Malware defender : info ou intox ?
NoProbs
Messages postés
34
Statut
Membre
-
anthony5151 Messages postés 10927 Statut Contributeur sécurité -
anthony5151 Messages postés 10927 Statut Contributeur sécurité -
Bonjour,
Je rencontre un problème avec mon PC :
Impossible de mettre à jour mon antivirus Bit Defender (message serveur invalide) et le centre de sécurité Windows est désactivé avec impossibilité de le réactiver
J'ai de temps en temps une fenetre malware defender qui apparait et me dit que mon PC est infecté et comme un crétin il me semble que j'ai accepté de faire un scan à partir de cette fenetre.
Je suis allé voir sur le net et ce malware defender est à priori un faux anti malware, le problème c'est que je ne sais même pas si c'est vrai !!
J'ai essayé de télécharger Ccleaner : résultat : échec !!
N'étant pas un spécialiste, qqn peut il me dire quoi faire svp ?
Je colle dessous le rapport Hijackthis.
Merci par avance à tous !!!
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:36:42, on 26/03/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Program Files\DigitalPersona\Bin\DpAgent.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Hp\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Interwrite Learning\Interwrite Workspace\IWStarter.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Users\darty\Program Files\DNA\btdna.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEUser.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4PS6HSDD\HiJackThis[1].exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Smartorrent Toolbar - {2f3a94fd-c89e-41c4-bbd6-18b11705e7f3} - C:\Program Files\Smartorrent\tbSmar.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Download Manager Browser Helper Object - {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} - C:\PROGRA~1\COMMON~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
O2 - BHO: Smartorrent Toolbar - {2f3a94fd-c89e-41c4-bbd6-18b11705e7f3} - C:\Program Files\Smartorrent\tbSmar.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: mysidesearch search enhancer - {8349BC85-7239-B526-7D30-9CBDD2B35008} - C:\Windows\system32\mhhewwywbyspgz.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll
O3 - Toolbar: Smartorrent Toolbar - {2f3a94fd-c89e-41c4-bbd6-18b11705e7f3} - C:\Program Files\Smartorrent\tbSmar.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [OnScreenDisplay] C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [DpAgent] C:\Program Files\DigitalPersona\Bin\dpagent.exe
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe"
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [InterWrite Device Manager] "C:\Program Files\Interwrite Learning\Interwrite Workspace\IWStarter.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Users\darty\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-18\..\Run: [A00F1C5C9BD.exe] C:\Windows\TEMP\_A00F1C5C9BD.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [A00F1C5C9BD.exe] C:\Windows\TEMP\_A00F1C5C9BD.exe (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O8 - Extra context menu item: &Recherche AOL Toolbar - c:\program files\aol\aol toolbar 5.0\resources\fr-fr\local\search.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix:
O15 - Trusted Zone: *.canalplay.com
O15 - Trusted Zone: *.canalplusactive.com
O15 - Trusted Zone: *.canalplay.com (HKLM)
O15 - Trusted Zone: *.canalplusactive.com (HKLM)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{36ABEDAD-47D5-42BE-A889-6FD9457E357A}: NameServer = 85.255.112.62,85.255.112.231
O17 - HKLM\System\CCS\Services\Tcpip\..\{F4A88FA0-0DB8-4556-AB74-DB8D3F31A6DF}: NameServer = 85.255.112.62,85.255.112.231
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.62,85.255.112.231
O17 - HKLM\System\CS1\Services\Tcpip\..\{36ABEDAD-47D5-42BE-A889-6FD9457E357A}: NameServer = 85.255.112.62,85.255.112.231
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.112.62,85.255.112.231
O17 - HKLM\System\CS2\Services\Tcpip\..\{36ABEDAD-47D5-42BE-A889-6FD9457E357A}: NameServer = 85.255.112.62,85.255.112.231
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.62,85.255.112.231
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: Biometric Authentication Service (DpHost) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DpHostW.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: Google Update Service (gupdate1c98a09a93c69c9) (gupdate1c98a09a93c69c9) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender S.R.L. - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PunkBuster (PnkBstrA) - Unknown owner - C:\Program Files\Electronic Arts\Medal of Honor Airborne\UnrealEngine3\MOHAGame\pb\PnkBstrA.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Service CANALPLAY - Canal+ Distribution - C:\Program Files\Lecteur CANALPLAY\CanalPlayService.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
O23 - Service: SAMSUNG WiselinkPro Service (WiselinkPro) - Unknown owner - C:\Program Files\SAMSUNG\SAMSUNG PC Share Manager\WiselinkPro.exe
O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe
Je rencontre un problème avec mon PC :
Impossible de mettre à jour mon antivirus Bit Defender (message serveur invalide) et le centre de sécurité Windows est désactivé avec impossibilité de le réactiver
J'ai de temps en temps une fenetre malware defender qui apparait et me dit que mon PC est infecté et comme un crétin il me semble que j'ai accepté de faire un scan à partir de cette fenetre.
Je suis allé voir sur le net et ce malware defender est à priori un faux anti malware, le problème c'est que je ne sais même pas si c'est vrai !!
J'ai essayé de télécharger Ccleaner : résultat : échec !!
N'étant pas un spécialiste, qqn peut il me dire quoi faire svp ?
Je colle dessous le rapport Hijackthis.
Merci par avance à tous !!!
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:36:42, on 26/03/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Program Files\DigitalPersona\Bin\DpAgent.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Hp\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Interwrite Learning\Interwrite Workspace\IWStarter.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Users\darty\Program Files\DNA\btdna.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEUser.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4PS6HSDD\HiJackThis[1].exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Smartorrent Toolbar - {2f3a94fd-c89e-41c4-bbd6-18b11705e7f3} - C:\Program Files\Smartorrent\tbSmar.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Download Manager Browser Helper Object - {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} - C:\PROGRA~1\COMMON~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
O2 - BHO: Smartorrent Toolbar - {2f3a94fd-c89e-41c4-bbd6-18b11705e7f3} - C:\Program Files\Smartorrent\tbSmar.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: mysidesearch search enhancer - {8349BC85-7239-B526-7D30-9CBDD2B35008} - C:\Windows\system32\mhhewwywbyspgz.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll
O3 - Toolbar: Smartorrent Toolbar - {2f3a94fd-c89e-41c4-bbd6-18b11705e7f3} - C:\Program Files\Smartorrent\tbSmar.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [OnScreenDisplay] C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [DpAgent] C:\Program Files\DigitalPersona\Bin\dpagent.exe
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe"
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [InterWrite Device Manager] "C:\Program Files\Interwrite Learning\Interwrite Workspace\IWStarter.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Users\darty\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-18\..\Run: [A00F1C5C9BD.exe] C:\Windows\TEMP\_A00F1C5C9BD.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [A00F1C5C9BD.exe] C:\Windows\TEMP\_A00F1C5C9BD.exe (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O8 - Extra context menu item: &Recherche AOL Toolbar - c:\program files\aol\aol toolbar 5.0\resources\fr-fr\local\search.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix:
O15 - Trusted Zone: *.canalplay.com
O15 - Trusted Zone: *.canalplusactive.com
O15 - Trusted Zone: *.canalplay.com (HKLM)
O15 - Trusted Zone: *.canalplusactive.com (HKLM)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{36ABEDAD-47D5-42BE-A889-6FD9457E357A}: NameServer = 85.255.112.62,85.255.112.231
O17 - HKLM\System\CCS\Services\Tcpip\..\{F4A88FA0-0DB8-4556-AB74-DB8D3F31A6DF}: NameServer = 85.255.112.62,85.255.112.231
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.62,85.255.112.231
O17 - HKLM\System\CS1\Services\Tcpip\..\{36ABEDAD-47D5-42BE-A889-6FD9457E357A}: NameServer = 85.255.112.62,85.255.112.231
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.112.62,85.255.112.231
O17 - HKLM\System\CS2\Services\Tcpip\..\{36ABEDAD-47D5-42BE-A889-6FD9457E357A}: NameServer = 85.255.112.62,85.255.112.231
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.62,85.255.112.231
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: Biometric Authentication Service (DpHost) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DpHostW.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: Google Update Service (gupdate1c98a09a93c69c9) (gupdate1c98a09a93c69c9) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender S.R.L. - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PunkBuster (PnkBstrA) - Unknown owner - C:\Program Files\Electronic Arts\Medal of Honor Airborne\UnrealEngine3\MOHAGame\pb\PnkBstrA.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Service CANALPLAY - Canal+ Distribution - C:\Program Files\Lecteur CANALPLAY\CanalPlayService.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
O23 - Service: SAMSUNG WiselinkPro Service (WiselinkPro) - Unknown owner - C:\Program Files\SAMSUNG\SAMSUNG PC Share Manager\WiselinkPro.exe
O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe
A voir également:
- Malware defender : info ou intox ?
- Malwarebytes anti-malware - Télécharger - Antivirus & Antimalwares
- Windows defender windows 7 - Télécharger - Antivirus & Antimalwares
- Mcafee malware - Accueil - Piratage
- Supprimer malware - Guide
- Desactiver windows defender - Guide
50 réponses
Bonjour,
O17 - HKLM\System\CCS\Services\Tcpip\..\{36ABEDAD-47D5-42BE-A889-6FD9457E357A}: NameServer = 85.255.112.62,85.255.112.231
O17 - HKLM\System\CCS\Services\Tcpip\..\{F4A88FA0-0DB8-4556-AB74-DB8D3F31A6DF}: NameServer = 85.255.112.62,85.255.112.231
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.62,85.255.112.231
O17 - HKLM\System\CS1\Services\Tcpip\..\{36ABEDAD-47D5-42BE-A889-6FD9457E357A}: NameServer = 85.255.112.62,85.255.112.231
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.112.62,85.255.112.231
O17 - HKLM\System\CS2\Services\Tcpip\..\{36ABEDAD-47D5-42BE-A889-6FD9457E357A}: NameServer = 85.255.112.62,85.255.112.231
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.62,85.255.112.231
==> Ton ordinateur est victime d'un détournement de DNS, qui redirige tes connections vers des sites de pub, notamment des sites de rogues (faux logiciel de protection) comme MalwareDefender
• Désactive le contrôle des comptes utilisateurs : Menu démarrer --> panneau de configuration --> comptes utilisateurs --> activer ou désactiver le controle des comptes utilisateur --> décoche la case "utiliser le contrôle....." Puis redémarre ton ordinateur.
• Télécharge SmitfraudFix (de S!Ri) : http://siri.urz.free.fr/Fix/SmitfraudFix.exe
• Enregistre-le sur le Bureau
• Double-clique sur SmitfraudFix.exe et choisis l'option 1 puis Entrée
• Un rapport sera généré, poste-le dans ta prochaine réponse stp.
