d-------- c:\program files\QuickTime
2009-01-24 14:53 . 2009-01-24 14:53 <REP> d-------- c:\program files\Bonjour
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-16 20:15 3,594,752 ------w c:\windows\system32\dllcache\mshtml.dll
2008-12-20 22:47 826,368 ----a-w c:\windows\system32\wininet.dll
2008-12-20 22:47 826,368 ------w c:\windows\system32\dllcache\wininet.dll
2008-12-20 22:47 671,232 ------w c:\windows\system32\dllcache\mstime.dll
2008-12-20 22:47 477,696 ------w c:\windows\system32\dllcache\mshtmled.dll
2008-12-20 22:47 44,544 ------w c:\windows\system32\dllcache\pngfilt.dll
2008-12-20 22:47 233,472 ------w c:\windows\system32\dllcache\webcheck.dll
2008-12-20 22:47 193,024 ------w c:\windows\system32\dllcache\msrating.dll
2008-12-20 22:47 105,984 ------w c:\windows\system32\dllcache\url.dll
2008-12-20 22:47 102,912 ------w c:\windows\system32\dllcache\occache.dll
2008-12-20 22:47 1,160,192 ------w c:\windows\system32\dllcache\urlmon.dll
2008-12-19 09:11 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe
2008-12-19 09:10 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe
2008-12-19 05:25 634,024 ------w c:\windows\system32\dllcache\iexplore.exe
2008-12-19 05:23 161,792 ------w c:\windows\system32\dllcache\ieakui.dll
2008-12-17 17:26 --------- d-----w c:\program files\Microsoft Silverlight
2008-12-17 17:25 --------- d-----w c:\program files\Microsoft
2008-12-17 17:24 --------- d-----w c:\program files\Windows Live SkyDrive
2008-12-17 17:17 --------- d-----w c:\program files\Fichiers communs\Windows Live
2008-12-12 10:18 87,336 ----a-w c:\windows\system32\dns-sd.exe
2008-12-12 10:11 61,440 ----a-w c:\windows\system32\dnssd.dll
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-12-11 10:57 333,952 ------w c:\windows\system32\dllcache\srv.sys
2008-12-02 21:37 49,480 ----a-w c:\windows\system32\sirenacm.dll
2008-11-21 21:47 524,288 ----a-w c:\windows\system32\DivXsm.exe
2008-11-21 21:47 3,596,288 ----a-w c:\windows\system32\qt-dx331.dll
2008-11-21 21:46 200,704 ----a-w c:\windows\system32\ssldivx.dll
2008-11-21 21:46 1,044,480 ----a-w c:\windows\system32\libdivx.dll
2008-11-21 21:45 823,296 ----a-w c:\windows\system32\divx_xx0c.dll
2008-11-21 21:45 823,296 ----a-w c:\windows\system32\divx_xx07.dll
2008-11-21 21:45 815,104 ----a-w c:\windows\system32\divx_xx0a.dll
2008-11-21 21:45 81,920 ----a-w c:\windows\system32\dpl100.dll
2008-11-21 21:45 802,816 ----a-w c:\windows\system32\divx_xx11.dll
2008-11-21 21:45 593,920 ----a-w c:\windows\system32\dpuGUI11.dll
2008-11-21 21:45 57,344 ----a-w c:\windows\system32\dpv11.dll
2008-11-21 21:45 53,248 ----a-w c:\windows\system32\dpuGUI10.dll
2008-11-21 21:45 344,064 ----a-w c:\windows\system32\dpus11.dll
2008-11-21 21:45 294,912 ----a-w c:\windows\system32\dpu11.dll
2008-11-21 21:45 294,912 ----a-w c:\windows\system32\dpu10.dll
2008-11-21 21:45 196,608 ----a-w c:\windows\system32\dtu100.dll
2008-11-21 21:44 161,096 ----a-w c:\windows\system32\DivXCodecVersionChecker.exe
2008-11-21 21:44 12,288 ----a-w c:\windows\system32\DivXWMPExtType.dll
2003-01-21 02:00 13,112,456 ----a-r c:\windows\system32\config\systemprofile\MpSetup.exe
2003-01-21 02:00 13,112,456 ----a-r c:\documents and settings\Giorgetti Laurent\MpSetup.exe
2003-01-21 02:00 13,112,456 ----a-r c:\documents and settings\Default User\MpSetup.exe
2008-10-04 00:53 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008100420081005\index.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2008-12-02 3882312]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Google Update"="c:\documents and settings\Giorgetti Laurent\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-05 133104]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="LaunApp" [X]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-01-27 335872]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2003-11-20 98304]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2003-11-20 499712]
"LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2003-04-28 184320]
"RemoteControl"="c:\sysinfo\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-21 40960]
"LaunchAp"="c:\program files\Launch Manager\LaunchAp.exe" [2004-01-28 32768]
"PowerKey"="c:\program files\Launch Manager\PowerKey.exe" [2002-08-30 94208]
"LManager"="c:\program files\Launch Manager\HotkeyApp.exe" [2004-02-04 45056]
"CtrlVol"="c:\program files\Launch Manager\CtrlVol.exe" [2004-01-28 184320]
"LMgrOSD"="c:\program files\Launch Manager\OSDCtrl.exe" [2004-02-03 49152]
"Wbutton"="c:\program files\Launch Manager\Wbutton.exe" [2004-01-30 65536]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Easy-PrintToolBox"="c:\program files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2004-01-14 409600]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="d:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-02-02 509784]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 c:\windows\system32\Ati2mdxx.exe]
"AGRSMMSG"="AGRSMMSG.exe" [2003-11-19 c:\windows\AGRSMMSG.exe]
"SoundMan"="SOUNDMAN.EXE" [2003-12-19 c:\windows\soundman.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_USERS\.DEFAULT\software\microsoft\windows\Currentversion\policies\explorer\Run]
"ComRepl"="c:\windows\System\comrepl.exe" [2009-01-18 81920]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\eMule\\emule.exe"=
"d:\\Program Files\\BitTorrent\\btdownloadgui.exe"=
"d:\\Program Files\\uTorrent\\uTorrent.exe"=
"d:\\Program Files\\Zattoo\\zattood.exe"=
"d:\\Program Files\\Zattoo\\Zattoo1.exe"=
"c:\\WINDOWS\\System32\\rtcshare.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"d:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-02-02 64160]
R1 Hotkey;Hotkey;c:\windows\system32\drivers\HOTKEY.sys [2004-02-20 9867]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 950096]
R3 POWERKEY;POWERKEY;c:\program files\Launch Manager\POWERKEY.SYS [2008-08-16 2343]
S1 Wbutton;Wbutton;c:\windows\system32\drivers\Wbutton.sys --> c:\windows\system32\drivers\Wbutton.sys [?]
.
