Win32.rungbu.a
Résolu
lepurlensois62
Messages postés
284
Date d'inscription
Statut
Membre
Dernière intervention
-
Amiral -
Amiral -
Bonjour,
Je suis infecté par ce virus et j'aimerais men débarrasser ?
Comment faire ?
Merci
Je suis infecté par ce virus et j'aimerais men débarrasser ?
Comment faire ?
Merci
28 réponses
Malwarebytes' Anti-Malware 1.36
Version de la base de données: 2176
Windows 5.1.2600 Service Pack 3
25/05/2009 17:36:04
mbam-log-2009-05-25 (17-36-04).txt
Type de recherche: Examen complet (C:\|)
Eléments examinés: 124545
Temps écoulé: 1 hour(s), 3 minute(s), 14 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 24
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
C:\lc.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\nu.cmd (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP28\A0009871.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP28\A0009881.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP28\A0009882.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010064.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010078.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010079.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010100.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010101.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010115.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010116.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010138.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010139.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010140.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010142.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010143.com (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010145.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010147.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010150.com (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010152.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010154.com (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010155.cmd (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010153.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
Version de la base de données: 2176
Windows 5.1.2600 Service Pack 3
25/05/2009 17:36:04
mbam-log-2009-05-25 (17-36-04).txt
Type de recherche: Examen complet (C:\|)
Eléments examinés: 124545
Temps écoulé: 1 hour(s), 3 minute(s), 14 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 24
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
C:\lc.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\nu.cmd (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP28\A0009871.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP28\A0009881.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP28\A0009882.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010064.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010078.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010079.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010100.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010101.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010115.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010116.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010138.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010139.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010140.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010142.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010143.com (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010145.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010147.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010150.com (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010152.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010154.com (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010155.cmd (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010153.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
SUPERAntiSpyware Scan Log
https://www.superantispyware.com/
Generated 06/03/2009 at 02:27 PM
Application Version : 4.26.1004
Core Rules Database Version : 3921
Trace Rules Database Version: 1865
Scan type : Complete Scan
Total Scan Time : 00:35:07
Memory items scanned : 597
Memory threats detected : 0
Registry items scanned : 4766
Registry threats detected : 0
File items scanned : 17191
File threats detected : 28
Adware.Tracking Cookie
C:\Documents and Settings\Caroline\Cookies\caroline@bs.serving-sys[2].txt
C:\Documents and Settings\Caroline\Cookies\caroline@tracking.publicidees[1].txt
C:\Documents and Settings\Caroline\Cookies\caroline@adtech[1].txt
C:\Documents and Settings\Caroline\Cookies\caroline@boursoramabanque.solution.weborama[2].txt
C:\Documents and Settings\Caroline\Cookies\caroline@cnam.solution.weborama[2].txt
C:\Documents and Settings\Caroline\Cookies\caroline@ad.zanox[1].txt
C:\Documents and Settings\Caroline\Cookies\caroline@serving-sys[2].txt
C:\Documents and Settings\Caroline\Cookies\caroline@nestlecereals.solution.weborama[2].txt
C:\Documents and Settings\Caroline\Cookies\caroline@2o7[1].txt
C:\Documents and Settings\Caroline\Cookies\caroline@weborama[1].txt
C:\Documents and Settings\LocalService\Cookies\system@www.van-steenbeek[1].txt
Trojan.Downloader-Gen/Suspicious
C:\GENPROC\OUTIL\MBR.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{ED68065C-59B1-4602-A861-8C2C4102216B}\RP32\A0011976.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{ED68065C-59B1-4602-A861-8C2C4102216B}\RP36\A0012213.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{ED68065C-59B1-4602-A861-8C2C4102216B}\RP40\A0013436.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{ED68065C-59B1-4602-A861-8C2C4102216B}\RP41\A0013992.EXE
C:\WINDOWS\Prefetch\MBR.EXE-15F95684.pf
Rootkit.Agent/Gen-OnlineGames
C:\SYSTEM VOLUME INFORMATION\_RESTORE{ED68065C-59B1-4602-A861-8C2C4102216B}\RP28\A0009808.SYS
C:\SYSTEM VOLUME INFORMATION\_RESTORE{ED68065C-59B1-4602-A861-8C2C4102216B}\RP28\A0009837.SYS
C:\SYSTEM VOLUME INFORMATION\_RESTORE{ED68065C-59B1-4602-A861-8C2C4102216B}\RP28\A0009843.SYS
C:\SYSTEM VOLUME INFORMATION\_RESTORE{ED68065C-59B1-4602-A861-8C2C4102216B}\RP28\A0009869.SYS
C:\SYSTEM VOLUME INFORMATION\_RESTORE{ED68065C-59B1-4602-A861-8C2C4102216B}\RP28\A0009880.SYS
C:\SYSTEM VOLUME INFORMATION\_RESTORE{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010077.SYS
C:\SYSTEM VOLUME INFORMATION\_RESTORE{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010087.SYS
C:\SYSTEM VOLUME INFORMATION\_RESTORE{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010090.SYS
C:\SYSTEM VOLUME INFORMATION\_RESTORE{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010091.SYS