Tutoriel illustré : http://www.malekal.com//tutorial_SmitFraudfix.php
O17 - HKLM\System\CCS\Services\Tcpip\..\{36ABEDAD-47D5-42BE-A889-6FD9457E357A}: NameServer = 85.255.112.62,85.255.112.231
O17 - HKLM\System\CCS\Services\Tcpip\..\{F4A88FA0-0DB8-4556-AB74-DB8D3F31A6DF}: NameServer = 85.255.112.62,85.255.112.231
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.62,85.255.112.231
O17 - HKLM\System\CS1\Services\Tcpip\..\{36ABEDAD-47D5-42BE-A889-6FD9457E357A}: NameServer = 85.255.112.62,85.255.112.231
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.112.62,85.255.112.231
O17 - HKLM\System\CS2\Services\Tcpip\..\{36ABEDAD-47D5-42BE-A889-6FD9457E357A}: NameServer = 85.255.112.62,85.255.112.231
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.62,85.255.112.231
==> Ton ordinateur est victime d'un détournement de DNS, qui redirige tes connections vers des sites de pub, notamment des sites de rogues (faux logiciel de protection) comme MalwareDefender
• Désactive le contrôle des comptes utilisateurs : Menu démarrer --> panneau de configuration --> comptes utilisateurs --> activer ou désactiver le controle des comptes utilisateur --> décoche la case "utiliser le contrôle....." Puis redémarre ton ordinateur.
• Télécharge SmitfraudFix (de S!Ri) : http://siri.urz.free.fr/Fix/SmitfraudFix.exe
• Enregistre-le sur le Bureau
• Double-clique sur SmitfraudFix.exe et choisis l'option 1 puis Entrée
• Un rapport sera généré, poste-le dans ta prochaine réponse stp.
Tutoriel illustré : http://www.malekal.com//tutorial_SmitFraudfix.php
Merci.
Voila le rapport :
SmitFraudFix v2.405
Scan done at 19:22:32,43, 27/03/2009
Run from C:\Users\darty\Desktop\SmitfraudFix
OS: Microsoft Windows [version 6.0.6001] - Windows_NT
The filesystem type is
Fix run in normal mode
»»»»»»»»»»»»»»»»»»»»»»»» Process
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\winlogon.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\DigitalPersona\Bin\DpHostW.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Electronic Arts\Medal of Honor Airborne\UnrealEngine3\MOHAGame\pb\PnkBstrA.exe
C:\Windows\system32\svchost.exe
C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Windows\system32\svchost.exe
C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\rundll32.exe
C:\Program Files\DigitalPersona\Bin\DpAgent.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Hp\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Windows\System32\rundll32.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Interwrite Learning\Interwrite Workspace\IWStarter.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\DNA\btdna.exe
C:\Windows\ehome\ehsched.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Windows\System32\svchost.exe
C:\Windows\ehome\ehRecvr.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\wbem\wmiprvse.exe
»»»»»»»»»»»»»»»»»»»»»»»» hosts
»»»»»»»»»»»»»»»»»»»»»»»» C:\
»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows
»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system
»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web
»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32
»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles
»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\darty
»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\darty\AppData\Local\Temp
»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\darty\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Start Menu
»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\darty\FAVORI~1
»»»»»»»»»»»»»»»»»»»»»»»» Desktop
»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys
»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, following keys are not inevitably infected!!!
o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, following keys are not inevitably infected!!!
Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!
VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!
404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
"LoadAppInit_DLLs"=dword:00000000
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\Windows\\system32\\userinit.exe,"
»»»»»»»»»»»»»»»»»»»»»»»» RK
»»»»»»»»»»»»»»»»»»»»»»»» DNS
Your computer may be victim of a DNS Hijack: 85.255.x.x detected !
Description: Intel(R) Wireless WiFi Link 4965AGN
DNS Server Search Order: 85.255.112.62
DNS Server Search Order: 85.255.112.231
HKLM\SYSTEM\CCS\Services\Tcpip\..\{36ABEDAD-47D5-42BE-A889-6FD9457E357A}: NameServer=85.255.112.62,85.255.112.231
HKLM\SYSTEM\CCS\Services\Tcpip\..\{F4A88FA0-0DB8-4556-AB74-DB8D3F31A6DF}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\..\{F4A88FA0-0DB8-4556-AB74-DB8D3F31A6DF}: NameServer=85.255.112.62,85.255.112.231
HKLM\SYSTEM\CS1\Services\Tcpip\..\{36ABEDAD-47D5-42BE-A889-6FD9457E357A}: NameServer=85.255.112.62,85.255.112.231
HKLM\SYSTEM\CS1\Services\Tcpip\..\{F4A88FA0-0DB8-4556-AB74-DB8D3F31A6DF}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\..\{F4A88FA0-0DB8-4556-AB74-DB8D3F31A6DF}: NameServer=85.255.112.62,85.255.112.231
HKLM\SYSTEM\CS2\Services\Tcpip\..\{36ABEDAD-47D5-42BE-A889-6FD9457E357A}: NameServer=85.255.112.62,85.255.112.231
HKLM\SYSTEM\CS2\Services\Tcpip\..\{F4A88FA0-0DB8-4556-AB74-DB8D3F31A6DF}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS2\Services\Tcpip\..\{F4A88FA0-0DB8-4556-AB74-DB8D3F31A6DF}: NameServer=85.255.112.62,85.255.112.231
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: NameServer=85.255.112.62,85.255.112.231
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: NameServer=85.255.112.62,85.255.112.231
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: NameServer=85.255.112.62,85.255.112.231
»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection
»»»»»»»»»»»»»»»»»»»»»»»» End
Voila le rapport :
SmitFraudFix v2.405
Scan done at 19:22:32,43, 27/03/2009
Run from C:\Users\darty\Desktop\SmitfraudFix
OS: Microsoft Windows [version 6.0.6001] - Windows_NT
The filesystem type is
Fix run in normal mode
»»»»»»»»»»»»»»»»»»»»»»»» Process
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\winlogon.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\DigitalPersona\Bin\DpHostW.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Electronic Arts\Medal of Honor Airborne\UnrealEngine3\MOHAGame\pb\PnkBstrA.exe
C:\Windows\system32\svchost.exe
C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Windows\system32\svchost.exe
C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\rundll32.exe
C:\Program Files\DigitalPersona\Bin\DpAgent.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Hp\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Windows\System32\rundll32.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Interwrite Learning\Interwrite Workspace\IWStarter.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\DNA\btdna.exe
C:\Windows\ehome\ehsched.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Windows\System32\svchost.exe
C:\Windows\ehome\ehRecvr.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\wbem\wmiprvse.exe
»»»»»»»»»»»»»»»»»»»»»»»» hosts
»»»»»»»»»»»»»»»»»»»»»»»» C:\
»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows
»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system
»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web
»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32
»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles
»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\darty
»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\darty\AppData\Local\Temp
»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\darty\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Start Menu
»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\darty\FAVORI~1
»»»»»»»»»»»»»»»»»»»»»»»» Desktop
»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys
»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, following keys are not inevitably infected!!!
o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, following keys are not inevitably infected!!!
Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!
VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!
404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
"LoadAppInit_DLLs"=dword:00000000
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\Windows\\system32\\userinit.exe,"
»»»»»»»»»»»»»»»»»»»»»»»» RK
»»»»»»»»»»»»»»»»»»»»»»»» DNS
Your computer may be victim of a DNS Hijack: 85.255.x.x detected !
Description: Intel(R) Wireless WiFi Link 4965AGN
DNS Server Search Order: 85.255.112.62
DNS Server Search Order: 85.255.112.231
HKLM\SYSTEM\CCS\Services\Tcpip\..\{36ABEDAD-47D5-42BE-A889-6FD9457E357A}: NameServer=85.255.112.62,85.255.112.231
HKLM\SYSTEM\CCS\Services\Tcpip\..\{F4A88FA0-0DB8-4556-AB74-DB8D3F31A6DF}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\..\{F4A88FA0-0DB8-4556-AB74-DB8D3F31A6DF}: NameServer=85.255.112.62,85.255.112.231
HKLM\SYSTEM\CS1\Services\Tcpip\..\{36ABEDAD-47D5-42BE-A889-6FD9457E357A}: NameServer=85.255.112.62,85.255.112.231
HKLM\SYSTEM\CS1\Services\Tcpip\..\{F4A88FA0-0DB8-4556-AB74-DB8D3F31A6DF}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\..\{F4A88FA0-0DB8-4556-AB74-DB8D3F31A6DF}: NameServer=85.255.112.62,85.255.112.231
HKLM\SYSTEM\CS2\Services\Tcpip\..\{36ABEDAD-47D5-42BE-A889-6FD9457E357A}: NameServer=85.255.112.62,85.255.112.231
HKLM\SYSTEM\CS2\Services\Tcpip\..\{F4A88FA0-0DB8-4556-AB74-DB8D3F31A6DF}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS2\Services\Tcpip\..\{F4A88FA0-0DB8-4556-AB74-DB8D3F31A6DF}: NameServer=85.255.112.62,85.255.112.231
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: NameServer=85.255.112.62,85.255.112.231
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: NameServer=85.255.112.62,85.255.112.231
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: NameServer=85.255.112.62,85.255.112.231
»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection
»»»»»»»»»»»»»»»»»»»»»»»» End
Ok :)
Relance le programme SmitfraudFix, et choisis l'option 5.
S'il te demande "Do you want to set your network to dynamic - DHCP server?" --> réponds oui
Poste le rapport dans ta prochaine réponse.
Relance le programme SmitfraudFix, et choisis l'option 5.
S'il te demande "Do you want to set your network to dynamic - DHCP server?" --> réponds oui
Poste le rapport dans ta prochaine réponse.
Voila la réponse
SmitFraudFix v2.405
Scan done at 19:38:26,56, 27/03/2009
Run from C:\Users\darty\Desktop\SmitfraudFix
OS: Microsoft Windows [version 6.0.6001] - Windows_NT
The filesystem type is
Fix run in normal mode
»»»»»»»»»»»»»»»»»»»»»»»» DNS Before Fix
Your computer may be victim of a DNS Hijack: 85.255.x.x detected !
Description: Intel(R) Wireless WiFi Link 4965AGN
DNS Server Search Order: 85.255.112.62
DNS Server Search Order: 85.255.112.231
HKLM\SYSTEM\CCS\Services\Tcpip\..\{36ABEDAD-47D5-42BE-A889-6FD9457E357A}: NameServer=85.255.112.62,85.255.112.231
HKLM\SYSTEM\CCS\Services\Tcpip\..\{F4A88FA0-0DB8-4556-AB74-DB8D3F31A6DF}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\..\{F4A88FA0-0DB8-4556-AB74-DB8D3F31A6DF}: NameServer=85.255.112.62,85.255.112.231
HKLM\SYSTEM\CS1\Services\Tcpip\..\{36ABEDAD-47D5-42BE-A889-6FD9457E357A}: NameServer=85.255.112.62,85.255.112.231
HKLM\SYSTEM\CS1\Services\Tcpip\..\{F4A88FA0-0DB8-4556-AB74-DB8D3F31A6DF}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\..\{F4A88FA0-0DB8-4556-AB74-DB8D3F31A6DF}: NameServer=85.255.112.62,85.255.112.231
HKLM\SYSTEM\CS2\Services\Tcpip\..\{36ABEDAD-47D5-42BE-A889-6FD9457E357A}: NameServer=85.255.112.62,85.255.112.231
HKLM\SYSTEM\CS2\Services\Tcpip\..\{F4A88FA0-0DB8-4556-AB74-DB8D3F31A6DF}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS2\Services\Tcpip\..\{F4A88FA0-0DB8-4556-AB74-DB8D3F31A6DF}: NameServer=85.255.112.62,85.255.112.231
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: NameServer=85.255.112.62,85.255.112.231
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: NameServer=85.255.112.62,85.255.112.231
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: NameServer=85.255.112.62,85.255.112.231
»»»»»»»»»»»»»»»»»»»»»»»» DNS After Fix
Description: Intel(R) Wireless WiFi Link 4965AGN
DNS Server Search Order: 212.27.40.241
DNS Server Search Order: 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\..\{F4A88FA0-0DB8-4556-AB74-DB8D3F31A6DF}: DhcpNameServer=212.27.40.241 212.27.40.240
SmitFraudFix v2.405
Scan done at 19:38:26,56, 27/03/2009
Run from C:\Users\darty\Desktop\SmitfraudFix
OS: Microsoft Windows [version 6.0.6001] - Windows_NT
The filesystem type is
Fix run in normal mode
»»»»»»»»»»»»»»»»»»»»»»»» DNS Before Fix
Your computer may be victim of a DNS Hijack: 85.255.x.x detected !