Contenu du dossier 'Tâches planifiées'
2009-01-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
2009-02-09 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-02-02 23:54]
2009-02-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4271046019-2757734838-2015800038-1005.job
- c:\documents and settings\Giorgetti Laurent\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-05 00:12]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.ch/
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Easy-WebPrint Ajouter à la liste d'impressions - d:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint Impression rapide - d:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Imprimer - d:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: Easy-WebPrint Prévisualiser - d:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-11 23:01:58
Windows 5.1.2600 Service Pack 3 FAT NTAPI
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\•€|ÿÿÿÿ"•€|þ»Ñw*]
"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(568)
c:\windows\system32\Ati2evxx.dll
.
Heure de fin: 2009-02-11 23:02:54
ComboFix-quarantined-files.txt 2009-02-11 22:02:52
ComboFix4.txt 2009-02-10 21:58:02
ComboFix5.txt 2009-02-11 21:59:54
ComboFix3.txt 2009-02-10 22:21:26
ComboFix2.txt 2009-02-11 16:32:54
Avant-CF: 2 821 914 624 octets libres
Après-CF: 2,810,642,432 octets libres
219 --- E O F --- 2009-02-11 16:10:51
Et le Hijackthis :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:08:18, on 11/02/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\SYSINFO\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Launch Manager\PowerKey.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\CtrlVol.exe
C:\Program Files\Launch Manager\OSDCtrl.exe
C:\Program Files\Launch Manager\Wbutton.exe
C:\Program Files\Java\jre6\bin\jusched.exe
D:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\Giorgetti Laurent\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Giorgetti Laurent\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Giorgetti Laurent\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
D:\Program Files\eMule\Divers\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ch/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - D:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [RemoteControl] C:\SYSINFO\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [LaunchApp] LaunApp
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe
O4 - HKLM\..\Run: [PowerKey] "C:\Program Files\Launch Manager\PowerKey.exe"
O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\HotkeyApp.exe
O4 - HKLM\..\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol.exe
O4 - HKLM\..\Run: [LMgrOSD] C:\Program Files\Launch Manager\OSDCtrl.exe
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Giorgetti Laurent\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [ComRepl] C:\WINDOWS\System\comrepl.exe /waitservice (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [ComRepl] C:\WINDOWS\System\comrepl.exe /waitservice (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
-
-
Bonsoir,
comme ça :
Copie ou imprime les instructions avant
Déconnecte toi d'internet et ferme toutes tes applications.
Désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)
Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :
File::
c:\windows\system\clipsrv.exe
c:\windows\system\esentutl.exe
c:\windows\rsvp.exe
c:\windows\system32\drivers\sessmgr.exe
c:\windows\dllhst3g.exe
c:\windows\system32\drivers\mstsc.exe
c:\windows\system32\drivers\dllhst3g.exe
c:\windows\cisvc.exe
c:\windows\system\logman.exe
c:\documents and settings\Giorgetti Laurent\Application Data\cmstp.exe
c:\windows\system\dllhst3g.exe
c:\windows\logman.exe
c:\documents and settings\Giorgetti Laurent\Application Data\cisvc.exe
c:\windows\mqtgsvc.exe
c:\windows\system32\drivers\ieudinit.exe
c:\documents and settings\Giorgetti Laurent\Application Data\mstinit.exe
c:\windows\system32\drivers\clipsrv.exe
c:\windows\system\mstinit.exe
c:\documents and settings\Giorgetti Laurent\Application Data\clipsrv.exe
REGNULL::
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\•€|ÿÿÿÿ"•€|þ»Ñw*]
Enregistre ce fichier sous le nom CFscript
Fait un glisser/déposer de ce fichier CFscript sur le fichier ComboFix.exe
Clique sur le fichier CFscript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFscrïpt vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.
Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
Réactive ton parefeu, ton antivirus, la garde de ton antispyware
Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
Remets aussi un rapport Hijackthis
Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt
Attention : cette manip a été fait pour cet ordi. Tout réutilisation peut endommager sévèrement le système d'exploitation.-
Voici :
ComboFix 09-02-10.01 - Giorgetti Laurent 2009-02-11 23:48:25.7 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.511.252 [GMT 1:00]
Lancé depuis: c:\documents and settings\Giorgetti Laurent\Bureau\C-Fix.exe
Commutateurs utilisés :: c:\documents and settings\Giorgetti Laurent\Bureau\CFScript.txt
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated)
* Un nouveau point de restauration a été créé
FILE ::
c:\documents and settings\Giorgetti Laurent\Application Data\cisvc.exe
c:\documents and settings\Giorgetti Laurent\Application Data\clipsrv.exe
c:\documents and settings\Giorgetti Laurent\Application Data\cmstp.exe
c:\documents and settings\Giorgetti Laurent\Application Data\mstinit.exe
c:\windows\cisvc.exe
c:\windows\dllhst3g.exe
c:\windows\logman.exe
c:\windows\mqtgsvc.exe
c:\windows\rsvp.exe
c:\windows\system\clipsrv.exe
c:\windows\system\dllhst3g.exe
c:\windows\system\esentutl.exe
c:\windows\system\logman.exe
c:\windows\system\mstinit.exe
c:\windows\system32\drivers\clipsrv.exe
c:\windows\system32\drivers\dllhst3g.exe
c:\windows\system32\drivers\ieudinit.exe
c:\windows\system32\drivers\mstsc.exe
c:\windows\system32\drivers\sessmgr.exe
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Giorgetti Laurent\Application Data\cisvc.exe
c:\documents and settings\Giorgetti Laurent\Application Data\clipsrv.exe
c:\documents and settings\Giorgetti Laurent\Application Data\cmstp.exe
c:\documents and settings\Giorgetti Laurent\Application Data\mstinit.exe
c:\windows\cisvc.exe
c:\windows\dllhst3g.exe
c:\windows\logman.exe
c:\windows\mqtgsvc.exe
c:\windows\rsvp.exe
c:\windows\system\clipsrv.exe
c:\windows\system\dllhst3g.exe
c:\windows\system\esentutl.exe
c:\windows\system\logman.exe
c:\windows\system\mstinit.exe
c:\windows\system32\drivers\clipsrv.exe
c:\windows\system32\drivers\dllhst3g.exe
c:\windows\system32\drivers\ieudinit.exe
c:\windows\system32\drivers\mstsc.exe
c:\windows\system32\drivers\sessmgr.exe
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-01-11 au 2009-02-11 ))))))))))))))))))))))))))))))))))))
.
