Virus Trojan:Win32/C2Lop.gen!J
Résolu
prisita
Messages postés
51
Date d'inscription
Statut
Membre
Dernière intervention
-
prisita Messages postés 51 Date d'inscription Statut Membre Dernière intervention -
prisita Messages postés 51 Date d'inscription Statut Membre Dernière intervention -
Bonjour,
J'ai été infecté par ce virus trojan (Trojan:Win32/C2Lop.gen!J )
il a aparement supprimé ou bloqué certains fichiers systeme et je pense qu'il s'est multiplié puisque je l'ai supprimé 5 fois!!
Que faire?
Ps:j'ai fait une analyse et j'ai télécharger un antivirus "Malwarebytes,Antimalware"
J'ai télécharger Hijackthis pour une analyse et voilà le rapport!!
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:15:57, on 21/06/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18248)
Boot mode: Normal
Running processes:
C:\windows\system32\Dwm.exe
C:\windows\Explorer.EXE
C:\windows\system32\taskeng.exe
C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtTry.exe
c:\Program Files\Hewlett-Packard\IAM\Bin\AsGHost.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe
C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\pthosttr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\SiteAdvisor\6173\SiteAdv.exe
C:\Program Files\Hewlett-Packard\File Sanitizer\CoreShredder.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
c:\Program Files\ActivIdentity\ActivClient\acevents.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\VolCtrl.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\windows\System32\wsqmcons.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www8.hp.com/fr/fr/home.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www8.hp.com/fr/fr/home.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www8.hp.com/fr/fr/home.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6173\SiteAdv.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: BHO_Startup - {3134413B-49B4-425C-98A5-893C1F195601} - C:\Program Files\Hewlett-Packard\File Sanitizer\IEBHO.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Credential Manager for HP ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - c:\Program Files\Hewlett-Packard\IAM\Bin\ItIEAddIn.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6173\SiteAdv.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [accrdsub] "c:\Program Files\ActivIdentity\ActivClient\accrdsub.exe"
O4 - HKLM\..\Run: [PTHOSTTR] c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe c:\PROGRA~1\HEWLET~1\IAM\Bin\ASTSVCC.dll,RegisterModule
O4 - HKLM\..\Run: [PDF Complete] C:\Program Files\PDF Complete\pdfsty.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [MVS Splash] C:\Program Files\McAfee\Managed VirusScan\Agent\Splash.exe
O4 - HKLM\..\Run: [McAfee Managed Services Tray] C:\Program Files\McAfee\Managed VirusScan\Agent\StartMyAgtTry.Exe
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6173\SiteAdv.exe
O4 - HKLM\..\Run: [File Sanitizer] C:\Program Files\Hewlett-Packard\File Sanitizer\CoreShredder.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [QlbCtrl.exe] C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
O4 - HKLM\..\Run: [HP Software Update] c:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\soundmax.exe /tray
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [second 32] "C:\ProgramData\Axis Wipe Wipe.m42y2"
O4 - HKCU\..\Run: [Fork live trust pop] "C:\ProgramData\drv lies base.kbverh4"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: Envoyer l'&image au périphérique Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix:
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - AppInit_DLLs: APSHook.dll,C:\windows\System32\dbnmpntw32.dll
O23 - Service: ActivClient Middleware Service (accoca) - ActivIdentity - c:\Program Files\ActivIdentity\ActivClient\accoca.exe
O23 - Service: Andrea ADI Filters Service (AEADIFilters) - Andrea Electronics Corporation - C:\windows\system32\AEADISRV.EXE
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\windows\system32\Ati2evxx.exe
O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
O23 - Service: EngineServer - McAfee, Inc. - C:\PROGRA~1\McAfee\MANAGE~1\VScan\ENGINE~1.EXE
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: HP ProtectTools Service - Hewlett-Packard Development Company, L.P - c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe
O23 - Service: Drive Encryption Service (HpFkCryptService) - SafeBoot International - c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
O23 - Service: File Sanitizer for HP ProtectTools (HPFSService) - Hewlett-Packard - C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: HP Service (hpsrv) - Hewlett-Packard Corporation - C:\windows\system32\Hpservice.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McShield - McAfee, Inc. - C:\PROGRA~1\McAfee\MANAGE~1\VScan\McShield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Virus and Spyware Protection Service (myAgtSvc) - McAfee, Inc. - C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.Exe
O23 - Service: PDF Document Manager (pdfcDispatcher) - PDF Complete Inc - C:\Program Files\PDF Complete\pdfsvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\windows\system32\PnkBstrA.exe
O23 - Service: RoxMediaDB10 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6173\SAService.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
J'ai été infecté par ce virus trojan (Trojan:Win32/C2Lop.gen!J )
il a aparement supprimé ou bloqué certains fichiers systeme et je pense qu'il s'est multiplié puisque je l'ai supprimé 5 fois!!
Que faire?
Ps:j'ai fait une analyse et j'ai télécharger un antivirus "Malwarebytes,Antimalware"
J'ai télécharger Hijackthis pour une analyse et voilà le rapport!!
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:15:57, on 21/06/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18248)
Boot mode: Normal
Running processes:
C:\windows\system32\Dwm.exe
C:\windows\Explorer.EXE
C:\windows\system32\taskeng.exe
C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtTry.exe
c:\Program Files\Hewlett-Packard\IAM\Bin\AsGHost.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe
C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\pthosttr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\SiteAdvisor\6173\SiteAdv.exe
C:\Program Files\Hewlett-Packard\File Sanitizer\CoreShredder.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
c:\Program Files\ActivIdentity\ActivClient\acevents.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\VolCtrl.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\windows\System32\wsqmcons.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www8.hp.com/fr/fr/home.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www8.hp.com/fr/fr/home.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www8.hp.com/fr/fr/home.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6173\SiteAdv.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: BHO_Startup - {3134413B-49B4-425C-98A5-893C1F195601} - C:\Program Files\Hewlett-Packard\File Sanitizer\IEBHO.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Credential Manager for HP ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - c:\Program Files\Hewlett-Packard\IAM\Bin\ItIEAddIn.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6173\SiteAdv.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [accrdsub] "c:\Program Files\ActivIdentity\ActivClient\accrdsub.exe"
O4 - HKLM\..\Run: [PTHOSTTR] c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe c:\PROGRA~1\HEWLET~1\IAM\Bin\ASTSVCC.dll,RegisterModule
O4 - HKLM\..\Run: [PDF Complete] C:\Program Files\PDF Complete\pdfsty.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [MVS Splash] C:\Program Files\McAfee\Managed VirusScan\Agent\Splash.exe
O4 - HKLM\..\Run: [McAfee Managed Services Tray] C:\Program Files\McAfee\Managed VirusScan\Agent\StartMyAgtTry.Exe
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6173\SiteAdv.exe
O4 - HKLM\..\Run: [File Sanitizer] C:\Program Files\Hewlett-Packard\File Sanitizer\CoreShredder.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [QlbCtrl.exe] C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
O4 - HKLM\..\Run: [HP Software Update] c:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\soundmax.exe /tray
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [second 32] "C:\ProgramData\Axis Wipe Wipe.m42y2"
O4 - HKCU\..\Run: [Fork live trust pop] "C:\ProgramData\drv lies base.kbverh4"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: Envoyer l'&image au périphérique Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix:
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - AppInit_DLLs: APSHook.dll,C:\windows\System32\dbnmpntw32.dll
O23 - Service: ActivClient Middleware Service (accoca) - ActivIdentity - c:\Program Files\ActivIdentity\ActivClient\accoca.exe
O23 - Service: Andrea ADI Filters Service (AEADIFilters) - Andrea Electronics Corporation - C:\windows\system32\AEADISRV.EXE
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\windows\system32\Ati2evxx.exe
O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
O23 - Service: EngineServer - McAfee, Inc. - C:\PROGRA~1\McAfee\MANAGE~1\VScan\ENGINE~1.EXE
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: HP ProtectTools Service - Hewlett-Packard Development Company, L.P - c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe
O23 - Service: Drive Encryption Service (HpFkCryptService) - SafeBoot International - c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
O23 - Service: File Sanitizer for HP ProtectTools (HPFSService) - Hewlett-Packard - C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: HP Service (hpsrv) - Hewlett-Packard Corporation - C:\windows\system32\Hpservice.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McShield - McAfee, Inc. - C:\PROGRA~1\McAfee\MANAGE~1\VScan\McShield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Virus and Spyware Protection Service (myAgtSvc) - McAfee, Inc. - C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.Exe
O23 - Service: PDF Document Manager (pdfcDispatcher) - PDF Complete Inc - C:\Program Files\PDF Complete\pdfsvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\windows\system32\PnkBstrA.exe
O23 - Service: RoxMediaDB10 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6173\SAService.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
A voir également:
- Trojan.win32.hosts2.gen
- Virus mcafee - Accueil - Piratage
- Trojan remover - Télécharger - Antivirus & Antimalwares
- Virus facebook demande d'amis - Accueil - Facebook
- Softonic virus ✓ - Forum Virus
- Faux message virus iphone ✓ - Forum Virus
72 réponses
va chercher combofix https://www.bleepingcomputer.com/combofix/how-to-use-combofix
ce programme fait un hijack et detecte seul les problemes
ca evitera de le faire manuellement
ce programme fait un hijack et detecte seul les problemes
ca evitera de le faire manuellement
Je dois faire quoi alors je suis super triste là !! mon pc il est tout neuf c'est un Hp!!! j'ai pas grand chose dessus
je peux peut etre réinstallé windows vista? possible? comment?
je peux peut etre réinstallé windows vista? possible? comment?
