Spy ware your computer is infected

robert -  
 robert -
Bonjour,

suite à "spyware", j'ai installé Zone Alarm, et j'avais avant Avast.
Sur le forum, il est proposé de nettoter avec Smitfraudfix.

Voici le rapport : Qu'en pensez-vous.

Par avance merci pour votre aide.

SmitFraudFix v2.320

Rapport fait à 0:11:39,39, 21/05/2009
Executé à partir de C:\Documents and Settings\HP_Propri‚taire\Mes documents\Thierry ROUGIER\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\CyberLink\PowerCinema\PCMService.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\frmwrk32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AskBarDis\bar\bin\AskService.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\AntivirusXP\AntivirusXP.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Controle Parental\bin\optproxy.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
c:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\HP_Propri‚taire

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\HP_Propri‚taire\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\HP_PRO~1\Favoris

»»»»»»»»»»»»»»»»»»»»»»»» Bureau

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="file:///C:/DOCUME~1/HP_PRO~1/LOCALS~1/Temp/msohtml1/01/clip_image002.jpg"
"SubscribedURL"="file:///C:/DOCUME~1/HP_PRO~1/LOCALS~1/Temp/msohtml1/01/clip_image002.jpg"
"FriendlyName"=""

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
"LoadAppInit_DLLs"=dword:00000001

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="userinit.exe"
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Rustock

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Realtek RTL8139/810x Family Fast Ethernet NIC - Miniport d'ordonnancement de paquets
DNS Server Search Order: 15.243.128.51
DNS Server Search Order: 15.243.160.51

Votre ordinateur est certainement victime d'un détournement de DNS: 85.255.x.x détecté !

Description: Realtek RTL8139/810x Family Fast Ethernet NIC - Miniport d'ordonnancement de paquets
DNS Server Search Order: 85.255.116.98
DNS Server Search Order: 85.255.112.123

HKLM\SYSTEM\CCS\Services\Tcpip\..\{C67A21EA-7089-411D-8E13-025EC593FAAB}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{C67A21EA-7089-411D-8E13-025EC593FAAB}: NameServer=85.255.116.98,85.255.112.123
HKLM\SYSTEM\CCS\Services\Tcpip\..\{DE246E2C-8697-44FE-A5BB-FA04D12D4DEC}: DhcpNameServer=15.243.128.51 15.243.160.51
HKLM\SYSTEM\CS1\Services\Tcpip\..\{C67A21EA-7089-411D-8E13-025EC593FAAB}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{C67A21EA-7089-411D-8E13-025EC593FAAB}: NameServer=85.255.116.98,85.255.112.123
HKLM\SYSTEM\CS1\Services\Tcpip\..\{DE246E2C-8697-44FE-A5BB-FA04D12D4DEC}: DhcpNameServer=15.243.128.51 15.243.160.51
HKLM\SYSTEM\CS2\Services\Tcpip\..\{C67A21EA-7089-411D-8E13-025EC593FAAB}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{C67A21EA-7089-411D-8E13-025EC593FAAB}: NameServer=85.255.116.98,85.255.112.123
HKLM\SYSTEM\CS2\Services\Tcpip\..\{DE246E2C-8697-44FE-A5BB-FA04D12D4DEC}: DhcpNameServer=15.243.128.51 15.243.160.51
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: NameServer=85.255.116.98,85.255.112.123
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: NameServer=85.255.116.98,85.255.112.123
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: NameServer=85.255.116.98,85.255.112.123

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin
Configuration: Windows XP Internet Explorer 7.0

3 réponses

  1.
    Destrio5 Messages postés 99820 Date d'inscription   Statut Modérateur Dernière intervention   10 324
     
    Bonjour,

    /!\ Désactive tes protections résidentes (Antivirus, etc...) /!\

    --> Télécharge ComboFix (de sUBs) sur ton Bureau.
    --> Double-clique sur ComboFix.exe (le .exe n'est pas forcément visible) afin de le lancer.
    --> Il va te demander d'installer la console de récupération : accepte.
    --> Lorsque la recherche sera terminée, un rapport apparaîtra. Poste ce rapport (C:\Combofix.txt) dans ta prochaine réponse.