Description: Intel(R) Wireless WiFi Link 4965AGN
DNS Server Search Order: 85.255.112.62
DNS Server Search Order: 85.255.112.231
HKLM\SYSTEM\CCS\Services\Tcpip\..\{36ABEDAD-47D5-42BE-A889-6FD9457E357A}: NameServer=85.255.112.62,85.255.112.231
HKLM\SYSTEM\CCS\Services\Tcpip\..\{F4A88FA0-0DB8-4556-AB74-DB8D3F31A6DF}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\..\{F4A88FA0-0DB8-4556-AB74-DB8D3F31A6DF}: NameServer=85.255.112.62,85.255.112.231
HKLM\SYSTEM\CS1\Services\Tcpip\..\{36ABEDAD-47D5-42BE-A889-6FD9457E357A}: NameServer=85.255.112.62,85.255.112.231
HKLM\SYSTEM\CS1\Services\Tcpip\..\{F4A88FA0-0DB8-4556-AB74-DB8D3F31A6DF}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\..\{F4A88FA0-0DB8-4556-AB74-DB8D3F31A6DF}: NameServer=85.255.112.62,85.255.112.231
HKLM\SYSTEM\CS2\Services\Tcpip\..\{36ABEDAD-47D5-42BE-A889-6FD9457E357A}: NameServer=85.255.112.62,85.255.112.231
HKLM\SYSTEM\CS2\Services\Tcpip\..\{F4A88FA0-0DB8-4556-AB74-DB8D3F31A6DF}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS2\Services\Tcpip\..\{F4A88FA0-0DB8-4556-AB74-DB8D3F31A6DF}: NameServer=85.255.112.62,85.255.112.231
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: NameServer=85.255.112.62,85.255.112.231
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: NameServer=85.255.112.62,85.255.112.231
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: NameServer=85.255.112.62,85.255.112.231
»»»»»»»»»»»»»»»»»»»»»»»» DNS After Fix
Description: Intel(R) Wireless WiFi Link 4965AGN
DNS Server Search Order: 212.27.40.241
DNS Server Search Order: 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\..\{F4A88FA0-0DB8-4556-AB74-DB8D3F31A6DF}: DhcpNameServer=212.27.40.241 212.27.40.240
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
OK, tes DNS ont été remis à la normale, on va maintenant voir si une autre infection l'accompagne (c'est généralement le cas) :
• Télécharge et installe Malwarebytes' Anti-Malware
• A la fin de l'installation, veille à ce que l'option « mettre a jour Malwarebyte's Anti-Malware » soit cochée
• Lance MBAM et laisse les Mises à jour se télécharger (sinon fais les manuellement au lancement du programme)
• Puis va dans l'onglet "Recherche", coche "Exécuter un examen rapide" puis "Rechercher"
• Sélectionne tes disques durs" puis clique sur "Lancer l’examen"
• A la fin du scan, clique sur Afficher les résultats
• Coche tous les éléments détectés puis clique sur Supprimer la sélection
• Enregistre le rapport
• S'il t'est demandé de redémarrer, clique sur Yes
• Poste le rapport de scan après la suppression ici
• Télécharge et installe Malwarebytes' Anti-Malware
• A la fin de l'installation, veille à ce que l'option « mettre a jour Malwarebyte's Anti-Malware » soit cochée
• Lance MBAM et laisse les Mises à jour se télécharger (sinon fais les manuellement au lancement du programme)
• Puis va dans l'onglet "Recherche", coche "Exécuter un examen rapide" puis "Rechercher"
• Sélectionne tes disques durs" puis clique sur "Lancer l’examen"
• A la fin du scan, clique sur Afficher les résultats
• Coche tous les éléments détectés puis clique sur Supprimer la sélection
• Enregistre le rapport
• S'il t'est demandé de redémarrer, clique sur Yes
• Poste le rapport de scan après la suppression ici
Aie !! Problème !!!
Le téléchargement se passe nickel, par contre impossible de le lancer : message "Malware byte a cessé de fonctionner"
Le téléchargement se passe nickel, par contre impossible de le lancer : message "Malware byte a cessé de fonctionner"
Supprime le, puis retélécharge le ici et réessaye stp :
http://sd-1.archive-host.com/membres/up/7739387536519291/levoila.exe
http://sd-1.archive-host.com/membres/up/7739387536519291/levoila.exe
/!\ A l'attention de ceux qui passent sur ce sujet /!\
Le logiciel qui suit n'est pas à utiliser à la légère ! Ne le faites que si un helpeur du forum qui connait bien cet outil vous l'a recommandé.
On va utiliser Combofix pour finir la désinfection. Attention, ce logiciel est très puissant, une mauvaise utilisation peut faire des dégâts... Fais exactement ce qui suit :
Télécharge ComboFix (de sUBs) sur ton Bureau (et pas ailleurs !). Pour cela, fais un clic droit sur ce lien et choisis "enregistrer la cible sous ... " et tape C-Fix dans dans la fenêtre qui s'ouvre, puis choisis le Bureau comme destination : http://download.bleepingcomputer.com/sUBs/ComboFix.exe
-------------------------------- [ ! ATTENTION ! ] --------------------------------
! déconnecte toi, ferme toutes tes applications en cours et DESACTIVE TOUTES TES DEFENCES (anti-virus, antispyware, pare-feu) le temps de la manipulation qui pourraient gêner fortement l'outil...Tu les réactiveras donc après !
Dans ton cas, il s'agit BitDefender.
==> Surtout, si tu rencontres des difficultés à ce niveau là, dis le moi avant de poursuivre...
Tuto ici pour installer la Console de récupération (important en cas de problème) : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
-----------------------------------------------------------------------------------------------------------------------------
Ensuite :
Fais un clic droit sur C-Fix.exe (= combofix.exe ) --> exécuter en tant qu’administrateur
Appuie sur une touche pour démarrer le scan .
Attention : n'utilise pas ta souris ni ton clavier pendant que le programme tourne. Cela pourrait figer l'ordi ---> si un message d'erreur windows apparait à un moment : clique sur la croix rouge en haut à droite de la fenêtre pour la fermer
Le rapport sera crée dans: C:\Combofix.txt , poste le ici stp
Le logiciel qui suit n'est pas à utiliser à la légère ! Ne le faites que si un helpeur du forum qui connait bien cet outil vous l'a recommandé.
On va utiliser Combofix pour finir la désinfection. Attention, ce logiciel est très puissant, une mauvaise utilisation peut faire des dégâts... Fais exactement ce qui suit :
Télécharge ComboFix (de sUBs) sur ton Bureau (et pas ailleurs !). Pour cela, fais un clic droit sur ce lien et choisis "enregistrer la cible sous ... " et tape C-Fix dans dans la fenêtre qui s'ouvre, puis choisis le Bureau comme destination : http://download.bleepingcomputer.com/sUBs/ComboFix.exe
-------------------------------- [ ! ATTENTION ! ] --------------------------------
! déconnecte toi, ferme toutes tes applications en cours et DESACTIVE TOUTES TES DEFENCES (anti-virus, antispyware, pare-feu) le temps de la manipulation qui pourraient gêner fortement l'outil...Tu les réactiveras donc après !
Dans ton cas, il s'agit BitDefender.
==> Surtout, si tu rencontres des difficultés à ce niveau là, dis le moi avant de poursuivre...
Tuto ici pour installer la Console de récupération (important en cas de problème) : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
-----------------------------------------------------------------------------------------------------------------------------
Ensuite :
Fais un clic droit sur C-Fix.exe (= combofix.exe ) --> exécuter en tant qu’administrateur
Appuie sur une touche pour démarrer le scan .
Attention : n'utilise pas ta souris ni ton clavier pendant que le programme tourne. Cela pourrait figer l'ordi ---> si un message d'erreur windows apparait à un moment : clique sur la croix rouge en haut à droite de la fenêtre pour la fermer
Le rapport sera crée dans: C:\Combofix.txt , poste le ici stp
Bon, je croyais avoir désactivé Bitdefender mais apparemment un message de combofix me dit :
le scanneur en temps reeel Bit Defender est toujours actif. Comment je l'arrete ?
le scanneur en temps reeel Bit Defender est toujours actif. Comment je l'arrete ?
Je ne connais pas du tout BitDefender, je supposais que toi tu aurais su le désactiver :-s
En faisant un clic-droit sur l'icone de BitDefender près de l'horloge, tu n'as pas une option pour l'arrêter ?
En faisant un clic-droit sur l'icone de BitDefender près de l'horloge, tu n'as pas une option pour l'arrêter ?
Voila le rapport . Est ce que je peux remettre l'antivirus ?
ComboFix 09-03-26.03 - darty 2009-03-27 21:32:22.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.2046.1092 [GMT 1:00]
Lancé depuis: c:\users\darty\Desktop\C-Fix.exe
AV: Bitdefender Antivirus *On-access scanning enabled* (Outdated)
FW: Bitdefender Firewall *enabled*
* Un nouveau point de restauration a été créé
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\recycler\S-9-1-30-100032561-100024058-100016540-1084.com
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\Antiphishing Component Update 3
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\Antiphishing Component Update 4
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\Antiphishing Component Update 6
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\Antiphishing Component Update 8
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp1097.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp13AE.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp1413.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp149E.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp1812.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp1AEF.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp1BC9.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp1F1D.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp1FA1.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp2023.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp224F.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp2470.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp2490.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp2619.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp2AA8.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp2B3D.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp2CAA.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp339D.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp339E.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp362C.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp3755.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp3E95.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp4356.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp436C.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp4569.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp4B1F.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp4B42.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp4CAA.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp51C7.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp53D.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp546F.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp5547.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp55CD.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp5659.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp5669.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp5ACC.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp5B97.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp5CDE.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp602B.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp6671.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp6871.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp6ED2.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp7299.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp74A3.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp75EE.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp78C2.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp7E99.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp83AF.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp86C.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp873.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp8DDE.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp8E81.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp99F4.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp9D28.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpA0DE.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpA2A5.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpA2FC.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpA3EC.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpA505.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpA769.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpA80.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpA8D4.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpB28C.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpB845.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpB941.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpC165.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpC3CB.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpC6C7.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpC94.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpC9C4.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpCA4.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpCACD.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpCB03.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpD365.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpD539.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpD845.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpD8D1.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpDA67.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpDD7A.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpE466.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpE935.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpED3B.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpF132.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpF1B.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpF657.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpFAB3.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpFC77.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpFD66.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpFEC8.tmp
c:\users\darty\AppData\Roaming\.#
c:\windows\System32\1000.exe
c:\windows\System32\303529.exe
c:\windows\system32\404Fix.exe
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\ahtn.htm
c:\windows\system32\drivers\gaopdxpofyiupmdoeivnbkmhusvifjpxqredrx.sys
c:\windows\system32\dumphive.exe
c:\windows\system32\frmwrk32.exe
c:\windows\system32\gaopdxcounter
c:\windows\system32\gaopdxkwqusiubesecnjwpwgymdcxipuinpvau.dll
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\KBL.LOG
c:\windows\system32\ntdll64.exe
c:\windows\system32\o4Patch.exe
c:\windows\system32\ovfstheiqymgaxttbtaciaiowhtquphdjbdwwa.dll
c:\windows\system32\ovfsthmknrxigjfydtifgvkxsgxqukxksjcvvm.dll
c:\windows\system32\ovfsthplpevixbovcfilwjxdbmjrohtxsgewkl.dll
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\uniq.tll
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\warning.gif
c:\windows\system32\WS2Fix.exe
c:\windows\system32\xcomm.dll
d:\recycler\S-9-1-30-100032561-100024058-100016540-1084.com
e:\recycler\S-9-1-30-100032561-100024058-100016540-1084.com
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_gaopdxserv.sys
-------\Service_Boonty Games
((((((((((((((((((((((((((((( Fichiers créés du 2009-02-27 au 2009-03-27 ))))))))))))))))))))))))))))))))))))
.
