Ordi infecté, demande d'analyse de rapport
Résolu/Fermé
LaetitiaH
Messages postés
169
Date d'inscription
jeudi 26 juillet 2007
Statut
Membre
Dernière intervention
5 août 2010
-
5 mars 2009 à 07:56
jlpjlp Messages postés 51580 Date d'inscription vendredi 18 mai 2007 Statut Contributeur sécurité Dernière intervention 3 mai 2022 - 5 mars 2009 à 20:28
jlpjlp Messages postés 51580 Date d'inscription vendredi 18 mai 2007 Statut Contributeur sécurité Dernière intervention 3 mai 2022 - 5 mars 2009 à 20:28
A voir également:
- Ordi infecté, demande d'analyse de rapport
- Mon ordi rame que faire - Guide
- Comment reinitialiser un ordi - Guide
- Ordi ecran noir - Guide
- Analyse disque dur - Télécharger - Informations & Diagnostic
- Plan rapport de stage - Guide
17 réponses
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
5 mars 2009 à 09:37
5 mars 2009 à 09:37
slt
colle un rapport antivir pour voir les infections trouvées
puis
_______________
mettre à jour adobe reader
https://acrobat.adobe.com/fr/fr/acrobat/pdf-reader.html
Mettre a jour java:
Télécharge JavaRa.zip de Paul 'Prm753' McLain et Fred de Vries.
Décompresse le fichier sur ton bureau (clique droit > Extraire tout.)
Double-clique sur le répertoire JavaRa obtenu.
Puis double-clique sur le fichier JavaRa.exe (le .exe peut ne pas s'afficher)
Clique sur Search For Updates.
Sélectionne Update Using jucheck.exe puis clique sur Search.
Autorise le processus à se connecter s'il te le demande, clique sur Install et suis les instructions d'installation. Cela prendra quelques minutes.
Quand l'installation est terminée, revient à l'écran de JavaRa et clique sur Remove Older Versions.
Clique sur Oui pour confirmer. L'outil va travailler, clique ensuite sur Ok, puis une deuxième fois sur Ok.
Un rapport va s'ouvrir, copie-colle le dans ta prochaine réponse.
Note : le rapport se trouve aussi à la racine de la partition système, en général C:\ sous le nom JavaRa.log
(c:\JavaRa.log)
Ferme l'application.
si cela ne fonctionne pas
https://www.java.com/fr/download/windows_manual.jsp?locale=fr&host=www.java.com:80
tu peux désinstaller les vieilles versions.
___________________________
mets a jour internet explorer :
https://www.01net.com/telecharger/windows/Internet/navigateur/fiches/33081.html
________________
Télécharge ici :
http://images.malwareremoval.com/random/RSIT.exe
random's system information tool (RSIT) par andom/random et sauvegarde-le sur le Bureau.
Double-clique sur RSIT.exe afin de lancer RSIT.
Clique Continue à l'écran Disclaimer.
Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.
Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront.
Poste le contenu de log.txt (<<qui sera affiché)
ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).
NB : Les rapports sont sauvegardés dans le dossier C:\rsit
colle un rapport antivir pour voir les infections trouvées
puis
_______________
mettre à jour adobe reader
https://acrobat.adobe.com/fr/fr/acrobat/pdf-reader.html
Mettre a jour java:
Télécharge JavaRa.zip de Paul 'Prm753' McLain et Fred de Vries.
Décompresse le fichier sur ton bureau (clique droit > Extraire tout.)
Double-clique sur le répertoire JavaRa obtenu.
Puis double-clique sur le fichier JavaRa.exe (le .exe peut ne pas s'afficher)
Clique sur Search For Updates.
Sélectionne Update Using jucheck.exe puis clique sur Search.
Autorise le processus à se connecter s'il te le demande, clique sur Install et suis les instructions d'installation. Cela prendra quelques minutes.
Quand l'installation est terminée, revient à l'écran de JavaRa et clique sur Remove Older Versions.
Clique sur Oui pour confirmer. L'outil va travailler, clique ensuite sur Ok, puis une deuxième fois sur Ok.
Un rapport va s'ouvrir, copie-colle le dans ta prochaine réponse.
Note : le rapport se trouve aussi à la racine de la partition système, en général C:\ sous le nom JavaRa.log
(c:\JavaRa.log)
Ferme l'application.
si cela ne fonctionne pas
https://www.java.com/fr/download/windows_manual.jsp?locale=fr&host=www.java.com:80
tu peux désinstaller les vieilles versions.
___________________________
mets a jour internet explorer :
https://www.01net.com/telecharger/windows/Internet/navigateur/fiches/33081.html
________________
Télécharge ici :
http://images.malwareremoval.com/random/RSIT.exe
random's system information tool (RSIT) par andom/random et sauvegarde-le sur le Bureau.
Double-clique sur RSIT.exe afin de lancer RSIT.
Clique Continue à l'écran Disclaimer.
Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.
Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront.
Poste le contenu de log.txt (<<qui sera affiché)
ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).
NB : Les rapports sont sauvegardés dans le dossier C:\rsit
LaetitiaH
Messages postés
169
Date d'inscription
jeudi 26 juillet 2007
Statut
Membre
Dernière intervention
5 août 2010
1
5 mars 2009 à 09:39
5 mars 2009 à 09:39
Bonjour,
Voici le rapport antivir (que je venais juste de faire).
Merci,
Laëtitia
Avira AntiVir Personal
Report file date: jeudi 5 mars 2009 06:16
Scanning for 1283405 virus strains and unwanted programs.
Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Boot mode: Normally booted
Username: SYSTEM
Computer name: XPSP2-653F4AEFD
Version information:
BUILD.DAT : 8.2.0.337 16934 Bytes 18/11/2008 13:05:00
AVSCAN.EXE : 8.1.4.10 315649 Bytes 18/11/2008 08:21:26
AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 07:56:40
LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:19
LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 07:58:52
ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 11:30:36
ANTIVIR1.VDF : 7.1.2.12 3336192 Bytes 11/02/2009 23:07:30
ANTIVIR2.VDF : 7.1.2.105 513536 Bytes 03/03/2009 23:07:32
ANTIVIR3.VDF : 7.1.2.121 89088 Bytes 04/03/2009 23:07:32
Engineversion : 8.2.0.100
AEVDF.DLL : 8.1.1.0 106868 Bytes 04/03/2009 23:07:39
AESCRIPT.DLL : 8.1.1.56 352634 Bytes 04/03/2009 23:07:38
AESCN.DLL : 8.1.1.7 127347 Bytes 04/03/2009 23:07:37
AERDL.DLL : 8.1.1.3 438645 Bytes 04/11/2008 13:58:38
AEPACK.DLL : 8.1.3.10 397686 Bytes 04/03/2009 23:07:37
AEOFFICE.DLL : 8.1.0.36 196987 Bytes 04/03/2009 23:07:36
AEHEUR.DLL : 8.1.0.100 1618295 Bytes 04/03/2009 23:07:35
AEHELP.DLL : 8.1.2.2 119158 Bytes 04/03/2009 23:07:34
AEGEN.DLL : 8.1.1.24 336244 Bytes 04/03/2009 23:07:33
AEEMU.DLL : 8.1.0.9 393588 Bytes 14/10/2008 10:05:56
AECORE.DLL : 8.1.6.6 176501 Bytes 04/03/2009 23:07:33
AEBB.DLL : 8.1.0.3 53618 Bytes 14/10/2008 10:05:56
AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:05
AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:28:01
AVREP.DLL : 8.0.0.2 98344 Bytes 31/07/2008 12:02:15
AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:40
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23
AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:49
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:40
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10
RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 13:48:07
RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 13:34:37
Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, E:,
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium
Start of the scan: jeudi 5 mars 2009 06:16
The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'unsecapp.exe' - '1' Module(s) have been scanned
Scan process 'prevx.exe' - '1' Module(s) have been scanned
Scan process 'WDBtnMgrSvc.exe' - '1' Module(s) have been scanned
Scan process 'UAService7.exe' - '1' Module(s) have been scanned
Scan process 'WdfMgr.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'NMSAccessU.exe' - '1' Module(s) have been scanned
Scan process 'MDM.EXE' - '1' Module(s) have been scanned
Scan process 'jqs.exe' - '1' Module(s) have been scanned
Scan process 'prevx.exe' - '1' Module(s) have been scanned
Scan process 'mDNSResponder.exe' - '1' Module(s) have been scanned
Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'daemon.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'TeaTimer.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'a2service.exe' - '1' Module(s) have been scanned
Scan process 'AAWTray.exe' - '1' Module(s) have been scanned
Scan process 'SSMMgr.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'zlclient.exe' - '0' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'CpuPowerMonitor.exe' - '1' Module(s) have been scanned
Scan process 'RTHDCPL.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'AAWService.exe' - '1' Module(s) have been scanned
Scan process 'vsmon.exe' - '0' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
44 processes with 44 modules were scanned
Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Master boot sector HD1
[INFO] No virus was found!
Master boot sector HD2
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.
Master boot sector HD3
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.
Master boot sector HD4
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.
Master boot sector HD5
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.
Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'E:\'
[INFO] No virus was found!
Starting to scan the registry.
The registry was scanned ( '54' files ).
Starting the file scan:
Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\WINDOWS\Installer\MSI8A.tmp
[DETECTION] Is the TR/BHO.OneStepSearch.66 Trojan
[NOTE] The file was deleted!
C:\WINDOWS\system32\drivers\sptd.sys
[WARNING] The file could not be opened!
Begin scan in 'E:\' <My Book>
E:\m0vnonh.bat
[DETECTION] Is the TR/PSW.Magania.auui Trojan
[NOTE] The file was deleted!
E:\Mes documents\telechargement\6000 Sound Effects CD-Rom ISO\6000SoEf\SETUP.EXE
[0] Archive type: NSIS
--> [TempDir]/Downloader.exe
[DETECTION] Contains HEUR/Malware suspicious code
[DETECTION] Is the TR/Dldr.Agent.67357 Trojan
[NOTE] The file was deleted!
End of the scan: jeudi 5 mars 2009 08:03
Used time: 1:47:03 Hour(s)
The scan has been done completely.
17931 Scanning directories
736340 Files were scanned
3 viruses and/or unwanted programs were found
1 Files were classified as suspicious:
3 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
2 Files cannot be scanned
736334 Files not concerned
5037 Archives were scanned
6 Warnings
3 Notes
Voici le rapport antivir (que je venais juste de faire).
Merci,
Laëtitia
Avira AntiVir Personal
Report file date: jeudi 5 mars 2009 06:16
Scanning for 1283405 virus strains and unwanted programs.
Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Boot mode: Normally booted
Username: SYSTEM
Computer name: XPSP2-653F4AEFD
Version information:
BUILD.DAT : 8.2.0.337 16934 Bytes 18/11/2008 13:05:00
AVSCAN.EXE : 8.1.4.10 315649 Bytes 18/11/2008 08:21:26
AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 07:56:40
LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:19
LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 07:58:52
ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 11:30:36
ANTIVIR1.VDF : 7.1.2.12 3336192 Bytes 11/02/2009 23:07:30
ANTIVIR2.VDF : 7.1.2.105 513536 Bytes 03/03/2009 23:07:32
ANTIVIR3.VDF : 7.1.2.121 89088 Bytes 04/03/2009 23:07:32
Engineversion : 8.2.0.100
AEVDF.DLL : 8.1.1.0 106868 Bytes 04/03/2009 23:07:39
AESCRIPT.DLL : 8.1.1.56 352634 Bytes 04/03/2009 23:07:38
AESCN.DLL : 8.1.1.7 127347 Bytes 04/03/2009 23:07:37
AERDL.DLL : 8.1.1.3 438645 Bytes 04/11/2008 13:58:38
AEPACK.DLL : 8.1.3.10 397686 Bytes 04/03/2009 23:07:37
AEOFFICE.DLL : 8.1.0.36 196987 Bytes 04/03/2009 23:07:36
AEHEUR.DLL : 8.1.0.100 1618295 Bytes 04/03/2009 23:07:35
AEHELP.DLL : 8.1.2.2 119158 Bytes 04/03/2009 23:07:34
AEGEN.DLL : 8.1.1.24 336244 Bytes 04/03/2009 23:07:33
AEEMU.DLL : 8.1.0.9 393588 Bytes 14/10/2008 10:05:56
AECORE.DLL : 8.1.6.6 176501 Bytes 04/03/2009 23:07:33
AEBB.DLL : 8.1.0.3 53618 Bytes 14/10/2008 10:05:56
AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:05
AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:28:01
AVREP.DLL : 8.0.0.2 98344 Bytes 31/07/2008 12:02:15
AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:40
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23
AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:49
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:40
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10
RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 13:48:07
RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 13:34:37
Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, E:,
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium
Start of the scan: jeudi 5 mars 2009 06:16
The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'unsecapp.exe' - '1' Module(s) have been scanned
Scan process 'prevx.exe' - '1' Module(s) have been scanned
Scan process 'WDBtnMgrSvc.exe' - '1' Module(s) have been scanned
Scan process 'UAService7.exe' - '1' Module(s) have been scanned
Scan process 'WdfMgr.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'NMSAccessU.exe' - '1' Module(s) have been scanned
Scan process 'MDM.EXE' - '1' Module(s) have been scanned
Scan process 'jqs.exe' - '1' Module(s) have been scanned
Scan process 'prevx.exe' - '1' Module(s) have been scanned
Scan process 'mDNSResponder.exe' - '1' Module(s) have been scanned
Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'daemon.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'TeaTimer.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'a2service.exe' - '1' Module(s) have been scanned
Scan process 'AAWTray.exe' - '1' Module(s) have been scanned
Scan process 'SSMMgr.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'zlclient.exe' - '0' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'CpuPowerMonitor.exe' - '1' Module(s) have been scanned
Scan process 'RTHDCPL.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'AAWService.exe' - '1' Module(s) have been scanned
Scan process 'vsmon.exe' - '0' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
44 processes with 44 modules were scanned
Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Master boot sector HD1
[INFO] No virus was found!
Master boot sector HD2
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.
Master boot sector HD3
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.
Master boot sector HD4
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.
Master boot sector HD5
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.
Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'E:\'
[INFO] No virus was found!
Starting to scan the registry.
The registry was scanned ( '54' files ).
Starting the file scan:
Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\WINDOWS\Installer\MSI8A.tmp
[DETECTION] Is the TR/BHO.OneStepSearch.66 Trojan
[NOTE] The file was deleted!
C:\WINDOWS\system32\drivers\sptd.sys
[WARNING] The file could not be opened!
Begin scan in 'E:\' <My Book>
E:\m0vnonh.bat
[DETECTION] Is the TR/PSW.Magania.auui Trojan
[NOTE] The file was deleted!
E:\Mes documents\telechargement\6000 Sound Effects CD-Rom ISO\6000SoEf\SETUP.EXE
[0] Archive type: NSIS
--> [TempDir]/Downloader.exe
[DETECTION] Contains HEUR/Malware suspicious code
[DETECTION] Is the TR/Dldr.Agent.67357 Trojan
[NOTE] The file was deleted!
End of the scan: jeudi 5 mars 2009 08:03
Used time: 1:47:03 Hour(s)
The scan has been done completely.
17931 Scanning directories
736340 Files were scanned
3 viruses and/or unwanted programs were found
1 Files were classified as suspicious:
3 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
2 Files cannot be scanned
736334 Files not concerned
5037 Archives were scanned
6 Warnings
3 Notes
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
5 mars 2009 à 10:05
5 mars 2009 à 10:05
télécharge OTMoveIt
http://oldtimer.geekstogo.com/OTMoveIt3.exe
(de Old_Timer) sur ton Bureau.
double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.
:files
C:\WINDOWS\Installer\MSI8A.tmp
E:\Mes documents\telechargement\6000 Sound Effects CD-Rom ISO
clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.
il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.
fais le reste déjà demandé et ceci
http://oldtimer.geekstogo.com/OTMoveIt3.exe
(de Old_Timer) sur ton Bureau.
double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.
:files
C:\WINDOWS\Installer\MSI8A.tmp
E:\Mes documents\telechargement\6000 Sound Effects CD-Rom ISO
clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.
il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.
fais le reste déjà demandé et ceci
LaetitiaH
Messages postés
169
Date d'inscription
jeudi 26 juillet 2007
Statut
Membre
Dernière intervention
5 août 2010
1
5 mars 2009 à 10:19
5 mars 2009 à 10:19
Voici le rapport move it :
========== FILES ==========
File/Folder C:\WINDOWS\Installer\MSI8A.tmp not found.
E:\Mes documents\telechargement\6000 Sound Effects CD-Rom ISO\6000SoEf\Cosmi moved successfully.
E:\Mes documents\telechargement\6000 Sound Effects CD-Rom ISO\6000SoEf moved successfully.
E:\Mes documents\telechargement\6000 Sound Effects CD-Rom ISO moved successfully.
OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 03052009_101908
========== FILES ==========
File/Folder C:\WINDOWS\Installer\MSI8A.tmp not found.
E:\Mes documents\telechargement\6000 Sound Effects CD-Rom ISO\6000SoEf\Cosmi moved successfully.
E:\Mes documents\telechargement\6000 Sound Effects CD-Rom ISO\6000SoEf moved successfully.
E:\Mes documents\telechargement\6000 Sound Effects CD-Rom ISO moved successfully.
OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 03052009_101908
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
5 mars 2009 à 10:23
5 mars 2009 à 10:23
ok parfait
vire le dossier otmovit en allant dans poste de travail puis C puis otmovit
_____________
branche tes disques externes (clés usb...) car ce sont elles la source du problème!
_____________
Télécharge RavAntivirus d'Evosla :
http://ww25.evosla.com/compteur.php?soft=rav_antivirus
# Si tu as une clé USB, disque dur externe, etc, branche-les sans les ouvrir avant de lancer ce FIX
# Fais un clic droit sur le fichier .ZIP > Extraire sur > le Bureau
# Doucle-clique sur >> RAV.exe << afin de lancer l'outil.
# Une fois RAV ANTIVIRUS lancé, laisse-le réagir , il scanne automatiquement tout les lecteurs (disques fixes et amovibles)
# Si infection > un log s'établira, sinon le soft affichera (très rapide) ==>Votre Ordinateur est sain .
# Retire tes disques amovibles et redémarrez votre ordinateur.
# Poste le rapport, si infection! (si rien au bout de deux minutes arrete)
_________________
Pour fusionner:
http://img.photobucket.com/albums/v666/sUBs/CFScript.gif
_______________
telecharge combofix:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Sauvegarde le sur ton bureau et pas ailleurs !
_________________
Ferme tous tes navigateurs (donc copie ou imprime les instructions avant)
Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :
File::
K:\m0vnonh.bat
Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4b9edb8f-8b05-11dd-a85e-001e8c5d4292}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{54efc6da-7de3-11dd-bfc4-806d6172696f}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{daa26d60-7dd8-11dd-bb41-001e8c5d4292}]
Enregistre ce fichier sous le nom CFscript
Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe
Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.
Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt
_____________________________
Télécharge sur le bureau Flash Disinfector (de SUBS) à cette adresse : http://www.techsupportforum.com/sectools/sUBs/Flash_Disinfector.exe
Double-clique sur l’icône.
Les icônes vont disparaître. C’est normal.
Si un rapport est généré en cas d'infection, sauvegarde-le sur le bureau, et poste le ensuite
Redémarre ensuite le PC.
vire le dossier otmovit en allant dans poste de travail puis C puis otmovit
_____________
branche tes disques externes (clés usb...) car ce sont elles la source du problème!
_____________
Télécharge RavAntivirus d'Evosla :
http://ww25.evosla.com/compteur.php?soft=rav_antivirus
# Si tu as une clé USB, disque dur externe, etc, branche-les sans les ouvrir avant de lancer ce FIX
# Fais un clic droit sur le fichier .ZIP > Extraire sur > le Bureau
# Doucle-clique sur >> RAV.exe << afin de lancer l'outil.
# Une fois RAV ANTIVIRUS lancé, laisse-le réagir , il scanne automatiquement tout les lecteurs (disques fixes et amovibles)
# Si infection > un log s'établira, sinon le soft affichera (très rapide) ==>Votre Ordinateur est sain .
# Retire tes disques amovibles et redémarrez votre ordinateur.
# Poste le rapport, si infection! (si rien au bout de deux minutes arrete)
_________________
Pour fusionner:
http://img.photobucket.com/albums/v666/sUBs/CFScript.gif
_______________
telecharge combofix:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Sauvegarde le sur ton bureau et pas ailleurs !
_________________
Ferme tous tes navigateurs (donc copie ou imprime les instructions avant)
Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :
File::
K:\m0vnonh.bat
Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4b9edb8f-8b05-11dd-a85e-001e8c5d4292}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{54efc6da-7de3-11dd-bfc4-806d6172696f}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{daa26d60-7dd8-11dd-bb41-001e8c5d4292}]
Enregistre ce fichier sous le nom CFscript
Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe
Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.
Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt
_____________________________
Télécharge sur le bureau Flash Disinfector (de SUBS) à cette adresse : http://www.techsupportforum.com/sectools/sUBs/Flash_Disinfector.exe
Double-clique sur l’icône.
Les icônes vont disparaître. C’est normal.
Si un rapport est généré en cas d'infection, sauvegarde-le sur le bureau, et poste le ensuite
Redémarre ensuite le PC.
LaetitiaH
Messages postés
169
Date d'inscription
jeudi 26 juillet 2007
Statut
Membre
Dernière intervention
5 août 2010
1
5 mars 2009 à 10:33
5 mars 2009 à 10:33
Merci pour ton aide, là, je dois aller à un rendez-vous (j'ai autant de virus que mon pc), je reviens d'ici 1 heure et je fais tout cela.