C:\SYSTEM VOLUME INFORMATION\_RESTORE{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010099.SYS
C:\SYSTEM VOLUME INFORMATION\_RESTORE{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010114.SYS
https://www.superantispyware.com/
Generated 06/03/2009 at 02:27 PM
Application Version : 4.26.1004
Core Rules Database Version : 3921
Trace Rules Database Version: 1865
Scan type : Complete Scan
Total Scan Time : 00:35:07
Memory items scanned : 597
Memory threats detected : 0
Registry items scanned : 4766
Registry threats detected : 0
File items scanned : 17191
File threats detected : 28
Adware.Tracking Cookie
C:\Documents and Settings\Caroline\Cookies\caroline@bs.serving-sys[2].txt
C:\Documents and Settings\Caroline\Cookies\caroline@tracking.publicidees[1].txt
C:\Documents and Settings\Caroline\Cookies\caroline@adtech[1].txt
C:\Documents and Settings\Caroline\Cookies\caroline@boursoramabanque.solution.weborama[2].txt
C:\Documents and Settings\Caroline\Cookies\caroline@cnam.solution.weborama[2].txt
C:\Documents and Settings\Caroline\Cookies\caroline@ad.zanox[1].txt
C:\Documents and Settings\Caroline\Cookies\caroline@serving-sys[2].txt
C:\Documents and Settings\Caroline\Cookies\caroline@nestlecereals.solution.weborama[2].txt
C:\Documents and Settings\Caroline\Cookies\caroline@2o7[1].txt
C:\Documents and Settings\Caroline\Cookies\caroline@weborama[1].txt
C:\Documents and Settings\LocalService\Cookies\system@www.van-steenbeek[1].txt
Trojan.Downloader-Gen/Suspicious
C:\GENPROC\OUTIL\MBR.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{ED68065C-59B1-4602-A861-8C2C4102216B}\RP32\A0011976.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{ED68065C-59B1-4602-A861-8C2C4102216B}\RP36\A0012213.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{ED68065C-59B1-4602-A861-8C2C4102216B}\RP40\A0013436.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{ED68065C-59B1-4602-A861-8C2C4102216B}\RP41\A0013992.EXE
C:\WINDOWS\Prefetch\MBR.EXE-15F95684.pf
Rootkit.Agent/Gen-OnlineGames
C:\SYSTEM VOLUME INFORMATION\_RESTORE{ED68065C-59B1-4602-A861-8C2C4102216B}\RP28\A0009808.SYS
C:\SYSTEM VOLUME INFORMATION\_RESTORE{ED68065C-59B1-4602-A861-8C2C4102216B}\RP28\A0009837.SYS
C:\SYSTEM VOLUME INFORMATION\_RESTORE{ED68065C-59B1-4602-A861-8C2C4102216B}\RP28\A0009843.SYS
C:\SYSTEM VOLUME INFORMATION\_RESTORE{ED68065C-59B1-4602-A861-8C2C4102216B}\RP28\A0009869.SYS
C:\SYSTEM VOLUME INFORMATION\_RESTORE{ED68065C-59B1-4602-A861-8C2C4102216B}\RP28\A0009880.SYS
C:\SYSTEM VOLUME INFORMATION\_RESTORE{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010077.SYS
C:\SYSTEM VOLUME INFORMATION\_RESTORE{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010087.SYS
C:\SYSTEM VOLUME INFORMATION\_RESTORE{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010090.SYS
C:\SYSTEM VOLUME INFORMATION\_RESTORE{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010091.SYS
C:\SYSTEM VOLUME INFORMATION\_RESTORE{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010099.SYS
C:\SYSTEM VOLUME INFORMATION\_RESTORE{ED68065C-59B1-4602-A861-8C2C4102216B}\RP29\A0010114.SYS
Bon
· Télécharge ToolsCleaner de A.Roshtein& dj QUIOU sur ton Bureau.(sur un des 2 liens)
http://pc-system.fr/
http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner
· Clique sur Recherche et laisse le scan se terminer.
· Clique, sur Suppression pour finaliser.
· Tu peux, si tu le souhaites, te servir des Options facultatives.
· Clique sur Quitter, pour que le rapport puisse se créer.
· Poste moi le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur( C:\).
+ 1 log hijackthis
· Télécharge ToolsCleaner de A.Roshtein& dj QUIOU sur ton Bureau.(sur un des 2 liens)
http://pc-system.fr/
http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner
· Clique sur Recherche et laisse le scan se terminer.
· Clique, sur Suppression pour finaliser.
· Tu peux, si tu le souhaites, te servir des Options facultatives.
· Clique sur Quitter, pour que le rapport puisse se créer.
· Poste moi le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur( C:\).
+ 1 log hijackthis
[ Rapport ToolsCleaner version 2.3.5 (par A.Rothstein & dj QUIOU) ]
--> Recherche:
C:\TB.txt: trouvé !
C:\GenProc: trouvé !
C:\Toolbar SD: trouvé !
C:\GenProc\outil\hijackthis.log: trouvé !
C:\GenProc\Page\GenProc[*].html: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !
---------------------------------
--> Suppression:
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\TB.txt: supprimé !
C:\GenProc\outil\hijackthis.log: supprimé !
C:\GenProc\Page\GenProc[*].html: ERREUR DE SUPPRESSION !!
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: supprimé !
C:\GenProc: supprimé !
C:\Toolbar SD: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !
--> Recherche:
C:\TB.txt: trouvé !
C:\GenProc: trouvé !
C:\Toolbar SD: trouvé !
C:\GenProc\outil\hijackthis.log: trouvé !
C:\GenProc\Page\GenProc[*].html: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !
---------------------------------
--> Suppression:
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\TB.txt: supprimé !
C:\GenProc\outil\hijackthis.log: supprimé !
C:\GenProc\Page\GenProc[*].html: ERREUR DE SUPPRESSION !!
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: supprimé !
C:\GenProc: supprimé !
C:\Toolbar SD: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:23:38, on 03/06/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
C:\PROGRA~1\NUMERI~1\MONASS~1\SMARTB~1\MotiveSB.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\vVX3000.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Caroline\Bureau\HiJackThis.exe
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\NUMERI~1\MONASS~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [PV92TRAY] PV92Tray.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: Sélection intelligente HP - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: NET Service - Unknown owner - C:\WINDOWS\wmssvc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
Scan saved at 22:23:38, on 03/06/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
C:\PROGRA~1\NUMERI~1\MONASS~1\SMARTB~1\MotiveSB.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\vVX3000.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Caroline\Bureau\HiJackThis.exe
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\NUMERI~1\MONASS~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [PV92TRAY] PV92Tray.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: Sélection intelligente HP - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: NET Service - Unknown owner - C:\WINDOWS\wmssvc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
Salut
Pour tous les lecteurs :
-- Ce logiciel n'est à utiliser que prescrit par un helper qualifié et formé à l'outil.