2009-03-27 20:01 . 2009-03-27 21:28 121 --a------ c:\windows\bdagent.INI
2009-03-27 18:11 . 2009-03-27 18:11 <REP> d-------- c:\program files\Les Aventures de Robinson Crusoe
2009-03-27 18:05 . 2009-03-27 18:05 <REP> d-------- c:\users\darty\AppData\Roaming\Be a King
2009-03-27 18:05 . 2009-03-27 18:05 <REP> d-------- c:\program files\Be a King
2009-03-26 21:57 . 2009-03-26 21:58 <REP> d-------- c:\program files\Emerald City Confidential
2009-03-26 21:51 . 2009-03-26 21:51 <REP> d-------- c:\users\darty\AppData\Roaming\Big Fish
2009-03-26 21:50 . 2009-03-26 21:50 <REP> d-------- c:\program files\Insider Tales - Stolen Venus
2009-03-26 21:28 . 2009-03-26 21:28 <REP> d-------- c:\program files\Mystery PI - The New York Fortune
2009-03-25 21:25 . 2009-03-25 21:25 <REP> d-------- c:\windows\BDOSCAN8
2009-03-22 22:02 . 2009-03-22 22:02 <REP> d-------- c:\program files\Tropical Mania
2009-03-22 17:45 . 2009-03-22 17:45 35,840 --a------ c:\windows\System32\gldx.exe
2009-03-22 00:19 . 2009-03-22 00:19 0 --a------ c:\windows\System32\drivers\ovfsth.sys
2009-03-21 23:22 . 2009-03-21 23:22 <REP> d-------- c:\program files\DigitalHQ
2009-03-21 23:21 . 2009-03-27 20:07 43 --a------ c:\windows\System32\ovfsthkrrpfqowegytoyhnnblvvfolrqnsqxvd.dat
2009-03-21 23:20 . 2009-03-27 20:07 40,435 --a------ c:\windows\System32\ovfsthwoeanqfcibtprejrmpwbhedeftvjimur.dat
2009-03-21 23:19 . 2009-03-21 23:19 <REP> d-------- c:\windows\Delicious - Emily's Tea Garden
2009-03-21 23:19 . 2009-03-21 23:22 <REP> d-------- c:\program files\Delicious - Emily's Tea Garden
2009-03-21 21:35 . 2009-03-21 23:12 <REP> d-------- c:\program files\Hidden Mysteries - Buckingham Palace
2009-03-21 17:36 . 2009-03-21 17:36 59 --a------ c:\windows\RUNAWAY.INI
2009-03-21 17:32 . 2009-03-21 17:32 <REP> d-------- c:\program files\PENDULO Studios
2009-03-21 13:31 . 2009-03-22 10:23 <REP> d-------- c:\program files\Cossacks
2009-03-21 13:31 . 2009-03-21 13:31 53,248 --a------ c:\windows\System32\unrar.dll
2009-03-20 19:22 . 2009-03-20 19:22 <REP> d-------- c:\users\All Users\BigFish
2009-03-20 19:22 . 2009-03-20 19:22 <REP> d-------- c:\programdata\BigFish
2009-03-20 19:01 . 2009-03-20 19:01 <REP> d-------- c:\users\darty\AppData\Roaming\BrandX Games
2009-03-20 18:25 . 2009-03-20 18:25 630,784 --a------ c:\windows\System32\mhhewwywbyspgz.dll
2009-03-18 14:56 . 2009-03-18 15:04 <REP> d-------- c:\program files\Téléchargeur de amerzone
2009-03-16 20:47 . 2009-03-16 20:47 <REP> d-------- c:\users\darty\AppData\Roaming\Sortasoft
2009-03-16 20:47 . 2009-03-16 20:47 <REP> d-------- c:\users\All Users\Sortasoft
2009-03-16 20:47 . 2009-03-16 20:47 <REP> d-------- c:\programdata\Sortasoft
2009-03-15 11:18 . 2009-03-15 11:18 <REP> d-------- c:\program files\Lost in the City
2009-03-15 10:47 . 2009-03-15 10:47 <REP> d-------- c:\users\darty\AppData\Roaming\Anabel
2009-03-14 23:53 . 2009-03-14 23:54 <REP> d-------- c:\program files\The Hidden Object Show - Season 2
2009-03-14 10:24 . 2009-03-14 10:24 <REP> d-------- c:\windows\Hidden Wonders of the Depths
2009-03-13 20:07 . 2009-03-13 20:07 <REP> d-------- c:\users\darty\AppData\Roaming\Boolat Games
2009-03-11 21:31 . 2009-03-11 21:31 <REP> d-------- c:\program files\Angela Young's Dream Adventure
2009-03-11 20:55 . 2008-12-16 04:29 8,147,456 --a------ c:\windows\System32\wmploc.DLL
2009-03-11 20:55 . 2008-12-16 06:31 7,680 --a------ c:\windows\System32\spwmp.dll
2009-03-11 20:55 . 2008-12-16 06:31 4,096 --a------ c:\windows\System32\msdxm.ocx
2009-03-11 20:55 . 2008-12-16 06:31 4,096 --a------ c:\windows\System32\dxmasf.dll
2009-03-11 20:54 . 2009-02-09 04:10 2,033,152 --a------ c:\windows\System32\win32k.sys
2009-03-11 20:54 . 2008-11-27 05:43 268,288 --a------ c:\windows\System32\schannel.dll
2009-03-10 21:36 . 2009-03-10 21:36 <REP> d-------- c:\users\All Users\Friday's games
2009-03-10 21:36 . 2009-03-10 21:36 <REP> d-------- c:\programdata\Friday's games
2009-03-08 19:09 . 2009-03-08 19:09 <REP> d-------- c:\program files\Curse of the Pharaoh - Napoleons Secret
2009-03-08 16:18 . 2009-03-08 16:18 <REP> d-------- c:\program files\Geoplan-Geospace
2009-03-08 16:10 . 2009-03-08 16:10 <REP> d-------- c:\program files\Interwrite Learning
2009-03-07 13:42 . 2009-03-07 13:43 <REP> d-------- c:\program files\The Mysterious City - Cairo
2009-03-05 22:57 . 2009-03-05 22:57 <REP> d-------- c:\users\darty\AppData\Roaming\ZEMNOTT
2009-03-05 22:57 . 2009-03-05 22:57 <REP> d-------- c:\users\All Users\ZEMNOTT
2009-03-05 22:57 . 2009-03-05 22:57 <REP> d-------- c:\programdata\ZEMNOTT
2009-03-05 22:55 . 2009-03-05 22:55 <REP> d-------- c:\windows\Nanny Mania 2
2009-03-05 22:53 . 2009-03-05 23:57 <REP> d-------- c:\program files\Eco-Match
2009-03-03 20:35 . 2009-03-03 20:35 <REP> d-------- c:\windows\Romopolis
2009-03-03 20:35 . 2009-03-03 20:35 <REP> d-------- c:\program files\Romopolis
2009-03-01 21:58 . 2009-03-01 23:03 <REP> d-------- c:\program files\Party Down
2009-02-28 21:28 . 2009-02-28 21:28 <REP> d-------- c:\users\darty\AppData\Roaming\SerpentOfIsis
2009-02-28 21:23 . 2009-02-28 21:25 <REP> d-------- c:\program files\The Serpent of Isis
2009-02-28 21:18 . 2009-02-28 21:18 <REP> d-------- c:\users\darty\AppData\Roaming\panoramik
2009-02-27 21:48 . 2009-02-27 21:48 <REP> d-------- c:\users\darty\AppData\Roaming\World-LooM
2009-02-27 20:13 . 2009-02-27 20:13 <REP> d-------- c:\program files\The Wizard's Pen
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-27 20:53 27,839 ----a-w c:\users\All Users\nvModes.dat
2009-03-27 20:53 27,839 ----a-w c:\programdata\nvModes.dat
2009-03-27 20:53 --------- d-----w c:\users\darty\AppData\Roaming\DNA
2009-03-27 20:53 --------- d-----w c:\program files\DNA
2009-03-27 20:10 86,792 ----a-w c:\windows\system32\drivers\bdfndisf.sys
2009-03-27 19:08 --------- d-----w c:\users\darty\AppData\Roaming\OpenOffice.org2
2009-03-27 18:05 --------- d---a-w c:\programdata\TEMP
2009-03-26 22:21 --------- d-----w c:\programdata\Google Updater
2009-03-25 20:38 --------- d-----w c:\programdata\BitDefender
2009-03-25 20:38 --------- d-----w c:\program files\Common Files\BitDefender
2009-03-25 19:49 --------- d-----w c:\program files\Java
2009-03-23 19:07 --------- d-----w c:\users\darty\AppData\Roaming\BitTorrent
2009-03-22 08:16 --------- d-----w c:\programdata\NVIDIA
2009-03-21 20:35 --------- d-----w c:\users\darty\AppData\Roaming\Zylom
2009-03-21 16:32 --------- d--h--w c:\program files\InstallShield Installation Information
2009-03-20 22:22 --------- d-----w c:\program files\Oberon Media
2009-03-19 19:45 --------- d-----w c:\program files\HP Games
2009-03-19 19:21 --------- d-----w c:\programdata\WildTangent
2009-03-19 14:29 --------- d-----w c:\users\darty\AppData\Roaming\Flood Light Games
2009-03-19 14:29 --------- d-----w c:\programdata\Flood Light Games
2009-03-18 14:39 --------- d-----w c:\program files\BoontyGames
2009-03-18 14:11 --------- d-----w c:\programdata\GameXzone
2009-03-18 14:04 --------- d-----w c:\program files\Téléchargeur de amerzone
2009-03-12 19:17 --------- d-----w c:\program files\Windows Mail
2009-03-11 20:13 --------- d-----w c:\users\darty\AppData\Roaming\PlayFirst
2009-03-11 20:13 --------- d-----w c:\programdata\PlayFirst
2009-03-04 21:30 --------- d-----w c:\programdata\Gogii
2009-03-03 21:01 --------- d-----w c:\users\darty\AppData\Roaming\MysteryStudio
2009-03-01 21:00 --------- d-----w c:\users\darty\AppData\Roaming\EleFun Games
2009-02-25 12:36 --------- d-----w c:\users\darty\AppData\Roaming\Tropical Dream Underwater Odyssey
2009-02-22 09:39 --------- d-----w c:\programdata\Enkord
2009-02-22 09:03 --------- d-----w c:\programdata\Big Fish Games Vancouver
2009-02-21 14:55 --------- d-----w c:\program files\Costume Chaos
2009-02-21 14:54 --------- d-----w c:\program files\Herods Lost Tomb
2009-02-21 09:32 --------- d-----w c:\programdata\FarmFrenzy-PizzaParty
2009-02-21 08:14 --------- d-----w c:\programdata\HoverBee Studios
2009-02-20 20:34 --------- d-----w c:\program files\Restoring Rhonda
2009-02-20 19:52 --------- d-----w c:\users\darty\AppData\Roaming\Skunk Studios
2009-02-20 14:57 --------- d-----w c:\users\darty\AppData\Roaming\blg
2009-02-20 14:57 --------- d-----w c:\programdata\blg
2009-02-18 12:49 --------- d-----w c:\users\darty\AppData\Roaming\FirstColony
2009-02-17 19:55 --------- d-----w c:\programdata\Mandragora
2009-02-16 18:46 --------- d-----w c:\program files\Google
2009-02-11 21:20 --------- d-----w c:\program files\BigfishGames
2009-02-11 20:05 --------- d-----w c:\programdata\SugarGames
2009-02-10 20:15 --------- d-----w c:\programdata\ApeZone
2009-02-05 17:12 --------- d-----w c:\program files\Cradle Of Rome