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
Tu as vu mon message ?
--> http://www.commentcamarche.net/forum/affich 13008802 virus trojan win32 c2lop gen j#18
--> http://www.commentcamarche.net/forum/affich 13008802 virus trojan win32 c2lop gen j#18
parce que là mon pc depuis le virus il se bloque on peut plus rien faire ou l'écran devient noir!!!
combofix pourrai réparer mon ordi?
combofix pourrai réparer mon ordi?
c bon j'ai fait combofix!! par contre n'arrivant pas à désactivé mc affee j'ai du le désinstallé!!!
voilà le rapport :
ComboFix 09-06-25.01 - Yohann 26/06/2009 21:51.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.33.1036.18.2041.1157 [GMT 2:00]
Lancé depuis: c:\users\Yohann\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\users\Yohann\AppData\Roaming\020000002723b282620C.manifest
c:\users\Yohann\AppData\Roaming\020000002723b282620O.manifest
c:\users\Yohann\AppData\Roaming\020000002723b282620P.manifest
c:\users\Yohann\AppData\Roaming\020000002723b282620S.manifest
c:\windows\system32\LCT16vO.vbs
c:\windows\System32\autochk.exe . . . est infecté!!
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-05-26 au 2009-06-26 ))))))))))))))))))))))))))))))))))))
.
2009-06-26 19:55 . 2009-06-26 19:55 -------- d-----w- c:\users\Yohann\AppData\Local\temp
2009-06-24 01:33 . 2009-06-24 01:33 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-06-23 18:53 . 2009-06-23 18:53 -------- d-----w- C:\_OTM
2009-06-23 18:32 . 2009-06-23 18:32 -------- d-----w- C:\rsit
2009-06-23 17:28 . 2009-06-23 17:44 -------- d-----w- C:\Lop SD
2009-06-22 04:35 . 2009-05-09 05:50 915456 ----a-w- c:\windows\system32\wininet.dll
2009-06-22 04:35 . 2009-05-09 05:34 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-06-21 21:20 . 2009-06-21 21:20 -------- d-----w- c:\users\Yohann\AppData\Roaming\Malwarebytes
2009-06-21 21:20 . 2009-06-17 09:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-21 21:20 . 2009-06-21 21:20 -------- d-----w- c:\programdata\Malwarebytes
2009-06-21 21:20 . 2009-06-21 21:20 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-21 21:20 . 2009-06-17 09:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-21 21:12 . 2009-06-21 21:12 -------- d-----w- c:\program files\Trend Micro
2009-06-21 14:29 . 2009-06-21 14:29 -------- d-----w- c:\programdata\LightScribe
2009-06-21 13:30 . 2009-06-21 13:30 393216 ----a-w- c:\programdata\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_fr_0C51F9E1D600D10B.dll
2009-06-20 07:15 . 2009-06-24 18:06 -------- d-----w- c:\users\Yohann\AppData\Roaming\LimeWire
2009-06-20 07:15 . 2009-06-20 07:15 -------- d-----w- c:\program files\LimeWire
2009-06-17 21:33 . 2009-06-17 21:33 -------- d-----w- c:\users\Yohann\AppData\Roaming\InterVideo
2009-06-17 20:46 . 2009-06-17 20:46 -------- d-----w- c:\programdata\Messenger Plus!
2009-06-17 09:07 . 2007-05-31 17:30 266088 ----a-w- c:\windows\system32\xactengine2_8.dll
2009-06-17 09:07 . 2007-05-31 17:29 18280 ----a-w- c:\windows\system32\x3daudio1_2.dll
2009-06-17 09:07 . 2007-05-16 14:45 443752 ----a-w- c:\windows\system32\d3dx10_34.dll
2009-06-17 09:07 . 2007-05-16 14:45 3497832 ----a-w- c:\windows\system32\d3dx9_34.dll
2009-06-17 09:07 . 2007-05-16 14:45 1124720 ----a-w- c:\windows\system32\D3DCompiler_34.dll
2009-06-17 09:07 . 2007-03-15 14:57 443752 ----a-w- c:\windows\system32\d3dx10_33.dll
2009-06-17 09:07 . 2007-03-12 14:42 1123696 ----a-w- c:\windows\system32\D3DCompiler_33.dll
2009-06-17 09:07 . 2006-11-29 11:06 440080 ----a-w- c:\windows\system32\d3dx10.dll
2009-06-17 09:06 . 2009-06-17 09:06 103736 ----a-w- c:\users\Yohann\AppData\Roaming\PnkBstrB.exe
2009-06-17 09:06 . 2009-06-17 09:06 103736 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-06-17 09:06 . 2009-06-17 09:06 66872 ----a-w- c:\windows\system32\PnkBstrA.exe
2009-06-17 08:52 . 2009-06-17 08:52 -------- d-----w- c:\program files\Activision
2009-06-17 07:50 . 2009-06-21 15:39 -------- d-----w- c:\programdata\Eq Anti Fork Live
2009-06-17 07:49 . 2009-06-21 22:59 -------- d-----w- c:\programdata\KnobExtra
2009-06-17 07:49 . 2009-06-21 22:59 -------- d-----w- c:\program files\Cicle Developement
2009-06-17 07:49 . 2009-06-17 07:49 -------- d-----w- c:\program files\Messenger Plus! Live
2009-06-17 05:58 . 2009-06-26 19:04 -------- d-----w- c:\users\Yohann\Tracing
2009-06-17 00:13 . 2009-06-18 01:19 -------- d-----w- c:\program files\Microsoft Silverlight
2009-06-17 00:12 . 2009-06-17 00:12 -------- d-----w- c:\program files\Microsoft Office Outlook Connector
2009-06-17 00:11 . 2009-06-17 00:11 -------- dc----w- c:\windows\system32\DRVSTORE
2009-06-17 00:11 . 2009-02-06 16:08 55280 ----a-w- c:\windows\system32\drivers\fssfltr.sys
2009-06-17 00:10 . 2009-06-17 00:10 -------- d-----w- c:\program files\Microsoft Sync Framework
2009-06-17 00:08 . 2009-06-17 00:08 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2009-06-17 00:05 . 2009-06-17 00:13 -------- d-----w- c:\program files\Microsoft
2009-06-17 00:05 . 2009-06-17 00:05 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-06-16 22:28 . 2009-06-16 22:28 -------- d-----w- c:\program files\Common Files\Windows Live
2009-06-16 22:13 . 2009-06-16 22:14 -------- dcsh--w- c:\program files\Common Files\WindowsLiveInstaller
2009-06-16 22:12 . 2009-06-17 00:11 -------- d-----w- c:\program files\Windows Live
2009-06-16 22:12 . 2009-06-16 22:12 -------- d-----w- c:\programdata\WLInstaller
2009-06-16 18:24 . 2009-06-25 22:28 12 ----a-w- c:\windows\bthservsdp.dat
2009-06-16 17:03 . 2009-06-19 07:21 -------- d-----w- c:\users\Yohann\AppData\Local\Microsoft Games
2009-06-16 16:47 . 2009-06-16 16:47 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-16 16:23 . 2008-10-22 01:22 2048 ----a-w- c:\windows\system32\tzres.dll
2009-06-16 16:00 . 2008-06-20 01:14 43544 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2009-06-16 16:00 . 2008-06-20 01:14 105016 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-06-16 16:00 . 2008-06-20 01:14 97800 ----a-w- c:\windows\system32\infocardapi.dll
2009-06-16 16:00 . 2008-06-20 01:14 11264 ----a-w- c:\windows\system32\icardres.dll
2009-06-16 16:00 . 2008-06-20 01:14 622080 ----a-w- c:\windows\system32\icardagt.exe
2009-06-16 16:00 . 2008-06-20 01:14 781344 ----a-w- c:\windows\system32\PresentationNative_v0300.dll
2009-06-16 16:00 . 2008-06-20 01:14 326160 ----a-w- c:\windows\system32\PresentationHost.exe
2009-06-16 15:56 . 2008-07-27 18:03 96760 ----a-w- c:\windows\system32\dfshim.dll
2009-06-16 15:55 . 2008-07-27 18:03 282112 ----a-w- c:\windows\system32\mscoree.dll
2009-06-16 15:55 . 2008-07-27 18:03 41984 ----a-w- c:\windows\system32\netfxperf.dll
2009-06-16 15:54 . 2008-07-27 18:03 158720 ----a-w- c:\windows\system32\mscorier.dll
2009-06-16 15:54 . 2008-07-27 18:03 83968 ----a-w- c:\windows\system32\mscories.dll