-- Ne pas utiliser en dehors de ce cas de figure : dangereux!
Lors de son exécution, ComboFix va vérifier si la Console de récupération Microsoft Windows est installée. Avec des infections comme celles d'aujourd'hui, il est fortement conseillé de l'avoir pré-installée sur votre PC avant toute suppression de nuisibles. Elle vous permettra de démarrer dans un mode spécial, de récupération (réparation), qui nous permet de vous aider plus facilement si jamais votre ordinateur rencontre un problème après une tentative de nettoyage.
Suivez les invites pour permettre à ComboFix de télécharger et installer la Console de récupération Microsoft Windows, et lorsque cela vous est demandé, acceptez le Contrat de Licence Utilisateur Final pour installer la Console de récupération Microsoft Windows.
Sous XP
https://support.microsoft.com/en-us/help/310994
Sous Vista
http://www.commentcamarche.net/faq/sujet 13735 console de recuperation vista sur cd bootable
**Note importante: Si la Console de récupération Microsoft Windows est déjà installée, ComboFix continuera ses procédures de suppression de nuisibles.
Télécharges ComboFix à partir d'un de ces liens :
En premier
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
A lire
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
Et important, enregistre le sur le bureau.
Avant d'utiliser ComboFix :
► Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.
► Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil.
Une fois fait, sur ton bureau double-clic sur Combofix.exe.
- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.
/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.
- En fin de scan il est possible que ComboFix ait besoin de redémarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.
- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)
► Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.
► Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.
+ 1 log hijackthis
++
Pour tous les lecteurs :
-- Ce logiciel n'est à utiliser que prescrit par un helper qualifié et formé à l'outil.
-- Ne pas utiliser en dehors de ce cas de figure : dangereux!
Lors de son exécution, ComboFix va vérifier si la Console de récupération Microsoft Windows est installée. Avec des infections comme celles d'aujourd'hui, il est fortement conseillé de l'avoir pré-installée sur votre PC avant toute suppression de nuisibles. Elle vous permettra de démarrer dans un mode spécial, de récupération (réparation), qui nous permet de vous aider plus facilement si jamais votre ordinateur rencontre un problème après une tentative de nettoyage.
Suivez les invites pour permettre à ComboFix de télécharger et installer la Console de récupération Microsoft Windows, et lorsque cela vous est demandé, acceptez le Contrat de Licence Utilisateur Final pour installer la Console de récupération Microsoft Windows.
Sous XP
https://support.microsoft.com/en-us/help/310994
Sous Vista
http://www.commentcamarche.net/faq/sujet 13735 console de recuperation vista sur cd bootable
**Note importante: Si la Console de récupération Microsoft Windows est déjà installée, ComboFix continuera ses procédures de suppression de nuisibles.
Télécharges ComboFix à partir d'un de ces liens :
En premier
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
A lire
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
Et important, enregistre le sur le bureau.
Avant d'utiliser ComboFix :
► Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.
► Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil.
Une fois fait, sur ton bureau double-clic sur Combofix.exe.
- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.
/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.
- En fin de scan il est possible que ComboFix ait besoin de redémarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.
- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)
► Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.
► Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.
+ 1 log hijackthis
++
ComboFix 09-06-06.03 - Caroline 07/06/2009 14:09.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.511.282 [GMT 2:00]
Lancé depuis: c:\documents and settings\Caroline\Bureau\ComboFix.exe
AV: Bitdefender Antivirus *On-access scanning enabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\rbj9jn1n.bat
c:\windows\system32\404Fix.exe
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\Cache
c:\windows\system32\dumphive.exe
c:\windows\system32\i
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\o4Patch.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_IPRIP
-------\Legacy_NET_SERVICE
-------\Service_AVPsys
-------\Service_Iprip
-------\Service_NET Service
-------\Legacy_IISADMIN
-------\Legacy_SMTPSVC
-------\Service_IISADMIN
-------\Service_SMTPSVC
((((((((((((((((((((((((((((( Fichiers créés du 2009-05-07 au 2009-06-07 ))))))))))))))))))))))))))))))))))))
.