Merci encore,
Laëtitia
Merci encore,
Laëtitia
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
5 mars 2009 à 10:35
5 mars 2009 à 10:35
ok je verrai cela après car dans une heure je ne serai pas dispo
a plus
a plus
LaetitiaH
Messages postés
169
Date d'inscription
jeudi 26 juillet 2007
Statut
Membre
Dernière intervention
5 août 2010
1
5 mars 2009 à 10:50
5 mars 2009 à 10:50
Ok, voici le rapport combofix (Il fallait bien que j'enlève la clé usb et le ddexterne ?)
ComboFix 09-03-04.01 - laetitia 2009-03-05 10:49:22.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.3071.2579 [GMT 1:00]
Lancé depuis: c:\documents and settings\laetitia\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\laetitia\Bureau\CFscript.txt
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated)
FW: ZoneAlarm Firewall *enabled*
* Un nouveau point de restauration a été créé
FILE ::
K:\m0vnonh.bat
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users\Application Data\vlc-0.9.6-win32.exe
c:\windows\WMA.EXE
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-02-05 au 2009-03-05 ))))))))))))))))))))))))))))))))))))
.
2009-03-05 10:17 . 2009-03-05 10:21 <REP> d-------- C:\rsit
2009-03-05 10:15 . 2009-03-05 10:15 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-03-05 10:10 . 2009-03-05 10:10 <REP> d-------- c:\program files\NOS
2009-03-05 10:10 . 2009-03-05 10:10 <REP> d-------- c:\documents and settings\All Users\Application Data\NOS
2009-03-05 08:16 . 2009-03-05 08:16 <REP> d-------- c:\program files\Lavalys
2009-03-05 00:20 . 2009-03-05 00:21 <REP> d-------- c:\program files\SpywareBlaster
2009-03-05 00:19 . 2009-03-05 00:19 <REP> d-------- c:\program files\Prevx
2009-03-05 00:19 . 2009-03-05 08:29 <REP> d-------- c:\documents and settings\All Users\Application Data\PrevxCSI
2009-03-05 00:19 . 2009-03-05 00:19 22,536 --a------ c:\windows\system32\drivers\pxscan.sys
2009-03-05 00:06 . 2009-03-05 00:06 <REP> d-------- c:\program files\Avira
2009-03-05 00:06 . 2009-03-05 00:06 <REP> d-------- c:\documents and settings\All Users\Application Data\Avira
2009-03-04 22:25 . 2009-03-05 00:19 287 --a------ c:\windows\wininit.ini
2009-03-04 21:44 . 2009-03-04 21:44 <REP> d-------- c:\windows\system32\Kaspersky Lab
2009-03-04 21:11 . 2009-03-04 21:11 <REP> d-------- c:\program files\Trend Micro
2009-03-04 20:59 . 2009-03-05 09:35 <REP> d-------- c:\program files\Lavasoft
2009-03-03 22:53 . 2008-09-08 21:27 <REP> d--h----- c:\documents and settings\Administrateur\Voisinage réseau
2009-03-03 22:53 . 2008-09-08 21:27 <REP> d--h----- c:\documents and settings\Administrateur\Voisinage d'impression
2009-03-03 22:53 . 2008-09-08 19:31 <REP> d--h----- c:\documents and settings\Administrateur\Modèles
2009-03-03 22:53 . 2008-09-08 21:27 <REP> d-------- c:\documents and settings\Administrateur\Mes documents
2009-03-03 22:53 . 2008-09-08 21:27 <REP> dr------- c:\documents and settings\Administrateur\Menu Démarrer
2009-03-03 22:53 . 2008-09-08 19:34 <REP> d-------- c:\documents and settings\Administrateur\Favoris
2009-03-03 22:53 . 2009-03-04 07:41 <REP> d-------- c:\documents and settings\Administrateur\Bureau
2009-03-03 22:53 . 2009-03-03 22:53 <REP> d-------- c:\documents and settings\Administrateur\Application Data\Malwarebytes
2009-03-03 22:53 . 2009-03-03 22:53 <REP> d-------- c:\documents and settings\Administrateur
2009-02-28 20:35 . 2009-02-28 21:00 <REP> d-------- c:\program files\CompteSurMoiCE1
2009-02-28 16:54 . 2009-02-28 16:54 <REP> d-------- c:\program files\AbiSuite2
2009-02-28 16:54 . 2009-02-28 16:54 <REP> d-------- c:\documents and settings\laetitia\AbiSuite
2009-02-28 15:57 . 2009-02-28 15:57 371 --a------ c:\windows\JMC_1000_V0601.OLD
2009-02-28 15:57 . 2009-02-28 15:59 371 --a------ c:\windows\JMC_1000_V0601.INI
2009-02-28 15:53 . 2009-02-28 15:53 <REP> d-------- c:\program files\RechLexique
2009-02-28 14:33 . 2009-02-28 15:57 <REP> d-------- C:\educampa
2009-02-28 14:13 . 2009-02-28 14:13 <REP> d-------- c:\documents and settings\laetitia\My GCompris
2009-02-28 14:13 . 2009-02-28 14:13 <REP> d-------- c:\documents and settings\laetitia\.config
2009-02-28 13:44 . 2009-02-28 13:44 <REP> d-------- c:\program files\TuxMath
2009-02-28 13:44 . 2009-02-28 13:48 <REP> d-------- c:\documents and settings\laetitia\Application Data\tuxmath
2009-02-28 13:40 . 2009-02-28 13:53 <REP> d-------- c:\program files\scoliv
2009-02-28 12:21 . 2009-02-28 12:21 255 --a------ c:\windows\gfscore.ini
2009-02-28 12:15 . 2009-02-28 12:15 <REP> d-------- c:\windows\Tabdes+
2009-02-28 12:15 . 2009-02-28 12:15 172,032 --a------ c:\windows\system32\cncs32.dll
2009-02-28 12:15 . 2009-02-28 12:15 18 --a------ c:\windows\gfact.ini
2009-02-28 11:53 . 2009-02-28 11:53 <REP> d-------- c:\program files\operagogo
2009-02-28 11:38 . 2009-02-28 11:38 <REP> d-------- c:\program files\Abracadacalc
2009-02-28 11:27 . 2009-02-28 11:27 <REP> d-------- c:\program files\Projet1
2009-02-28 11:27 . 2009-02-28 11:27 <REP> d-------- c:\program files\math
2009-02-28 11:23 . 2009-02-28 11:23 <REP> d-------- c:\program files\Tables
2009-02-26 20:23 . 2009-02-26 20:23 <REP> d-------- c:\program files\CD Natation
2009-02-20 16:54 . 2009-02-20 16:54 <REP> d-------- c:\program files\declic
2009-02-10 11:13 . 2009-02-10 11:13 <REP> d-------- c:\program files\Safari
2009-02-08 20:48 . 2009-02-08 20:54 <REP> d-------- c:\program files\TuxPaint
2009-02-08 20:48 . 2009-02-08 20:52 <REP> d-------- c:\documents and settings\laetitia\Application Data\TuxPaint
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-05 09:26 --------- d-----w c:\program files\Mozilla Thunderbird
2009-03-05 09:15 410,984 ----a-w c:\windows\system32\deploytk.dll
2009-03-05 09:10 --------- d-----w c:\program files\Java
2009-03-05 08:35 --------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft
2009-03-04 23:23 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-03-04 22:57 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-03-04 21:36 --------- d-----w c:\documents and settings\All Users\Application Data\FLEXnet
2009-03-04 20:50 --------- d-----w c:\program files\Spybot - Search & Destroy
2009-03-04 19:54 --------- d-----w c:\program files\a-squared Free
2009-03-04 06:46 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-03-03 06:37 28,672 ----a-w c:\windows\Internet Logs\xDB80.tmp
2009-03-03 00:13 2,103,808 ----a-w c:\windows\Internet Logs\xDB7F.tmp
2009-03-03 00:13 122,368 ----a-w c:\windows\Internet Logs\xDB7E.tmp
2009-03-03 00:11 4,168,963 ----a-w c:\windows\Internet Logs\tvDebug.zip
2009-03-01 19:40 622,304 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-03-01 19:40 52,922,400 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-03-01 18:27 --------- d-----w c:\documents and settings\laetitia\Application Data\Canon
2009-02-28 10:38 290,816 ------w c:\windows\Setup1.exe
2009-02-28 10:27 74,752 ------w c:\windows\ST6UNST.EXE
2009-02-25 21:30 44,544 ----a-w c:\windows\Internet Logs\xDB7C.tmp
2009-02-25 21:30 2,018,816 ----a-w c:\windows\Internet Logs\xDB7D.tmp
2009-02-24 21:44 86,016 ----a-w c:\windows\Internet Logs\xDB7B.tmp
2009-02-22 21:18 38,912 ----a-w c:\windows\Internet Logs\xDB79.tmp
2009-02-22 21:18 2,013,184 ----a-w c:\windows\Internet Logs\xDB7A.tmp
2009-02-21 22:39 65,024 ----a-w c:\windows\Internet Logs\xDB77.tmp
2009-02-21 22:39 2,012,672 ----a-w c:\windows\Internet Logs\xDB78.tmp
2009-02-19 02:12 30,208 ----a-w c:\windows\Internet Logs\xDB75.tmp
2009-02-19 02:12 2,009,600 ----a-w c:\windows\Internet Logs\xDB76.tmp
2009-02-18 21:17 226,816 ----a-w c:\windows\Internet Logs\xDB73.tmp
2009-02-18 21:17 2,010,624 ----a-w c:\windows\Internet Logs\xDB74.tmp
2009-02-18 17:58 --------- d-----w c:\documents and settings\laetitia\Application Data\uTorrent
2009-02-16 11:02 --------- d-----w c:\documents and settings\laetitia\Application Data\OpenOffice.org2
2009-02-14 23:45 54,272 ----a-w c:\windows\Internet Logs\xDB72.tmp
2009-02-13 19:40 526,848 ----a-w c:\windows\Internet Logs\xDB70.tmp
2009-02-13 19:40 2,001,920 ----a-w c:\windows\Internet Logs\xDB71.tmp
2009-02-11 09:19 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-11 09:19 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-02-10 18:51 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-10 18:50 --------- d-s---w c:\documents and settings\All Users\Application Data\Memeo
2009-02-10 10:13 --------- d-----w c:\documents and settings\laetitia\Application Data\Apple Computer
2009-02-04 07:12 203,776 ----a-w c:\windows\Internet Logs\xDB6E.tmp
2009-02-04 07:12 1,970,688 ----a-w c:\windows\Internet Logs\xDB6F.tmp
2009-01-31 20:41 77,824 ----a-w c:\windows\Internet Logs\xDB6C.tmp
2009-01-31 20:41 1,955,328 ----a-w c:\windows\Internet Logs\xDB6D.tmp
2009-01-31 19:19 --------- d-----w c:\program files\Primaths
2009-01-30 21:17 51,200 ----a-w c:\windows\Internet Logs\xDB6A.tmp
2009-01-30 21:17 1,951,744 ----a-w c:\windows\Internet Logs\xDB6B.tmp
2009-01-30 07:05 155,648 ----a-w c:\windows\Internet Logs\xDB68.tmp
2009-01-30 07:05 1,951,232 ----a-w c:\windows\Internet Logs\xDB69.tmp
2009-01-27 21:13 69,120 ----a-w c:\windows\Internet Logs\xDB66.tmp
2009-01-27 21:13 1,948,160 ----a-w c:\windows\Internet Logs\xDB67.tmp
2009-01-26 20:02 336,384 ----a-w c:\windows\Internet Logs\xDB64.tmp
2009-01-26 20:02 1,944,064 ----a-w c:\windows\Internet Logs\xDB65.tmp
2009-01-23 23:20 100,864 ----a-w c:\windows\Internet Logs\xDB62.tmp
2009-01-23 23:20 1,917,952 ----a-w c:\windows\Internet Logs\xDB63.tmp
2009-01-23 07:13 112,128 ----a-w c:\windows\Internet Logs\xDB61.tmp
2009-01-21 21:44 85,504 ----a-w c:\windows\Internet Logs\xDB5F.tmp
2009-01-21 21:44 1,900,032 ----a-w c:\windows\Internet Logs\xDB60.tmp
2009-01-21 01:00 99,328 ----a-w c:\windows\Internet Logs\xDB5E.tmp
2009-01-20 18:21 --------- d-----w c:\program files\KONAMI
2009-01-20 07:33 52,224 ----a-w c:\windows\Internet Logs\xDB5C.tmp
2009-01-20 07:33 1,899,008 ----a-w c:\windows\Internet Logs\xDB5D.tmp
2009-01-19 20:46 163,328 ----a-w c:\windows\Internet Logs\xDB5A.tmp