2009-06-16 15:51 . 2009-06-16 15:51 -------- d-----w- c:\program files\MSXML 4.0
2009-06-16 15:48 . 2009-04-30 12:37 428544 ----a-w- c:\windows\system32\EncDec.dll
2009-06-16 15:48 . 2009-04-30 12:37 293376 ----a-w- c:\windows\system32\psisdecd.dll
2009-06-16 15:47 . 2008-06-26 01:45 12240896 ----a-w- c:\windows\system32\NlsLexicons0007.dll
2009-06-16 15:47 . 2008-06-26 01:45 2644480 ----a-w- c:\windows\system32\NlsLexicons0009.dll
2009-06-16 15:46 . 2008-06-26 03:29 801280 ----a-w- c:\windows\system32\NaturalLanguage6.dll
2009-06-16 15:42 . 2009-04-23 12:42 636928 ----a-w- c:\windows\system32\localspl.dll
2009-06-16 15:39 . 2008-04-10 05:12 738304 ----a-w- c:\windows\system32\inetcomm.dll
2009-06-16 15:39 . 2008-04-26 08:08 1314816 ----a-w- c:\windows\system32\quartz.dll
2009-06-16 15:28 . 2008-09-10 03:40 1334272 ----a-w- c:\windows\system32\msxml6.dll
2009-06-16 15:25 . 2009-06-20 09:59 -------- d-----w- c:\users\Yohann\AppData\Local\Adobe
2009-06-16 15:24 . 2009-06-21 13:30 -------- d-----w- c:\users\Yohann\AppData\Local\Google
2009-06-16 15:24 . 2009-06-26 19:37 -------- d-----w- c:\programdata\NOS
2009-06-16 15:24 . 2009-06-26 19:37 -------- d-----w- c:\program files\NOS
2009-06-16 15:23 . 2009-06-21 13:13 -------- d-----w- c:\program files\Google
2009-06-16 15:18 . 2008-10-16 21:13 1809944 ----a-w- c:\windows\system32\wuaueng.dll
2009-06-16 15:18 . 2008-10-16 21:09 51224 ----a-w- c:\windows\system32\wuauclt.exe
2009-06-16 15:18 . 2008-10-16 21:09 43544 ----a-w- c:\windows\system32\wups2.dll
2009-06-16 15:18 . 2008-10-16 20:56 1524736 ----a-w- c:\windows\system32\wucltux.dll
2009-06-16 15:17 . 2008-10-16 21:08 34328 ----a-w- c:\windows\system32\wups.dll
2009-06-16 15:17 . 2008-10-16 20:55 83456 ----a-w- c:\windows\system32\wudriver.dll
2009-06-16 15:17 . 2008-10-16 21:12 561688 ----a-w- c:\windows\system32\wuapi.dll
2009-06-16 15:17 . 2008-10-16 12:08 162064 ----a-w- c:\windows\system32\wuwebv.dll
2009-06-16 15:17 . 2008-10-16 11:56 31232 ----a-w- c:\windows\system32\wuapp.exe
2009-06-16 15:02 . 2009-06-16 15:02 -------- d-----w- c:\users\Yohann\AppData\Roaming\ATI
2009-06-16 15:02 . 2009-06-16 15:02 -------- d-----w- c:\users\Yohann\AppData\Local\ATI
2009-06-16 15:02 . 2009-06-16 15:02 -------- d-----w- c:\programdata\ATI
2009-06-16 15:02 . 2009-06-21 14:41 -------- d-----w- c:\users\Yohann\AppData\Roaming\HPQLOG
2009-06-16 15:01 . 2009-06-18 06:41 115312 ----a-w- c:\users\Yohann\AppData\Local\GDIPFONTCACHEV1.DAT
2009-06-16 15:01 . 2009-06-16 15:01 44 ----a-w- c:\windows\system\hpsysdrv.dat
2009-06-16 14:52 . 2009-06-16 14:52 -------- d-----w- c:\users\Yohann\AppData\Roaming\Hewlett-Packard
2009-06-16 14:49 . 2009-06-16 14:49 -------- d-----w- c:\program files\HP Webcam Application
2009-06-16 14:48 . 2008-03-07 13:35 180224 ----a-w- c:\windows\system32\rsnp2uvc.dll
2009-06-16 14:48 . 2009-06-16 14:48 -------- d-----w- c:\program files\Common Files\SNP2UVC
2009-06-16 14:48 . 2008-04-10 15:27 1804160 ----a-w- c:\windows\system32\drivers\snp2uvc.sys
2009-06-16 14:48 . 2007-07-05 06:28 176128 ----a-w- c:\windows\system32\csnp2uvc.dll
2009-06-16 14:48 . 2007-05-10 04:16 28160 ----a-w- c:\windows\system32\drivers\sncduvc.sys
2009-06-16 14:48 . 2009-06-16 14:48 -------- d-----w- c:\windows\Hewlett-Packard
2009-06-16 14:47 . 2009-06-16 14:47 -------- d-----w- c:\users\Yohann\Bluetooth Software
2009-06-16 14:47 . 2008-02-01 09:41 80936 ----a-w- c:\windows\system32\drivers\btwavdt.sys
2009-06-16 14:47 . 2008-02-01 09:41 80424 ----a-w- c:\windows\system32\drivers\btwaudio.sys
2009-06-16 14:47 . 2008-02-01 09:41 16168 ----a-w- c:\windows\system32\drivers\btwrchid.sys
2009-06-16 14:47 . 2008-02-01 09:41 233472 ----a-w- c:\windows\system32\BtwRSupport.dll
2009-06-16 14:46 . 2009-06-16 14:46 -------- d-----w- c:\windows\system32\es-MX
2009-06-16 14:46 . 2009-06-16 14:46 -------- d-----w- c:\windows\system32\es-AR
2009-06-16 14:46 . 2009-06-16 14:46 -------- d-----w- c:\program files\WIDCOMM
2009-06-16 14:42 . 2009-06-16 14:43 -------- d-----w- c:\program files\ATI Technologies
2009-06-16 14:42 . 2009-06-16 14:42 -------- d-----w- c:\program files\ATI
2009-06-16 14:41 . 2009-06-16 14:41 -------- d-----w- c:\users\Yohann\AppData\Roaming\InstallShield
2009-06-16 14:32 . 2009-06-16 14:32 -------- d-sh--we c:\programdata\Modèles
2009-06-16 14:32 . 2009-06-16 14:32 -------- d-sh--we c:\programdata\Menu Démarrer
2009-06-16 14:32 . 2009-06-16 14:32 -------- d-sh--we c:\program files\Fichiers communs
2009-06-16 14:32 . 2009-06-16 14:32 -------- d-sh--we c:\users\Default\Voisinage réseau
2009-06-16 14:32 . 2009-06-16 14:32 -------- d-sh--we c:\users\Default\Voisinage d'impression
2009-06-16 14:32 . 2009-06-16 14:32 -------- d-sh--we c:\users\Default\Modèles
2009-06-16 14:32 . 2009-06-16 14:32 -------- d-sh--we c:\users\Default\Mes documents
2009-06-16 14:32 . 2009-06-16 14:32 -------- d-sh--we c:\users\Default\Menu Démarrer
2009-06-16 14:32 . 2009-06-16 14:32 -------- d-sh--we c:\programdata\Favoris
2009-06-16 14:32 . 2009-06-16 14:32 -------- d-sh--we c:\programdata\Bureau
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-26 19:47 . 2008-06-18 09:19 -------- d-----w- c:\program files\SiteAdvisor
2009-06-26 19:47 . 2008-06-18 09:19 -------- d-----w- c:\programdata\SiteAdvisor
2009-06-26 19:09 . 2008-04-15 21:57 713542 ----a-w- c:\windows\system32\perfh00C.dat
2009-06-26 19:09 . 2008-04-15 21:57 143542 ----a-w- c:\windows\system32\perfc00C.dat
2009-06-26 19:03 . 2008-06-18 08:38 -------- d-----w- c:\programdata\hpqLog
2009-06-26 18:14 . 2008-04-17 10:29 17408 ----a-w- c:\windows\system32\rpcnetp.dll
2009-06-24 01:32 . 2008-06-18 09:20 -------- d-----w- c:\program files\Java
2009-06-19 01:03 . 2008-06-18 08:57 -------- d-----w- c:\programdata\Microsoft Help
2009-06-18 01:06 . 2008-06-18 09:03 -------- d-----w- c:\program files\Microsoft Works
2009-06-17 09:06 . 2008-06-18 08:50 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-16 16:51 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-06-16 14:52 . 2008-06-18 08:51 -------- d-----w- c:\programdata\Hewlett-Packard
2009-06-16 14:41 . 2008-06-18 08:02 -------- d-----w- c:\program files\Analog Devices
2009-06-16 14:41 . 2008-06-18 08:02 -------- d-----w- c:\programdata\SonicFocus
2009-06-16 14:41 . 2009-06-16 14:41 0 --sha-r- c:\windows\system32\drivers\103C_HP_bNB_6830s_Y5336AN_0U_QCNU9112CM7_E480268-A41_4A_I30E9_SHP_V95.1C_68PZD F.0A_T090220_WV3-1_L40C_M2042_J250_7Intel_86FD_92.00_#080618_N_(KU404ET#ABF)_XMOBILE_CN10_Z_2F.0A_G100295C2.MRK
2009-06-16 14:32 . 2009-06-16 14:32 -------- d-sh--we c:\programdata\Modèles
2009-06-16 14:32 . 2009-06-16 14:32 -------- d-sh--we c:\programdata\Menu Démarrer
2009-04-23 12:43 . 2009-06-16 15:42 784896 ----a-w- c:\windows\system32\rpcrt4.dll
2009-04-21 11:55 . 2009-06-16 15:42 2033152 ----a-w- c:\windows\system32\win32k.sys