2009-06-06 12:00 . 2009-06-06 12:00 -------- d-----w- c:\documents and settings\Caroline\Local Settings\Application Data\WMTools Downloaded Files
2009-06-03 11:46 . 2009-06-03 11:46 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-06-03 11:45 . 2009-06-04 16:12 -------- d-----w- c:\documents and settings\Caroline\Application Data\SUPERAntiSpyware.com
2009-06-03 11:45 . 2009-06-04 16:11 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-06-03 11:06 . 2009-06-03 11:08 -------- d-----w- c:\program files\Windows Live Safety Center
2009-06-02 18:21 . 2009-06-02 18:21 -------- d-----w- c:\documents and settings\All Users\Application Data\MailFrontier
2009-05-27 20:01 . 2003-11-04 13:10 69632 ----a-w- c:\windows\system32\lfgif13n.dll
2009-05-27 20:01 . 2004-05-14 14:53 462848 ----a-w- c:\windows\system32\ltkrn13n.dll
2009-05-27 20:01 . 2004-05-14 14:53 450560 ----a-w- c:\windows\system32\ltimg13n.dll
2009-05-27 20:01 . 2004-05-14 14:53 299008 ----a-w- c:\windows\system32\ltdis13n.dll
2009-05-27 20:01 . 2004-05-14 14:53 163840 ----a-w- c:\windows\system32\ltfil13n.dll
2009-05-27 20:01 . 2004-05-14 14:53 57344 ----a-w- c:\windows\system32\lfbmp13n.dll
2009-05-27 20:01 . 2004-05-14 14:53 401408 ----a-w- c:\windows\system32\lfcmp13n.dll
2009-05-27 20:01 . 2004-01-12 00:09 206336 ----a-w- c:\windows\system32\ltefx13n.dll
2009-05-27 16:00 . 2009-06-02 18:20 -------- d-----w- c:\documents and settings\Caroline\Application Data\VSO
2009-05-25 14:29 . 2009-05-25 14:29 -------- d-----w- c:\documents and settings\Caroline\Application Data\Malwarebytes
2009-05-25 14:28 . 2009-05-25 14:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-20 17:30 . 2009-05-20 17:32 4212 ---h--w- c:\windows\system32\zllictbl.dat
2009-05-20 17:29 . 2004-04-27 02:40 11264 ----a-w- c:\windows\system32\SpOrder.dll
2009-05-20 17:28 . 2009-06-02 18:21 -------- d-----w- c:\windows\Internet Logs
2009-05-18 14:42 . 2009-05-18 14:42 152576 ----a-w- c:\documents and settings\Caroline\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-05-15 16:09 . 2009-05-15 16:15 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-05-15 16:09 . 2009-04-17 18:23 44544 ----a-w- c:\windows\system32\msxml4a.dll
2009-05-15 16:03 . 2009-05-15 16:03 604416 ----a-w- c:\windows\system32\TUProgSt.exe
2009-05-15 16:03 . 2009-04-27 12:21 28928 ----a-w- c:\windows\system32\uxtuneup.dll
2009-05-15 16:03 . 2009-05-15 16:03 361216 ----a-w- c:\windows\system32\TuneUpDefragService.exe
2009-05-15 16:02 . 2009-05-15 16:02 -------- d-----w- c:\documents and settings\All Users\Application Data\TuneUp Software
2009-05-15 16:02 . 2009-05-27 15:25 -------- d-----w- c:\program files\TuneUp Utilities 2009
2009-05-15 16:01 . 2009-05-15 16:01 -------- d-sh--w- c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2009-05-15 15:26 . 2009-05-15 15:26 -------- d-----w- c:\program files\SystemRequirementsLab
2009-05-15 15:26 . 2009-05-15 15:26 -------- d-----w- c:\documents and settings\Caroline\Application Data\SystemRequirementsLab
2009-05-15 15:26 . 2009-05-15 15:26 290816 ----a-w- c:\documents and settings\Caroline\Application Data\SystemRequirementsLab\SRLProxy_nvd_4.dll
2009-05-15 15:26 . 2009-05-15 15:26 290816 ----a-w- c:\documents and settings\Caroline\Application Data\SystemRequirementsLab\SRLProxy_nvd_3.dll
2009-05-15 15:26 . 2009-05-15 15:26 290816 ----a-w- c:\documents and settings\Caroline\Application Data\SystemRequirementsLab\SRLProxy_nvd_2.dll
2009-05-15 15:26 . 2009-05-15 15:26 290816 ----a-w- c:\documents and settings\Caroline\Application Data\SystemRequirementsLab\SRLProxy_nvd_1.dll
2009-05-15 08:30 . 2001-08-17 19:52 18688 -c--a-w- c:\windows\system32\dllcache\cdaudio.sys
2009-05-15 08:30 . 2001-08-17 19:52 18688 ----a-w- c:\windows\system32\drivers\cdaudio.sys
2009-05-12 15:34 . 2009-05-12 15:34 -------- d--h--r- C:\MSOCache
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-07 12:05 . 2008-06-23 21:55 -------- d-----w- c:\program files\Fichiers communs\Softwin
2009-06-07 12:05 . 2008-06-23 21:56 -------- d-----w- c:\documents and settings\All Users\Application Data\BitDefender
2009-06-07 12:04 . 2008-06-23 21:58 81984 ----a-w- c:\windows\system32\bdod.bin
2009-06-06 21:12 . 2009-04-22 10:13 -------- d-----w- c:\documents and settings\Caroline\Application Data\HPAppData
2009-06-06 20:26 . 2009-03-07 18:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-06-04 16:27 . 2008-12-17 13:21 1 ----a-w- c:\documents and settings\Caroline\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-06-03 20:18 . 2009-04-22 17:57 -------- d-----w- c:\program files\Trend Micro
2009-06-02 19:44 . 2008-06-23 23:00 -------- d-----w- c:\program files\eMule
2009-06-02 18:20 . 2008-06-23 22:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-05-19 17:57 . 2001-08-28 12:00 70262 ----a-w- c:\windows\system32\perfc00C.dat
2009-05-19 17:57 . 2001-08-28 12:00 424888 ----a-w- c:\windows\system32\perfh00C.dat
2009-05-18 14:44 . 2008-12-17 13:12 -------- d-----w- c:\program files\Java
2009-05-03 18:08 . 2009-05-03 18:07 -------- d-----w- c:\program files\Microsoft LifeCam
2009-04-22 15:55 . 2008-07-07 15:31 17864 ----a-w- c:\documents and settings\Caroline\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-22 15:55 . 2009-04-22 15:55 -------- d-----w- c:\program files\Microsoft
2009-04-22 15:55 . 2009-04-22 15:54 -------- d-----w- c:\program files\Windows Live
2009-04-22 15:54 . 2009-04-22 15:54 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-04-22 15:49 . 2009-04-22 15:49 -------- d-----w- c:\program files\Fichiers communs\Windows Live
2009-04-22 13:38 . 2001-08-28 12:00 512000 ----a-w- c:\windows\system32\winlogon.exe
2009-04-22 12:19 . 2008-06-23 21:28 87263 ----a-w- c:\windows\PCHEALTH\HELPCTR\OfflineCache\index.dat
2009-04-22 09:14 . 2009-04-22 08:45 177917 ----a-w- c:\windows\hpoins27.dat