2009-01-19 20:46 1,894,400 ----a-w c:\windows\Internet Logs\xDB5B.tmp
2009-01-18 20:02 92,672 ----a-w c:\windows\Internet Logs\xDB58.tmp
2009-01-18 20:02 1,888,768 ----a-w c:\windows\Internet Logs\xDB59.tmp
2009-01-17 21:31 149,504 ----a-w c:\windows\Internet Logs\xDB56.tmp
2009-01-17 21:31 1,883,648 ----a-w c:\windows\Internet Logs\xDB57.tmp
2009-01-16 19:21 --------- d-----w c:\program files\Celestia 1.5.1 Edu
2009-01-16 19:19 --------- d-----w c:\program files\Celestia
2009-01-16 12:59 118,272 ----a-w c:\windows\Internet Logs\xDB54.tmp
2009-01-16 12:59 1,871,360 ----a-w c:\windows\Internet Logs\xDB55.tmp
2009-01-15 18:25 --------- d-----w c:\documents and settings\laetitia\Application Data\Stellarium
2009-01-15 12:06 58,880 ----a-w c:\windows\Internet Logs\xDB52.tmp
2009-01-15 12:06 1,862,656 ----a-w c:\windows\Internet Logs\xDB53.tmp
2009-01-15 09:49 --------- d-----w c:\documents and settings\laetitia\Application Data\dvdcss
2009-01-14 21:18 451,584 ----a-w c:\windows\Internet Logs\xDB50.tmp
2009-01-14 21:18 1,862,144 ----a-w c:\windows\Internet Logs\xDB51.tmp
2009-01-14 16:23 --------- d-----w c:\program files\Ciel
2009-01-14 16:19 --------- d-----w c:\program files\Stellarium
2009-01-12 18:59 --------- d-----w c:\documents and settings\laetitia\Application Data\Media Player Classic
2009-01-12 18:58 --------- d-----w c:\program files\K-Lite Codec Pack
2009-01-10 19:08 379,392 ----a-w c:\windows\Internet Logs\xDB4E.tmp
2009-01-10 19:08 1,848,320 ----a-w c:\windows\Internet Logs\xDB4F.tmp
2009-01-05 22:14 --------- d-s---w c:\documents and settings\All Users\Application Data\WD
2009-01-05 22:14 --------- d-----w c:\program files\WD
2009-01-05 22:14 --------- d-----w c:\program files\Fichiers communs\eSellerate
2009-01-05 22:13 --------- d-----w c:\program files\Western Digital Technologies
2009-01-05 22:13 --------- d-----w c:\program files\Western Digital
2009-01-02 22:34 46,080 ----a-w c:\windows\Internet Logs\xDB4C.tmp
2009-01-02 22:34 1,828,864 ----a-w c:\windows\Internet Logs\xDB4D.tmp
2008-12-26 21:46 118,784 ----a-w c:\windows\Internet Logs\xDB4A.tmp
2008-12-26 21:46 1,827,840 ----a-w c:\windows\Internet Logs\xDB4B.tmp
2008-12-25 20:30 100,352 ----a-w c:\windows\Internet Logs\xDB48.tmp
2008-12-25 20:30 1,827,328 ----a-w c:\windows\Internet Logs\xDB49.tmp
2008-12-21 19:42 57,856 ----a-w c:\windows\Internet Logs\xDB46.tmp
2008-12-21 19:42 1,822,720 ----a-w c:\windows\Internet Logs\xDB47.tmp
2008-12-19 21:29 110,080 ----a-w c:\windows\Internet Logs\xDB44.tmp
2008-12-19 21:29 1,815,040 ----a-w c:\windows\Internet Logs\xDB45.tmp
2008-12-17 20:44 228,352 ----a-w c:\windows\Internet Logs\xDB42.tmp
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-19 15360]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CPU Power Monitor"="c:\program files\ASUS\AI Suite\AiGear3\CpuPowerMonitor.exe" [2007-09-06 626688]
"Cpu Level Up help"="c:\program files\ASUS\AI Suite\CpuLevelUpHelp.exe" [2007-09-11 880640]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-07-20 7110656]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-07-20 86016]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016]
"PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2003-12-04 406016]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"Samsung PanelMgr"="c:\windows\Samsung\PanelMgr\SSMMgr.exe" [2007-05-30 520192]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-05 148888]
"RTHDCPL"="RTHDCPL.EXE" [2007-08-10 c:\windows\RTHDCPL.exe]
"nwiz"="nwiz.exe" [2005-07-20 c:\windows\system32\nwiz.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nlsf"="move" [X]
"Config"="c:\windows\system32\run.cmd" [2006-02-14 248]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-19 44544]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"MemCheckBoxInRunDlg"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"NoStrCmpLogical"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"MemCheckBoxInRunDlg"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.PIM1"= pclepim1.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@=""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@=""
[HKLM\~\startupfolder\C:^Documents and Settings^laetitia^Menu Démarrer^Programmes^Démarrage^OpenOffice.org 2.4.lnk]
path=c:\documents and settings\laetitia\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 2.4.lnk
backup=c:\windows\pss\OpenOffice.org 2.4.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^laetitia^Menu Démarrer^Programmes^Démarrage^WD Anywhere Backup Launcher.lnk]
path=c:\documents and settings\laetitia\Menu Démarrer\Programmes\Démarrage\WD Anywhere Backup Launcher.lnk
backup=c:\windows\pss\WD Anywhere Backup Launcher.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
--a------ 2007-05-10 21:46 624248 c:\program files\Adobe\Acrobat 8.0\Acrobat\acrotray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe_ID0EYTHM]
--a------ 2007-03-20 15:40 1884160 c:\progra~1\FICHIE~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ai Nap]
--a------ 2007-09-06 10:19 1426432 c:\program files\ASUS\AI Suite\AiNap\AiNap.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-11-20 13:20 290088 c:\program files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-01-19 11:55 5674352 c:\program files\MSN Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PopupLexical]
--a------ 2006-10-24 16:17 2646016 c:\program files\Cordial\PopupLexical.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WD Drive Manager]
--a------ 2008-01-30 04:50 438272 c:\program files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
-r------- 2005-05-03 11:43 69632 c:\windows\Alcmtr.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Integration de Cordial"=c:\program files\CORDIAL\DLL_32\INTEGRATION_CORDIAL.EXE
"PopupLexical"="c:\program files\Cordial\PopupLexical.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"DisablePagingExecutive"=dword:00000001
"SecondLevelDataCache"=dword:00000200
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Fichiers communs\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server
"50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server
"50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server
R0 pxscan;pxscan;c:\windows\system32\drivers\pxscan.sys [2009-03-05 22536]
R1 SAVRKBootTasks;Boot Tasks Driver;c:\windows\system32\SAVRKBootTasks.sys [2008-10-25 18816]
R2 CSIScanner;CSIScanner;c:\program files\Prevx\prevx.exe [2009-03-05 4150840]
R2 WDBtnMgrSvc.exe;WD Drive Manager Service;c:\program files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe [2008-01-30 106496]
S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys --> c:\windows\system32\Drivers\SSPORT.sys [?]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2009-03-05 33752]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\8D.tmp --> c:\windows\system32\8D.tmp [?]
.
Contenu du dossier 'Tâches planifiées'
2009-03-04 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe []
2009-03-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
- - - - ORPHELINS SUPPRIMES - - - -
MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre1.6.0_07\bin\jusched.exe
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://google.fr/
mWindow Title =
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.fr/keyword/%s
IE: &Point&&Go - c:\program files\Fichiers communs\Expert System\PGPlatform\PGPlatform.htm
IE: Ajouter au fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir la sélection en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la sélection en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir les liens sélectionnés en fichier Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convertir les liens sélectionnés en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\laetitia\Application Data\Mozilla\Firefox\Profiles\54znq1f2.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-05 10:50:03
Windows 5.1.2600 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\8D.tmp"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,17,1b,b7,a7,3a,
ff,29,bf,c8,28,51,af,b0,29,a3,98,42,cf,03,00,74,7b,a6,e0,e2,63,26,f1,3f,c8,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:6a,9c,d6,61,af,45,84,18,ab,1e,5e,e4,43,
22,93,1d,71,3b,04,66,8b,46,0d,96,a3,fc,eb,12,3f,76,fa,12,6a,9c,d6,61,af,45,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:ff,7c,85,e0,43,d4,0e,fe,e7,96,18,a4,41,
cc,98,93,25,da,ec,7e,55,20,c9,26,04,86,d1,c8,c1,55,e2,2d,ff,7c,85,e0,43,d4,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:3e,1e,9e,e0,57,5a,93,61,7e,0d,f9,d2,d7,
d8,05,fc,3e,1e,9e,e0,57,5a,93,61,80,eb,e1,15,0d,87,72,45,86,8c,21,01,be,91,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:cd,44,cd,b9,a6,33,6c,cd,a4,70,cf,6e,42,
2d,b0,2c,cd,44,cd,b9,a6,33,6c,cd,e1,92,eb,67,43,41,64,cb,f5,1d,4d,73,a8,13,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,fc,dd,9b,3f,77,
87,fb,42,b0,18,ed,a7,3f,8d,37,a4,96,90,15,b2,1e,fd,e6,0d,df,20,58,62,78,6b,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:31,77,e1,ba,b1,f8,68,02,01,98,a6,c7,70,
47,25,88,31,77,e1,ba,b1,f8,68,02,1a,da,80,9c,be,3d,1c,61,fb,a7,78,e6,12,2f,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:01,3a,48,fc,e8,04,4a,f1,22,63,e7,3d,61,
57,0d,44,83,6c,56,8b,a0,85,96,ab,e7,98,51,b7,51,db,2d,9c,01,3a,48,fc,e8,04,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:51,fa,6e,91,28,9e,14,cc,bb,7c,fd,cc,56,
1e,14,41,51,fa,6e,91,28,9e,14,cc,d2,2b,40,c7,6f,b2,0d,af,f6,0f,4e,58,98,5b,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,ea,c2,16,89,72,
5f,f7,43,b1,cd,45,5a,a8,c4,f8,b9,f7,d1,b9,84,ef,41,62,33,3d,ce,ea,26,2d,45,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:e3,0e,66,d5,eb,bc,2f,6b,3a,c4,e3,0c,89,
ce,fa,a1,e3,0e,66,d5,eb,bc,2f,6b,4a,df,30,57,be,34,e2,2d,2a,b7,cc,b5,b9,7f,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:05,73,21,dd,54,d8,4a,c5,44,32,82,d6,96,
f8,8b,4d,fa,ea,66,7f,d4,3b,6b,70,8b,96,97,96,b3,27,c3,89,6c,43,2d,1e,aa,22,\
.