2008-06-18 08:50 . 2008-06-18 08:50 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-03-18 2289664]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-02-06 3885408]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-06-21 39408]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-04-18 178712]
"accrdsub"="c:\program files\ActivIdentity\ActivClient\accrdsub.exe" [2007-05-15 293168]
"PTHOSTTR"="c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE" [2008-05-08 238984]
"CognizanceTS"="c:\progra~1\HEWLET~1\IAM\Bin\ASTSVCC.dll" [2008-05-21 24848]
"PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2008-05-12 318488]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-27 1045800]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-04-15 70912]
"File Sanitizer"="c:\program files\Hewlett-Packard\File Sanitizer\CoreShredder.exe" [2008-05-02 10244096]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-24 148888]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-05-14 177456]
"WatchDog"="c:\program files\InterVideo\DVD Check\DVDCheck.exe" [2008-05-24 197904]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2008-04-04 1314816]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"RunMVSMyClean"="c:\windows\myclean.bat" [2008-04-21 384]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-1-16 727592]
DVD Check.lnk - c:\program files\InterVideo\DVD Check\DVDCheck.exe [2008-6-18 197904]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"FilterAdministratorToken"= 1 (0x1)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\APSHook.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer2"=wdmaud.drv
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli ASWLNPkg
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{36A4BBC5-0A1A-4D0F-87E9-C9601168FD0F}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{0D63D014-898A-48B4-B1FC-972F9B8BA154}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync
"{FC58988B-2CE6-49CF-8199-897CBA332176}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{D8F0A442-2EF8-4BA0-8675-CD175FF3BBBE}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{9F18E239-8650-46B7-B49D-7B05AD4E0152}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{9B29CB20-F4D0-4357-A799-31DB50769022}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{0CBFE391-2725-4ADA-B0B0-5540BF8D6309}"= UDP:c:\program files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"{CDFEA762-B6DE-470E-8E0A-DD7567411731}"= TCP:c:\program files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
R0 SbAlg;SbAlg;c:\windows\System32\drivers\SbAlg.sys [14/05/2008 02:36 51376]
R0 SbFsLock;SbFsLock;c:\windows\System32\drivers\SbFsLock.sys [14/05/2008 02:36 12928]
R1 RsvLock;RsvLock;c:\windows\System32\drivers\rsvlock.sys [14/05/2008 02:36 12496]
R2 accoca;ActivClient Middleware Service;c:\program files\ActivIdentity\ActivClient\accoca.exe [16/05/2007 01:08 182576]
R2 ASBroker;Logon Session Broker;c:\windows\System32\svchost.exe -k Cognizance [21/01/2008 04:23 21504]
R2 ASChannel;Local Communication Channel;c:\windows\System32\svchost.exe -k Cognizance [21/01/2008 04:23 21504]
R2 HP ProtectTools Service;HP ProtectTools Service;c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe [14/05/2008 22:41 34184]
R2 HpFkCryptService;Drive Encryption Service;c:\program files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [14/05/2008 02:35 256512]
R2 HPFSService;File Sanitizer for HP ProtectTools;c:\program files\Hewlett-Packard\File Sanitizer\HPFSService.exe [18/06/2008 11:20 77824]
R2 hpsrv;HP Service;c:\windows\System32\hpservice.exe [07/04/2008 20:13 24936]
R2 pdfcDispatcher;PDF Document Manager;c:\program files\PDF Complete\pdfsvc.exe [18/06/2008 10:50 576024]
R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [18/06/2008 11:21 193840]
R3 NETw5v32;Pilote de carte Intel(R) Wireless WiFi Link pour Windows Vista 32 bits ;c:\windows\System32\drivers\NETw5v32.sys [28/04/2008 08:29 3658752]
S2 0288391246045635mcinstcleanup;McAfee Application Installer Cleanup (0288391246045635);c:\users\Yohann\AppData\Local\Temp\028839~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service --> c:\users\Yohann\AppData\Local\Temp\028839~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service [?]
S2 rpcnetp;rpcnetp;c:\windows\System32\rpcnetp.exe --> c:\windows\System32\rpcnetp.exe [?]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\System32\drivers\b57nd60x.sys [21/01/2008 04:23 179712]
S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [17/06/2009 02:11 55280]
S3 fsssvc;Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [06/02/2009 18:08 533360]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\System32\drivers\mbamswissarmy.sys [21/06/2009 23:20 38160]
S3 RoxMediaDB10;RoxMediaDB10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [08/04/2008 14:12 1112560]
--- Autres Services/Pilotes en mémoire ---
*Deregistered* - MfeAVFK
*Deregistered* - MfeBOPK
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Cognizance REG_MULTI_SZ ASBroker ASChannel
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
bthsvcs REG_MULTI_SZ BthServ
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Contenu du dossier 'Tâches planifiées'
2009-06-26 c:\windows\Tasks\User_Feed_Synchronization-{7B780B48-2074-446D-8864-2E018D9F0FAC}.job
- c:\windows\system32\msfeedssync.exe [2009-06-22 11:31]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fr_mq&c=83&bd=all&pf=cmnb
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Envoyer au périphérique &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: Envoyer l'&image au périphérique Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-26 21:55
Windows 6.0.6001 Service Pack 1 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pdfcDispatcher]
"ImagePath"="c:\program files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(996)
c:\windows\system32\APSHook.dll
- - - - - - - > 'lsass.exe'(716)
c:\windows\system32\APSHook.dll
c:\program files\Hewlett-Packard\IAM\bin\ASWLNPkg.dll
c:\program files\Hewlett-Packard\IAM\bin\ItMsg.dll
.
Heure de fin: 2009-06-26 21:57
ComboFix-quarantined-files.txt 2009-06-26 19:57
Avant-CF: 184 111 411 200 octets libres
Après-CF: 184 274 124 800 octets libres
299 --- E O F --- 2009-06-26 18:19
voilà le rapport :
ComboFix 09-06-25.01 - Yohann 26/06/2009 21:51.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.33.1036.18.2041.1157 [GMT 2:00]
Lancé depuis: c:\users\Yohann\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\users\Yohann\AppData\Roaming\020000002723b282620C.manifest
c:\users\Yohann\AppData\Roaming\020000002723b282620O.manifest
c:\users\Yohann\AppData\Roaming\020000002723b282620P.manifest
c:\users\Yohann\AppData\Roaming\020000002723b282620S.manifest
c:\windows\system32\LCT16vO.vbs
c:\windows\System32\autochk.exe . . . est infecté!!