2009-02-05 14:10 --------- d-----w c:\users\darty\AppData\Roaming\dvdcss
2009-02-04 12:41 --------- d-----w c:\users\darty\AppData\Roaming\Playrix Entertainment
2009-02-03 20:51 --------- d-----w c:\users\darty\AppData\Roaming\HSA
2009-02-02 22:07 --------- d-----w c:\users\darty\AppData\Roaming\Friday's games
2009-02-02 21:02 --------- d-----w c:\users\darty\AppData\Roaming\Coyotes Tale
2009-02-02 18:42 --------- d-----w c:\program files\Samsung
2009-02-02 12:43 --------- d-----w c:\users\darty\AppData\Roaming\Island
2009-02-01 20:10 --------- d-----w c:\programdata\Meridian93
2009-02-01 20:09 --------- d-----w c:\users\darty\AppData\Roaming\Meridian93
2009-02-01 19:54 --------- d-----w c:\users\darty\AppData\Roaming\RobinsonCrusoe
2009-02-01 16:44 --------- d-----w c:\users\darty\AppData\Roaming\ViquaSoft
2009-01-30 08:41 --------- d-----w c:\program files\Lecteur CANALPLAY
2009-01-29 22:05 --------- d-----w c:\users\darty\AppData\Roaming\TimeQuest
2009-01-29 22:03 --------- d-----w c:\program files\Totem Tribe
2009-01-29 21:42 --------- d-----w c:\program files\Vogue Tales
2009-01-28 19:48 --------- d-----w c:\programdata\VogueTales
2009-01-28 15:51 --------- d-----w c:\program files\Sallys Salon
2009-01-28 11:26 --------- d-----w c:\programdata\Vogue Tales
2009-01-28 11:02 --------- d-----w c:\programdata\InterAction studios
2008-10-11 18:52 27,335 ----a-w c:\users\darty\AppData\Roaming\nvModes.dat
2008-08-23 18:13 174 --sha-w c:\program files\desktop.ini
2008-04-24 06:32 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-04-24 06:32 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2008-04-24 06:32 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
2008-10-23 22:35 16,384 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-10-23 22:35 32,768 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2008-10-23 22:35 16,384 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{2f3a94fd-c89e-41c4-bbd6-18b11705e7f3}"= "c:\program files\Smartorrent\tbSmar.dll" [2008-11-23 1784856]
[HKEY_CLASSES_ROOT\clsid\{2f3a94fd-c89e-41c4-bbd6-18b11705e7f3}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2f3a94fd-c89e-41c4-bbd6-18b11705e7f3}]
2008-11-23 23:03 1784856 --a------ c:\program files\Smartorrent\tbSmar.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8349BC85-7239-B526-7D30-9CBDD2B35008}]
2009-03-20 18:25 630784 --a------ c:\windows\system32\mhhewwywbyspgz.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{2f3a94fd-c89e-41c4-bbd6-18b11705e7f3}"= "c:\program files\Smartorrent\tbSmar.dll" [2008-11-23 1784856]
[HKEY_CLASSES_ROOT\clsid\{2f3a94fd-c89e-41c4-bbd6-18b11705e7f3}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{2F3A94FD-C89E-41C4-BBD6-18B11705E7F3}"= "c:\program files\Smartorrent\tbSmar.dll" [2008-11-23 1784856]
[HKEY_CLASSES_ROOT\clsid\{2f3a94fd-c89e-41c4-bbd6-18b11705e7f3}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-03-22 149040]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-25 39408]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-03-27 342848]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-10 216520]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 102400]
"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2007-01-17 634880]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-09-12 182808]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-09-30 181544]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-09-19 202032]
"OnScreenDisplay"="c:\program files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe" [2007-09-04 554320]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-08-16 218408]
"DpAgent"="c:\program files\DigitalPersona\Bin\dpagent.exe" [2007-09-20 671744]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-06-16 75008]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-09-13 480560]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-08 311296]
"BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2008\IEShow.exe" [2007-10-09 61440]
"BDAgent"="c:\program files\BitDefender\BitDefender 2008\bdagent.exe" [2009-03-27 368640]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-15 153136]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-02-27 13515296]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-02-27 92704]
"InterWrite Device Manager"="c:\program files\Interwrite Learning\Interwrite Workspace\IWStarter.exe" [2007-09-21 1122304]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"RtHDVCpl"="RtHDVCpl.exe" [2007-08-17 c:\windows\RtHDVCpl.exe]
c:\users\darty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 2.4.lnk - c:\program files\OpenOffice.org 2.4\program\quickstart.exe [2008-01-21 393216]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)
"NoActiveDesktopChanges"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3codecp"= l3codecp.acm
"msacm.avis"= ff_acm.acm
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli DPPWDFLT
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{4757DF27-BB99-458F-80CB-DB0364C8F28F}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{419E922C-2259-4F5C-8434-B5F1D2E96D3A}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{E0F9C7C3-CA1A-416F-A34C-0862127D6393}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{EB55CB69-2800-4DE8-A74E-01C74B7C84E3}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{ECCE1CEF-E35A-4D98-B328-225A47D70E75}"= c:\program files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector
"{31501F90-C592-4D85-9438-33EFD5D13D23}"= c:\program files\HP\QuickPlay\QP.exe:Quick Play
"{C3B4693F-2000-437E-B074-E9B72031798A}"= c:\program files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{E661D763-1AD9-4680-B994-3BA0E48E3AC9}"= UDP:c:\program files\Electronic Arts\Medal of Honor Airborne\UnrealEngine3\Binaries\MOHA.exe:Medal of Honor Airborne
"{E911C296-A208-4414-B72B-16FF9588005C}"= TCP:c:\program files\Electronic Arts\Medal of Honor Airborne\UnrealEngine3\Binaries\MOHA.exe:Medal of Honor Airborne
"{F447015E-E82D-4B8F-8956-A39F6478AFFA}"= UDP:c:\program files\DNA\btdna.exe:DNA
"{C88D7A4F-D46E-48CD-96D0-BA1ECFBD1E6B}"= TCP:c:\program files\DNA\btdna.exe:DNA
"{F3B89985-7BF5-44B5-9D4E-EE2A42062761}"= UDP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent
"{E31F4E8A-0769-4B1A-9E31-4114195CBB25}"= TCP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent
"{8068D17E-06FF-480A-9AC1-C3F0676BEAD7}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{1298C032-B160-458E-A3C8-BC7331CE56F9}"= UDP:c:\program files\Lecteur CANALPLAY\CanalPlayer.exe:Lecteur CANALPLAY
"{018B64A2-15D3-495C-8582-C77D800E1665}"= TCP:c:\program files\Lecteur CANALPLAY\CanalPlayer.exe:Lecteur CANALPLAY
"{F7A98888-0FC7-49F5-BE51-8FD6C7784EFE}"= UDP:c:\program files\DNA\btdna.exe:DNA (TCP-In)
"{4C65ADFC-9C57-4D87-976C-9C5943C4C2E2}"= TCP:c:\program files\DNA\btdna.exe:DNA (UDP-In)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\BitTorrent\\bittorrent.exe"= c:\program files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent
R2 {22D78859-9CE9-4B77-BF18-AC83E81A9263};{22D78859-9CE9-4B77-BF18-AC83E81A9263};c:\program files\Hp\QuickPlay\[u]0/u00.fcl [2008-01-16 00:22:44 39408]
R2 TeamViewer4;TeamViewer 4;c:\program files\TeamViewer\Version4\TeamViewer_Service.exe [2008-12-15 185640]
R2 X4HSX32Ex;X4HSX32Ex;c:\program files\Player Metaboli\X4HSX32Ex.sys [2008-04-25 29856]
R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\System32\drivers\bdfndisf.sys [2007-10-19 86792]
S2 gupdate1c98a09a93c69c9;Google Update Service (gupdate1c98a09a93c69c9);c:\program files\Google\Update\GoogleUpdate.exe [2009-02-08 133104]
S3 Service CANALPLAY;Service CANALPLAY;c:\program files\Lecteur CANALPLAY\CanalPlayService.exe [2008-04-21 436096]
S3 WiselinkPro;SAMSUNG WiselinkPro Service;c:\program files\Samsung\SAMSUNG PC Share Manager\WiselinkPro.exe [2009-02-02 4014080]
--- Autres Services/Pilotes en mémoire ---
*Deregistered* - sptd
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
\shell\AutoRun\command - H:\LaunchU3.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9e9b063f-d10a-11dc-8d37-806e6f6e6963}]
\shell\AutoRun\command - F:\autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a915f3ae-9f32-11dd-a158-001e68056457}]
\shell\AutoRun\command - H:\LaunchU3.exe
.
Contenu du dossier 'Tâches planifiées'
2009-03-27 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-26 22:20]
2009-03-27 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-08 17:22]
2009-03-26 c:\windows\Tasks\User_Feed_Synchronization-{683B7A7C-3607-42F0-AF40-80427994F3E7}.job
- c:\windows\system32\msfeedssync.exe [2008-01-19 08:33]
.