    Pour t'aider : Un guide et un tutoriel sur l'utilisation de ComboFix
    0
    1. robert
       
      Comment désactive-t-on les protections résidentes.
      J'ai :
      - la ou les protections "d'origine" de l'ordinateur
      - avast
      - zone alarme.

      Depuis ce matin, il apparait sur avast "cheval de troie", et le rapport de
      Smitfraudfix indiquait : "Votre ordinateur est certainement victime d'un détournement de DNS: 85.255.x.x détecté !" . Avast ne peut le déplacer car il est occupé par un autre processeur.
      Que dois-je faire ?

      merci pour votre aide.
      0
  2. Destrio5 Messages postés 99820 Date d'inscription   Statut Modérateur Dernière intervention   10 324
     
    Fais quand même ComboFix.
    0
  3. robert
     
    Après lancement de ComboFix, le fonctionnement est correct, apparement !
    Pouvez-vous me confirmer avec le rapport (désolé, il est un peu long) ?

    Encore merci !!!!

    ComboFix 09-05-20.A0 - HP_Propriétaire 21/05/2009 12:55.1 - NTFSx86
    Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.959.107 [GMT 2:00]
    Lancé depuis: c:\docume~1\HP_PRO~1\MESDOC~1\THIERR~1\combofix.exe
    AV: avast! antivirus 4.8.1335 [VPS 090520-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
    AV: ZoneAlarm Security Suite Antivirus *On-access scanning disabled* (Outdated) {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF}
    FW: ZoneAlarm Security Suite Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
    .