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-05-26 au 2009-06-26 ))))))))))))))))))))))))))))))))))))
.
2009-06-26 19:55 . 2009-06-26 19:55 -------- d-----w- c:\users\Yohann\AppData\Local\temp
2009-06-24 01:33 . 2009-06-24 01:33 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-06-23 18:53 . 2009-06-23 18:53 -------- d-----w- C:\_OTM
2009-06-23 18:32 . 2009-06-23 18:32 -------- d-----w- C:\rsit
2009-06-23 17:28 . 2009-06-23 17:44 -------- d-----w- C:\Lop SD
2009-06-22 04:35 . 2009-05-09 05:50 915456 ----a-w- c:\windows\system32\wininet.dll
2009-06-22 04:35 . 2009-05-09 05:34 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-06-21 21:20 . 2009-06-21 21:20 -------- d-----w- c:\users\Yohann\AppData\Roaming\Malwarebytes
2009-06-21 21:20 . 2009-06-17 09:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-21 21:20 . 2009-06-21 21:20 -------- d-----w- c:\programdata\Malwarebytes
2009-06-21 21:20 . 2009-06-21 21:20 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-21 21:20 . 2009-06-17 09:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-21 21:12 . 2009-06-21 21:12 -------- d-----w- c:\program files\Trend Micro
2009-06-21 14:29 . 2009-06-21 14:29 -------- d-----w- c:\programdata\LightScribe
2009-06-21 13:30 . 2009-06-21 13:30 393216 ----a-w- c:\programdata\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_fr_0C51F9E1D600D10B.dll
2009-06-20 07:15 . 2009-06-24 18:06 -------- d-----w- c:\users\Yohann\AppData\Roaming\LimeWire
2009-06-20 07:15 . 2009-06-20 07:15 -------- d-----w- c:\program files\LimeWire
2009-06-17 21:33 . 2009-06-17 21:33 -------- d-----w- c:\users\Yohann\AppData\Roaming\InterVideo
2009-06-17 20:46 . 2009-06-17 20:46 -------- d-----w- c:\programdata\Messenger Plus!
2009-06-17 09:07 . 2007-05-31 17:30 266088 ----a-w- c:\windows\system32\xactengine2_8.dll
2009-06-17 09:07 . 2007-05-31 17:29 18280 ----a-w- c:\windows\system32\x3daudio1_2.dll
2009-06-17 09:07 . 2007-05-16 14:45 443752 ----a-w- c:\windows\system32\d3dx10_34.dll
2009-06-17 09:07 . 2007-05-16 14:45 3497832 ----a-w- c:\windows\system32\d3dx9_34.dll
2009-06-17 09:07 . 2007-05-16 14:45 1124720 ----a-w- c:\windows\system32\D3DCompiler_34.dll
2009-06-17 09:07 . 2007-03-15 14:57 443752 ----a-w- c:\windows\system32\d3dx10_33.dll
2009-06-17 09:07 . 2007-03-12 14:42 1123696 ----a-w- c:\windows\system32\D3DCompiler_33.dll
2009-06-17 09:07 . 2006-11-29 11:06 440080 ----a-w- c:\windows\system32\d3dx10.dll
2009-06-17 09:06 . 2009-06-17 09:06 103736 ----a-w- c:\users\Yohann\AppData\Roaming\PnkBstrB.exe
2009-06-17 09:06 . 2009-06-17 09:06 103736 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-06-17 09:06 . 2009-06-17 09:06 66872 ----a-w- c:\windows\system32\PnkBstrA.exe
2009-06-17 08:52 . 2009-06-17 08:52 -------- d-----w- c:\program files\Activision
2009-06-17 07:50 . 2009-06-21 15:39 -------- d-----w- c:\programdata\Eq Anti Fork Live
2009-06-17 07:49 . 2009-06-21 22:59 -------- d-----w- c:\programdata\KnobExtra
2009-06-17 07:49 . 2009-06-21 22:59 -------- d-----w- c:\program files\Cicle Developement
2009-06-17 07:49 . 2009-06-17 07:49 -------- d-----w- c:\program files\Messenger Plus! Live
2009-06-17 05:58 . 2009-06-26 19:04 -------- d-----w- c:\users\Yohann\Tracing
2009-06-17 00:13 . 2009-06-18 01:19 -------- d-----w- c:\program files\Microsoft Silverlight
2009-06-17 00:12 . 2009-06-17 00:12 -------- d-----w- c:\program files\Microsoft Office Outlook Connector
2009-06-17 00:11 . 2009-06-17 00:11 -------- dc----w- c:\windows\system32\DRVSTORE
2009-06-17 00:11 . 2009-02-06 16:08 55280 ----a-w- c:\windows\system32\drivers\fssfltr.sys
2009-06-17 00:10 . 2009-06-17 00:10 -------- d-----w- c:\program files\Microsoft Sync Framework
2009-06-17 00:08 . 2009-06-17 00:08 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2009-06-17 00:05 . 2009-06-17 00:13 -------- d-----w- c:\program files\Microsoft
2009-06-17 00:05 . 2009-06-17 00:05 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-06-16 22:28 . 2009-06-16 22:28 -------- d-----w- c:\program files\Common Files\Windows Live
2009-06-16 22:13 . 2009-06-16 22:14 -------- dcsh--w- c:\program files\Common Files\WindowsLiveInstaller
2009-06-16 22:12 . 2009-06-17 00:11 -------- d-----w- c:\program files\Windows Live
2009-06-16 22:12 . 2009-06-16 22:12 -------- d-----w- c:\programdata\WLInstaller
2009-06-16 18:24 . 2009-06-25 22:28 12 ----a-w- c:\windows\bthservsdp.dat
2009-06-16 17:03 . 2009-06-19 07:21 -------- d-----w- c:\users\Yohann\AppData\Local\Microsoft Games
2009-06-16 16:47 . 2009-06-16 16:47 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-16 16:23 . 2008-10-22 01:22 2048 ----a-w- c:\windows\system32\tzres.dll
2009-06-16 16:00 . 2008-06-20 01:14 43544 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2009-06-16 16:00 . 2008-06-20 01:14 105016 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-06-16 16:00 . 2008-06-20 01:14 97800 ----a-w- c:\windows\system32\infocardapi.dll
2009-06-16 16:00 . 2008-06-20 01:14 11264 ----a-w- c:\windows\system32\icardres.dll
2009-06-16 16:00 . 2008-06-20 01:14 622080 ----a-w- c:\windows\system32\icardagt.exe
2009-06-16 16:00 . 2008-06-20 01:14 781344 ----a-w- c:\windows\system32\PresentationNative_v0300.dll
2009-06-16 16:00 . 2008-06-20 01:14 326160 ----a-w- c:\windows\system32\PresentationHost.exe
2009-06-16 15:56 . 2008-07-27 18:03 96760 ----a-w- c:\windows\system32\dfshim.dll
2009-06-16 15:55 . 2008-07-27 18:03 282112 ----a-w- c:\windows\system32\mscoree.dll
2009-06-16 15:55 . 2008-07-27 18:03 41984 ----a-w- c:\windows\system32\netfxperf.dll
2009-06-16 15:54 . 2008-07-27 18:03 158720 ----a-w- c:\windows\system32\mscorier.dll
2009-06-16 15:54 . 2008-07-27 18:03 83968 ----a-w- c:\windows\system32\mscories.dll
2009-06-16 15:51 . 2009-06-16 15:51 -------- d-----w- c:\program files\MSXML 4.0
2009-06-16 15:48 . 2009-04-30 12:37 428544 ----a-w- c:\windows\system32\EncDec.dll
2009-06-16 15:48 . 2009-04-30 12:37 293376 ----a-w- c:\windows\system32\psisdecd.dll
2009-06-16 15:47 . 2008-06-26 01:45 12240896 ----a-w- c:\windows\system32\NlsLexicons0007.dll
2009-06-16 15:47 . 2008-06-26 01:45 2644480 ----a-w- c:\windows\system32\NlsLexicons0009.dll
2009-06-16 15:46 . 2008-06-26 03:29 801280 ----a-w- c:\windows\system32\NaturalLanguage6.dll
2009-06-16 15:42 . 2009-04-23 12:42 636928 ----a-w- c:\windows\system32\localspl.dll