2009-04-22 08:48 . 2009-04-22 08:48 -------- d-----w- c:\documents and settings\All Users\Application Data\HP Product Assistant
2009-04-22 08:48 . 2009-04-21 11:02 -------- d-----w- c:\documents and settings\All Users\Application Data\HP
2009-04-22 08:48 . 2009-04-21 11:00 -------- d-----w- c:\program files\HP
2009-04-22 08:37 . 2009-04-22 08:37 -------- d-----w- c:\program files\MSXML 4.0
2009-04-22 07:33 . 2009-04-21 14:03 -------- d-----w- c:\program files\ma-config.com
2009-04-22 07:33 . 2009-04-21 14:03 -------- d-----w- c:\documents and settings\All Users\Application Data\ma-config.com
2009-04-21 17:05 . 2009-04-21 14:19 1536 ----a-w- c:\windows\system32\TrueSoft.dat
2009-04-21 17:01 . 2008-06-23 21:26 25776 -c--a-w- c:\windows\system32\emptyregdb.dat
2009-04-21 14:46 . 2009-04-21 14:46 -------- d-----w- c:\program files\Hewlett-Packard
2009-04-21 14:45 . 2009-04-21 14:45 -------- d-----w- c:\program files\Fichiers communs\HP
2009-04-21 14:11 . 2008-07-05 12:54 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-04-21 12:04 . 2009-04-21 12:04 -------- d-----w- c:\documents and settings\All Users\Application Data\HPSSUPPLY
2009-04-21 11:23 . 2009-04-21 11:23 -------- d-----w- c:\documents and settings\Caroline\Application Data\HP
2009-04-21 11:21 . 2009-04-21 11:21 -------- d-----w- c:\documents and settings\All Users\Application Data\WEBREG
2009-04-21 11:01 . 2009-04-21 11:01 -------- d-----w- c:\program files\Fichiers communs\Hewlett-Packard
2009-04-21 10:58 . 2009-04-21 10:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Hewlett-Packard
2009-03-15 07:37 . 2009-04-21 14:03 429224 ----a-w- c:\documents and settings\Caroline\Application Data\Mozilla\Firefox\Profiles\iq28b1t3.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\plugins\nphardwaredetection.dll
.
------- Sigcheck -------
[-] 2009-04-22 09:10 506368 86DB0FDAF2591C86389D36CF44658CFE c:\windows\$NtServicePackUninstall$\winlogon.exe
[7] 2008-04-14 02:34 512000 DD73D6B9F6B4CB630CF35B438B540174 c:\windows\ServicePackFiles\i386\winlogon.exe
[-] 2004-08-19 23:10 506368 123EEA158F74D0F67A51DCDF065D1091 c:\windows\SoftwareDistribution\Download\70ccc3de7e94865059fbcf2f809c03b1\winlogon.exe
[-] 2009-04-22 13:38 512000 8D71F28DEB37CC9C2E344095D8BFE1EE c:\windows\system32\winlogon.exe
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Motive SmartBridge"="c:\progra~1\NUMERI~1\MONASS~1\SMARTB~1\MotiveSB.exe" [2004-10-22 393216]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-14 49152]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896]
"VX3000"="c:\windows\vVX3000.exe" [2007-04-10 709992]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2007-05-17 279912]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"PCTVOICE"="pctspk.exe" - c:\windows\system32\pctspk.exe [2001-08-23 86016]
"PV92TRAY"="PV92Tray.exe" - c:\windows\system32\PV92Tray.exe [2003-10-30 323584]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-10-22 1622016]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [15/05/2009 18:03 604416]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contenu du dossier 'Tâches planifiées'
2009-06-07 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-07 08:53]
2009-06-07 c:\windows\Tasks\Maintenance en 1 clic.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-04-27 13:42]
.
- - - - ORPHELINS SUPPRIMES - - - -
SafeBoot-procexp90.Sys
.
------- Examen supplémentaire -------
.
mWindow Title =
uInternet Settings,ProxyOverride = 127.0.0.1;*.local
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Caroline\Application Data\Mozilla\Firefox\Profiles\iq28b1t3.default\
FF - plugin: c:\documents and settings\Caroline\Application Data\Mozilla\Firefox\Profiles\iq28b1t3.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\plugins\nphardwaredetection.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
---- PARAMETRES FIREFOX ----
FF - user.js: network.http.max-connections-per-server - 6
FF - user.js: network.http.max-persistent-connections-per-server - 3
FF - user.js: content.max.tokenizing.time - 1500000
FF - user.js: content.notify.interval - 750000
FF - user.js: nglayout.initialpaint.delay - 100
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-07 14:17
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'explorer.exe'(1984)
c:\progra~1\NUMERI~1\MONASS~1\SMARTB~1\SBHook.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Microsoft LifeCam\MSCamS32.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\tcpsvcs.exe
c:\windows\system32\snmp.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
c:\program files\HP\Digital Imaging\bin\hpqste08.exe
c:\program files\HP\Digital Imaging\bin\hpqbam08.exe
c:\program files\HP\Digital Imaging\bin\hpqgpc01.exe
.
**************************************************************************
.
Heure de fin: 2009-06-07 14:24 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-06-07 12:24
Avant-CF: 33 399 681 024 octets libres
Après-CF: 33 610 301 440 octets libres
WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect
230 --- E O F --- 2009-05-16 09:10
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.511.282 [GMT 2:00]
Lancé depuis: c:\documents and settings\Caroline\Bureau\ComboFix.exe
AV: Bitdefender Antivirus *On-access scanning enabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\rbj9jn1n.bat
c:\windows\system32\404Fix.exe
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\Cache
c:\windows\system32\dumphive.exe
c:\windows\system32\i
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\o4Patch.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_IPRIP
-------\Legacy_NET_SERVICE
-------\Service_AVPsys
-------\Service_Iprip
-------\Service_NET Service
-------\Legacy_IISADMIN
-------\Legacy_SMTPSVC
-------\Service_IISADMIN
-------\Service_SMTPSVC
((((((((((((((((((((((((((((( Fichiers créés du 2009-05-07 au 2009-06-07 ))))))))))))))))))))))))))))))))))))
.
2009-06-06 12:00 . 2009-06-06 12:00 -------- d-----w- c:\documents and settings\Caroline\Local Settings\Application Data\WMTools Downloaded Files
2009-06-03 11:46 . 2009-06-03 11:46 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-06-03 11:45 . 2009-06-04 16:12 -------- d-----w- c:\documents and settings\Caroline\Application Data\SUPERAntiSpyware.com
2009-06-03 11:45 . 2009-06-04 16:11 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-06-03 11:06 . 2009-06-03 11:08 -------- d-----w- c:\program files\Windows Live Safety Center
2009-06-02 18:21 . 2009-06-02 18:21 -------- d-----w- c:\documents and settings\All Users\Application Data\MailFrontier
2009-05-27 20:01 . 2003-11-04 13:10 69632 ----a-w- c:\windows\system32\lfgif13n.dll
2009-05-27 20:01 . 2004-05-14 14:53 462848 ----a-w- c:\windows\system32\ltkrn13n.dll
2009-05-27 20:01 . 2004-05-14 14:53 450560 ----a-w- c:\windows\system32\ltimg13n.dll
2009-05-27 20:01 . 2004-05-14 14:53 299008 ----a-w- c:\windows\system32\ltdis13n.dll
2009-05-27 20:01 . 2004-05-14 14:53 163840 ----a-w- c:\windows\system32\ltfil13n.dll
2009-05-27 20:01 . 2004-05-14 14:53 57344 ----a-w- c:\windows\system32\lfbmp13n.dll
2009-05-27 20:01 . 2004-05-14 14:53 401408 ----a-w- c:\windows\system32\lfcmp13n.dll
2009-05-27 20:01 . 2004-01-12 00:09 206336 ----a-w- c:\windows\system32\ltefx13n.dll
2009-05-27 16:00 . 2009-06-02 18:20 -------- d-----w- c:\documents and settings\Caroline\Application Data\VSO
2009-05-25 14:29 . 2009-05-25 14:29 -------- d-----w- c:\documents and settings\Caroline\Application Data\Malwarebytes
2009-05-25 14:28 . 2009-05-25 14:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-20 17:30 . 2009-05-20 17:32 4212 ---h--w- c:\windows\system32\zllictbl.dat
2009-05-20 17:29 . 2004-04-27 02:40 11264 ----a-w- c:\windows\system32\SpOrder.dll
2009-05-20 17:28 . 2009-06-02 18:21 -------- d-----w- c:\windows\Internet Logs
2009-05-18 14:42 . 2009-05-18 14:42 152576 ----a-w- c:\documents and settings\Caroline\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-05-15 16:09 . 2009-05-15 16:15 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-05-15 16:09 . 2009-04-17 18:23 44544 ----a-w- c:\windows\system32\msxml4a.dll
2009-05-15 16:03 . 2009-05-15 16:03 604416 ----a-w- c:\windows\system32\TUProgSt.exe
2009-05-15 16:03 . 2009-04-27 12:21 28928 ----a-w- c:\windows\system32\uxtuneup.dll
2009-05-15 16:03 . 2009-05-15 16:03 361216 ----a-w- c:\windows\system32\TuneUpDefragService.exe
2009-05-15 16:02 . 2009-05-15 16:02 -------- d-----w- c:\documents and settings\All Users\Application Data\TuneUp Software
2009-05-15 16:02 . 2009-05-27 15:25 -------- d-----w- c:\program files\TuneUp Utilities 2009
2009-05-15 16:01 . 2009-05-15 16:01 -------- d-sh--w- c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2009-05-15 15:26 . 2009-05-15 15:26 -------- d-----w- c:\program files\SystemRequirementsLab
2009-05-15 15:26 . 2009-05-15 15:26 -------- d-----w- c:\documents and settings\Caroline\Application Data\SystemRequirementsLab
2009-05-15 15:26 . 2009-05-15 15:26 290816 ----a-w- c:\documents and settings\Caroline\Application Data\SystemRequirementsLab\SRLProxy_nvd_4.dll
2009-05-15 15:26 . 2009-05-15 15:26 290816 ----a-w- c:\documents and settings\Caroline\Application Data\SystemRequirementsLab\SRLProxy_nvd_3.dll
2009-05-15 15:26 . 2009-05-15 15:26 290816 ----a-w- c:\documents and settings\Caroline\Application Data\SystemRequirementsLab\SRLProxy_nvd_2.dll
2009-05-15 15:26 . 2009-05-15 15:26 290816 ----a-w- c:\documents and settings\Caroline\Application Data\SystemRequirementsLab\SRLProxy_nvd_1.dll
2009-05-15 08:30 . 2001-08-17 19:52 18688 -c--a-w- c:\windows\system32\dllcache\cdaudio.sys
2009-05-15 08:30 . 2001-08-17 19:52 18688 ----a-w- c:\windows\system32\drivers\cdaudio.sys
2009-05-12 15:34 . 2009-05-12 15:34 -------- d--h--r- C:\MSOCache
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-07 12:05 . 2008-06-23 21:55 -------- d-----w- c:\program files\Fichiers communs\Softwin
2009-06-07 12:05 . 2008-06-23 21:56 -------- d-----w- c:\documents and settings\All Users\Application Data\BitDefender
2009-06-07 12:04 . 2008-06-23 21:58 81984 ----a-w- c:\windows\system32\bdod.bin
2009-06-06 21:12 . 2009-04-22 10:13 -------- d-----w- c:\documents and settings\Caroline\Application Data\HPAppData
2009-06-06 20:26 . 2009-03-07 18:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-06-04 16:27 . 2008-12-17 13:21 1 ----a-w- c:\documents and settings\Caroline\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-06-03 20:18 . 2009-04-22 17:57 -------- d-----w- c:\program files\Trend Micro
2009-06-02 19:44 . 2008-06-23 23:00 -------- d-----w- c:\program files\eMule
2009-06-02 18:20 . 2008-06-23 22:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-05-19 17:57 . 2001-08-28 12:00 70262 ----a-w- c:\windows\system32\perfc00C.dat
2009-05-19 17:57 . 2001-08-28 12:00 424888 ----a-w- c:\windows\system32\perfh00C.dat
2009-05-18 14:44 . 2008-12-17 13:12 -------- d-----w- c:\program files\Java
2009-05-03 18:08 . 2009-05-03 18:07 -------- d-----w- c:\program files\Microsoft LifeCam
2009-04-22 15:55 . 2008-07-07 15:31 17864 ----a-w- c:\documents and settings\Caroline\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-22 15:55 . 2009-04-22 15:55 -------- d-----w- c:\program files\Microsoft
2009-04-22 15:55 . 2009-04-22 15:54 -------- d-----w- c:\program files\Windows Live
2009-04-22 15:54 . 2009-04-22 15:54 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-04-22 15:49 . 2009-04-22 15:49 -------- d-----w- c:\program files\Fichiers communs\Windows Live
2009-04-22 13:38 . 2001-08-28 12:00 512000 ----a-w- c:\windows\system32\winlogon.exe
2009-04-22 12:19 . 2008-06-23 21:28 87263 ----a-w- c:\windows\PCHEALTH\HELPCTR\OfflineCache\index.dat
2009-04-22 09:14 . 2009-04-22 08:45 177917 ----a-w- c:\windows\hpoins27.dat
2009-04-22 08:48 . 2009-04-22 08:48 -------- d-----w- c:\documents and settings\All Users\Application Data\HP Product Assistant
2009-04-22 08:48 . 2009-04-21 11:02 -------- d-----w- c:\documents and settings\All Users\Application Data\HP
2009-04-22 08:48 . 2009-04-21 11:00 -------- d-----w- c:\program files\HP
2009-04-22 08:37 . 2009-04-22 08:37 -------- d-----w- c:\program files\MSXML 4.0
2009-04-22 07:33 . 2009-04-21 14:03 -------- d-----w- c:\program files\ma-config.com
2009-04-22 07:33 . 2009-04-21 14:03 -------- d-----w- c:\documents and settings\All Users\Application Data\ma-config.com
2009-04-21 17:05 . 2009-04-21 14:19 1536 ----a-w- c:\windows\system32\TrueSoft.dat
2009-04-21 17:01 . 2008-06-23 21:26 25776 -c--a-w- c:\windows\system32\emptyregdb.dat
2009-04-21 14:46 . 2009-04-21 14:46 -------- d-----w- c:\program files\Hewlett-Packard
2009-04-21 14:45 . 2009-04-21 14:45 -------- d-----w- c:\program files\Fichiers communs\HP
2009-04-21 14:11 . 2008-07-05 12:54 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-04-21 12:04 . 2009-04-21 12:04 -------- d-----w- c:\documents and settings\All Users\Application Data\HPSSUPPLY
2009-04-21 11:23 . 2009-04-21 11:23 -------- d-----w- c:\documents and settings\Caroline\Application Data\HP
2009-04-21 11:21 . 2009-04-21 11:21 -------- d-----w- c:\documents and settings\All Users\Application Data\WEBREG
2009-04-21 11:01 . 2009-04-21 11:01 -------- d-----w- c:\program files\Fichiers communs\Hewlett-Packard
2009-04-21 10:58 . 2009-04-21 10:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Hewlett-Packard
2009-03-15 07:37 . 2009-04-21 14:03 429224 ----a-w- c:\documents and settings\Caroline\Application Data\Mozilla\Firefox\Profiles\iq28b1t3.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\plugins\nphardwaredetection.dll
.
------- Sigcheck -------
[-] 2009-04-22 09:10 506368 86DB0FDAF2591C86389D36CF44658CFE c:\windows\$NtServicePackUninstall$\winlogon.exe
[7] 2008-04-14 02:34 512000 DD73D6B9F6B4CB630CF35B438B540174 c:\windows\ServicePackFiles\i386\winlogon.exe
[-] 2004-08-19 23:10 506368 123EEA158F74D0F67A51DCDF065D1091 c:\windows\SoftwareDistribution\Download\70ccc3de7e94865059fbcf2f809c03b1\winlogon.exe
[-] 2009-04-22 13:38 512000 8D71F28DEB37CC9C2E344095D8BFE1EE c:\windows\system32\winlogon.exe
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Motive SmartBridge"="c:\progra~1\NUMERI~1\MONASS~1\SMARTB~1\MotiveSB.exe" [2004-10-22 393216]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-14 49152]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896]
"VX3000"="c:\windows\vVX3000.exe" [2007-04-10 709992]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2007-05-17 279912]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"PCTVOICE"="pctspk.exe" - c:\windows\system32\pctspk.exe [2001-08-23 86016]
"PV92TRAY"="PV92Tray.exe" - c:\windows\system32\PV92Tray.exe [2003-10-30 323584]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-10-22 1622016]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [15/05/2009 18:03 604416]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contenu du dossier 'Tâches planifiées'
2009-06-07 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-07 08:53]
2009-06-07 c:\windows\Tasks\Maintenance en 1 clic.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-04-27 13:42]
.
- - - - ORPHELINS SUPPRIMES - - - -
SafeBoot-procexp90.Sys
.
------- Examen supplémentaire -------
.
mWindow Title =
uInternet Settings,ProxyOverride = 127.0.0.1;*.local
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Caroline\Application Data\Mozilla\Firefox\Profiles\iq28b1t3.default\
FF - plugin: c:\documents and settings\Caroline\Application Data\Mozilla\Firefox\Profiles\iq28b1t3.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\plugins\nphardwaredetection.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
---- PARAMETRES FIREFOX ----
FF - user.js: network.http.max-connections-per-server - 6
FF - user.js: network.http.max-persistent-connections-per-server - 3
FF - user.js: content.max.tokenizing.time - 1500000
FF - user.js: content.notify.interval - 750000
FF - user.js: nglayout.initialpaint.delay - 100
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-07 14:17
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'explorer.exe'(1984)
c:\progra~1\NUMERI~1\MONASS~1\SMARTB~1\SBHook.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Microsoft LifeCam\MSCamS32.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\tcpsvcs.exe
c:\windows\system32\snmp.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
c:\program files\HP\Digital Imaging\bin\hpqste08.exe
c:\program files\HP\Digital Imaging\bin\hpqbam08.exe
c:\program files\HP\Digital Imaging\bin\hpqgpc01.exe
.
**************************************************************************
.
Heure de fin: 2009-06-07 14:24 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-06-07 12:24
Avant-CF: 33 399 681 024 octets libres
Après-CF: 33 610 301 440 octets libres
WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect
230 --- E O F --- 2009-05-16 09:10
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:52:31, on 07/06/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\PROGRA~1\NUMERI~1\MONASS~1\SMARTB~1\MotiveSB.exe
C:\WINDOWS\system32\PV92Tray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\vVX3000.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Documents and Settings\Caroline\Bureau\HiJackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\NUMERI~1\MONASS~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [PV92TRAY] PV92Tray.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: Sélection intelligente HP - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe
Scan saved at 16:52:31, on 07/06/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\PROGRA~1\NUMERI~1\MONASS~1\SMARTB~1\MotiveSB.exe
C:\WINDOWS\system32\PV92Tray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\vVX3000.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Documents and Settings\Caroline\Bureau\HiJackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\NUMERI~1\MONASS~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [PV92TRAY] PV92Tray.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: Sélection intelligente HP - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
· Télécharge ToolsCleaner de A.Roshtein& dj QUIOU sur ton Bureau.(sur un des 2 liens)
http://pc-system.fr/
http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner
· Clique sur Recherche et laisse le scan se terminer.
· Clique, sur Suppression pour finaliser.
· Tu peux, si tu le souhaites, te servir des Options facultatives.
· Clique sur Quitter, pour que le rapport puisse se créer.
· Poste moi le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur( C:\).
[ Rapport ToolsCleaner version 2.3.5 (par A.Rothstein & dj QUIOU) ]
--> Recherche:
C:\Combofix.txt: trouvé !
C:\Qoobox: trouvé !
C:\Documents and Settings\Caroline\Bureau\ComboFix.exe: trouvé !
C:\Documents and Settings\Caroline\Bureau\HijackThis.exe: trouvé !
C:\Documents and Settings\Caroline\Bureau\hijackthis.log: trouvé !
C:\Documents and Settings\Caroline\Recent\HijackThis.lnk: trouvé !
---------------------------------
--> Suppression:
C:\Documents and Settings\Caroline\Bureau\ComboFix.exe: ERREUR DE SUPPRESSION !!
C:\Documents and Settings\Caroline\Bureau\HijackThis.exe: supprimé !
C:\Documents and Settings\Caroline\Recent\HijackThis.lnk: supprimé !
C:\Combofix.txt: supprimé !
C:\Documents and Settings\Caroline\Bureau\hijackthis.log: supprimé !
C:\Qoobox: supprimé !
--> Recherche:
C:\Combofix.txt: trouvé !
C:\Qoobox: trouvé !
C:\Documents and Settings\Caroline\Bureau\ComboFix.exe: trouvé !
C:\Documents and Settings\Caroline\Bureau\HijackThis.exe: trouvé !
C:\Documents and Settings\Caroline\Bureau\hijackthis.log: trouvé !
C:\Documents and Settings\Caroline\Recent\HijackThis.lnk: trouvé !
---------------------------------
--> Suppression:
C:\Documents and Settings\Caroline\Bureau\ComboFix.exe: ERREUR DE SUPPRESSION !!
C:\Documents and Settings\Caroline\Bureau\HijackThis.exe: supprimé !
C:\Documents and Settings\Caroline\Recent\HijackThis.lnk: supprimé !
C:\Combofix.txt: supprimé !
C:\Documents and Settings\Caroline\Bureau\hijackthis.log: supprimé !
C:\Qoobox: supprimé !
Re
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) ► faudrait le mettre à jour ;))
Ton PC est ouvert aux failles de sécurité ;)
Passe un coup de MBAM
Ensuite
4/ Lance HijackThis
puis --> Do a system scan only
coche les lignes indiquées ci-dessous
puis --> Fix checked
puis oui à la question de confirmation
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\NUMERI~1\MONASS~1\SMARTB~1\MotiveSB.exe => Motive®SmartBridge
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe => HP®SoftwareUpdate
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install => NVidia®nView
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background => Microsoft®Network Messenger
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/default.aspx
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/default.aspx
O23 - Service: Service Bonjour (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe => Apple Computer®Bonjour for Windows
C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSRespond
démarrer------------exécuter--------------tu tapes : services.msc
N'oublie pas d'installer un pare-feu
+++
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) ► faudrait le mettre à jour ;))
Ton PC est ouvert aux failles de sécurité ;)
Passe un coup de MBAM
Ensuite
4/ Lance HijackThis
puis --> Do a system scan only
coche les lignes indiquées ci-dessous
puis --> Fix checked
puis oui à la question de confirmation
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\NUMERI~1\MONASS~1\SMARTB~1\MotiveSB.exe => Motive®SmartBridge
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe => HP®SoftwareUpdate
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install => NVidia®nView
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background => Microsoft®Network Messenger
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/default.aspx
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/default.aspx
O23 - Service: Service Bonjour (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe => Apple Computer®Bonjour for Windows
C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSRespond
démarrer------------exécuter--------------tu tapes : services.msc
N'oublie pas d'installer un pare-feu
+++
"C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSRespond
démarrer------------exécuter--------------tu tapes : services.msc "
=> Je fais quoi avec ça ?
"Ton PC est ouvert aux failles de sécurité ;) "
=> Comment le fermé ? lol
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSRespond
démarrer------------exécuter--------------tu tapes : services.msc "
=> Je fais quoi avec ça ?
"Ton PC est ouvert aux failles de sécurité ;) "
=> Comment le fermé ? lol