Heure de fin: 2009-03-05 10:51:01
ComboFix-quarantined-files.txt 2009-03-05 09:51:00
Avant-CF: 371 190 759 424 octets libres
Après-CF: 371,181,228,032 octets libres
WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect
385 --- E O F --- 2009-03-05 09:31:14
ComboFix 09-03-04.01 - laetitia 2009-03-05 10:49:22.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.3071.2579 [GMT 1:00]
Lancé depuis: c:\documents and settings\laetitia\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\laetitia\Bureau\CFscript.txt
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated)
FW: ZoneAlarm Firewall *enabled*
* Un nouveau point de restauration a été créé
FILE ::
K:\m0vnonh.bat
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users\Application Data\vlc-0.9.6-win32.exe
c:\windows\WMA.EXE
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-02-05 au 2009-03-05 ))))))))))))))))))))))))))))))))))))
.
2009-03-05 10:17 . 2009-03-05 10:21 <REP> d-------- C:\rsit
2009-03-05 10:15 . 2009-03-05 10:15 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-03-05 10:10 . 2009-03-05 10:10 <REP> d-------- c:\program files\NOS
2009-03-05 10:10 . 2009-03-05 10:10 <REP> d-------- c:\documents and settings\All Users\Application Data\NOS
2009-03-05 08:16 . 2009-03-05 08:16 <REP> d-------- c:\program files\Lavalys
2009-03-05 00:20 . 2009-03-05 00:21 <REP> d-------- c:\program files\SpywareBlaster
2009-03-05 00:19 . 2009-03-05 00:19 <REP> d-------- c:\program files\Prevx
2009-03-05 00:19 . 2009-03-05 08:29 <REP> d-------- c:\documents and settings\All Users\Application Data\PrevxCSI
2009-03-05 00:19 . 2009-03-05 00:19 22,536 --a------ c:\windows\system32\drivers\pxscan.sys
2009-03-05 00:06 . 2009-03-05 00:06 <REP> d-------- c:\program files\Avira
2009-03-05 00:06 . 2009-03-05 00:06 <REP> d-------- c:\documents and settings\All Users\Application Data\Avira
2009-03-04 22:25 . 2009-03-05 00:19 287 --a------ c:\windows\wininit.ini
2009-03-04 21:44 . 2009-03-04 21:44 <REP> d-------- c:\windows\system32\Kaspersky Lab
2009-03-04 21:11 . 2009-03-04 21:11 <REP> d-------- c:\program files\Trend Micro
2009-03-04 20:59 . 2009-03-05 09:35 <REP> d-------- c:\program files\Lavasoft
2009-03-03 22:53 . 2008-09-08 21:27 <REP> d--h----- c:\documents and settings\Administrateur\Voisinage réseau
2009-03-03 22:53 . 2008-09-08 21:27 <REP> d--h----- c:\documents and settings\Administrateur\Voisinage d'impression
2009-03-03 22:53 . 2008-09-08 19:31 <REP> d--h----- c:\documents and settings\Administrateur\Modèles
2009-03-03 22:53 . 2008-09-08 21:27 <REP> d-------- c:\documents and settings\Administrateur\Mes documents
2009-03-03 22:53 . 2008-09-08 21:27 <REP> dr------- c:\documents and settings\Administrateur\Menu Démarrer
2009-03-03 22:53 . 2008-09-08 19:34 <REP> d-------- c:\documents and settings\Administrateur\Favoris
2009-03-03 22:53 . 2009-03-04 07:41 <REP> d-------- c:\documents and settings\Administrateur\Bureau
2009-03-03 22:53 . 2009-03-03 22:53 <REP> d-------- c:\documents and settings\Administrateur\Application Data\Malwarebytes
2009-03-03 22:53 . 2009-03-03 22:53 <REP> d-------- c:\documents and settings\Administrateur
2009-02-28 20:35 . 2009-02-28 21:00 <REP> d-------- c:\program files\CompteSurMoiCE1
2009-02-28 16:54 . 2009-02-28 16:54 <REP> d-------- c:\program files\AbiSuite2
2009-02-28 16:54 . 2009-02-28 16:54 <REP> d-------- c:\documents and settings\laetitia\AbiSuite
2009-02-28 15:57 . 2009-02-28 15:57 371 --a------ c:\windows\JMC_1000_V0601.OLD
2009-02-28 15:57 . 2009-02-28 15:59 371 --a------ c:\windows\JMC_1000_V0601.INI
2009-02-28 15:53 . 2009-02-28 15:53 <REP> d-------- c:\program files\RechLexique
2009-02-28 14:33 . 2009-02-28 15:57 <REP> d-------- C:\educampa
2009-02-28 14:13 . 2009-02-28 14:13 <REP> d-------- c:\documents and settings\laetitia\My GCompris
2009-02-28 14:13 . 2009-02-28 14:13 <REP> d-------- c:\documents and settings\laetitia\.config
2009-02-28 13:44 . 2009-02-28 13:44 <REP> d-------- c:\program files\TuxMath
2009-02-28 13:44 . 2009-02-28 13:48 <REP> d-------- c:\documents and settings\laetitia\Application Data\tuxmath
2009-02-28 13:40 . 2009-02-28 13:53 <REP> d-------- c:\program files\scoliv
2009-02-28 12:21 . 2009-02-28 12:21 255 --a------ c:\windows\gfscore.ini
2009-02-28 12:15 . 2009-02-28 12:15 <REP> d-------- c:\windows\Tabdes+
2009-02-28 12:15 . 2009-02-28 12:15 172,032 --a------ c:\windows\system32\cncs32.dll
2009-02-28 12:15 . 2009-02-28 12:15 18 --a------ c:\windows\gfact.ini
2009-02-28 11:53 . 2009-02-28 11:53 <REP> d-------- c:\program files\operagogo
2009-02-28 11:38 . 2009-02-28 11:38 <REP> d-------- c:\program files\Abracadacalc
2009-02-28 11:27 . 2009-02-28 11:27 <REP> d-------- c:\program files\Projet1
2009-02-28 11:27 . 2009-02-28 11:27 <REP> d-------- c:\program files\math
2009-02-28 11:23 . 2009-02-28 11:23 <REP> d-------- c:\program files\Tables
2009-02-26 20:23 . 2009-02-26 20:23 <REP> d-------- c:\program files\CD Natation
2009-02-20 16:54 . 2009-02-20 16:54 <REP> d-------- c:\program files\declic
2009-02-10 11:13 . 2009-02-10 11:13 <REP> d-------- c:\program files\Safari
2009-02-08 20:48 . 2009-02-08 20:54 <REP> d-------- c:\program files\TuxPaint
2009-02-08 20:48 . 2009-02-08 20:52 <REP> d-------- c:\documents and settings\laetitia\Application Data\TuxPaint
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-05 09:26 --------- d-----w c:\program files\Mozilla Thunderbird
2009-03-05 09:15 410,984 ----a-w c:\windows\system32\deploytk.dll
2009-03-05 09:10 --------- d-----w c:\program files\Java
2009-03-05 08:35 --------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft
2009-03-04 23:23 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-03-04 22:57 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-03-04 21:36 --------- d-----w c:\documents and settings\All Users\Application Data\FLEXnet
2009-03-04 20:50 --------- d-----w c:\program files\Spybot - Search & Destroy
2009-03-04 19:54 --------- d-----w c:\program files\a-squared Free
2009-03-04 06:46 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-03-03 06:37 28,672 ----a-w c:\windows\Internet Logs\xDB80.tmp
2009-03-03 00:13 2,103,808 ----a-w c:\windows\Internet Logs\xDB7F.tmp
2009-03-03 00:13 122,368 ----a-w c:\windows\Internet Logs\xDB7E.tmp
2009-03-03 00:11 4,168,963 ----a-w c:\windows\Internet Logs\tvDebug.zip
2009-03-01 19:40 622,304 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-03-01 19:40 52,922,400 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-03-01 18:27 --------- d-----w c:\documents and settings\laetitia\Application Data\Canon
2009-02-28 10:38 290,816 ------w c:\windows\Setup1.exe
2009-02-28 10:27 74,752 ------w c:\windows\ST6UNST.EXE
2009-02-25 21:30 44,544 ----a-w c:\windows\Internet Logs\xDB7C.tmp
2009-02-25 21:30 2,018,816 ----a-w c:\windows\Internet Logs\xDB7D.tmp
2009-02-24 21:44 86,016 ----a-w c:\windows\Internet Logs\xDB7B.tmp
2009-02-22 21:18 38,912 ----a-w c:\windows\Internet Logs\xDB79.tmp
2009-02-22 21:18 2,013,184 ----a-w c:\windows\Internet Logs\xDB7A.tmp
2009-02-21 22:39 65,024 ----a-w c:\windows\Internet Logs\xDB77.tmp
2009-02-21 22:39 2,012,672 ----a-w c:\windows\Internet Logs\xDB78.tmp
2009-02-19 02:12 30,208 ----a-w c:\windows\Internet Logs\xDB75.tmp
2009-02-19 02:12 2,009,600 ----a-w c:\windows\Internet Logs\xDB76.tmp
2009-02-18 21:17 226,816 ----a-w c:\windows\Internet Logs\xDB73.tmp
2009-02-18 21:17 2,010,624 ----a-w c:\windows\Internet Logs\xDB74.tmp
2009-02-18 17:58 --------- d-----w c:\documents and settings\laetitia\Application Data\uTorrent
2009-02-16 11:02 --------- d-----w c:\documents and settings\laetitia\Application Data\OpenOffice.org2
2009-02-14 23:45 54,272 ----a-w c:\windows\Internet Logs\xDB72.tmp
2009-02-13 19:40 526,848 ----a-w c:\windows\Internet Logs\xDB70.tmp
2009-02-13 19:40 2,001,920 ----a-w c:\windows\Internet Logs\xDB71.tmp
2009-02-11 09:19 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-11 09:19 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-02-10 18:51 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-10 18:50 --------- d-s---w c:\documents and settings\All Users\Application Data\Memeo
2009-02-10 10:13 --------- d-----w c:\documents and settings\laetitia\Application Data\Apple Computer
2009-02-04 07:12 203,776 ----a-w c:\windows\Internet Logs\xDB6E.tmp