2009-06-16 15:39 . 2008-04-10 05:12 738304 ----a-w- c:\windows\system32\inetcomm.dll
2009-06-16 15:39 . 2008-04-26 08:08 1314816 ----a-w- c:\windows\system32\quartz.dll
2009-06-16 15:28 . 2008-09-10 03:40 1334272 ----a-w- c:\windows\system32\msxml6.dll
2009-06-16 15:25 . 2009-06-20 09:59 -------- d-----w- c:\users\Yohann\AppData\Local\Adobe
2009-06-16 15:24 . 2009-06-21 13:30 -------- d-----w- c:\users\Yohann\AppData\Local\Google
2009-06-16 15:24 . 2009-06-26 19:37 -------- d-----w- c:\programdata\NOS
2009-06-16 15:24 . 2009-06-26 19:37 -------- d-----w- c:\program files\NOS
2009-06-16 15:23 . 2009-06-21 13:13 -------- d-----w- c:\program files\Google
2009-06-16 15:18 . 2008-10-16 21:13 1809944 ----a-w- c:\windows\system32\wuaueng.dll
2009-06-16 15:18 . 2008-10-16 21:09 51224 ----a-w- c:\windows\system32\wuauclt.exe
2009-06-16 15:18 . 2008-10-16 21:09 43544 ----a-w- c:\windows\system32\wups2.dll
2009-06-16 15:18 . 2008-10-16 20:56 1524736 ----a-w- c:\windows\system32\wucltux.dll
2009-06-16 15:17 . 2008-10-16 21:08 34328 ----a-w- c:\windows\system32\wups.dll
2009-06-16 15:17 . 2008-10-16 20:55 83456 ----a-w- c:\windows\system32\wudriver.dll
2009-06-16 15:17 . 2008-10-16 21:12 561688 ----a-w- c:\windows\system32\wuapi.dll
2009-06-16 15:17 . 2008-10-16 12:08 162064 ----a-w- c:\windows\system32\wuwebv.dll
2009-06-16 15:17 . 2008-10-16 11:56 31232 ----a-w- c:\windows\system32\wuapp.exe
2009-06-16 15:02 . 2009-06-16 15:02 -------- d-----w- c:\users\Yohann\AppData\Roaming\ATI
2009-06-16 15:02 . 2009-06-16 15:02 -------- d-----w- c:\users\Yohann\AppData\Local\ATI
2009-06-16 15:02 . 2009-06-16 15:02 -------- d-----w- c:\programdata\ATI
2009-06-16 15:02 . 2009-06-21 14:41 -------- d-----w- c:\users\Yohann\AppData\Roaming\HPQLOG
2009-06-16 15:01 . 2009-06-18 06:41 115312 ----a-w- c:\users\Yohann\AppData\Local\GDIPFONTCACHEV1.DAT
2009-06-16 15:01 . 2009-06-16 15:01 44 ----a-w- c:\windows\system\hpsysdrv.dat
2009-06-16 14:52 . 2009-06-16 14:52 -------- d-----w- c:\users\Yohann\AppData\Roaming\Hewlett-Packard
2009-06-16 14:49 . 2009-06-16 14:49 -------- d-----w- c:\program files\HP Webcam Application
2009-06-16 14:48 . 2008-03-07 13:35 180224 ----a-w- c:\windows\system32\rsnp2uvc.dll
2009-06-16 14:48 . 2009-06-16 14:48 -------- d-----w- c:\program files\Common Files\SNP2UVC
2009-06-16 14:48 . 2008-04-10 15:27 1804160 ----a-w- c:\windows\system32\drivers\snp2uvc.sys
2009-06-16 14:48 . 2007-07-05 06:28 176128 ----a-w- c:\windows\system32\csnp2uvc.dll
2009-06-16 14:48 . 2007-05-10 04:16 28160 ----a-w- c:\windows\system32\drivers\sncduvc.sys
2009-06-16 14:48 . 2009-06-16 14:48 -------- d-----w- c:\windows\Hewlett-Packard
2009-06-16 14:47 . 2009-06-16 14:47 -------- d-----w- c:\users\Yohann\Bluetooth Software
2009-06-16 14:47 . 2008-02-01 09:41 80936 ----a-w- c:\windows\system32\drivers\btwavdt.sys
2009-06-16 14:47 . 2008-02-01 09:41 80424 ----a-w- c:\windows\system32\drivers\btwaudio.sys
2009-06-16 14:47 . 2008-02-01 09:41 16168 ----a-w- c:\windows\system32\drivers\btwrchid.sys
2009-06-16 14:47 . 2008-02-01 09:41 233472 ----a-w- c:\windows\system32\BtwRSupport.dll
2009-06-16 14:46 . 2009-06-16 14:46 -------- d-----w- c:\windows\system32\es-MX
2009-06-16 14:46 . 2009-06-16 14:46 -------- d-----w- c:\windows\system32\es-AR
2009-06-16 14:46 . 2009-06-16 14:46 -------- d-----w- c:\program files\WIDCOMM
2009-06-16 14:42 . 2009-06-16 14:43 -------- d-----w- c:\program files\ATI Technologies
2009-06-16 14:42 . 2009-06-16 14:42 -------- d-----w- c:\program files\ATI
2009-06-16 14:41 . 2009-06-16 14:41 -------- d-----w- c:\users\Yohann\AppData\Roaming\InstallShield
2009-06-16 14:32 . 2009-06-16 14:32 -------- d-sh--we c:\programdata\Modèles
2009-06-16 14:32 . 2009-06-16 14:32 -------- d-sh--we c:\programdata\Menu Démarrer
2009-06-16 14:32 . 2009-06-16 14:32 -------- d-sh--we c:\program files\Fichiers communs
2009-06-16 14:32 . 2009-06-16 14:32 -------- d-sh--we c:\users\Default\Voisinage réseau
2009-06-16 14:32 . 2009-06-16 14:32 -------- d-sh--we c:\users\Default\Voisinage d'impression
2009-06-16 14:32 . 2009-06-16 14:32 -------- d-sh--we c:\users\Default\Modèles
2009-06-16 14:32 . 2009-06-16 14:32 -------- d-sh--we c:\users\Default\Mes documents
2009-06-16 14:32 . 2009-06-16 14:32 -------- d-sh--we c:\users\Default\Menu Démarrer
2009-06-16 14:32 . 2009-06-16 14:32 -------- d-sh--we c:\programdata\Favoris
2009-06-16 14:32 . 2009-06-16 14:32 -------- d-sh--we c:\programdata\Bureau
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-26 19:47 . 2008-06-18 09:19 -------- d-----w- c:\program files\SiteAdvisor
2009-06-26 19:47 . 2008-06-18 09:19 -------- d-----w- c:\programdata\SiteAdvisor
2009-06-26 19:09 . 2008-04-15 21:57 713542 ----a-w- c:\windows\system32\perfh00C.dat
2009-06-26 19:09 . 2008-04-15 21:57 143542 ----a-w- c:\windows\system32\perfc00C.dat
2009-06-26 19:03 . 2008-06-18 08:38 -------- d-----w- c:\programdata\hpqLog
2009-06-26 18:14 . 2008-04-17 10:29 17408 ----a-w- c:\windows\system32\rpcnetp.dll
2009-06-24 01:32 . 2008-06-18 09:20 -------- d-----w- c:\program files\Java
2009-06-19 01:03 . 2008-06-18 08:57 -------- d-----w- c:\programdata\Microsoft Help
2009-06-18 01:06 . 2008-06-18 09:03 -------- d-----w- c:\program files\Microsoft Works
2009-06-17 09:06 . 2008-06-18 08:50 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-16 16:51 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-06-16 14:52 . 2008-06-18 08:51 -------- d-----w- c:\programdata\Hewlett-Packard
2009-06-16 14:41 . 2008-06-18 08:02 -------- d-----w- c:\program files\Analog Devices
2009-06-16 14:41 . 2008-06-18 08:02 -------- d-----w- c:\programdata\SonicFocus
2009-06-16 14:41 . 2009-06-16 14:41 0 --sha-r- c:\windows\system32\drivers\103C_HP_bNB_6830s_Y5336AN_0U_QCNU9112CM7_E480268-A41_4A_I30E9_SHP_V95.1C_68PZD F.0A_T090220_WV3-1_L40C_M2042_J250_7Intel_86FD_92.00_#080618_N_(KU404ET#ABF)_XMOBILE_CN10_Z_2F.0A_G100295C2.MRK
2009-06-16 14:32 . 2009-06-16 14:32 -------- d-sh--we c:\programdata\Modèles
2009-06-16 14:32 . 2009-06-16 14:32 -------- d-sh--we c:\programdata\Menu Démarrer
2009-04-23 12:43 . 2009-06-16 15:42 784896 ----a-w- c:\windows\system32\rpcrt4.dll
2009-04-21 11:55 . 2009-06-16 15:42 2033152 ----a-w- c:\windows\system32\win32k.sys
2008-06-18 08:50 . 2008-06-18 08:50 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-03-18 2289664]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-02-06 3885408]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-06-21 39408]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-04-18 178712]