2009-02-11 17:06 . 2009-02-11 17:07 1,374 --a------ c:\windows\imsins.BAK
2009-02-10 18:25 . 2009-02-10 18:25 <REP> d-------- c:\documents and settings\NetworkService\Bureau
2009-02-10 17:14 . 2003-01-21 03:00 13,112,456 -ra------ c:\documents and settings\Administrateur\MpSetup.exe
2009-02-10 17:13 . 2004-02-19 01:38 <REP> d--h----- c:\documents and settings\Administrateur\Voisinage réseau
2009-02-10 17:13 . 2004-02-19 01:38 <REP> d--h----- c:\documents and settings\Administrateur\Voisinage d'impression
2009-02-10 17:13 . 2004-02-19 01:38 <REP> d--h----- c:\documents and settings\Administrateur\Modèles
2009-02-10 17:13 . 2004-02-19 01:48 <REP> dr------- c:\documents and settings\Administrateur\Mes documents
2009-02-10 17:13 . 2004-02-19 01:38 <REP> dr------- c:\documents and settings\Administrateur\Menu Démarrer
2009-02-10 17:13 . 2004-02-19 01:48 <REP> dr------- c:\documents and settings\Administrateur\Favoris
2009-02-10 17:13 . 2004-02-19 01:38 <REP> d-------- c:\documents and settings\Administrateur\Bureau
2009-02-10 17:13 . 2009-02-10 17:13 <REP> d-------- c:\documents and settings\Administrateur
2009-02-10 08:05 . 2009-01-18 20:05 81,920 --a------ c:\windows\mstsc.exe
2009-02-10 02:35 . 2009-01-18 20:05 81,920 --a------ c:\windows\system\comrepl.exe
2009-02-10 01:54 . 2009-02-10 01:54 <REP> d-------- C:\rsit
2009-02-10 01:48 . 2009-02-10 01:48 <REP> d-------- c:\program files\Avira
2009-02-10 01:48 . 2009-02-10 01:48 <REP> d-------- c:\documents and settings\All Users\Application Data\Avira
2009-02-10 01:14 . 2009-02-10 01:14 <REP> d-------- c:\documents and settings\Giorgetti Laurent\Application Data\Malwarebytes
2009-02-10 01:14 . 2009-02-10 01:14 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-10 01:14 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-10 01:14 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-10 00:47 . 2009-02-10 00:47 <REP> d-------- C:\Lop SD
2009-02-09 23:46 . 2009-02-09 23:46 <REP> d-------- c:\documents and settings\All Users\Application Data\TEMP
2009-02-03 00:17 . 2009-02-02 23:54 15,688 --a------ c:\windows\system32\lsdelete.exe
2009-02-03 00:03 . 2009-02-03 00:03 <REP> d-------- c:\documents and settings\LocalService\Bureau
2009-02-02 23:54 . 2009-02-02 23:54 64,160 --a------ c:\windows\system32\drivers\Lbd.sys
2009-02-02 23:03 . 2009-02-02 23:03 <REP> d-------- c:\program files\Lavasoft
2009-02-02 23:03 . 2009-02-02 23:03 <REP> d-------- c:\documents and settings\All Users\Application Data\Lavasoft
2009-02-02 23:03 . 2009-02-02 23:03 <REP> d--h----- c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-01-24 15:01 . 2009-01-24 15:01 <REP> d-------- c:\program files\iPod
2009-01-24 14:58 . 2009-01-24 14:58 <REP> d-------- c:\program files\QuickTime
2009-01-24 14:53 . 2009-01-24 14:53 <REP> d-------- c:\program files\Bonjour
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-16 20:15 3,594,752 ------w c:\windows\system32\dllcache\mshtml.dll
2008-12-20 22:47 826,368 ----a-w c:\windows\system32\wininet.dll
2008-12-20 22:47 826,368 ------w c:\windows\system32\dllcache\wininet.dll
2008-12-20 22:47 671,232 ------w c:\windows\system32\dllcache\mstime.dll
2008-12-20 22:47 477,696 ------w c:\windows\system32\dllcache\mshtmled.dll
2008-12-20 22:47 44,544 ------w c:\windows\system32\dllcache\pngfilt.dll
2008-12-20 22:47 233,472 ------w c:\windows\system32\dllcache\webcheck.dll
2008-12-20 22:47 193,024 ------w c:\windows\system32\dllcache\msrating.dll
2008-12-20 22:47 105,984 ------w c:\windows\system32\dllcache\url.dll
2008-12-20 22:47 102,912 ------w c:\windows\system32\dllcache\occache.dll
2008-12-20 22:47 1,160,192 ------w c:\windows\system32\dllcache\urlmon.dll
2008-12-19 09:11 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe
2008-12-19 09:10 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe
2008-12-19 05:25 634,024 ------w c:\windows\system32\dllcache\iexplore.exe
2008-12-19 05:23 161,792 ------w c:\windows\system32\dllcache\ieakui.dll
2008-12-17 17:26 --------- d-----w c:\program files\Microsoft Silverlight
2008-12-17 17:25 --------- d-----w c:\program files\Microsoft
2008-12-17 17:24 --------- d-----w c:\program files\Windows Live SkyDrive
2008-12-17 17:17 --------- d-----w c:\program files\Fichiers communs\Windows Live
2008-12-12 10:18 87,336 ----a-w c:\windows\system32\dns-sd.exe
2008-12-12 10:11 61,440 ----a-w c:\windows\system32\dnssd.dll
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-12-11 10:57 333,952 ------w c:\windows\system32\dllcache\srv.sys
2008-12-02 21:37 49,480 ----a-w c:\windows\system32\sirenacm.dll
2008-11-21 21:47 524,288 ----a-w c:\windows\system32\DivXsm.exe
2008-11-21 21:47 3,596,288 ----a-w c:\windows\system32\qt-dx331.dll
2008-11-21 21:46 200,704 ----a-w c:\windows\system32\ssldivx.dll
2008-11-21 21:46 1,044,480 ----a-w c:\windows\system32\libdivx.dll
2008-11-21 21:45 823,296 ----a-w c:\windows\system32\divx_xx0c.dll
2008-11-21 21:45 823,296 ----a-w c:\windows\system32\divx_xx07.dll
2008-11-21 21:45 815,104 ----a-w c:\windows\system32\divx_xx0a.dll
2008-11-21 21:45 81,920 ----a-w c:\windows\system32\dpl100.dll
2008-11-21 21:45 802,816 ----a-w c:\windows\system32\divx_xx11.dll
2008-11-21 21:45 593,920 ----a-w c:\windows\system32\dpuGUI11.dll
2008-11-21 21:45 57,344 ----a-w c:\windows\system32\dpv11.dll
2008-11-21 21:45 53,248 ----a-w c:\windows\system32\dpuGUI10.dll
2008-11-21 21:45 344,064 ----a-w c:\windows\system32\dpus11.dll
2008-11-21 21:45 294,912 ----a-w c:\windows\system32\dpu11.dll
2008-11-21 21:45 294,912 ----a-w c:\windows\system32\dpu10.dll
2008-11-21 21:45 196,608 ----a-w c:\windows\system32\dtu100.dll
2008-11-21 21:44 161,096 ----a-w c:\windows\system32\DivXCodecVersionChecker.exe
2008-11-21 21:44 12,288 ----a-w c:\windows\system32\DivXWMPExtType.dll
2003-01-21 02:00 13,112,456 ----a-r c:\windows\system32\config\systemprofile\MpSetup.exe
2003-01-21 02:00 13,112,456 ----a-r c:\documents and settings\Giorgetti Laurent\MpSetup.exe
2003-01-21 02:00 13,112,456 ----a-r c:\documents and settings\Default User\MpSetup.exe
2008-10-04 00:53 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008100420081005\index.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2008-12-02 3882312]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Google Update"="c:\documents and settings\Giorgetti Laurent\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-05 133104]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="LaunApp" [X]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-01-27 335872]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2003-11-20 98304]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2003-11-20 499712]
"LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2003-04-28 184320]
"RemoteControl"="c:\sysinfo\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-21 40960]
"LaunchAp"="c:\program files\Launch Manager\LaunchAp.exe" [2004-01-28 32768]
"PowerKey"="c:\program files\Launch Manager\PowerKey.exe" [2002-08-30 94208]
"LManager"="c:\program files\Launch Manager\HotkeyApp.exe" [2004-02-04 45056]
"CtrlVol"="c:\program files\Launch Manager\CtrlVol.exe" [2004-01-28 184320]
"LMgrOSD"="c:\program files\Launch Manager\OSDCtrl.exe" [2004-02-03 49152]
"Wbutton"="c:\program files\Launch Manager\Wbutton.exe" [2004-01-30 65536]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Easy-PrintToolBox"="c:\program files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2004-01-14 409600]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="d:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-02-02 509784]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 c:\windows\system32\Ati2mdxx.exe]
"AGRSMMSG"="AGRSMMSG.exe" [2003-11-19 c:\windows\AGRSMMSG.exe]
"SoundMan"="SOUNDMAN.EXE" [2003-12-19 c:\windows\soundman.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_USERS\.DEFAULT\software\microsoft\windows\Currentversion\policies\explorer\Run]
"ComRepl"="c:\windows\System\comrepl.exe" [2009-01-18 81920]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\eMule\\emule.exe"=
"d:\\Program Files\\BitTorrent\\btdownloadgui.exe"=
"d:\\Program Files\\uTorrent\\uTorrent.exe"=
"d:\\Program Files\\Zattoo\\zattood.exe"=
"d:\\Program Files\\Zattoo\\Zattoo1.exe"=
"c:\\WINDOWS\\System32\\rtcshare.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"d:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-02-02 64160]
R1 Hotkey;Hotkey;c:\windows\system32\drivers\HOTKEY.sys [2004-02-20 9867]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 950096]
R3 POWERKEY;POWERKEY;c:\program files\Launch Manager\POWERKEY.SYS [2008-08-16 2343]
S1 Wbutton;Wbutton;c:\windows\system32\drivers\Wbutton.sys --> c:\windows\system32\drivers\Wbutton.sys [?]
.
Contenu du dossier 'Tâches planifiées'
2009-01-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
2009-02-09 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-02-02 23:54]
2009-02-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4271046019-2757734838-2015800038-1005.job
- c:\documents and settings\Giorgetti Laurent\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-05 00:12]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.ch/
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Easy-WebPrint Ajouter à la liste d'impressions - d:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint Impression rapide - d:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Imprimer - d:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: Easy-WebPrint Prévisualiser - d:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-11 23:49:57
Windows 5.1.2600 Service Pack 3 FAT NTAPI
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\•€|ÿÿÿÿ"•€|þ»Ñw*]
"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(568)
c:\windows\system32\Ati2evxx.dll
.
Heure de fin: 2009-02-11 23:50:49
ComboFix-quarantined-files.txt 2009-02-11 22:50:48
ComboFix5.txt 2009-02-11 22:47:58
ComboFix4.txt 2009-02-10 22:21:26
ComboFix3.txt 2009-02-11 16:32:54
ComboFix2.txt 2009-02-11 22:02:56
Avant-CF: 2 766 307 328 octets libres
Après-CF: 2,753,953,792 octets libres
242 --- E O F --- 2009-02-11 16:10:51
Et Hijackthis :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:53:03, on 11/02/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\SYSINFO\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Launch Manager\PowerKey.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\CtrlVol.exe
C:\Program Files\Launch Manager\OSDCtrl.exe
C:\Program Files\Launch Manager\Wbutton.exe
C:\Program Files\Java\jre6\bin\jusched.exe
D:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\Giorgetti Laurent\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Giorgetti Laurent\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Giorgetti Laurent\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
D:\Program Files\eMule\Divers\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ch/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - D:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [RemoteControl] C:\SYSINFO\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [LaunchApp] LaunApp
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe
O4 - HKLM\..\Run: [PowerKey] "C:\Program Files\Launch Manager\PowerKey.exe"
O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\HotkeyApp.exe
O4 - HKLM\..\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol.exe
O4 - HKLM\..\Run: [LMgrOSD] C:\Program Files\Launch Manager\OSDCtrl.exe
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Giorgetti Laurent\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [ComRepl] C:\WINDOWS\System\comrepl.exe /waitservice (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [ComRepl] C:\WINDOWS\System\comrepl.exe /waitservice (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
-
-
Re,
ce coup-ci, ils semblent partis;
On va nettoyer.
Lis bien et exécute cette manip dans l’ordre.
#Télécharge et installe ces logiciels (si tu ne les as pas) pour les 3 premiers
mets les à jour, comme indiqué dans les démos ou tutos.
Ne les utilise pas tout de suite.
Antispywares et autres :
Télécharge Malwarebytes' Anti-Malware (MBAM) et enregistre le sur ton bureau à partir de ce lien :
https://www.malwarebytes.com/
A la fin du téléchargement, ferme toutes les fenêtres et programmes, y compris celui-ci.
Double-clique sur l'icône Download_mbam-setup.exe sur ton bureau pour démarrer le programme d'installation.
Pendant l'installation, suis les indications (en particulier le choix de la langue et l'autorisation d'accession à Internet). N'apporte aucune modification aux réglages par défaut et, en fin d'installation, vérifie que les options Update Malwarebytes' Anti-Malware et Launch Malwarebytes' Anti-Malware sont cochées.
MBAM démarrera automatiquement et enverra un message demandant à mettre à jour le programme avant de lancer une analyse. Comme MBAM se met automatiquement à jour en fin d'installation, clique sur OK pour fermer la boîte de dialogue.
Nettoyeurs (de fichiers inutiles) et autres :
*Ccleaner (gratuit)
Téléchargement :
https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html
Tuto :
https://www.vulgarisation-informatique.com/nettoyer-windows-ccleaner.php
Lors de l’installation, [décoche] l’option qui t’installerait la barre Yahoo !