2009-02-04 07:12 1,970,688 ----a-w c:\windows\Internet Logs\xDB6F.tmp
2009-01-31 20:41 77,824 ----a-w c:\windows\Internet Logs\xDB6C.tmp
2009-01-31 20:41 1,955,328 ----a-w c:\windows\Internet Logs\xDB6D.tmp
2009-01-31 19:19 --------- d-----w c:\program files\Primaths
2009-01-30 21:17 51,200 ----a-w c:\windows\Internet Logs\xDB6A.tmp
2009-01-30 21:17 1,951,744 ----a-w c:\windows\Internet Logs\xDB6B.tmp
2009-01-30 07:05 155,648 ----a-w c:\windows\Internet Logs\xDB68.tmp
2009-01-30 07:05 1,951,232 ----a-w c:\windows\Internet Logs\xDB69.tmp
2009-01-27 21:13 69,120 ----a-w c:\windows\Internet Logs\xDB66.tmp
2009-01-27 21:13 1,948,160 ----a-w c:\windows\Internet Logs\xDB67.tmp
2009-01-26 20:02 336,384 ----a-w c:\windows\Internet Logs\xDB64.tmp
2009-01-26 20:02 1,944,064 ----a-w c:\windows\Internet Logs\xDB65.tmp
2009-01-23 23:20 100,864 ----a-w c:\windows\Internet Logs\xDB62.tmp
2009-01-23 23:20 1,917,952 ----a-w c:\windows\Internet Logs\xDB63.tmp
2009-01-23 07:13 112,128 ----a-w c:\windows\Internet Logs\xDB61.tmp
2009-01-21 21:44 85,504 ----a-w c:\windows\Internet Logs\xDB5F.tmp
2009-01-21 21:44 1,900,032 ----a-w c:\windows\Internet Logs\xDB60.tmp
2009-01-21 01:00 99,328 ----a-w c:\windows\Internet Logs\xDB5E.tmp
2009-01-20 18:21 --------- d-----w c:\program files\KONAMI
2009-01-20 07:33 52,224 ----a-w c:\windows\Internet Logs\xDB5C.tmp
2009-01-20 07:33 1,899,008 ----a-w c:\windows\Internet Logs\xDB5D.tmp
2009-01-19 20:46 163,328 ----a-w c:\windows\Internet Logs\xDB5A.tmp
2009-01-19 20:46 1,894,400 ----a-w c:\windows\Internet Logs\xDB5B.tmp
2009-01-18 20:02 92,672 ----a-w c:\windows\Internet Logs\xDB58.tmp
2009-01-18 20:02 1,888,768 ----a-w c:\windows\Internet Logs\xDB59.tmp
2009-01-17 21:31 149,504 ----a-w c:\windows\Internet Logs\xDB56.tmp
2009-01-17 21:31 1,883,648 ----a-w c:\windows\Internet Logs\xDB57.tmp
2009-01-16 19:21 --------- d-----w c:\program files\Celestia 1.5.1 Edu
2009-01-16 19:19 --------- d-----w c:\program files\Celestia
2009-01-16 12:59 118,272 ----a-w c:\windows\Internet Logs\xDB54.tmp
2009-01-16 12:59 1,871,360 ----a-w c:\windows\Internet Logs\xDB55.tmp
2009-01-15 18:25 --------- d-----w c:\documents and settings\laetitia\Application Data\Stellarium
2009-01-15 12:06 58,880 ----a-w c:\windows\Internet Logs\xDB52.tmp
2009-01-15 12:06 1,862,656 ----a-w c:\windows\Internet Logs\xDB53.tmp
2009-01-15 09:49 --------- d-----w c:\documents and settings\laetitia\Application Data\dvdcss
2009-01-14 21:18 451,584 ----a-w c:\windows\Internet Logs\xDB50.tmp
2009-01-14 21:18 1,862,144 ----a-w c:\windows\Internet Logs\xDB51.tmp
2009-01-14 16:23 --------- d-----w c:\program files\Ciel
2009-01-14 16:19 --------- d-----w c:\program files\Stellarium
2009-01-12 18:59 --------- d-----w c:\documents and settings\laetitia\Application Data\Media Player Classic
2009-01-12 18:58 --------- d-----w c:\program files\K-Lite Codec Pack
2009-01-10 19:08 379,392 ----a-w c:\windows\Internet Logs\xDB4E.tmp
2009-01-10 19:08 1,848,320 ----a-w c:\windows\Internet Logs\xDB4F.tmp
2009-01-05 22:14 --------- d-s---w c:\documents and settings\All Users\Application Data\WD
2009-01-05 22:14 --------- d-----w c:\program files\WD
2009-01-05 22:14 --------- d-----w c:\program files\Fichiers communs\eSellerate
2009-01-05 22:13 --------- d-----w c:\program files\Western Digital Technologies
2009-01-05 22:13 --------- d-----w c:\program files\Western Digital
2009-01-02 22:34 46,080 ----a-w c:\windows\Internet Logs\xDB4C.tmp
2009-01-02 22:34 1,828,864 ----a-w c:\windows\Internet Logs\xDB4D.tmp
2008-12-26 21:46 118,784 ----a-w c:\windows\Internet Logs\xDB4A.tmp
2008-12-26 21:46 1,827,840 ----a-w c:\windows\Internet Logs\xDB4B.tmp
2008-12-25 20:30 100,352 ----a-w c:\windows\Internet Logs\xDB48.tmp
2008-12-25 20:30 1,827,328 ----a-w c:\windows\Internet Logs\xDB49.tmp
2008-12-21 19:42 57,856 ----a-w c:\windows\Internet Logs\xDB46.tmp
2008-12-21 19:42 1,822,720 ----a-w c:\windows\Internet Logs\xDB47.tmp
2008-12-19 21:29 110,080 ----a-w c:\windows\Internet Logs\xDB44.tmp
2008-12-19 21:29 1,815,040 ----a-w c:\windows\Internet Logs\xDB45.tmp
2008-12-17 20:44 228,352 ----a-w c:\windows\Internet Logs\xDB42.tmp
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-19 15360]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CPU Power Monitor"="c:\program files\ASUS\AI Suite\AiGear3\CpuPowerMonitor.exe" [2007-09-06 626688]
"Cpu Level Up help"="c:\program files\ASUS\AI Suite\CpuLevelUpHelp.exe" [2007-09-11 880640]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-07-20 7110656]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-07-20 86016]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016]
"PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2003-12-04 406016]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"Samsung PanelMgr"="c:\windows\Samsung\PanelMgr\SSMMgr.exe" [2007-05-30 520192]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-05 148888]
"RTHDCPL"="RTHDCPL.EXE" [2007-08-10 c:\windows\RTHDCPL.exe]
"nwiz"="nwiz.exe" [2005-07-20 c:\windows\system32\nwiz.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nlsf"="move" [X]
"Config"="c:\windows\system32\run.cmd" [2006-02-14 248]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-19 44544]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"MemCheckBoxInRunDlg"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"NoStrCmpLogical"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"MemCheckBoxInRunDlg"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.PIM1"= pclepim1.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@=""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@=""
[HKLM\~\startupfolder\C:^Documents and Settings^laetitia^Menu Démarrer^Programmes^Démarrage^OpenOffice.org 2.4.lnk]
path=c:\documents and settings\laetitia\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 2.4.lnk
backup=c:\windows\pss\OpenOffice.org 2.4.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^laetitia^Menu Démarrer^Programmes^Démarrage^WD Anywhere Backup Launcher.lnk]
path=c:\documents and settings\laetitia\Menu Démarrer\Programmes\Démarrage\WD Anywhere Backup Launcher.lnk
backup=c:\windows\pss\WD Anywhere Backup Launcher.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
--a------ 2007-05-10 21:46 624248 c:\program files\Adobe\Acrobat 8.0\Acrobat\acrotray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe_ID0EYTHM]
--a------ 2007-03-20 15:40 1884160 c:\progra~1\FICHIE~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ai Nap]
--a------ 2007-09-06 10:19 1426432 c:\program files\ASUS\AI Suite\AiNap\AiNap.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-11-20 13:20 290088 c:\program files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-01-19 11:55 5674352 c:\program files\MSN Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PopupLexical]
--a------ 2006-10-24 16:17 2646016 c:\program files\Cordial\PopupLexical.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WD Drive Manager]
--a------ 2008-01-30 04:50 438272 c:\program files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
-r------- 2005-05-03 11:43 69632 c:\windows\Alcmtr.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Integration de Cordial"=c:\program files\CORDIAL\DLL_32\INTEGRATION_CORDIAL.EXE
"PopupLexical"="c:\program files\Cordial\PopupLexical.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"DisablePagingExecutive"=dword:00000001
"SecondLevelDataCache"=dword:00000200
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Fichiers communs\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server
"50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server
"50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server
R0 pxscan;pxscan;c:\windows\system32\drivers\pxscan.sys [2009-03-05 22536]
R1 SAVRKBootTasks;Boot Tasks Driver;c:\windows\system32\SAVRKBootTasks.sys [2008-10-25 18816]
R2 CSIScanner;CSIScanner;c:\program files\Prevx\prevx.exe [2009-03-05 4150840]
R2 WDBtnMgrSvc.exe;WD Drive Manager Service;c:\program files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe [2008-01-30 106496]
S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys --> c:\windows\system32\Drivers\SSPORT.sys [?]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2009-03-05 33752]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\8D.tmp --> c:\windows\system32\8D.tmp [?]
.