"accrdsub"="c:\program files\ActivIdentity\ActivClient\accrdsub.exe" [2007-05-15 293168]
"PTHOSTTR"="c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE" [2008-05-08 238984]
"CognizanceTS"="c:\progra~1\HEWLET~1\IAM\Bin\ASTSVCC.dll" [2008-05-21 24848]
"PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2008-05-12 318488]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-27 1045800]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-04-15 70912]
"File Sanitizer"="c:\program files\Hewlett-Packard\File Sanitizer\CoreShredder.exe" [2008-05-02 10244096]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-24 148888]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-05-14 177456]
"WatchDog"="c:\program files\InterVideo\DVD Check\DVDCheck.exe" [2008-05-24 197904]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2008-04-04 1314816]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"RunMVSMyClean"="c:\windows\myclean.bat" [2008-04-21 384]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-1-16 727592]
DVD Check.lnk - c:\program files\InterVideo\DVD Check\DVDCheck.exe [2008-6-18 197904]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"FilterAdministratorToken"= 1 (0x1)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\APSHook.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer2"=wdmaud.drv
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli ASWLNPkg
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{36A4BBC5-0A1A-4D0F-87E9-C9601168FD0F}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{0D63D014-898A-48B4-B1FC-972F9B8BA154}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync
"{FC58988B-2CE6-49CF-8199-897CBA332176}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{D8F0A442-2EF8-4BA0-8675-CD175FF3BBBE}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{9F18E239-8650-46B7-B49D-7B05AD4E0152}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{9B29CB20-F4D0-4357-A799-31DB50769022}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{0CBFE391-2725-4ADA-B0B0-5540BF8D6309}"= UDP:c:\program files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"{CDFEA762-B6DE-470E-8E0A-DD7567411731}"= TCP:c:\program files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
R0 SbAlg;SbAlg;c:\windows\System32\drivers\SbAlg.sys [14/05/2008 02:36 51376]
R0 SbFsLock;SbFsLock;c:\windows\System32\drivers\SbFsLock.sys [14/05/2008 02:36 12928]
R1 RsvLock;RsvLock;c:\windows\System32\drivers\rsvlock.sys [14/05/2008 02:36 12496]
R2 accoca;ActivClient Middleware Service;c:\program files\ActivIdentity\ActivClient\accoca.exe [16/05/2007 01:08 182576]
R2 ASBroker;Logon Session Broker;c:\windows\System32\svchost.exe -k Cognizance [21/01/2008 04:23 21504]
R2 ASChannel;Local Communication Channel;c:\windows\System32\svchost.exe -k Cognizance [21/01/2008 04:23 21504]
R2 HP ProtectTools Service;HP ProtectTools Service;c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe [14/05/2008 22:41 34184]
R2 HpFkCryptService;Drive Encryption Service;c:\program files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [14/05/2008 02:35 256512]
R2 HPFSService;File Sanitizer for HP ProtectTools;c:\program files\Hewlett-Packard\File Sanitizer\HPFSService.exe [18/06/2008 11:20 77824]
R2 hpsrv;HP Service;c:\windows\System32\hpservice.exe [07/04/2008 20:13 24936]
R2 pdfcDispatcher;PDF Document Manager;c:\program files\PDF Complete\pdfsvc.exe [18/06/2008 10:50 576024]
R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [18/06/2008 11:21 193840]
R3 NETw5v32;Pilote de carte Intel(R) Wireless WiFi Link pour Windows Vista 32 bits ;c:\windows\System32\drivers\NETw5v32.sys [28/04/2008 08:29 3658752]
S2 0288391246045635mcinstcleanup;McAfee Application Installer Cleanup (0288391246045635);c:\users\Yohann\AppData\Local\Temp\028839~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service --> c:\users\Yohann\AppData\Local\Temp\028839~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service [?]
S2 rpcnetp;rpcnetp;c:\windows\System32\rpcnetp.exe --> c:\windows\System32\rpcnetp.exe [?]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\System32\drivers\b57nd60x.sys [21/01/2008 04:23 179712]
S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [17/06/2009 02:11 55280]
S3 fsssvc;Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [06/02/2009 18:08 533360]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\System32\drivers\mbamswissarmy.sys [21/06/2009 23:20 38160]
S3 RoxMediaDB10;RoxMediaDB10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [08/04/2008 14:12 1112560]
--- Autres Services/Pilotes en mémoire ---
*Deregistered* - MfeAVFK
*Deregistered* - MfeBOPK
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Cognizance REG_MULTI_SZ ASBroker ASChannel
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
bthsvcs REG_MULTI_SZ BthServ
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Contenu du dossier 'Tâches planifiées'
2009-06-26 c:\windows\Tasks\User_Feed_Synchronization-{7B780B48-2074-446D-8864-2E018D9F0FAC}.job
- c:\windows\system32\msfeedssync.exe [2009-06-22 11:31]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fr_mq&c=83&bd=all&pf=cmnb
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Envoyer au périphérique &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: Envoyer l'&image au périphérique Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-26 21:55
Windows 6.0.6001 Service Pack 1 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pdfcDispatcher]
"ImagePath"="c:\program files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(996)
c:\windows\system32\APSHook.dll
- - - - - - - > 'lsass.exe'(716)
c:\windows\system32\APSHook.dll
c:\program files\Hewlett-Packard\IAM\bin\ASWLNPkg.dll
c:\program files\Hewlett-Packard\IAM\bin\ItMsg.dll
.
Heure de fin: 2009-06-26 21:57
ComboFix-quarantined-files.txt 2009-06-26 19:57
Avant-CF: 184 111 411 200 octets libres
Après-CF: 184 274 124 800 octets libres
299 --- E O F --- 2009-06-26 18:19
Moué...
--> Fais analyser le fichier suivant : c:\windows\System32\autochk.exe
--> Sur VirusTotal et poste le lien de l'analyse.
--> Fais analyser le fichier suivant : c:\windows\System32\autochk.exe
--> Sur VirusTotal et poste le lien de l'analyse.
Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.18 2009.06.26 -
AhnLab-V3 5.0.0.2 2009.06.25 -
AntiVir 7.9.0.196 2009.06.25 -
Antiy-AVL 2.0.3.1 2009.06.25 -
Authentium 5.1.2.4 2009.06.25 -
Avast 4.8.1335.0 2009.06.25 -
AVG 8.5.0.339 2009.06.25 -
BitDefender 7.2 2009.06.26 -
CAT-QuickHeal 10.00 2009.06.25 -
ClamAV 0.94.1 2009.06.26 -
Comodo 1424 2009.06.26 -
DrWeb 5.0.0.12182 2009.06.26 -
eSafe 7.0.17.0 2009.06.25 -
eTrust-Vet 31.6.6580 2009.06.26 -
F-Prot 4.4.4.56 2009.06.25 -
F-Secure 8.0.14470.0 2009.06.25 -
Fortinet 3.117.0.0 2009.06.25 -
GData 19 2009.06.26 -
Ikarus T3.1.1.59.0 2009.06.26 -
Jiangmin 11.0.706 2009.06.25 -
K7AntiVirus 7.10.768 2009.06.19 -
Kaspersky 7.0.0.125 2009.06.26 -
McAfee 5657 2009.06.25 -
McAfee+Artemis 5657 2009.06.25 -
McAfee-GW-Edition 6.7.6 2009.06.25 -
Microsoft 1.4803 2009.06.26 -
NOD32 4190 2009.06.26 -
Norman 6.01.09 2009.06.25 -
nProtect 2009.1.8.0 2009.06.26 -
Panda 10.0.0.16 2009.06.26 -
PCTools 4.4.2.0 2009.06.25 -
Prevx 3.0 2009.06.26 -
Rising 21.35.34.00 2009.06.25 -
Sophos 4.43.0 2009.06.26 -
Sunbelt 3.2.1858.2 2009.06.25 -
Symantec 1.4.4.12 2009.06.26 -
TheHacker 6.3.4.3.354 2009.06.25 -
TrendMicro 8.950.0.1094 2009.06.26 -
VBA32 3.12.10.7 2009.06.26 -
ViRobot 2009.6.25.1804 2009.06.25 -
VirusBuster 4.6.5.0 2009.06.25 -
Information additionnelle
File size: 642560 bytes
MD5...: b91bc36040c812ad5b127c6ee18895af
SHA1..: 84e61412ffe0277361b0e19eb7f01d632ea45ce1
SHA256: 8cc355e9230edb67043a633f78725847a4589d206ffb91a20be9505d58bdc771
ssdeep: 12288:K522HlaA/v5Lze6Z02L7lN2/07qCAEC6+sPZ/AhFN:K522H1X5HL22W/8q
CvX+sah3
PEiD..: -
TrID..: File type identification
Generic Win/DOS Executable (50.0%)
DOS Executable Generic (49.9%)
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x16ce
timedatestamp.....: 0x45676936 (Fri Nov 24 21:50:46 2006)
machinetype.......: 0x14c (I386)
( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x9ce 0xa00 6.08 f189542e08c559931787766ce6450847
.cdata 0x2000 0x4400 0x4400 6.00 5a186198384a33ff53fb5b3a26368bb3
.mdata 0x7000 0x300 0x400 1.74 88192dcaae8771af957eb9352792661d
.reloc 0x8000 0x60 0x200 1.51 737c7c8641e2692a26d3adfc985b4135
( 1 imports )
> ntdll.dll: NtCreateKey, NtOpenProcessToken, NtCreateFile, NtClose, NtAdjustPrivilegesToken, NtDeleteFile, NtWriteFile, RtlInitUnicodeString, NtSetSecurityObject, NtTerminateProcess, NtSetValueKey, NtQuerySecurityObject, NtReadFile, RtlQueryEnvironmentVariable_U, NtQueryInformationToken, RtlUnwind, wcscpy
( 0 exports )
PDFiD.: -
RDS...: NSRL Reference Data Set
-
packers (F-Prot): embedded
a-squared 4.5.0.18 2009.06.26 -
AhnLab-V3 5.0.0.2 2009.06.25 -
AntiVir 7.9.0.196 2009.06.25 -
Antiy-AVL 2.0.3.1 2009.06.25 -
Authentium 5.1.2.4 2009.06.25 -
Avast 4.8.1335.0 2009.06.25 -
AVG 8.5.0.339 2009.06.25 -
BitDefender 7.2 2009.06.26 -
CAT-QuickHeal 10.00 2009.06.25 -
ClamAV 0.94.1 2009.06.26 -
Comodo 1424 2009.06.26 -
DrWeb 5.0.0.12182 2009.06.26 -
eSafe 7.0.17.0 2009.06.25 -
eTrust-Vet 31.6.6580 2009.06.26 -
F-Prot 4.4.4.56 2009.06.25 -
F-Secure 8.0.14470.0 2009.06.25 -
Fortinet 3.117.0.0 2009.06.25 -
GData 19 2009.06.26 -
Ikarus T3.1.1.59.0 2009.06.26 -
Jiangmin 11.0.706 2009.06.25 -
K7AntiVirus 7.10.768 2009.06.19 -
Kaspersky 7.0.0.125 2009.06.26 -
McAfee 5657 2009.06.25 -
McAfee+Artemis 5657 2009.06.25 -
McAfee-GW-Edition 6.7.6 2009.06.25 -
Microsoft 1.4803 2009.06.26 -
NOD32 4190 2009.06.26 -
Norman 6.01.09 2009.06.25 -
nProtect 2009.1.8.0 2009.06.26 -
Panda 10.0.0.16 2009.06.26 -
PCTools 4.4.2.0 2009.06.25 -
Prevx 3.0 2009.06.26 -
Rising 21.35.34.00 2009.06.25 -
Sophos 4.43.0 2009.06.26 -
Sunbelt 3.2.1858.2 2009.06.25 -
Symantec 1.4.4.12 2009.06.26 -
TheHacker 6.3.4.3.354 2009.06.25 -
TrendMicro 8.950.0.1094 2009.06.26 -
VBA32 3.12.10.7 2009.06.26 -
ViRobot 2009.6.25.1804 2009.06.25 -
VirusBuster 4.6.5.0 2009.06.25 -
Information additionnelle
File size: 642560 bytes
MD5...: b91bc36040c812ad5b127c6ee18895af
SHA1..: 84e61412ffe0277361b0e19eb7f01d632ea45ce1
SHA256: 8cc355e9230edb67043a633f78725847a4589d206ffb91a20be9505d58bdc771
ssdeep: 12288:K522HlaA/v5Lze6Z02L7lN2/07qCAEC6+sPZ/AhFN:K522H1X5HL22W/8q
CvX+sah3
PEiD..: -
TrID..: File type identification
Generic Win/DOS Executable (50.0%)
DOS Executable Generic (49.9%)
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x16ce
timedatestamp.....: 0x45676936 (Fri Nov 24 21:50:46 2006)
machinetype.......: 0x14c (I386)
( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x9ce 0xa00 6.08 f189542e08c559931787766ce6450847
.cdata 0x2000 0x4400 0x4400 6.00 5a186198384a33ff53fb5b3a26368bb3
.mdata 0x7000 0x300 0x400 1.74 88192dcaae8771af957eb9352792661d
.reloc 0x8000 0x60 0x200 1.51 737c7c8641e2692a26d3adfc985b4135
( 1 imports )
> ntdll.dll: NtCreateKey, NtOpenProcessToken, NtCreateFile, NtClose, NtAdjustPrivilegesToken, NtDeleteFile, NtWriteFile, RtlInitUnicodeString, NtSetSecurityObject, NtTerminateProcess, NtSetValueKey, NtQuerySecurityObject, NtReadFile, RtlQueryEnvironmentVariable_U, NtQueryInformationToken, RtlUnwind, wcscpy
( 0 exports )
PDFiD.: -
RDS...: NSRL Reference Data Set
-
packers (F-Prot): embedded
a chaque fois que j'ai eu a l'utiliser il me proposait les modifications en lien avec l'infection
mais c'est il y a quelque temps deja....J'imagine qu'il faut payer maintenant
mais c'est il y a quelque temps deja....J'imagine qu'il faut payer maintenant
"A chaque fois que j'ai eu a l'utiliser il me proposait les modifications en lien avec l'infection
mais c'est il y a quelque temps deja....J'imagine qu'il faut payer maintenant"
--> Merci d'éviter de raconter n'importe quoi.
/!\ Seul prisita peut suivre cette procédure. /!\
1/
---> Ouvre le Bloc-notes.
---> Copie le texte ci-dessous par sélection puis Ctrl+C :
KillAll::
Folder::
c:\programdata\Eq Anti Fork Live
c:\programdata\KnobExtra
c:\program files\Cicle Developement
FileLook::
c:\windows\System32\rpcnetp.exe
--> Colle la sélection dans le Bloc-notes.
--> Enregistre ce fichier sur le Bureau (Impératif).
--> Nom du fichier : CFScript
--> Type du fichier : tous les fichiers
--> Clique sur Enregistrer.
--> Quitte le Bloc-notes.
2/
--> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :
http://www.searchengines.pl/phpbb203/pliki/picasso/virus/programs/combofix/combofix_cfscript.gif
--> Une fenêtre bleue va apparaître : au message qui apparaît, tu acceptes.
--> Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal !
Ne touche à rien tant que le scan n'est pas terminé.
--> Une fois le scan achevé, un rapport va s'afficher : poste-le.
--> Si le fichier ne s'ouvre pas, il se trouve ici C:\Combofix.txt
mais c'est il y a quelque temps deja....J'imagine qu'il faut payer maintenant"
--> Merci d'éviter de raconter n'importe quoi.
/!\ Seul prisita peut suivre cette procédure. /!\
1/
---> Ouvre le Bloc-notes.
---> Copie le texte ci-dessous par sélection puis Ctrl+C :
KillAll::
Folder::
c:\programdata\Eq Anti Fork Live
c:\programdata\KnobExtra
c:\program files\Cicle Developement
FileLook::
c:\windows\System32\rpcnetp.exe
--> Colle la sélection dans le Bloc-notes.
--> Enregistre ce fichier sur le Bureau (Impératif).
--> Nom du fichier : CFScript
--> Type du fichier : tous les fichiers
--> Clique sur Enregistrer.
--> Quitte le Bloc-notes.
2/
--> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :
http://www.searchengines.pl/phpbb203/pliki/picasso/virus/programs/combofix/combofix_cfscript.gif
--> Une fenêtre bleue va apparaître : au message qui apparaît, tu acceptes.
--> Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal !
Ne touche à rien tant que le scan n'est pas terminé.
--> Une fois le scan achevé, un rapport va s'afficher : poste-le.
--> Si le fichier ne s'ouvre pas, il se trouve ici C:\Combofix.txt