========================================
->Affiche tous les fichiers et dossiers :
clique sur démarrer/panneau de configuration (en affichage classique)/option des dossiers/affichage
[Coche] « afficher les dossiers et fichiers cachés »
[Décoche] la case « Masquer les fichiers protégés du système d'exploitation (recommandé) »
[Décoche] « masquer les extensions dont le type est connu »
Puis fais [appliquer] pour valider les changements.
Et [Ok]
.
=======================================
========================================
->Lance CCleaner.
Suppression des fichiers temporaires
Va dans la section "Options" situé dans la marge gauche.
Décoche "Avancé"
Retourne ensuite dans la section "Nettoyeur"
Fais bien attention de cocher toutes ces cases dans la marge gauche (Internet Explorer/Windows Explorer/Système)
• Clique sur [Analyse]
• Patiente le temps du scan, qui peut prendre un peu de temps si c'est la première fois.
• Une fois le scan terminé, clique sur [Lancer le Nettoyage]
========================================
Lance Malwarebytes AntiMalware
Dans l'onglet analyse, vérifie que "Exécuter un scan rapide" est coché et clique sur le bouton Rechercher pour démarrer l'analyse.
MBAM analyse ton ordinateur. L'analyse peut prendre un certain temps. Il suffit de vérifier de temps en temps son avancement.
A la fin de l'analyse, un message s'affiche indiquant la fin de l'analyse. Clique sur OK pour poursuivre.
Si des malwares ont été détectés, leur liste s'affiche.
En cliquant sur Suppression (?) , MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.
MBAM va ouvrir le bloc-notes et y copier le rapport d'analyse. Ferme le bloc-note. (Le rapport peut être retrouvé sous l'onglet Rapports/logs)
Ferme MBAM en cliquant sur Quitter.
Poste le rapport dans ta réponse.
========================================
->Relance CCleaner.
Suppression des incohérences du registre
• Clique sur l'icône [Registre] situés dans la marge à gauche
• Puis clique sur [Analyser les erreurs]
• Patiente pendant que CCleaner scan ton registre.
• Une fois le scan terminé, coche toutes les entrèes qu'il t'aura trouvée.
• Tu peux cliquer ensuite sur [Corriger les erreurs].
Si tu n'est pas sur de ce que tu fais, tu peux choisir de sauvegarder les entrées cochées pour les restaurer ultérieurement.
========================================
->Vide ta Corbeille.
========================================
- > Ouvre ce lien pour scanner ton PC avec un BitDefender en ligne (uniquement sous Internet Explorer) :
http://www.bitdefender.fr/scan_fr/scan8/ie.html
Utilisation :
Cliquer sur "J'accepte" puis accepter également l'ActiveX bloqué par la barre anti-popup du SP2 qui clignotera en haut et l'installer.
Ensuite, cliquer sur "Cliquez ici pour scanner".
Patienter jusqu'à la fin du scan qui peut durer assez longtemps...
Copier/coller le rapport entier sur le forum.
Tutoriel en images ici : http://pageperso.aol.fr/rginformatique/mapage/defender.htm (merci à Balltrap34 pour cette réalisation)
[Recoche] la case « Masquer les fichiers protégés du système d'exploitation (recommandé) » -
Bonsoir,
il en reste même deux.
Copie ou imprime les instructions avant
Déconnecte toi d'internet et ferme toutes tes applications.
Désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)
Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :
File::
c:\windows\mstsc.exe
c:\windows\system\comrepl.exe
Enregistre ce fichier sous le nom CFscript
Fait un glisser/déposer de ce fichier CFscript sur le fichier ComboFix.exe
Clique sur le fichier CFscript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFscrïpt vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.
Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
Réactive ton parefeu, ton antivirus, la garde de ton antispyware
Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
Remets aussi un rapport Hijackthis
Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt
Attention : cette manip a été fait pour cet ordi. Tout réutilisation peut endommager sévèrement le système d'exploitation.-
Et voila :
ComboFix 09-02-10.01 - Giorgetti Laurent 2009-02-12 0:22:18.8 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.511.273 [GMT 1:00]
Lancé depuis: c:\documents and settings\Giorgetti Laurent\Bureau\C-Fix.exe
Commutateurs utilisés :: c:\documents and settings\Giorgetti Laurent\Bureau\CFScript.txt
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated)
* Un nouveau point de restauration a été créé
FILE ::
c:\windows\mstsc.exe
c:\windows\system\comrepl.exe
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\mstsc.exe
c:\windows\system\comrepl.exe
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-01-11 au 2009-02-11 ))))))))))))))))))))))))))))))))))))
.
2009-02-11 17:06 . 2009-02-11 17:07 1,374 --a------ c:\windows\imsins.BAK
2009-02-10 18:25 . 2009-02-10 18:25 <REP> d-------- c:\documents and settings\NetworkService\Bureau
2009-02-10 17:14 . 2003-01-21 03:00 13,112,456 -ra------ c:\documents and settings\Administrateur\MpSetup.exe
2009-02-10 17:13 . 2004-02-19 01:38 <REP> d--h----- c:\documents and settings\Administrateur\Voisinage réseau
2009-02-10 17:13 . 2004-02-19 01:38 <REP> d--h----- c:\documents and settings\Administrateur\Voisinage d'impression
2009-02-10 17:13 . 2004-02-19 01:38 <REP> d--h----- c:\documents and settings\Administrateur\Modèles
2009-02-10 17:13 . 2004-02-19 01:48 <REP> dr------- c:\documents and settings\Administrateur\Mes documents
2009-02-10 17:13 . 2004-02-19 01:38 <REP> dr------- c:\documents and settings\Administrateur\Menu Démarrer
2009-02-10 17:13 . 2004-02-19 01:48 <REP> dr------- c:\documents and settings\Administrateur\Favoris
2009-02-10 17:13 . 2004-02-19 01:38 <REP> d-------- c:\documents and settings\Administrateur\Bureau
2009-02-10 17:13 . 2009-02-10 17:13 <REP> d-------- c:\documents and settings\Administrateur
2009-02-10 01:54 . 2009-02-10 01:54 <REP> d-------- C:\rsit
2009-02-10 01:48 . 2009-02-10 01:48 <REP> d-------- c:\program files\Avira
2009-02-10 01:48 . 2009-02-10 01:48 <REP> d-------- c:\documents and settings\All Users\Application Data\Avira
2009-02-10 01:14 . 2009-02-10 01:14 <REP> d-------- c:\documents and settings\Giorgetti Laurent\Application Data\Malwarebytes
2009-02-10 01:14 . 2009-02-10 01:14 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-10 01:14 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-10 01:14 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-10 00:47 . 2009-02-10 00:47 <REP> d-------- C:\Lop SD
2009-02-09 23:46 . 2009-02-09 23:46 <REP> d-------- c:\documents and settings\All Users\Application Data\TEMP