- - - - ORPHELINS SUPPRIMES - - - -
HKU-Default-Run-A00F1C5C9BD.exe - c:\windows\TEMP\_A00F1C5C9BD.exe
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://fr.yahoo.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fr_fr&c=81&bd=Pavilion&pf=laptop
IE: &Recherche AOL Toolbar - c:\program files\aol\aol toolbar 5.0\resources\fr-fr\local\search.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
Trusted Zone: canalplay.com
Trusted Zone: canalplusactive.com
Trusted Zone: canalplay.com
Trusted Zone: canalplusactive.com
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-27 21:54:46
Windows 6.0.6001 Service Pack 1 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'lsass.exe'(732)
c:\windows\system32\DPPWDFLT.dll
- - - - - - - > 'Explorer.exe'(5184)
c:\program files\DigitalPersona\Bin\DpoFeedb.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\System32\nvvsvc.exe
c:\windows\System32\audiodg.exe
c:\program files\DigitalPersona\Bin\DpHostW.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
c:\program files\Electronic Arts\Medal of Honor Airborne\UnrealEngine3\MOHAGame\pb\PnkBstrA.exe
c:\program files\Hp\QuickPlay\Kernel\TV\QPCapSvc.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\program files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe
c:\program files\Hewlett-Packard\Shared\hpqWmiEx.exe
c:\program files\Hp\QuickPlay\Kernel\TV\QPSched.exe
c:\windows\System32\rundll32.exe
c:\windows\System32\conime.exe
c:\program files\Synaptics\SynTP\SynTPEnh.exe
c:\windows\System32\rundll32.exe
c:\program files\Hewlett-Packard\Shared\HpqToaster.exe
c:\windows\ehome\ehmsas.exe
c:\windows\ehome\ehsched.exe
c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
c:\program files\OpenOffice.org 2.4\program\soffice.exe
c:\program files\OpenOffice.org 2.4\program\soffice.bin
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\windows\ehome\ehrecvr.exe
c:\program files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
.
**************************************************************************
.
Heure de fin: 2009-03-27 22:06:20 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-03-27 21:06:01
Avant-CF: 32,201,388,032 octets libres
Après-CF: 32,057,982,976 octets libres
463 --- E O F --- 2009-03-26 22:41:59
ComboFix 09-03-26.03 - darty 2009-03-27 21:32:22.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.2046.1092 [GMT 1:00]
Lancé depuis: c:\users\darty\Desktop\C-Fix.exe
AV: Bitdefender Antivirus *On-access scanning enabled* (Outdated)
FW: Bitdefender Firewall *enabled*
* Un nouveau point de restauration a été créé
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\recycler\S-9-1-30-100032561-100024058-100016540-1084.com
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\Antiphishing Component Update 3
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\Antiphishing Component Update 4
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\Antiphishing Component Update 6
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\Antiphishing Component Update 8
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp1097.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp13AE.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp1413.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp149E.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp1812.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp1AEF.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp1BC9.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp1F1D.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp1FA1.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp2023.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp224F.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp2470.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp2490.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp2619.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp2AA8.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp2B3D.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp2CAA.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp339D.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp339E.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp362C.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp3755.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp3E95.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp4356.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp436C.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp4569.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp4B1F.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp4B42.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp4CAA.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp51C7.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp53D.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp546F.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp5547.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp55CD.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp5659.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp5669.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp5ACC.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp5B97.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp5CDE.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp602B.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp6671.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp6871.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp6ED2.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp7299.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp74A3.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp75EE.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp78C2.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp7E99.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp83AF.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp86C.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp873.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp8DDE.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp8E81.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp99F4.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp9D28.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpA0DE.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpA2A5.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpA2FC.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpA3EC.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpA505.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpA769.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpA80.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpA8D4.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpB28C.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpB845.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpB941.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpC165.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpC3CB.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpC6C7.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpC94.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpC9C4.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpCA4.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpCACD.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpCB03.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpD365.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpD539.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpD845.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpD8D1.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpDA67.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpDD7A.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpE466.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpE935.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpED3B.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpF132.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpF1B.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpF657.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpFAB3.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpFC77.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpFD66.tmp
c:\users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpFEC8.tmp
c:\users\darty\AppData\Roaming\.#
c:\windows\System32\1000.exe
c:\windows\System32\303529.exe
c:\windows\system32\404Fix.exe
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\ahtn.htm
c:\windows\system32\drivers\gaopdxpofyiupmdoeivnbkmhusvifjpxqredrx.sys
c:\windows\system32\dumphive.exe
c:\windows\system32\frmwrk32.exe
c:\windows\system32\gaopdxcounter
c:\windows\system32\gaopdxkwqusiubesecnjwpwgymdcxipuinpvau.dll
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\KBL.LOG
c:\windows\system32\ntdll64.exe
c:\windows\system32\o4Patch.exe
c:\windows\system32\ovfstheiqymgaxttbtaciaiowhtquphdjbdwwa.dll
c:\windows\system32\ovfsthmknrxigjfydtifgvkxsgxqukxksjcvvm.dll
c:\windows\system32\ovfsthplpevixbovcfilwjxdbmjrohtxsgewkl.dll
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\uniq.tll
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\warning.gif
c:\windows\system32\WS2Fix.exe
c:\windows\system32\xcomm.dll
d:\recycler\S-9-1-30-100032561-100024058-100016540-1084.com
e:\recycler\S-9-1-30-100032561-100024058-100016540-1084.com
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_gaopdxserv.sys
-------\Service_Boonty Games
((((((((((((((((((((((((((((( Fichiers créés du 2009-02-27 au 2009-03-27 ))))))))))))))))))))))))))))))))))))
.
2009-03-27 20:01 . 2009-03-27 21:28 121 --a------ c:\windows\bdagent.INI
2009-03-27 18:11 . 2009-03-27 18:11 <REP> d-------- c:\program files\Les Aventures de Robinson Crusoe
2009-03-27 18:05 . 2009-03-27 18:05 <REP> d-------- c:\users\darty\AppData\Roaming\Be a King
2009-03-27 18:05 . 2009-03-27 18:05 <REP> d-------- c:\program files\Be a King
2009-03-26 21:57 . 2009-03-26 21:58 <REP> d-------- c:\program files\Emerald City Confidential
2009-03-26 21:51 . 2009-03-26 21:51 <REP> d-------- c:\users\darty\AppData\Roaming\Big Fish
2009-03-26 21:50 . 2009-03-26 21:50 <REP> d-------- c:\program files\Insider Tales - Stolen Venus
2009-03-26 21:28 . 2009-03-26 21:28 <REP> d-------- c:\program files\Mystery PI - The New York Fortune
2009-03-25 21:25 . 2009-03-25 21:25 <REP> d-------- c:\windows\BDOSCAN8
2009-03-22 22:02 . 2009-03-22 22:02 <REP> d-------- c:\program files\Tropical Mania
2009-03-22 17:45 . 2009-03-22 17:45 35,840 --a------ c:\windows\System32\gldx.exe
2009-03-22 00:19 . 2009-03-22 00:19 0 --a------ c:\windows\System32\drivers\ovfsth.sys
2009-03-21 23:22 . 2009-03-21 23:22 <REP> d-------- c:\program files\DigitalHQ
2009-03-21 23:21 . 2009-03-27 20:07 43 --a------ c:\windows\System32\ovfsthkrrpfqowegytoyhnnblvvfolrqnsqxvd.dat
2009-03-21 23:20 . 2009-03-27 20:07 40,435 --a------ c:\windows\System32\ovfsthwoeanqfcibtprejrmpwbhedeftvjimur.dat
2009-03-21 23:19 . 2009-03-21 23:19 <REP> d-------- c:\windows\Delicious - Emily's Tea Garden
2009-03-21 23:19 . 2009-03-21 23:22 <REP> d-------- c:\program files\Delicious - Emily's Tea Garden
2009-03-21 21:35 . 2009-03-21 23:12 <REP> d-------- c:\program files\Hidden Mysteries - Buckingham Palace
2009-03-21 17:36 . 2009-03-21 17:36 59 --a------ c:\windows\RUNAWAY.INI
2009-03-21 17:32 . 2009-03-21 17:32 <REP> d-------- c:\program files\PENDULO Studios
2009-03-21 13:31 . 2009-03-22 10:23 <REP> d-------- c:\program files\Cossacks
2009-03-21 13:31 . 2009-03-21 13:31 53,248 --a------ c:\windows\System32\unrar.dll
2009-03-20 19:22 . 2009-03-20 19:22 <REP> d-------- c:\users\All Users\BigFish
2009-03-20 19:22 . 2009-03-20 19:22 <REP> d-------- c:\programdata\BigFish
2009-03-20 19:01 . 2009-03-20 19:01 <REP> d-------- c:\users\darty\AppData\Roaming\BrandX Games
2009-03-20 18:25 . 2009-03-20 18:25 630,784 --a------ c:\windows\System32\mhhewwywbyspgz.dll
2009-03-18 14:56 . 2009-03-18 15:04 <REP> d-------- c:\program files\Téléchargeur de amerzone
2009-03-16 20:47 . 2009-03-16 20:47 <REP> d-------- c:\users\darty\AppData\Roaming\Sortasoft
2009-03-16 20:47 . 2009-03-16 20:47 <REP> d-------- c:\users\All Users\Sortasoft
2009-03-16 20:47 . 2009-03-16 20:47 <REP> d-------- c:\programdata\Sortasoft
2009-03-15 11:18 . 2009-03-15 11:18 <REP> d-------- c:\program files\Lost in the City
2009-03-15 10:47 . 2009-03-15 10:47 <REP> d-------- c:\users\darty\AppData\Roaming\Anabel
2009-03-14 23:53 . 2009-03-14 23:54 <REP> d-------- c:\program files\The Hidden Object Show - Season 2
2009-03-14 10:24 . 2009-03-14 10:24 <REP> d-------- c:\windows\Hidden Wonders of the Depths
2009-03-13 20:07 . 2009-03-13 20:07 <REP> d-------- c:\users\darty\AppData\Roaming\Boolat Games
2009-03-11 21:31 . 2009-03-11 21:31 <REP> d-------- c:\program files\Angela Young's Dream Adventure
2009-03-11 20:55 . 2008-12-16 04:29 8,147,456 --a------ c:\windows\System32\wmploc.DLL
2009-03-11 20:55 . 2008-12-16 06:31 7,680 --a------ c:\windows\System32\spwmp.dll
2009-03-11 20:55 . 2008-12-16 06:31 4,096 --a------ c:\windows\System32\msdxm.ocx
2009-03-11 20:55 . 2008-12-16 06:31 4,096 --a------ c:\windows\System32\dxmasf.dll
2009-03-11 20:54 . 2009-02-09 04:10 2,033,152 --a------ c:\windows\System32\win32k.sys