    (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\autorun.inf
    c:\documents and settings\All Users\Application Data\Starware370
    c:\documents and settings\All Users\Application Data\Starware370\buttons\563_button_1b_def.bmp
    c:\documents and settings\All Users\Application Data\Starware370\buttons\563_button_1b_over.bmp
    c:\documents and settings\All Users\Application Data\Starware370\buttons\572_button_1b_def.bmp
    c:\documents and settings\All Users\Application Data\Starware370\buttons\572_button_1b_over.bmp
    c:\documents and settings\All Users\Application Data\Starware370\buttons\573_button_1b_def.bmp
    c:\documents and settings\All Users\Application Data\Starware370\buttons\573_button_1b_over.bmp
    c:\documents and settings\All Users\Application Data\Starware370\buttons\Button_60.bmp
    c:\documents and settings\All Users\Application Data\Starware370\buttons\Button_60.bmp_new
    c:\documents and settings\All Users\Application Data\Starware370\buttons\Button_70.bmp
    c:\documents and settings\All Users\Application Data\Starware370\buttons\Button_70.bmp_new
    c:\documents and settings\All Users\Application Data\Starware370\buttons\Button_80.bmp
    c:\documents and settings\All Users\Application Data\Starware370\buttons\Button_80.bmp_new
    c:\documents and settings\All Users\Application Data\Starware370\buttons\FindIt.bmp
    c:\documents and settings\All Users\Application Data\Starware370\buttons\FindItHot.bmp
    c:\documents and settings\All Users\Application Data\Starware370\buttons\findithotxp.png
    c:\documents and settings\All Users\Application Data\Starware370\buttons\finditxp.png
    c:\documents and settings\All Users\Application Data\Starware370\buttons\logo.bmp
    c:\documents and settings\All Users\Application Data\Starware370\buttons\logoxp.bmp
    c:\documents and settings\All Users\Application Data\Starware370\contexts\error.xml
    c:\documents and settings\All Users\Application Data\Starware370\contexts\Related.xml
    c:\documents and settings\All Users\Application Data\Starware370\contexts\Travel.xml
    c:\documents and settings\All Users\Application Data\Starware370\SimpleUpdate\ProductMessagingConfig.xml
    c:\documents and settings\All Users\Application Data\Starware370\SimpleUpdate\ProductMessagingConfig.xml.backup
    c:\documents and settings\All Users\Application Data\Starware370\SimpleUpdate\SimpleUpdateConfig.xml
    c:\documents and settings\All Users\Application Data\Starware370\SimpleUpdate\SimpleUpdateConfig.xml.backup
    c:\documents and settings\All Users\Application Data\Starware370\SimpleUpdate\TimerManagerConfig.xml
    c:\documents and settings\All Users\Application Data\Starware370\SimpleUpdate\TimerManagerConfig.xml.backup
    c:\documents and settings\LocalService\Application Data\Starware370
    c:\documents and settings\LocalService\Application Data\Starware370\BrowserSearch\BrowserSearch.xml
    c:\documents and settings\LocalService\Application Data\Starware370\BrowserSearch\BrowserSearch.xml.backup
    c:\documents and settings\LocalService\Application Data\Starware370\Button_6\Button_6Options.xml
    c:\documents and settings\LocalService\Application Data\Starware370\Button_6\Button_6Options.xml.backup
    c:\documents and settings\LocalService\Application Data\Starware370\Button_7\Button_7Options.xml
    c:\documents and settings\LocalService\Application Data\Starware370\Button_7\Button_7Options.xml.backup
    c:\documents and settings\LocalService\Application Data\Starware370\Button_8\Button_8Options.xml
    c:\documents and settings\LocalService\Application Data\Starware370\Button_8\Button_8Options.xml.backup
    c:\documents and settings\LocalService\Application Data\Starware370\Configurator\Configurator.xml
    c:\documents and settings\LocalService\Application Data\Starware370\Configurator\Configurator.xml.backup
    c:\documents and settings\LocalService\Application Data\Starware370\ErrorSearch\ErrorSearchOptions.xml
    c:\documents and settings\LocalService\Application Data\Starware370\ErrorSearch\ErrorSearchOptions.xml.backup
    c:\documents and settings\LocalService\Application Data\Starware370\Paroles\ParolesOptions.xml
    c:\documents and settings\LocalService\Application Data\Starware370\Paroles\ParolesOptions.xml.backup
    c:\documents and settings\LocalService\Application Data\Starware370\Radio_FR\Radio_FROptions.xml
    c:\documents and settings\LocalService\Application Data\Starware370\Radio_FR\Radio_FROptions.xml.backup
    c:\documents and settings\LocalService\Application Data\Starware370\Recherche_de_musique\Recherche_de_musiqueOptions.xml
    c:\documents and settings\LocalService\Application Data\Starware370\Recherche_de_musique\Recherche_de_musiqueOptions.xml.backup
    c:\documents and settings\LocalService\Application Data\Starware370\RelatedSearch\RelatedSearchOptions.xml
    c:\documents and settings\LocalService\Application Data\Starware370\RelatedSearch\RelatedSearchOptions.xml.backup
    c:\documents and settings\LocalService\Application Data\Starware370\Telechargement\TelechargementOptions.xml
    c:\documents and settings\LocalService\Application Data\Starware370\Telechargement\TelechargementOptions.xml.backup
    c:\documents and settings\LocalService\Application Data\Starware370\ToolbarLogo\ToolbarLogoOptions.xml
    c:\documents and settings\LocalService\Application Data\Starware370\ToolbarLogo\ToolbarLogoOptions.xml.backup
    c:\documents and settings\LocalService\Application Data\Starware370\ToolbarSearch\ToolbarSearchOptions.xml