2009-02-03 00:17 . 2009-02-02 23:54 15,688 --a------ c:\windows\system32\lsdelete.exe
2009-02-03 00:03 . 2009-02-03 00:03 <REP> d-------- c:\documents and settings\LocalService\Bureau
2009-02-02 23:54 . 2009-02-02 23:54 64,160 --a------ c:\windows\system32\drivers\Lbd.sys
2009-02-02 23:03 . 2009-02-02 23:03 <REP> d-------- c:\program files\Lavasoft
2009-02-02 23:03 . 2009-02-02 23:03 <REP> d-------- c:\documents and settings\All Users\Application Data\Lavasoft
2009-02-02 23:03 . 2009-02-02 23:03 <REP> d--h----- c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-01-24 15:01 . 2009-01-24 15:01 <REP> d-------- c:\program files\iPod
2009-01-24 14:58 . 2009-01-24 14:58 <REP> d-------- c:\program files\QuickTime
2009-01-24 14:53 . 2009-01-24 14:53 <REP> d-------- c:\program files\Bonjour
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-16 20:15 3,594,752 ------w c:\windows\system32\dllcache\mshtml.dll
2008-12-20 22:47 826,368 ----a-w c:\windows\system32\wininet.dll
2008-12-20 22:47 826,368 ------w c:\windows\system32\dllcache\wininet.dll
2008-12-20 22:47 671,232 ------w c:\windows\system32\dllcache\mstime.dll
2008-12-20 22:47 477,696 ------w c:\windows\system32\dllcache\mshtmled.dll
2008-12-20 22:47 44,544 ------w c:\windows\system32\dllcache\pngfilt.dll
2008-12-20 22:47 233,472 ------w c:\windows\system32\dllcache\webcheck.dll
2008-12-20 22:47 193,024 ------w c:\windows\system32\dllcache\msrating.dll
2008-12-20 22:47 105,984 ------w c:\windows\system32\dllcache\url.dll
2008-12-20 22:47 102,912 ------w c:\windows\system32\dllcache\occache.dll
2008-12-20 22:47 1,160,192 ------w c:\windows\system32\dllcache\urlmon.dll
2008-12-19 09:11 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe
2008-12-19 09:10 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe
2008-12-19 05:25 634,024 ------w c:\windows\system32\dllcache\iexplore.exe
2008-12-19 05:23 161,792 ------w c:\windows\system32\dllcache\ieakui.dll
2008-12-17 17:26 --------- d-----w c:\program files\Microsoft Silverlight
2008-12-17 17:25 --------- d-----w c:\program files\Microsoft
2008-12-17 17:24 --------- d-----w c:\program files\Windows Live SkyDrive
2008-12-17 17:17 --------- d-----w c:\program files\Fichiers communs\Windows Live
2008-12-12 10:18 87,336 ----a-w c:\windows\system32\dns-sd.exe
2008-12-12 10:11 61,440 ----a-w c:\windows\system32\dnssd.dll
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-12-11 10:57 333,952 ------w c:\windows\system32\dllcache\srv.sys
2008-12-02 21:37 49,480 ----a-w c:\windows\system32\sirenacm.dll
2008-11-21 21:47 524,288 ----a-w c:\windows\system32\DivXsm.exe
2008-11-21 21:47 3,596,288 ----a-w c:\windows\system32\qt-dx331.dll
2008-11-21 21:46 200,704 ----a-w c:\windows\system32\ssldivx.dll
2008-11-21 21:46 1,044,480 ----a-w c:\windows\system32\libdivx.dll
2008-11-21 21:45 823,296 ----a-w c:\windows\system32\divx_xx0c.dll
2008-11-21 21:45 823,296 ----a-w c:\windows\system32\divx_xx07.dll
2008-11-21 21:45 815,104 ----a-w c:\windows\system32\divx_xx0a.dll
2008-11-21 21:45 81,920 ----a-w c:\windows\system32\dpl100.dll
2008-11-21 21:45 802,816 ----a-w c:\windows\system32\divx_xx11.dll
2008-11-21 21:45 593,920 ----a-w c:\windows\system32\dpuGUI11.dll
2008-11-21 21:45 57,344 ----a-w c:\windows\system32\dpv11.dll
2008-11-21 21:45 53,248 ----a-w c:\windows\system32\dpuGUI10.dll
2008-11-21 21:45 344,064 ----a-w c:\windows\system32\dpus11.dll
2008-11-21 21:45 294,912 ----a-w c:\windows\system32\dpu11.dll
2008-11-21 21:45 294,912 ----a-w c:\windows\system32\dpu10.dll
2008-11-21 21:45 196,608 ----a-w c:\windows\system32\dtu100.dll
2008-11-21 21:44 161,096 ----a-w c:\windows\system32\DivXCodecVersionChecker.exe
2008-11-21 21:44 12,288 ----a-w c:\windows\system32\DivXWMPExtType.dll
2003-01-21 02:00 13,112,456 ----a-r c:\windows\system32\config\systemprofile\MpSetup.exe
2003-01-21 02:00 13,112,456 ----a-r c:\documents and settings\Giorgetti Laurent\MpSetup.exe
2003-01-21 02:00 13,112,456 ----a-r c:\documents and settings\Default User\MpSetup.exe
2008-10-04 00:53 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008100420081005\index.dat
.
((((((((((((((((((((((((((((( SnapShot_2009-02-11_17.32.01.50 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-02-11 23:04:10 16,384 ----a-w c:\windows\temp\Perflib_Perfdata_74c.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2008-12-02 3882312]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Google Update"="c:\documents and settings\Giorgetti Laurent\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-05 133104]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="LaunApp" [X]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-01-27 335872]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2003-11-20 98304]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2003-11-20 499712]
"LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2003-04-28 184320]
"RemoteControl"="c:\sysinfo\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-21 40960]
"LaunchAp"="c:\program files\Launch Manager\LaunchAp.exe" [2004-01-28 32768]
"PowerKey"="c:\program files\Launch Manager\PowerKey.exe" [2002-08-30 94208]
"LManager"="c:\program files\Launch Manager\HotkeyApp.exe" [2004-02-04 45056]
"CtrlVol"="c:\program files\Launch Manager\CtrlVol.exe" [2004-01-28 184320]
"LMgrOSD"="c:\program files\Launch Manager\OSDCtrl.exe" [2004-02-03 49152]
"Wbutton"="c:\program files\Launch Manager\Wbutton.exe" [2004-01-30 65536]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Easy-PrintToolBox"="c:\program files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2004-01-14 409600]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="d:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-02-02 509784]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 c:\windows\system32\Ati2mdxx.exe]
"AGRSMMSG"="AGRSMMSG.exe" [2003-11-19 c:\windows\AGRSMMSG.exe]
"SoundMan"="SOUNDMAN.EXE" [2003-12-19 c:\windows\soundman.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\eMule\\emule.exe"=
"d:\\Program Files\\BitTorrent\\btdownloadgui.exe"=
"d:\\Program Files\\uTorrent\\uTorrent.exe"=
"d:\\Program Files\\Zattoo\\zattood.exe"=
"d:\\Program Files\\Zattoo\\Zattoo1.exe"=
"c:\\WINDOWS\\System32\\rtcshare.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"d:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-02-02 64160]
R1 Hotkey;Hotkey;c:\windows\system32\drivers\HOTKEY.sys [2004-02-20 9867]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 950096]
R3 POWERKEY;POWERKEY;c:\program files\Launch Manager\POWERKEY.SYS [2008-08-16 2343]
S1 Wbutton;Wbutton;c:\windows\system32\drivers\Wbutton.sys --> c:\windows\system32\drivers\Wbutton.sys [?]
.
Contenu du dossier 'Tâches planifiées'
2009-01-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
2009-02-09 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-02-02 23:54]
2009-02-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4271046019-2757734838-2015800038-1005.job
- c:\documents and settings\Giorgetti Laurent\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-05 00:12]
.
- - - - ORPHELINS SUPPRIMES - - - -
HKU-Default-Explorer_Run-ComRepl - c:\windows\System\comrepl.exe
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.ch/
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Easy-WebPrint Ajouter à la liste d'impressions - d:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint Impression rapide - d:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Imprimer - d:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: Easy-WebPrint Prévisualiser - d:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-12 00:23:58
Windows 5.1.2600 Service Pack 3 FAT NTAPI
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\•€|ÿÿÿÿ"•€|þ»Ñw*]
"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(568)
c:\windows\system32\Ati2evxx.dll
.
Heure de fin: 2009-02-12 0:24:51
ComboFix-quarantined-files.txt 2009-02-11 23:24:50
ComboFix5.txt 2009-02-11 23:21:50
ComboFix4.txt 2009-02-11 16:32:54
ComboFix3.txt 2009-02-11 22:02:56
ComboFix2.txt 2009-02-11 22:50:52
Avant-CF: 2 717 351 936 octets libres
Après-CF: 2,704,670,720 octets libres
210 --- E O F --- 2009-02-11 16:10:51
Hijackthis :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:27:27, on 12/02/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\SYSINFO\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Launch Manager\PowerKey.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\CtrlVol.exe
C:\Program Files\Launch Manager\OSDCtrl.exe
C:\Program Files\Launch Manager\Wbutton.exe
C:\Program Files\Java\jre6\bin\jusched.exe
D:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Giorgetti Laurent\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Giorgetti Laurent\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Giorgetti Laurent\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
D:\Program Files\eMule\Divers\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ch/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - D:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [RemoteControl] C:\SYSINFO\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [LaunchApp] LaunApp
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe
O4 - HKLM\..\Run: [PowerKey] "C:\Program Files\Launch Manager\PowerKey.exe"
O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\HotkeyApp.exe
O4 - HKLM\..\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol.exe
O4 - HKLM\..\Run: [LMgrOSD] C:\Program Files\Launch Manager\OSDCtrl.exe
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Giorgetti Laurent\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
- Voici deja le rapport MBAM :
Malwarebytes' Anti-Malware 1.34
Version de la base de données: 1750
Windows 5.1.2600 Service Pack 3
12/02/2009 00:39:03
mbam-log-2009-02-12 (00-39-03).txt
Type de recherche: Examen rapide
Eléments examinés: 66590
Temps écoulé: 3 minute(s), 41 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
(Aucun élément nuisible détecté)
-
-
Re,
avant (si il en est encore temps), après sinon, je voudrais que tu fasses ça :
Ouvre le registre et navigue avec les + et les - jusqu'à la clé
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
Clique successivement sur Fichier puis sur Exporter et choisis un nom (XXXXXX par exemple). Tu retiens le nom du répertoire (Mes documents par défaut).
Ferme le registre et ouvre l'explorateur Windows.
Clique droit sur le fichier et choisis Modifier.
Le bloc-notes s'ouvre avec le contenu de la clé.
Copie le dans ta réponse.
===============
Fais de même avec :
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
-
BitDefender Online Scanner - Rapport virus en temps réel
Généré à: Thu, Feb 12, 2009 - 01:31:12
Info d'analyse
Fichiers scannés
59451
Infectés Fichiers
0
Virus Détectés
Aucun virus trouvé.
Voici ce qu'il y a dans les 4 clés que tu m'as demandé d'analyser:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]
Windows Registry Editor Version 5.00
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
Il y en a plusieurs pour la 4ème destination :
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
"DebugOptions"="2048"
"Documents"=""
"DosPrint"="no"
"NetMessage"="no"
"NullPort"="None"
"Programs"="com exe bat pif cmd"
"Device"="Canon iP5200,winspool,Ne02:"
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
"DebugOptions"="2048"
"Documents"=""
"DosPrint"="no"
"NetMessage"="no"
"NullPort"="None"
"Programs"="com exe bat pif cmd"
"Device"="Canon iP5200,winspool,Ne02:"
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
"DebugOptions"="2048"
"Documents"=""
"DosPrint"="no"
"NetMessage"="no"
"NullPort"="None"
"Programs"="com exe bat pif cmd"
"Device"="Canon iP5200,winspool,Ne02:"
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
"DebugOptions"="2048"
"Documents"=""
"DosPrint"="no"
"NetMessage"="no"
"NullPort"="None"
"Programs"="com exe bat pif cmd"
"Device"="Canon iP5200,winspool,Ne02:"
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
"DebugOptions"="2048"
"Documents"=""
"DosPrint"="no"
"NetMessage"="no"
"NullPort"="None"
"Programs"="com exe bat pif cmd"
"Device"="Canon iP5200,winspool,Ne02:"
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
"DebugOptions"="2048"
"Documents"=""
"DosPrint"="no"
"NetMessage"="no"
"NullPort"="None"
"Programs"="com exe bat pif cmd"
"Device"="Canon iP5200,winspool,Ne02:"
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
"DebugOptions"="2048"
"Documents"=""
"DosPrint"="no"
"NetMessage"="no"
"NullPort"="None"
"Programs"="com exe bat pif cmd"
"Device"="Canon iP5200,winspool,Ne02:"
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
"DebugOptions"="2048"
"Documents"=""
"DosPrint"="no"
"NetMessage"="no"
"NullPort"="None"
"Programs"="com exe bat pif cmd"
"Device"="Canon iP5200,winspool,Ne02:"
Voila
-
-
Re,
OK, merci.
On finit demain.
L'ordi est sain.
Il reste à nettoyer les outils et à fignoler. -
Re,
il te manque un parefeu.
Ce lien t'en propose un certain nombre (gratuits) :
http://www.malekal.com/menu_tutorials_logiciels.php
Je te suggère On line Armor.
===================
Mets à jour la base virale et fais un scan complet avec Antivir.
====================
Nettoyage des fichiers et de la base de registre
Télécharge Ccleaner (gratuit)
https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html
Tuto :
https://www.vulgarisation-informatique.com/nettoyer-windows-ccleaner.php
Lors de l’installation, [décoche] l’option qui t’installerait la barre Yahoo !
->Lance CCleaner.
Suppression des fichiers temporaires
Va dans la section "Options" situé dans la marge gauche.
Décoche "Avancé"
Retourne ensuite dans la section "Nettoyeur"
Fais bien attention de cocher toutes ces cases dans la marge gauche (Internet Explorer/Windows Explorer/Système)
• Clique sur [Analyse]
• Patiente le temps du scan, qui peut prendre un peu de temps si c'est la première fois.
• Une fois le scan terminé, clique sur [Lancer le Nettoyage]
->Relance CCleaner.
Suppression des incohérences du registre
• Clique sur l'icône [Registre] situés dans la marge à gauche
• Puis clique sur [Analyser les erreurs]
• Patiente pendant que CCleaner scan ton registre.
• Une fois le scan terminé, coche toutes les entrèes qu'il t'aura trouvée.
• Tu peux cliquer ensuite sur [Corriger les erreurs].
Si tu n'est pas sûr de ce que tu fais, tu peux choisir de sauvegarder les entrées cochées pour les restaurer ultérieurement.
========================================
Nettoyage des outils.
Démarrer, Exécuter, tapecombofix /u
dans la zone de saisie puis clique sur OK.
* Télécharge ToolsCleaner par A.Rothstein & dj QUIOU sur ton Bureau.
http://pc-system.fr/
hxxp://a-rothstein.changelog.fr/TC/ToolsCleaner2.exe
hxxp://pagesperso-orange.fr/AceRothstein/ToolsCleaner2.exe
* Clique sur Recherche et laisse le scan se terminer.
* Clique, sur Suppression pour finaliser.
* Tu peux, si tu le souhaites, te servir des Options facultatives.
* Clique sur Quitter, pour que le rapport puisse se créer.
* Poste moi le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur( C:\).-
bonsoir
Voici le rapport :
[ Rapport ToolsCleaner version 2.3.0 (par A.Rothstein & dj QUIOU) ]
-->- Recherche:
C:\Combofix.txt: trouvé !
C:\lopR.txt: trouvé !
C:\Lop SD: trouvé !
C:\Qoobox: trouvé !
C:\Rsit: trouvé !
---------------------------------
-->- Suppression:
C:\Combofix.txt: supprimé !
C:\lopR.txt: supprimé !
C:\Lop SD: supprimé !
C:\Qoobox: supprimé !
C:\Rsit: supprimé !
Pas de virus trouvé lors du scan
Merci encore à vous 2 pour votre aide !!
-
-
Bonsoir,
supprime ToolsCleaner sur ton Bureau et C:\TCleaner.txt.
=====================================
Voici quelques conseils pour mieux protéger ton ordi des malwares :
1) Mets à jour Windows en consultant régulièrement le site de mise à jour :
http://www.update.microsoft.com/windowsupdate/v6/default.aspx
2) pour réduire les risques de réinfection, je te recommande fortement d'installer ces programmes gratuits :
- SpywareBlaster protège des ActiveX malicieux : http://www.commentcamarche.net/telecharger/telecharger 226 spyware blaster
un tutoriel :
https://www.malekal.com/tutorial-spywareblaster/
- SpywareGuard offre une protection en temps réel contre les tentatives d'installation des spywares. Prends garde à n'avoir qu'un seul anti-spyware en garde active pour éviter les risques de conflit : http://www.commentcamarche.net/telecharger/telecharger 34055277 spywareguard .
- Sécurise Internet Explorer
* Clique sur Démarrer puis Exécuter
* Tape Inetcpl.cpl dans la zone de saisie puis OK
* Clique sur l'onglet Sécurité
* Clique sur "Rétablir toutes les zones au niveau par défaut"
* Sélectionne Zone Internet et clique sur "Personaliser le niveau"
* Dans la section sur les ActiveX, règle sur "Demander" les téléchargements des ActiveX sognés et non sognés et règle sur "Désactivé" "Contrôles d'initialisation et de script ActiveX non marqués comme sécurisés"
- ATF Cleaner nettoye les fichiers temporaires d'Internet Explorer et Windows (et Firefox), vide la corbeille et effectue quelques autres actions de nettoyage. Il améliore la vitesse et élimine les fichiers malveillants logés dans les fichiers temporaires : https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html
- Noscript est un "Addon" pour Firefox qui empêche l'exécution de scripts en provenance des sites Web. il stoppe l'installation de logiciels infectieux via flash, java, javascript et d'autres points d'entrée : http://www.geekstogo.com/forum/redirect.php?url=http%3A%2F%2Fwww.noscript.net
- Conserve une sauvegarde des fichiers importants. Ceco devient de plus en plus important. Cet article, en anglais, est rempli d'informations sur les solutions possibles : http://www.geekstogo.com/559/options-for-home-computer-data-backup-part-1/
- MVPS Hosts replace le fichier Hosts par un fichier contenantles sites de pub et autres sites dangereux. Fondamentalement, cela empêche l'ordi de se connecter à ces sites en redirigeant l'appel vers 127.0.0.1 qui correspond à ton ordi. Ceci rend plus difficile d'infecter l'ordi.
https://winhelp2002.mvps.org/hosts.htm
- Il vaut mieux utiliser un navigateur alternatif à Internet Explorer. Je recommande celui de Mozilla, Firefox, très agréable, mieux sécurisé et doté d'un très bon bloqueur de pop-ups. lien de téléchargement : http://www.commentcamarche.net/telecharger/telecharger 111 firefox
3) Si tu lis l'anglais, cet article de Tony Klein comporte d'excellentes suggestions : http://www.geekstogo.com/how-did-i-get-infected-in-the-first-place
4)ERUNT (Emergency Recovery Utility NT) permet de prendre une sauvegarde de la base de registre et de la restaurer en cas de besoin. La copie de sauvegarde du registre effectuée par Windows n'est pas complète : http://www.commentcamarche.net/telecharger/telecharger 34055395 erunt
5)Console de récupération Face aux nouvelles menaces (attaque du secteur de boot par exemple), la Console de récupération peut être la seule solution. Un tutoriel ici : https://www.pcastuces.com/pratique/windows/xp/console_recuperation/page1.htm . N'hésite pas à poser des questions si nécessaire.
Précédent
- 1
- 2