2009-03-11 20:54 . 2008-11-27 05:43 268,288 --a------ c:\windows\System32\schannel.dll
2009-03-10 21:36 . 2009-03-10 21:36 <REP> d-------- c:\users\All Users\Friday's games
2009-03-10 21:36 . 2009-03-10 21:36 <REP> d-------- c:\programdata\Friday's games
2009-03-08 19:09 . 2009-03-08 19:09 <REP> d-------- c:\program files\Curse of the Pharaoh - Napoleons Secret
2009-03-08 16:18 . 2009-03-08 16:18 <REP> d-------- c:\program files\Geoplan-Geospace
2009-03-08 16:10 . 2009-03-08 16:10 <REP> d-------- c:\program files\Interwrite Learning
2009-03-07 13:42 . 2009-03-07 13:43 <REP> d-------- c:\program files\The Mysterious City - Cairo
2009-03-05 22:57 . 2009-03-05 22:57 <REP> d-------- c:\users\darty\AppData\Roaming\ZEMNOTT
2009-03-05 22:57 . 2009-03-05 22:57 <REP> d-------- c:\users\All Users\ZEMNOTT
2009-03-05 22:57 . 2009-03-05 22:57 <REP> d-------- c:\programdata\ZEMNOTT
2009-03-05 22:55 . 2009-03-05 22:55 <REP> d-------- c:\windows\Nanny Mania 2
2009-03-05 22:53 . 2009-03-05 23:57 <REP> d-------- c:\program files\Eco-Match
2009-03-03 20:35 . 2009-03-03 20:35 <REP> d-------- c:\windows\Romopolis
2009-03-03 20:35 . 2009-03-03 20:35 <REP> d-------- c:\program files\Romopolis
2009-03-01 21:58 . 2009-03-01 23:03 <REP> d-------- c:\program files\Party Down
2009-02-28 21:28 . 2009-02-28 21:28 <REP> d-------- c:\users\darty\AppData\Roaming\SerpentOfIsis
2009-02-28 21:23 . 2009-02-28 21:25 <REP> d-------- c:\program files\The Serpent of Isis
2009-02-28 21:18 . 2009-02-28 21:18 <REP> d-------- c:\users\darty\AppData\Roaming\panoramik
2009-02-27 21:48 . 2009-02-27 21:48 <REP> d-------- c:\users\darty\AppData\Roaming\World-LooM
2009-02-27 20:13 . 2009-02-27 20:13 <REP> d-------- c:\program files\The Wizard's Pen
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-27 20:53 27,839 ----a-w c:\users\All Users\nvModes.dat
2009-03-27 20:53 27,839 ----a-w c:\programdata\nvModes.dat
2009-03-27 20:53 --------- d-----w c:\users\darty\AppData\Roaming\DNA
2009-03-27 20:53 --------- d-----w c:\program files\DNA
2009-03-27 20:10 86,792 ----a-w c:\windows\system32\drivers\bdfndisf.sys
2009-03-27 19:08 --------- d-----w c:\users\darty\AppData\Roaming\OpenOffice.org2
2009-03-27 18:05 --------- d---a-w c:\programdata\TEMP
2009-03-26 22:21 --------- d-----w c:\programdata\Google Updater
2009-03-25 20:38 --------- d-----w c:\programdata\BitDefender
2009-03-25 20:38 --------- d-----w c:\program files\Common Files\BitDefender
2009-03-25 19:49 --------- d-----w c:\program files\Java
2009-03-23 19:07 --------- d-----w c:\users\darty\AppData\Roaming\BitTorrent
2009-03-22 08:16 --------- d-----w c:\programdata\NVIDIA
2009-03-21 20:35 --------- d-----w c:\users\darty\AppData\Roaming\Zylom
2009-03-21 16:32 --------- d--h--w c:\program files\InstallShield Installation Information
2009-03-20 22:22 --------- d-----w c:\program files\Oberon Media
2009-03-19 19:45 --------- d-----w c:\program files\HP Games
2009-03-19 19:21 --------- d-----w c:\programdata\WildTangent
2009-03-19 14:29 --------- d-----w c:\users\darty\AppData\Roaming\Flood Light Games
2009-03-19 14:29 --------- d-----w c:\programdata\Flood Light Games
2009-03-18 14:39 --------- d-----w c:\program files\BoontyGames
2009-03-18 14:11 --------- d-----w c:\programdata\GameXzone
2009-03-18 14:04 --------- d-----w c:\program files\Téléchargeur de amerzone
2009-03-12 19:17 --------- d-----w c:\program files\Windows Mail
2009-03-11 20:13 --------- d-----w c:\users\darty\AppData\Roaming\PlayFirst
2009-03-11 20:13 --------- d-----w c:\programdata\PlayFirst
2009-03-04 21:30 --------- d-----w c:\programdata\Gogii
2009-03-03 21:01 --------- d-----w c:\users\darty\AppData\Roaming\MysteryStudio
2009-03-01 21:00 --------- d-----w c:\users\darty\AppData\Roaming\EleFun Games
2009-02-25 12:36 --------- d-----w c:\users\darty\AppData\Roaming\Tropical Dream Underwater Odyssey
2009-02-22 09:39 --------- d-----w c:\programdata\Enkord
2009-02-22 09:03 --------- d-----w c:\programdata\Big Fish Games Vancouver
2009-02-21 14:55 --------- d-----w c:\program files\Costume Chaos
2009-02-21 14:54 --------- d-----w c:\program files\Herods Lost Tomb
2009-02-21 09:32 --------- d-----w c:\programdata\FarmFrenzy-PizzaParty
2009-02-21 08:14 --------- d-----w c:\programdata\HoverBee Studios
2009-02-20 20:34 --------- d-----w c:\program files\Restoring Rhonda
2009-02-20 19:52 --------- d-----w c:\users\darty\AppData\Roaming\Skunk Studios
2009-02-20 14:57 --------- d-----w c:\users\darty\AppData\Roaming\blg
2009-02-20 14:57 --------- d-----w c:\programdata\blg
2009-02-18 12:49 --------- d-----w c:\users\darty\AppData\Roaming\FirstColony
2009-02-17 19:55 --------- d-----w c:\programdata\Mandragora
2009-02-16 18:46 --------- d-----w c:\program files\Google
2009-02-11 21:20 --------- d-----w c:\program files\BigfishGames
2009-02-11 20:05 --------- d-----w c:\programdata\SugarGames
2009-02-10 20:15 --------- d-----w c:\programdata\ApeZone
2009-02-05 17:12 --------- d-----w c:\program files\Cradle Of Rome
2009-02-05 14:10 --------- d-----w c:\users\darty\AppData\Roaming\dvdcss
2009-02-04 12:41 --------- d-----w c:\users\darty\AppData\Roaming\Playrix Entertainment
2009-02-03 20:51 --------- d-----w c:\users\darty\AppData\Roaming\HSA
2009-02-02 22:07 --------- d-----w c:\users\darty\AppData\Roaming\Friday's games
2009-02-02 21:02 --------- d-----w c:\users\darty\AppData\Roaming\Coyotes Tale
2009-02-02 18:42 --------- d-----w c:\program files\Samsung
2009-02-02 12:43 --------- d-----w c:\users\darty\AppData\Roaming\Island
2009-02-01 20:10 --------- d-----w c:\programdata\Meridian93
2009-02-01 20:09 --------- d-----w c:\users\darty\AppData\Roaming\Meridian93
2009-02-01 19:54 --------- d-----w c:\users\darty\AppData\Roaming\RobinsonCrusoe
2009-02-01 16:44 --------- d-----w c:\users\darty\AppData\Roaming\ViquaSoft
2009-01-30 08:41 --------- d-----w c:\program files\Lecteur CANALPLAY
2009-01-29 22:05 --------- d-----w c:\users\darty\AppData\Roaming\TimeQuest
2009-01-29 22:03 --------- d-----w c:\program files\Totem Tribe
2009-01-29 21:42 --------- d-----w c:\program files\Vogue Tales
2009-01-28 19:48 --------- d-----w c:\programdata\VogueTales
2009-01-28 15:51 --------- d-----w c:\program files\Sallys Salon
2009-01-28 11:26 --------- d-----w c:\programdata\Vogue Tales
2009-01-28 11:02 --------- d-----w c:\programdata\InterAction studios
2008-10-11 18:52 27,335 ----a-w c:\users\darty\AppData\Roaming\nvModes.dat
2008-08-23 18:13 174 --sha-w c:\program files\desktop.ini
2008-04-24 06:32 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-04-24 06:32 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2008-04-24 06:32 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
2008-10-23 22:35 16,384 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-10-23 22:35 32,768 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2008-10-23 22:35 16,384 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{2f3a94fd-c89e-41c4-bbd6-18b11705e7f3}"= "c:\program files\Smartorrent\tbSmar.dll" [2008-11-23 1784856]
[HKEY_CLASSES_ROOT\clsid\{2f3a94fd-c89e-41c4-bbd6-18b11705e7f3}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2f3a94fd-c89e-41c4-bbd6-18b11705e7f3}]
2008-11-23 23:03 1784856 --a------ c:\program files\Smartorrent\tbSmar.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8349BC85-7239-B526-7D30-9CBDD2B35008}]
2009-03-20 18:25 630784 --a------ c:\windows\system32\mhhewwywbyspgz.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{2f3a94fd-c89e-41c4-bbd6-18b11705e7f3}"= "c:\program files\Smartorrent\tbSmar.dll" [2008-11-23 1784856]
[HKEY_CLASSES_ROOT\clsid\{2f3a94fd-c89e-41c4-bbd6-18b11705e7f3}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{2F3A94FD-C89E-41C4-BBD6-18B11705E7F3}"= "c:\program files\Smartorrent\tbSmar.dll" [2008-11-23 1784856]
[HKEY_CLASSES_ROOT\clsid\{2f3a94fd-c89e-41c4-bbd6-18b11705e7f3}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-03-22 149040]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-25 39408]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-03-27 342848]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-10 216520]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 102400]
"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2007-01-17 634880]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-09-12 182808]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-09-30 181544]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-09-19 202032]
"OnScreenDisplay"="c:\program files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe" [2007-09-04 554320]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-08-16 218408]
"DpAgent"="c:\program files\DigitalPersona\Bin\dpagent.exe" [2007-09-20 671744]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-06-16 75008]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-09-13 480560]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-08 311296]
"BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2008\IEShow.exe" [2007-10-09 61440]
"BDAgent"="c:\program files\BitDefender\BitDefender 2008\bdagent.exe" [2009-03-27 368640]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-15 153136]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-02-27 13515296]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-02-27 92704]
"InterWrite Device Manager"="c:\program files\Interwrite Learning\Interwrite Workspace\IWStarter.exe" [2007-09-21 1122304]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"RtHDVCpl"="RtHDVCpl.exe" [2007-08-17 c:\windows\RtHDVCpl.exe]
c:\users\darty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 2.4.lnk - c:\program files\OpenOffice.org 2.4\program\quickstart.exe [2008-01-21 393216]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)
"NoActiveDesktopChanges"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3codecp"= l3codecp.acm
"msacm.avis"= ff_acm.acm
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli DPPWDFLT
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{4757DF27-BB99-458F-80CB-DB0364C8F28F}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{419E922C-2259-4F5C-8434-B5F1D2E96D3A}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{E0F9C7C3-CA1A-416F-A34C-0862127D6393}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{EB55CB69-2800-4DE8-A74E-01C74B7C84E3}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{ECCE1CEF-E35A-4D98-B328-225A47D70E75}"= c:\program files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector
"{31501F90-C592-4D85-9438-33EFD5D13D23}"= c:\program files\HP\QuickPlay\QP.exe:Quick Play
"{C3B4693F-2000-437E-B074-E9B72031798A}"= c:\program files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{E661D763-1AD9-4680-B994-3BA0E48E3AC9}"= UDP:c:\program files\Electronic Arts\Medal of Honor Airborne\UnrealEngine3\Binaries\MOHA.exe:Medal of Honor Airborne
"{E911C296-A208-4414-B72B-16FF9588005C}"= TCP:c:\program files\Electronic Arts\Medal of Honor Airborne\UnrealEngine3\Binaries\MOHA.exe:Medal of Honor Airborne
"{F447015E-E82D-4B8F-8956-A39F6478AFFA}"= UDP:c:\program files\DNA\btdna.exe:DNA
"{C88D7A4F-D46E-48CD-96D0-BA1ECFBD1E6B}"= TCP:c:\program files\DNA\btdna.exe:DNA
"{F3B89985-7BF5-44B5-9D4E-EE2A42062761}"= UDP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent
"{E31F4E8A-0769-4B1A-9E31-4114195CBB25}"= TCP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent
"{8068D17E-06FF-480A-9AC1-C3F0676BEAD7}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{1298C032-B160-458E-A3C8-BC7331CE56F9}"= UDP:c:\program files\Lecteur CANALPLAY\CanalPlayer.exe:Lecteur CANALPLAY
"{018B64A2-15D3-495C-8582-C77D800E1665}"= TCP:c:\program files\Lecteur CANALPLAY\CanalPlayer.exe:Lecteur CANALPLAY
"{F7A98888-0FC7-49F5-BE51-8FD6C7784EFE}"= UDP:c:\program files\DNA\btdna.exe:DNA (TCP-In)
"{4C65ADFC-9C57-4D87-976C-9C5943C4C2E2}"= TCP:c:\program files\DNA\btdna.exe:DNA (UDP-In)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\BitTorrent\\bittorrent.exe"= c:\program files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent
R2 {22D78859-9CE9-4B77-BF18-AC83E81A9263};{22D78859-9CE9-4B77-BF18-AC83E81A9263};c:\program files\Hp\QuickPlay\[u]0/u00.fcl [2008-01-16 00:22:44 39408]
R2 TeamViewer4;TeamViewer 4;c:\program files\TeamViewer\Version4\TeamViewer_Service.exe [2008-12-15 185640]
R2 X4HSX32Ex;X4HSX32Ex;c:\program files\Player Metaboli\X4HSX32Ex.sys [2008-04-25 29856]
R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\System32\drivers\bdfndisf.sys [2007-10-19 86792]
S2 gupdate1c98a09a93c69c9;Google Update Service (gupdate1c98a09a93c69c9);c:\program files\Google\Update\GoogleUpdate.exe [2009-02-08 133104]
S3 Service CANALPLAY;Service CANALPLAY;c:\program files\Lecteur CANALPLAY\CanalPlayService.exe [2008-04-21 436096]
S3 WiselinkPro;SAMSUNG WiselinkPro Service;c:\program files\Samsung\SAMSUNG PC Share Manager\WiselinkPro.exe [2009-02-02 4014080]
--- Autres Services/Pilotes en mémoire ---
*Deregistered* - sptd
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
\shell\AutoRun\command - H:\LaunchU3.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9e9b063f-d10a-11dc-8d37-806e6f6e6963}]
\shell\AutoRun\command - F:\autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a915f3ae-9f32-11dd-a158-001e68056457}]
\shell\AutoRun\command - H:\LaunchU3.exe
.