    c:\documents and settings\LocalService\Application Data\Starware370\ToolbarSearch\ToolbarSearchOptions.xml.backup
    c:\documents and settings\LocalService\Application Data\Starware370\TravelSearch\TravelSearchOptions.xml
    c:\documents and settings\LocalService\Application Data\Starware370\TravelSearch\TravelSearchOptions.xml.backup
    c:\documents and settings\LocalService\protect.dll
    c:\documents and settings\NetworkService\protect.dll
    c:\program files\AntivirusXP
    c:\program files\AntivirusXP\AntivirusXP.exe
    c:\program files\FunWebProducts
    c:\program files\FunWebProducts\Installr\1.bin\F3EZSETP.DLL
    c:\program files\GamesBar\oberontb.dll
    c:\program files\Starware370
    c:\program files\Starware370\icons\star_16.ico
    c:\program files\Starware370\Starware370Config.xml
    c:\program files\Starware370\Starware370Uninstall.exe
    C:\resycled
    c:\windows\pack.epk
    c:\windows\system32\404Fix.exe
    c:\windows\system32\ahtn.htm
    c:\windows\system32\autochk.dll
    c:\windows\system32\config\systemprofile\Application Data\Starware370
    c:\windows\system32\config\systemprofile\Application Data\Starware370\BrowserSearch\BrowserSearch.xml
    c:\windows\system32\config\systemprofile\Application Data\Starware370\BrowserSearch\BrowserSearch.xml.backup
    c:\windows\system32\config\systemprofile\Application Data\Starware370\Button_6\Button_6Options.xml
    c:\windows\system32\config\systemprofile\Application Data\Starware370\Button_6\Button_6Options.xml.backup
    c:\windows\system32\config\systemprofile\Application Data\Starware370\Button_7\Button_7Options.xml
    c:\windows\system32\config\systemprofile\Application Data\Starware370\Button_7\Button_7Options.xml.backup
    c:\windows\system32\config\systemprofile\Application Data\Starware370\Button_8\Button_8Options.xml
    c:\windows\system32\config\systemprofile\Application Data\Starware370\Button_8\Button_8Options.xml.backup
    c:\windows\system32\config\systemprofile\Application Data\Starware370\Configurator\Configurator.xml
    c:\windows\system32\config\systemprofile\Application Data\Starware370\Configurator\Configurator.xml.backup
    c:\windows\system32\config\systemprofile\Application Data\Starware370\ErrorSearch\ErrorSearchOptions.xml
    c:\windows\system32\config\systemprofile\Application Data\Starware370\ErrorSearch\ErrorSearchOptions.xml.backup
    c:\windows\system32\config\systemprofile\Application Data\Starware370\Layouts\ToolbarLayout.xml
    c:\windows\system32\config\systemprofile\Application Data\Starware370\Layouts\ToolbarLayout.xml.backup
    c:\windows\system32\config\systemprofile\Application Data\Starware370\Manager\ManagerOptions.xml
    c:\windows\system32\config\systemprofile\Application Data\Starware370\Manager\ManagerOptions.xml.backup
    c:\windows\system32\config\systemprofile\Application Data\Starware370\Paroles\ParolesOptions.xml
    c:\windows\system32\config\systemprofile\Application Data\Starware370\Paroles\ParolesOptions.xml.backup
    c:\windows\system32\config\systemprofile\Application Data\Starware370\Radio_FR\Radio_FROptions.xml
    c:\windows\system32\config\systemprofile\Application Data\Starware370\Radio_FR\Radio_FROptions.xml.backup
    c:\windows\system32\config\systemprofile\Application Data\Starware370\Recherche_de_musique\Recherche_de_musiqueOptions.xml
    c:\windows\system32\config\systemprofile\Application Data\Starware370\Recherche_de_musique\Recherche_de_musiqueOptions.xml.backup
    c:\windows\system32\config\systemprofile\Application Data\Starware370\RelatedSearch\RelatedSearchOptions.xml
    c:\windows\system32\config\systemprofile\Application Data\Starware370\RelatedSearch\RelatedSearchOptions.xml.backup
    c:\windows\system32\config\systemprofile\Application Data\Starware370\Telechargement\TelechargementOptions.xml
    c:\windows\system32\config\systemprofile\Application Data\Starware370\Telechargement\TelechargementOptions.xml.backup
    c:\windows\system32\config\systemprofile\Application Data\Starware370\Toolbar\TBProductsOptions.xml
    c:\windows\system32\config\systemprofile\Application Data\Starware370\Toolbar\TBProductsOptions.xml.backup
    c:\windows\system32\config\systemprofile\Application Data\Starware370\ToolbarLogo\ToolbarLogoOptions.xml
    c:\windows\system32\config\systemprofile\Application Data\Starware370\ToolbarLogo\ToolbarLogoOptions.xml.backup
    c:\windows\system32\config\systemprofile\Application Data\Starware370\ToolbarSearch\ToolbarSearchOptions.xml
    c:\windows\system32\config\systemprofile\Application Data\Starware370\ToolbarSearch\ToolbarSearchOptions.xml.backup
    c:\windows\system32\config\systemprofile\Application Data\Starware370\TravelSearch\TravelSearchOptions.xml
    c:\windows\system32\config\systemprofile\Application Data\Starware370\TravelSearch\TravelSearchOptions.xml.backup
    c:\windows\system32\config\systemprofile\protect.dll
    c:\windows\system32\dumphive.exe
    c:\windows\system32\frmwrk32.exe
    c:\windows\system32\IEDFix.exe
    c:\windows\system32\loader49.exe
    c:\windows\system32\oporolor.ini
    c:\windows\system32\ovfsthgwpvjvdafsjaqdlgwfmclrnedmjtfdue.dat
    c:\windows\system32\oyilehel.ini
    c:\windows\system32\prnet.tmp
    c:\windows\system32\Process.exe
    c:\windows\system32\SrchSTS.exe
    c:\windows\system32\tmp.reg
    c:\windows\system32\uniq.tll
    c:\windows\system32\VACFix.exe
    c:\windows\system32\VCCLSID.exe
    c:\windows\system32\warning.gif
    c:\windows\system32\win32hlp.cnf
    c:\windows\system32\WS2Fix.exe
    D:\Autorun.inf
    D:\Desktop.ini
    D:\resycled