Contenu du dossier 'Tâches planifiées'
2009-03-04 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe []
2009-03-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
- - - - ORPHELINS SUPPRIMES - - - -
MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre1.6.0_07\bin\jusched.exe
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://google.fr/
mWindow Title =
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.fr/keyword/%s
IE: &Point&&Go - c:\program files\Fichiers communs\Expert System\PGPlatform\PGPlatform.htm
IE: Ajouter au fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir la sélection en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la sélection en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir les liens sélectionnés en fichier Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convertir les liens sélectionnés en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\laetitia\Application Data\Mozilla\Firefox\Profiles\54znq1f2.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-05 10:50:03
Windows 5.1.2600 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\8D.tmp"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,17,1b,b7,a7,3a,
ff,29,bf,c8,28,51,af,b0,29,a3,98,42,cf,03,00,74,7b,a6,e0,e2,63,26,f1,3f,c8,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:6a,9c,d6,61,af,45,84,18,ab,1e,5e,e4,43,
22,93,1d,71,3b,04,66,8b,46,0d,96,a3,fc,eb,12,3f,76,fa,12,6a,9c,d6,61,af,45,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:ff,7c,85,e0,43,d4,0e,fe,e7,96,18,a4,41,
cc,98,93,25,da,ec,7e,55,20,c9,26,04,86,d1,c8,c1,55,e2,2d,ff,7c,85,e0,43,d4,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:3e,1e,9e,e0,57,5a,93,61,7e,0d,f9,d2,d7,
d8,05,fc,3e,1e,9e,e0,57,5a,93,61,80,eb,e1,15,0d,87,72,45,86,8c,21,01,be,91,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:cd,44,cd,b9,a6,33,6c,cd,a4,70,cf,6e,42,
2d,b0,2c,cd,44,cd,b9,a6,33,6c,cd,e1,92,eb,67,43,41,64,cb,f5,1d,4d,73,a8,13,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,fc,dd,9b,3f,77,
87,fb,42,b0,18,ed,a7,3f,8d,37,a4,96,90,15,b2,1e,fd,e6,0d,df,20,58,62,78,6b,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:31,77,e1,ba,b1,f8,68,02,01,98,a6,c7,70,
47,25,88,31,77,e1,ba,b1,f8,68,02,1a,da,80,9c,be,3d,1c,61,fb,a7,78,e6,12,2f,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:01,3a,48,fc,e8,04,4a,f1,22,63,e7,3d,61,
57,0d,44,83,6c,56,8b,a0,85,96,ab,e7,98,51,b7,51,db,2d,9c,01,3a,48,fc,e8,04,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:51,fa,6e,91,28,9e,14,cc,bb,7c,fd,cc,56,
1e,14,41,51,fa,6e,91,28,9e,14,cc,d2,2b,40,c7,6f,b2,0d,af,f6,0f,4e,58,98,5b,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,ea,c2,16,89,72,
5f,f7,43,b1,cd,45,5a,a8,c4,f8,b9,f7,d1,b9,84,ef,41,62,33,3d,ce,ea,26,2d,45,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:e3,0e,66,d5,eb,bc,2f,6b,3a,c4,e3,0c,89,
ce,fa,a1,e3,0e,66,d5,eb,bc,2f,6b,4a,df,30,57,be,34,e2,2d,2a,b7,cc,b5,b9,7f,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:05,73,21,dd,54,d8,4a,c5,44,32,82,d6,96,
f8,8b,4d,fa,ea,66,7f,d4,3b,6b,70,8b,96,97,96,b3,27,c3,89,6c,43,2d,1e,aa,22,\
.
Heure de fin: 2009-03-05 10:51:01
ComboFix-quarantined-files.txt 2009-03-05 09:51:00
Avant-CF: 371 190 759 424 octets libres
Après-CF: 371,181,228,032 octets libres
WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect
385 --- E O F --- 2009-03-05 09:31:14
LaetitiaH
Messages postés
169
Date d'inscription
jeudi 26 juillet 2007
Statut
Membre
Dernière intervention
5 août 2010
1
5 mars 2009 à 10:55
5 mars 2009 à 10:55
Et flash desinfector (avec la clé et le disque) ne trouve rien. Dois-je faire autre chose ?
Merci beaucoup en tous cas,
Laetitia
Merci beaucoup en tous cas,
Laetitia
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
5 mars 2009 à 11:16
5 mars 2009 à 11:16
Télécharge ToolsCleaner sur ton bureau.
--> http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner
# Clique sur Recherche et laisse le scan agir ...
# Clique sur Suppression pour finaliser.
# Tu peux, si tu le souhaites, te servir des Options facultatives.
# Clique sur Quitter pour obtenir le rapport.
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).
_______________________
désactive ta restauration puis redemarre ton ordi puis réactive la
http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fdocid/20020830101856924
_______________________
verifie avec antivir si c'est bon!
--> http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner
# Clique sur Recherche et laisse le scan agir ...
# Clique sur Suppression pour finaliser.
# Tu peux, si tu le souhaites, te servir des Options facultatives.
# Clique sur Quitter pour obtenir le rapport.
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).
_______________________
désactive ta restauration puis redemarre ton ordi puis réactive la
http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fdocid/20020830101856924
_______________________
verifie avec antivir si c'est bon!
LaetitiaH
Messages postés
169
Date d'inscription
jeudi 26 juillet 2007
Statut
Membre
Dernière intervention
5 août 2010
1
5 mars 2009 à 12:36
5 mars 2009 à 12:36
Je fais cela tout de suite. Antivir (le résident) vient de réagir à cela : WORM/Generic.4084
LaetitiaH
Messages postés
169
Date d'inscription
jeudi 26 juillet 2007
Statut
Membre
Dernière intervention
5 août 2010
1
5 mars 2009 à 12:42
5 mars 2009 à 12:42
[ Rapport ToolsCleaner version 2.3.2 (par A.Rothstein & dj QUIOU) ]
Voici le rapport de toolscleaner :
-->- Recherche:
C:\Combofix.txt: trouvé !
C:\TB.txt: trouvé !
C:\Combofix: trouvé !
C:\Qoobox: trouvé !
C:\Toolbar SD: trouvé !
C:\Rsit: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\laetitia\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\laetitia\Bureau\ComboFix.exe: trouvé !
C:\Documents and Settings\laetitia\Bureau\hijackthis.log: trouvé !
C:\Documents and Settings\laetitia\Bureau\OTMoveIt3.exe: trouvé !
C:\Documents and Settings\laetitia\Bureau\Rsit.exe: trouvé !
C:\Documents and Settings\laetitia\Bureau\désinfection\hijackthis.log: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !
Voici le rapport de toolscleaner :
-->- Recherche:
C:\Combofix.txt: trouvé !
C:\TB.txt: trouvé !
C:\Combofix: trouvé !
C:\Qoobox: trouvé !
C:\Toolbar SD: trouvé !
C:\Rsit: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\laetitia\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\laetitia\Bureau\ComboFix.exe: trouvé !
C:\Documents and Settings\laetitia\Bureau\hijackthis.log: trouvé !
C:\Documents and Settings\laetitia\Bureau\OTMoveIt3.exe: trouvé !
C:\Documents and Settings\laetitia\Bureau\Rsit.exe: trouvé !
C:\Documents and Settings\laetitia\Bureau\désinfection\hijackthis.log: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
5 mars 2009 à 13:08
5 mars 2009 à 13:08
ok vire tout et passe à la suite. Et pour antivir active dans les options la recherche des rootkits . À plus
LaetitiaH
Messages postés
169
Date d'inscription
jeudi 26 juillet 2007
Statut
Membre
Dernière intervention
5 août 2010
1
5 mars 2009 à 13:22
5 mars 2009 à 13:22
Où se trouve cette option concernant les roolkits ?
Oups, en fait j'ai trouvé, je t'envoies cela dès que c'est fait.
Merci pour tout.
Laëtitia
Oups, en fait j'ai trouvé, je t'envoies cela dès que c'est fait.
Merci pour tout.
Laëtitia
LaetitiaH
Messages postés
169
Date d'inscription
jeudi 26 juillet 2007
Statut
Membre
Dernière intervention
5 août 2010
1
5 mars 2009 à 14:31
5 mars 2009 à 14:31
A priori, c'est bon d'après antivir :
Merci beaucoup pour ton aide, je pensais perdre tous mon travail dans la bataille. Merci,
Laëtitia
Avira AntiVir Personal
Report file date: jeudi 5 mars 2009 13:38
Scanning for 1284346 virus strains and unwanted programs.
Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Boot mode: Normally booted
Username: SYSTEM
Computer name: XPSP2-653F4AEFD
Version information:
BUILD.DAT : 8.2.0.337 16934 Bytes 18/11/2008 13:05:00
AVSCAN.EXE : 8.1.4.10 315649 Bytes 18/11/2008 08:21:26
AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 07:56:40
LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:19
LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 07:58:52
ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 11:30:36
ANTIVIR1.VDF : 7.1.2.12 3336192 Bytes 11/02/2009 23:07:30
ANTIVIR2.VDF : 7.1.2.105 513536 Bytes 03/03/2009 23:07:32
ANTIVIR3.VDF : 7.1.2.123 102400 Bytes 05/03/2009 09:57:18
Engineversion : 8.2.0.100
AEVDF.DLL : 8.1.1.0 106868 Bytes 04/03/2009 23:07:39
AESCRIPT.DLL : 8.1.1.56 352634 Bytes 04/03/2009 23:07:38
AESCN.DLL : 8.1.1.7 127347 Bytes 04/03/2009 23:07:37
AERDL.DLL : 8.1.1.3 438645 Bytes 04/11/2008 13:58:38
AEPACK.DLL : 8.1.3.10 397686 Bytes 04/03/2009 23:07:37
AEOFFICE.DLL : 8.1.0.36 196987 Bytes 04/03/2009 23:07:36
AEHEUR.DLL : 8.1.0.100 1618295 Bytes 04/03/2009 23:07:35
AEHELP.DLL : 8.1.2.2 119158 Bytes 04/03/2009 23:07:34
AEGEN.DLL : 8.1.1.24 336244 Bytes 04/03/2009 23:07:33
AEEMU.DLL : 8.1.0.9 393588 Bytes 14/10/2008 10:05:56
AECORE.DLL : 8.1.6.6 176501 Bytes 04/03/2009 23:07:33
AEBB.DLL : 8.1.0.3 53618 Bytes 14/10/2008 10:05:56
AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:05
AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:28:01
AVREP.DLL : 8.0.0.2 98344 Bytes 31/07/2008 12:02:15
AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:40
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23
AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:49
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:40
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10
RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 13:48:07
RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 13:34:37
Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, E:,
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: on
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Deviating archive types..........: +Netscape/Mozilla Mailbox, +MS Outlook Mailbox,
Macro heuristic..................: on
File heuristic...................: medium
Start of the scan: jeudi 5 mars 2009 13:38
Starting search for hidden objects.
'78309' objects were checked, '0' hidden objects were found.
The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'WDBtnMgrSvc.exe' - '1' Module(s) have been scanned
Scan process 'UAService7.exe' - '1' Module(s) have been scanned
Scan process 'WdfMgr.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'NMSAccessU.exe' - '1' Module(s) have been scanned
Scan process 'MDM.EXE' - '1' Module(s) have been scanned
Scan process 'jqs.exe' - '1' Module(s) have been scanned
Scan process 'mDNSResponder.exe' - '1' Module(s) have been scanned
Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'a2service.exe' - '1' Module(s) have been scanned
Scan process 'daemon.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'TeaTimer.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'SSMMgr.exe' - '1' Module(s) have been scanned
Scan process 'zlclient.exe' - '0' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'CpuPowerMonitor.exe' - '1' Module(s) have been scanned
Scan process 'RTHDCPL.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'vsmon.exe' - '0' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
39 processes with 39 modules were scanned
Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Master boot sector HD1
[INFO] No virus was found!