Contenu du dossier 'Tâches planifiées'
2009-03-27 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-26 22:20]
2009-03-27 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-08 17:22]
2009-03-26 c:\windows\Tasks\User_Feed_Synchronization-{683B7A7C-3607-42F0-AF40-80427994F3E7}.job
- c:\windows\system32\msfeedssync.exe [2008-01-19 08:33]
.
- - - - ORPHELINS SUPPRIMES - - - -
HKU-Default-Run-A00F1C5C9BD.exe - c:\windows\TEMP\_A00F1C5C9BD.exe
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://fr.yahoo.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fr_fr&c=81&bd=Pavilion&pf=laptop
IE: &Recherche AOL Toolbar - c:\program files\aol\aol toolbar 5.0\resources\fr-fr\local\search.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
Trusted Zone: canalplay.com
Trusted Zone: canalplusactive.com
Trusted Zone: canalplay.com
Trusted Zone: canalplusactive.com
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-27 21:54:46
Windows 6.0.6001 Service Pack 1 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'lsass.exe'(732)
c:\windows\system32\DPPWDFLT.dll
- - - - - - - > 'Explorer.exe'(5184)
c:\program files\DigitalPersona\Bin\DpoFeedb.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\System32\nvvsvc.exe
c:\windows\System32\audiodg.exe
c:\program files\DigitalPersona\Bin\DpHostW.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
c:\program files\Electronic Arts\Medal of Honor Airborne\UnrealEngine3\MOHAGame\pb\PnkBstrA.exe
c:\program files\Hp\QuickPlay\Kernel\TV\QPCapSvc.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\program files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe
c:\program files\Hewlett-Packard\Shared\hpqWmiEx.exe
c:\program files\Hp\QuickPlay\Kernel\TV\QPSched.exe
c:\windows\System32\rundll32.exe
c:\windows\System32\conime.exe
c:\program files\Synaptics\SynTP\SynTPEnh.exe
c:\windows\System32\rundll32.exe
c:\program files\Hewlett-Packard\Shared\HpqToaster.exe
c:\windows\ehome\ehmsas.exe
c:\windows\ehome\ehsched.exe
c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
c:\program files\OpenOffice.org 2.4\program\soffice.exe
c:\program files\OpenOffice.org 2.4\program\soffice.bin
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\windows\ehome\ehrecvr.exe
c:\program files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
.
**************************************************************************
.
Heure de fin: 2009-03-27 22:06:20 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-03-27 21:06:01
Avant-CF: 32,201,388,032 octets libres
Après-CF: 32,057,982,976 octets libres
463 --- E O F --- 2009-03-26 22:41:59
/!\ ATTENTION /!\ Le script qui suit a été écrit spécialement pour NoProbs, il n'est pas transposable sur un autre ordinateur !
• Télécharge ce dossier NoProbs.zip
• Fais un clic-droit dessus --> Extraire tout --> choisis le Bureau comme destination
• Un autre dossier va apparaitre, prends le fichier CFScript.txt qui se trouve à l'intérieur et place le sur le Bureau.
• Désactive tes logiciels de protection
• Fais un glisser/déposer de ce fichier CFScript.txt sur le fichier Combofix.exe
• Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
• Une fois le scan achevé, un rapport va s'afficher : enregistre le et redémarre ton ordinateur
Tu peux réactiver BitDefender au redémarrage (s'il ne le fait pas automatiquement)
• Télécharge ce dossier NoProbs.zip
• Fais un clic-droit dessus --> Extraire tout --> choisis le Bureau comme destination
• Un autre dossier va apparaitre, prends le fichier CFScript.txt qui se trouve à l'intérieur et place le sur le Bureau.
• Désactive tes logiciels de protection
• Fais un glisser/déposer de ce fichier CFScript.txt sur le fichier Combofix.exe
• Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
• Une fois le scan achevé, un rapport va s'afficher : enregistre le et redémarre ton ordinateur
Tu peux réactiver BitDefender au redémarrage (s'il ne le fait pas automatiquement)
Bon j'ai un problème, il m'est impossible de désactiver Bit Defender, je n'y ai plus acces nulle part et je ne sais pas ou le trouver !! du coup le rapport ne s'édite pas.
En plus je ne peux plus lancer bitdefender, j'ai un message qui me dit que xcomm.dll est introuvable.
Et pour couronner le tout, je ne peux plus désinstaller bit defender !!
Si t'as une solution miracle, je suis preneur stp.
En plus je ne peux plus lancer bitdefender, j'ai un message qui me dit que xcomm.dll est introuvable.
Et pour couronner le tout, je ne peux plus désinstaller bit defender !!
Si t'as une solution miracle, je suis preneur stp.
Une petite précision qui pourrait t'aider :
Lorsque j'ai fait le glisser déplacer, sur l'icone cFix j'ai eu un message qui me disait acces refusé, vous n'avez pas les autorisations administrateurs, voili voilou
Lorsque j'ai fait le glisser déplacer, sur l'icone cFix j'ai eu un message qui me disait acces refusé, vous n'avez pas les autorisations administrateurs, voili voilou
Ce p..... de bit defender, je le vois activé dans le centre de sécurité windows dans la partie "Protection contre les programmes malveillants" et je ne peux pas y accéder pour le désactiver.
Fais un clic-droit sur l'icone de Combofix --> Propriétés --> Compatibilité --> Coche "Exécuter ce programme en temps qu'administrateur"
Sinon pour BitDefender... essaye de redémarrer en mode sans échec pour faire la manipulation que je t'ai donnée, dans ce mode il ne sera pas actif.
Pour redémarrer en mode sans échec :
Tu n' auras pas accès à Internet pendant le "mode sans échec". Aussi, copie/colle toute cette procédure dans un fichier texte et mets-la sur le "Bureau" pour l'avoir à ta disposition. Ferme toutes les fenêtres et applications.
Redémarre ton ordinateur, puis tapote sur la touche F8 (F5 sur certains PC) avant l’apparition du logo Windows, un menu va apparaître, tu devra choisir de démarrer en mode sans échec. Choisis ta session habituelle, et ne t'inquiète pas si les couleurs et la taille des icônes changent, c'est normal !
Sinon pour BitDefender... essaye de redémarrer en mode sans échec pour faire la manipulation que je t'ai donnée, dans ce mode il ne sera pas actif.
Pour redémarrer en mode sans échec :
Tu n' auras pas accès à Internet pendant le "mode sans échec". Aussi, copie/colle toute cette procédure dans un fichier texte et mets-la sur le "Bureau" pour l'avoir à ta disposition. Ferme toutes les fenêtres et applications.
Redémarre ton ordinateur, puis tapote sur la touche F8 (F5 sur certains PC) avant l’apparition du logo Windows, un menu va apparaître, tu devra choisir de démarrer en mode sans échec. Choisis ta session habituelle, et ne t'inquiète pas si les couleurs et la taille des icônes changent, c'est normal !
Dernier message pour ce soir :
J'ai réussi à désinstaller bit defender, j'ai redémarré le PC, j'ai relancé le script que tu m'as envoyé et oh surprise, bit defender apparait toujours dans le centre de sécurité windows alors que je ne l'ai plus du tout sur le PC !!!
Voici le message exact :
Protection antivirus Activé
BitDefender Antivirus indique qu'il est à jour et que la détection de virus est activée
Protection contre les logiciels espions et autres programmes malveillants Activé
Windows Defender et Bit Defender antispam indiquent qu'ils sont tous deux activés.
Allez, je repasse demain.
Quel que soit le résultat, je te remercie d'essayer de m'aider
J'ai réussi à désinstaller bit defender, j'ai redémarré le PC, j'ai relancé le script que tu m'as envoyé et oh surprise, bit defender apparait toujours dans le centre de sécurité windows alors que je ne l'ai plus du tout sur le PC !!!
Voici le message exact :
Protection antivirus Activé
BitDefender Antivirus indique qu'il est à jour et que la détection de virus est activée
Protection contre les logiciels espions et autres programmes malveillants Activé
Windows Defender et Bit Defender antispam indiquent qu'ils sont tous deux activés.
Allez, je repasse demain.
Quel que soit le résultat, je te remercie d'essayer de m'aider