    .
    ((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_OVFSTHUTIWABLOQPYBKOFKLGSFWDBTJHWITHTR
    -------\Service_msqpdxserv.sys
    -------\Service_ovfsthutiwabloqpybkofklgsfwdbtjhwithtr

    ((((((((((((((((((((((((((((( Fichiers créés du 2009-04-21 au 2009-05-21 ))))))))))))))))))))))))))))))))))))
    .

    2009-05-20 21:33 . 2006-06-05 19:32 135 ----a-w c:\documents and settings\Administrateur\Local Settings\Application Data\fusioncache.dat
    2009-05-20 18:08 . 2009-05-20 18:08 -------- d-----w c:\program files\SonicWallES
    2009-05-20 17:45 . 2009-05-21 11:10 18885920 --sha-w c:\windows\system32\drivers\fidbox.dat
    2009-05-20 17:42 . 2009-05-20 17:42 -------- d-----w c:\program files\AskBarDis
    2009-05-20 17:41 . 2009-05-20 18:07 4212 ---ha-w c:\windows\system32\zllictbl.dat
    2009-05-20 17:41 . 2009-02-15 22:10 72584 ----a-w c:\windows\zllsputility.exe
    2009-05-20 17:40 . 2009-02-15 22:10 1221512 ----a-w c:\windows\system32\zpeng25.dll
    2009-05-20 17:40 . 2009-05-20 17:41 -------- d-----w c:\windows\system32\ZoneLabs
    2009-05-20 17:40 . 2009-05-20 17:40 -------- d-----w c:\program files\Zone Labs
    2009-05-20 17:39 . 2009-05-21 11:07 -------- d-----w c:\windows\Internet Logs
    2009-05-19 15:50 . 2008-04-14 02:34 26624 ----a-w c:\windows\system32\dllcache\userinit.exe
    2009-04-25 07:11 . 2009-04-25 07:11 -------- d-----w c:\program files\vanBasco's Karaoke Player

    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-05-21 11:09 . 2007-03-02 17:25 -------- d-----w c:\program files\Wanadoo
    2009-05-21 11:06 . 2009-05-20 17:45 253028 --sha-w c:\windows\system32\drivers\fidbox.idx
    2009-05-21 11:05 . 2009-05-21 11:07 1387520 ----a-w c:\windows\Internet Logs\xDB4.tmp
    2009-05-21 10:56 . 2008-06-03 17:41 -------- d-----w c:\program files\GamesBar
    2009-05-21 08:54 . 2008-11-23 12:44 664 ----a-w c:\windows\system32\d3d9caps.dat
    2009-05-20 19:06 . 2009-05-20 19:15 1499136 ----a-w c:\windows\Internet Logs\xDB3.tmp
    2009-05-20 19:06 . 2009-05-20 19:15 662528 ----a-w c:\windows\Internet Logs\xDB2.tmp
    2009-05-20 18:03 . 2009-05-20 18:05 1457152 ----a-w c:\windows\Internet Logs\xDB1.tmp
    2009-05-18 20:37 . 2007-03-24 13:18 -------- d-----w c:\program files\QuickTime
    2009-04-01 12:14 . 2009-04-01 12:14 -------- d-----w c:\program files\Fichiers communs\Wise Installation Wizard
    2009-03-29 06:45 . 2004-11-23 07:26 65362 ----a-w c:\windows\system32\perfc00C.dat
    2009-03-29 06:45 . 2004-11-23 07:26 449322 ----a-w c:\windows\system32\perfh00C.dat
    2009-03-28 11:50 . 2009-01-28 14:48 -------- d-----w c:\program files\Oberon Media
    2008-05-25 12:56 . 2008-05-25 12:38 134247527 ----a-w c:\program files\OOo_2.4.0_Win32Intel_install_wJRE_fr.exe
    .

    ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
    REGEDIT4

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
    2008-10-16 16:22 333192 ----a-w c:\program files\AskBarDis\bar\bin\askBar.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-21 68856]
    "WOOKIT"="c:\program files\Wanadoo\Shell.exe" [2004-08-23 122880]
    "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
    "MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "HPHUPD08"="c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-01 49152]
    "PCMService"="c:\program files\CyberLink\PowerCinema\PCMService.exe" [2006-02-24 147456]
    "Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-22 237568]
    "HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-15 249856]
    "HP Software Update"="c:\program files\HP\HP Software Update\HPwuSchd2.exe" [2006-02-19 49152]
    "TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2006-06-05 180269]
    "WOOWATCH"="c:\progra~1\Wanadoo\Watch.exe" [2004-08-23 20480]
    "WOOTASKBARICON"="c:\progra~1\Wanadoo\GestMaj.exe" [2004-10-14 32768]
    "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 132496]
    "Symantec PIF AlertEng"="c:\program files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
    "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
    "ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-02-15 981384]
    "MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2008-04-14 172544]
    "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2006-03-08 16010240]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-21 68856]

    c:\documents and settings\HP_Propri‚taire\Menu D‚marrer\Programmes\D‚marrage\
    ChkDisk.dll [2009-5-18 23552]
    ChkDisk.lnk - c:\windows\system32\rundll32.exe [2004-8-5 33792]

    c:\documents and settings\Administrateur\Menu D‚marrer\Programmes\D‚marrage\
    Pin.lnk - c:\hp\bin\CLOAKER.EXE [2006-6-5 27136]

    c:\documents and settings\HP_Propri‚taire\Menu D‚marrer\Programmes\D‚marrage\
    ChkDisk.dll [2009-5-18 23552]
    ChkDisk.lnk - c:\windows\system32\rundll32.exe [2004-8-5 33792]

    c:\documents and settings\HP_Propri‚taire\Menu D‚marrer\Programmes\D‚marrage\
    ChkDisk.dll [2009-5-18 23552]
    ChkDisk.lnk - c:\windows\system32\rundll32.exe [2004-8-5 33792]

    c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
    HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]

    [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
    "NoSetActiveDesktop"= 1 (0x1)
    "NoActiveDesktopChanges"= 1 (0x1)

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusDisableNotify"=dword:00000001
    "UpdatesDisableNotify"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\CyberLink\\PowerCinema\\PowerCinema.exe"=
    "c:\\Program Files\\CyberLink\\PowerCinema\\PCMService.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
    "c:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
    "c:\\Program Files\\IncrediMail\\bin\\ImLc.exe"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "c:\\WINDOWS\\system32\\HPZipm12.exe"=

    R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [23/01/2009 21:32 114768]
    R2 ASKService;ASKService;c:\program files\AskBarDis\bar\bin\AskService.exe [20/05/2009 19:42 464264]
    R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [23/01/2009 21:32 20560]
    R2 OPTENET_FILTER;Control Parental;c:\program files\Controle Parental\bin\optproxy.exe [27/02/2007 21:40 564400]
    .
    Contenu du dossier 'Tâches planifiées'

    2009-04-21 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 12:57]

    2009-05-21 c:\windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job
    - c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 10:20]
    .
    - - - - ORPHELINS SUPPRIMES - - - -

    HKCU-Run-prnet - c:\windows\system32\prnet.tmp
    HKCU-Run-AntivirusXP.exe - c:\program files\AntivirusXP\AntivirusXP.exe
    HKLM-Run-prnet - c:\windows\system32\prnet.tmp
    HKLM-Run-7e321721 - c:\windows\system32\roloropo.dll
    HKLM-Run-PCDrProfiler - (no file)
    HKU-Default-Run-autochk - c:\windows\system32\config\SYSTEM~1\protect.dll
    Notify-WgaLogon - (no file)

    .
    ------- Examen supplémentaire -------
    .
    uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=63&bd=PAVILION&pf=desktop
    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=63&bd=PAVILION&pf=desktop
    uInternet Connection Wizard,ShellNext = iexplore
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
    IE: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
    IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    IE: { - c:\program files\Messenger\msmsgs.exe
    IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\HP_Propriétaire\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
    LSP: c:\program files\Controle Parental\bin\lsp.dll
    Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
    DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game04.zylom.com/activex/zylomgamesplayer.cab
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-05-21 13:09
    Windows 5.1.2600 Service Pack 3 NTFS

    Recherche de processus cachés ...

    Recherche d'éléments en démarrage automatique cachés ...

    Recherche de fichiers cachés ...

    Scan terminé avec succès
    Fichiers cachés: 0

    **************************************************************************
    .
    --------------------- CLES DE REGISTRE BLOQUEES ---------------------

    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]
    "C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
    .
    --------------------- DLLs chargées dans les processus actifs ---------------------

    - - - - - - - > 'winlogon.exe'(640)
    c:\windows\system32\Ati2evxx.dll

    - - - - - - - > 'explorer.exe'(3248)
    c:\progra~1\FICHIE~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
    c:\program files\Fichiers communs\Microsoft Shared\Web Components\10\1036\OWCI10.DLL
    c:\progra~1\FICHIE~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
    c:\program files\Fichiers communs\Microsoft Shared\Web Components\11\1036\OWCI11.DLL
    c:\windows\system32\msls31.dll
    c:\windows\system32\eappprxy.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\program files\Controle Parental\bin\lsp.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Autres processus actifs ------------------------
    .
    c:\windows\system32\ati2evxx.exe
    c:\windows\system32\ZoneLabs\vsmon.exe
    c:\windows\system32\ati2evxx.exe
    c:\windows\system32\ZoneLabs\avsys\ScanningProcess.exe
    c:\program files\Alwil Software\Avast4\aswUpdSv.exe
    c:\program files\Alwil Software\Avast4\ashServ.exe
    c:\windows\system32\ZoneLabs\avsys\ScanningProcess.exe
    c:\program files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
    c:\program files\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
    c:\windows\system32\FTRTSVC.exe
    c:\program files\Fichiers communs\LightScribe\LSSrvc.exe
    c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
    c:\program files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
    c:\progra~1\Wanadoo\TaskBarIcon.exe
    c:\progra~1\Wanadoo\GestionnaireInternet.exe
    c:\program files\OpenOffice.org 2.3\program\soffice.exe
    c:\program files\OpenOffice.org 2.3\program\soffice.bin
    c:\progra~1\Wanadoo\ComComp.exe
    c:\progra~1\Wanadoo\Toaster.exe
    c:\progra~1\Wanadoo\Inactivity.exe
    c:\progra~1\Wanadoo\PollingModule.exe
    c:\program files\Alwil Software\Avast4\ashMaiSv.exe
    c:\program files\Alwil Software\Avast4\ashWebSv.exe
    c:\program files\HP\Digital Imaging\bin\hpqste08.exe
    c:\windows\system32\dwwin.exe
    c:\hp\KBD\kbd.exe
    c:\windows\system32\HPZipm12.exe
    .
    **************************************************************************
    .
    Heure de fin: 2009-05-21 13:13 - La machine a redémarré
    ComboFix-quarantined-files.txt 2009-05-21 11:13

    Avant-CF: 132 241 559 552 octets libres
    Après-CF: 132 226 256 896 octets libres

    362 --- E O F --- 2008-12-18 19:51
    0

Discussions similaires

Spam SMS : your messenger vérification code is ***
Metheor -
Radinoz -

1 réponse
Sms étranges "... is your instagram code"
Anon_4067 -
lablg23 -

5 réponses
Page bleue : your PC ran into a problem and needs to restart
pitchalou -
Malekal_morte- -

2 réponses
Rtc battery low
Laeti28 -
Laeti28 -

15 réponses
usb device over current
jean-michel -
Robin -

39 réponses