Master boot sector HD2
[INFO] No virus was found!
Master boot sector HD3
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.
Master boot sector HD4
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.
Master boot sector HD5
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.
Master boot sector HD6
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.
Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'E:\'
[INFO] No virus was found!
Starting to scan the registry.
The registry was scanned ( '53' files ).
Starting the file scan:
Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\WINDOWS\system32\drivers\sptd.sys
[WARNING] The file could not be opened!
Begin scan in 'E:\' <My Book>
End of the scan: jeudi 5 mars 2009 14:23
Used time: 45:33 Minute(s)
The scan has been done completely.
17784 Scanning directories
728970 Files were scanned
0 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
2 Files cannot be scanned
728968 Files not concerned
16895 Archives were scanned
6 Warnings
0 Notes
78309 Objects were scanned with rootkit scan
0 Hidden objects were found
Merci beaucoup pour ton aide, je pensais perdre tous mon travail dans la bataille. Merci,
Laëtitia
Avira AntiVir Personal
Report file date: jeudi 5 mars 2009 13:38
Scanning for 1284346 virus strains and unwanted programs.
Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Boot mode: Normally booted
Username: SYSTEM
Computer name: XPSP2-653F4AEFD
Version information:
BUILD.DAT : 8.2.0.337 16934 Bytes 18/11/2008 13:05:00
AVSCAN.EXE : 8.1.4.10 315649 Bytes 18/11/2008 08:21:26
AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 07:56:40
LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:19
LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 07:58:52
ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 11:30:36
ANTIVIR1.VDF : 7.1.2.12 3336192 Bytes 11/02/2009 23:07:30
ANTIVIR2.VDF : 7.1.2.105 513536 Bytes 03/03/2009 23:07:32
ANTIVIR3.VDF : 7.1.2.123 102400 Bytes 05/03/2009 09:57:18
Engineversion : 8.2.0.100
AEVDF.DLL : 8.1.1.0 106868 Bytes 04/03/2009 23:07:39
AESCRIPT.DLL : 8.1.1.56 352634 Bytes 04/03/2009 23:07:38
AESCN.DLL : 8.1.1.7 127347 Bytes 04/03/2009 23:07:37
AERDL.DLL : 8.1.1.3 438645 Bytes 04/11/2008 13:58:38
AEPACK.DLL : 8.1.3.10 397686 Bytes 04/03/2009 23:07:37
AEOFFICE.DLL : 8.1.0.36 196987 Bytes 04/03/2009 23:07:36
AEHEUR.DLL : 8.1.0.100 1618295 Bytes 04/03/2009 23:07:35
AEHELP.DLL : 8.1.2.2 119158 Bytes 04/03/2009 23:07:34
AEGEN.DLL : 8.1.1.24 336244 Bytes 04/03/2009 23:07:33
AEEMU.DLL : 8.1.0.9 393588 Bytes 14/10/2008 10:05:56
AECORE.DLL : 8.1.6.6 176501 Bytes 04/03/2009 23:07:33
AEBB.DLL : 8.1.0.3 53618 Bytes 14/10/2008 10:05:56
AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:05
AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:28:01
AVREP.DLL : 8.0.0.2 98344 Bytes 31/07/2008 12:02:15
AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:40
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23
AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:49
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:40
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10
RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 13:48:07
RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 13:34:37
Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, E:,
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: on
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Deviating archive types..........: +Netscape/Mozilla Mailbox, +MS Outlook Mailbox,
Macro heuristic..................: on
File heuristic...................: medium
Start of the scan: jeudi 5 mars 2009 13:38
Starting search for hidden objects.
'78309' objects were checked, '0' hidden objects were found.
The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'WDBtnMgrSvc.exe' - '1' Module(s) have been scanned
Scan process 'UAService7.exe' - '1' Module(s) have been scanned
Scan process 'WdfMgr.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'NMSAccessU.exe' - '1' Module(s) have been scanned
Scan process 'MDM.EXE' - '1' Module(s) have been scanned
Scan process 'jqs.exe' - '1' Module(s) have been scanned
Scan process 'mDNSResponder.exe' - '1' Module(s) have been scanned
Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'a2service.exe' - '1' Module(s) have been scanned
Scan process 'daemon.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'TeaTimer.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'SSMMgr.exe' - '1' Module(s) have been scanned
Scan process 'zlclient.exe' - '0' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'CpuPowerMonitor.exe' - '1' Module(s) have been scanned
Scan process 'RTHDCPL.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'vsmon.exe' - '0' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
39 processes with 39 modules were scanned
Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Master boot sector HD1
[INFO] No virus was found!
Master boot sector HD2
[INFO] No virus was found!
Master boot sector HD3
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.
Master boot sector HD4
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.
Master boot sector HD5
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.
Master boot sector HD6
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.
Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'E:\'
[INFO] No virus was found!
Starting to scan the registry.
The registry was scanned ( '53' files ).
Starting the file scan:
Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\WINDOWS\system32\drivers\sptd.sys
[WARNING] The file could not be opened!
Begin scan in 'E:\' <My Book>
End of the scan: jeudi 5 mars 2009 14:23
Used time: 45:33 Minute(s)
The scan has been done completely.
17784 Scanning directories
728970 Files were scanned
0 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
2 Files cannot be scanned
728968 Files not concerned
16895 Archives were scanned
6 Warnings
0 Notes
78309 Objects were scanned with rootkit scan
0 Hidden objects were found
LaetitiaH
Messages postés
169
Date d'inscription
jeudi 26 juillet 2007
Statut
Membre
Dernière intervention
5 août 2010
1
5 mars 2009 à 17:27
5 mars 2009 à 17:27
Incroyable ! Tout fonctionne parfaitement, j'ai même retrouvé mon dossier application data qui semblait avoir disparu avec mes mails. Vraiment, un grand merci pour ton aide et ton efficacité.
Bonne soirée,
Laëtitia
Bonne soirée,
Laëtitia
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
5 mars 2009 à 20:28
5 mars 2009 à 20:28
ok parfait c'est bon!!!!!!!
pour protéger gratos ton ordi
http://www.commentcamarche.net/telecharger/logiciel 4 securite
mettre un antivirus
ANTIVIR ou AVG8 ou (AVAST )
https://www.malekal.com/avira-free-security-antivirus-gratuit/ (merci Malekal)
-------------
des anti-espions :
MalwareByte's Anti-Malware + SPYBOT +/- si tea timer non active de spybot:
WINDOWS DEFENDER ou SPYWARE TERMINATOR
+
SPYWAREBLASTER pour immuniser le système contre vundo notamment mais en anglais (mais facile d'utilisation : il suffit de faire "update" pour mettre à jour tous les mois et ensuite" enable all protection" pour immuniser)...
Rq : spybot … sortent de nouvelles versions régulièrement, vérifiez que vous avez la dernière version
--------
un pare feu :
celui de (Windows) ou mieux Online armor ou KERIO ou JETICO ou ZONE ALARM (mettre que le parefeu gratuit) ou COMODO
http://www.commentcamarche.net/telecharger/telecharger 34055356 online armor personal firewall
https://www.01net.com/telecharger/windows/Securite/firewall/fiches/39911.html
https://forum.pcastuces.com/sujet.asp?f=25&s=35606
https://www.clubic.com/telecharger-fiche11071-sunbelt-personal-firewall-ex-kerio.html
https://manuelsdaide.com/contact/
http://www.open-files.com/forum/index.php?showtopic=29277
http://www.commentcamarche.net/telecharger/telecharger 157 zonealarm
-----------
CCLEANER pour effacer les traces de surf
---------
naviguer avec firefox ou safari ou opera et non internet explorer plus touché par les virus
http://www.mozilla-europe.org/fr/products/firefox/
pour protéger gratos ton ordi
http://www.commentcamarche.net/telecharger/logiciel 4 securite
mettre un antivirus
ANTIVIR ou AVG8 ou (AVAST )
https://www.malekal.com/avira-free-security-antivirus-gratuit/ (merci Malekal)
-------------
des anti-espions :
MalwareByte's Anti-Malware + SPYBOT +/- si tea timer non active de spybot:
WINDOWS DEFENDER ou SPYWARE TERMINATOR
+
SPYWAREBLASTER pour immuniser le système contre vundo notamment mais en anglais (mais facile d'utilisation : il suffit de faire "update" pour mettre à jour tous les mois et ensuite" enable all protection" pour immuniser)...
Rq : spybot … sortent de nouvelles versions régulièrement, vérifiez que vous avez la dernière version
--------
un pare feu :
celui de (Windows) ou mieux Online armor ou KERIO ou JETICO ou ZONE ALARM (mettre que le parefeu gratuit) ou COMODO
http://www.commentcamarche.net/telecharger/telecharger 34055356 online armor personal firewall
https://www.01net.com/telecharger/windows/Securite/firewall/fiches/39911.html
https://forum.pcastuces.com/sujet.asp?f=25&s=35606
https://www.clubic.com/telecharger-fiche11071-sunbelt-personal-firewall-ex-kerio.html
https://manuelsdaide.com/contact/
http://www.open-files.com/forum/index.php?showtopic=29277
http://www.commentcamarche.net/telecharger/telecharger 157 zonealarm
-----------
CCLEANER pour effacer les traces de surf
---------
naviguer avec firefox ou safari ou opera et non internet explorer plus touché par les virus
http://www.mozilla-europe.org/fr/products/firefox/
5 mars 2009 à 10:16
Logfile of random's system information tool 1.05 (written by random/random)
Run by laetitia at 2009-03-05 10:17:03
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 354 GB (74%) free of 477 GB
Total RAM: 3071 MB (73% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:17:08, on 05/03/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ASUS\AI Suite\AiGear3\CpuPowerMonitor.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Prevx\prevx.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe
C:\Program Files\Prevx\prevx.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Documents and Settings\laetitia\Bureau\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\laetitia.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=55729C844D6A45819CAD368B3E178C9F
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/keyword/%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: QUICKfind BHO Object - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - C:\PROGRA~1\IDM\QUICKF~1\PlugIns\IEHelp.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [CPU Power Monitor] "C:\Program Files\ASUS\AI Suite\AiGear3\CpuPowerMonitor.exe"
O4 - HKLM\..\Run: [Cpu Level Up help] C:\Program Files\ASUS\AI Suite\CpuLevelUpHelp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Samsung PanelMgr] C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe /autorun
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-19\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'Default user')
O8 - Extra context menu item: &Point&&Go - C:\Program Files\Fichiers communs\Expert System\PGPlatform\PGPlatform.htm
O8 - Extra context menu item: Ajouter au fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Adobe Version Cue CS3 {fr_FR} (Adobe Version Cue CS3) - Adobe Systems Incorporated - C:\Program Files\Fichiers communs\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CSIScanner - Prevx - C:\Program Files\Prevx\prevx.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: WD Drive Manager Service (WDBtnMgrSvc.exe) - WDC - C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe