Virus Trojan:Win32/C2Lop.gen!J
Résolu
prisita
Messages postés
51
Date d'inscription
Statut
Membre
Dernière intervention
-
prisita Messages postés 51 Date d'inscription Statut Membre Dernière intervention -
prisita Messages postés 51 Date d'inscription Statut Membre Dernière intervention -
Bonjour,
J'ai été infecté par ce virus trojan (Trojan:Win32/C2Lop.gen!J )
il a aparement supprimé ou bloqué certains fichiers systeme et je pense qu'il s'est multiplié puisque je l'ai supprimé 5 fois!!
Que faire?
Ps:j'ai fait une analyse et j'ai télécharger un antivirus "Malwarebytes,Antimalware"
J'ai télécharger Hijackthis pour une analyse et voilà le rapport!!
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:15:57, on 21/06/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18248)
Boot mode: Normal
Running processes:
C:\windows\system32\Dwm.exe
C:\windows\Explorer.EXE
C:\windows\system32\taskeng.exe
C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtTry.exe
c:\Program Files\Hewlett-Packard\IAM\Bin\AsGHost.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe
C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\pthosttr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\SiteAdvisor\6173\SiteAdv.exe
C:\Program Files\Hewlett-Packard\File Sanitizer\CoreShredder.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
c:\Program Files\ActivIdentity\ActivClient\acevents.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\VolCtrl.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\windows\System32\wsqmcons.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www8.hp.com/fr/fr/home.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www8.hp.com/fr/fr/home.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www8.hp.com/fr/fr/home.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6173\SiteAdv.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: BHO_Startup - {3134413B-49B4-425C-98A5-893C1F195601} - C:\Program Files\Hewlett-Packard\File Sanitizer\IEBHO.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Credential Manager for HP ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - c:\Program Files\Hewlett-Packard\IAM\Bin\ItIEAddIn.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6173\SiteAdv.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [accrdsub] "c:\Program Files\ActivIdentity\ActivClient\accrdsub.exe"
O4 - HKLM\..\Run: [PTHOSTTR] c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe c:\PROGRA~1\HEWLET~1\IAM\Bin\ASTSVCC.dll,RegisterModule
O4 - HKLM\..\Run: [PDF Complete] C:\Program Files\PDF Complete\pdfsty.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [MVS Splash] C:\Program Files\McAfee\Managed VirusScan\Agent\Splash.exe
O4 - HKLM\..\Run: [McAfee Managed Services Tray] C:\Program Files\McAfee\Managed VirusScan\Agent\StartMyAgtTry.Exe
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6173\SiteAdv.exe
O4 - HKLM\..\Run: [File Sanitizer] C:\Program Files\Hewlett-Packard\File Sanitizer\CoreShredder.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [QlbCtrl.exe] C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
O4 - HKLM\..\Run: [HP Software Update] c:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\soundmax.exe /tray
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [second 32] "C:\ProgramData\Axis Wipe Wipe.m42y2"
O4 - HKCU\..\Run: [Fork live trust pop] "C:\ProgramData\drv lies base.kbverh4"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: Envoyer l'&image au périphérique Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix:
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - AppInit_DLLs: APSHook.dll,C:\windows\System32\dbnmpntw32.dll
O23 - Service: ActivClient Middleware Service (accoca) - ActivIdentity - c:\Program Files\ActivIdentity\ActivClient\accoca.exe
O23 - Service: Andrea ADI Filters Service (AEADIFilters) - Andrea Electronics Corporation - C:\windows\system32\AEADISRV.EXE
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\windows\system32\Ati2evxx.exe
O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
O23 - Service: EngineServer - McAfee, Inc. - C:\PROGRA~1\McAfee\MANAGE~1\VScan\ENGINE~1.EXE
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: HP ProtectTools Service - Hewlett-Packard Development Company, L.P - c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe
O23 - Service: Drive Encryption Service (HpFkCryptService) - SafeBoot International - c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
O23 - Service: File Sanitizer for HP ProtectTools (HPFSService) - Hewlett-Packard - C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: HP Service (hpsrv) - Hewlett-Packard Corporation - C:\windows\system32\Hpservice.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McShield - McAfee, Inc. - C:\PROGRA~1\McAfee\MANAGE~1\VScan\McShield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Virus and Spyware Protection Service (myAgtSvc) - McAfee, Inc. - C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.Exe
O23 - Service: PDF Document Manager (pdfcDispatcher) - PDF Complete Inc - C:\Program Files\PDF Complete\pdfsvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\windows\system32\PnkBstrA.exe
O23 - Service: RoxMediaDB10 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6173\SAService.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
J'ai été infecté par ce virus trojan (Trojan:Win32/C2Lop.gen!J )
il a aparement supprimé ou bloqué certains fichiers systeme et je pense qu'il s'est multiplié puisque je l'ai supprimé 5 fois!!
Que faire?
Ps:j'ai fait une analyse et j'ai télécharger un antivirus "Malwarebytes,Antimalware"
J'ai télécharger Hijackthis pour une analyse et voilà le rapport!!
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:15:57, on 21/06/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18248)
Boot mode: Normal
Running processes:
C:\windows\system32\Dwm.exe
C:\windows\Explorer.EXE
C:\windows\system32\taskeng.exe
C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtTry.exe
c:\Program Files\Hewlett-Packard\IAM\Bin\AsGHost.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe
C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\pthosttr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\SiteAdvisor\6173\SiteAdv.exe
C:\Program Files\Hewlett-Packard\File Sanitizer\CoreShredder.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
c:\Program Files\ActivIdentity\ActivClient\acevents.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\VolCtrl.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\windows\System32\wsqmcons.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www8.hp.com/fr/fr/home.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www8.hp.com/fr/fr/home.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www8.hp.com/fr/fr/home.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6173\SiteAdv.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: BHO_Startup - {3134413B-49B4-425C-98A5-893C1F195601} - C:\Program Files\Hewlett-Packard\File Sanitizer\IEBHO.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Credential Manager for HP ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - c:\Program Files\Hewlett-Packard\IAM\Bin\ItIEAddIn.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6173\SiteAdv.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [accrdsub] "c:\Program Files\ActivIdentity\ActivClient\accrdsub.exe"
O4 - HKLM\..\Run: [PTHOSTTR] c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe c:\PROGRA~1\HEWLET~1\IAM\Bin\ASTSVCC.dll,RegisterModule
O4 - HKLM\..\Run: [PDF Complete] C:\Program Files\PDF Complete\pdfsty.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [MVS Splash] C:\Program Files\McAfee\Managed VirusScan\Agent\Splash.exe
O4 - HKLM\..\Run: [McAfee Managed Services Tray] C:\Program Files\McAfee\Managed VirusScan\Agent\StartMyAgtTry.Exe
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6173\SiteAdv.exe
O4 - HKLM\..\Run: [File Sanitizer] C:\Program Files\Hewlett-Packard\File Sanitizer\CoreShredder.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [QlbCtrl.exe] C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
O4 - HKLM\..\Run: [HP Software Update] c:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\soundmax.exe /tray
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [second 32] "C:\ProgramData\Axis Wipe Wipe.m42y2"
O4 - HKCU\..\Run: [Fork live trust pop] "C:\ProgramData\drv lies base.kbverh4"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: Envoyer l'&image au périphérique Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix:
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - AppInit_DLLs: APSHook.dll,C:\windows\System32\dbnmpntw32.dll
O23 - Service: ActivClient Middleware Service (accoca) - ActivIdentity - c:\Program Files\ActivIdentity\ActivClient\accoca.exe
O23 - Service: Andrea ADI Filters Service (AEADIFilters) - Andrea Electronics Corporation - C:\windows\system32\AEADISRV.EXE
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\windows\system32\Ati2evxx.exe
O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
O23 - Service: EngineServer - McAfee, Inc. - C:\PROGRA~1\McAfee\MANAGE~1\VScan\ENGINE~1.EXE
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: HP ProtectTools Service - Hewlett-Packard Development Company, L.P - c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe
O23 - Service: Drive Encryption Service (HpFkCryptService) - SafeBoot International - c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
O23 - Service: File Sanitizer for HP ProtectTools (HPFSService) - Hewlett-Packard - C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: HP Service (hpsrv) - Hewlett-Packard Corporation - C:\windows\system32\Hpservice.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McShield - McAfee, Inc. - C:\PROGRA~1\McAfee\MANAGE~1\VScan\McShield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Virus and Spyware Protection Service (myAgtSvc) - McAfee, Inc. - C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.Exe
O23 - Service: PDF Document Manager (pdfcDispatcher) - PDF Complete Inc - C:\Program Files\PDF Complete\pdfsvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\windows\system32\PnkBstrA.exe
O23 - Service: RoxMediaDB10 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6173\SAService.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
A voir également:
- Trojan.win32.hosts2.gen
- Virus mcafee - Accueil - Piratage
- Trojan remover - Télécharger - Antivirus & Antimalwares
- Virus facebook demande d'amis - Accueil - Facebook
- Faux message virus iphone ✓ - Forum Virus
- Message virus iphone site adulte - Forum iPhone
72 réponses
It is possible that ComboFix, even on its first run, may have fixed the problems you are having
c'est ecris sur la page du guide pour combofix alors tes petites remarques garde les pour toi destrio5
prisita ton probleme semble etre majeur et difficile a resoudre par messieux tout le monde
alors retourne sur le site de combofix
au bas de la page tu y trouvera une liste de forum ou tu pouras poster ton log combo fix
et obtenir une aide plus adequate
c'est ecris sur la page du guide pour combofix alors tes petites remarques garde les pour toi destrio5
prisita ton probleme semble etre majeur et difficile a resoudre par messieux tout le monde
alors retourne sur le site de combofix
au bas de la page tu y trouvera une liste de forum ou tu pouras poster ton log combo fix
et obtenir une aide plus adequate
"c'est ecris sur la page du guide pour combofix alors tes petites remarques garde les pour toi destrio5"
--> Je pense être plus en mesure de l'aider que toi.
"au bas de la page tu y trouvera une liste de forum ou tu pouras poster ton log combo fix
et obtenir une aide plus adequate"
--> Dans les forums français, on y retrouve un forum où je fais partie de l'équipe de "désinfecteurs" donc quand on ne sait pas, on ne se tait car cela peut avoir des conséquences assez embêtantes pour l'utilisateur.
--> Je pense être plus en mesure de l'aider que toi.
"au bas de la page tu y trouvera une liste de forum ou tu pouras poster ton log combo fix
et obtenir une aide plus adequate"
--> Dans les forums français, on y retrouve un forum où je fais partie de l'équipe de "désinfecteurs" donc quand on ne sait pas, on ne se tait car cela peut avoir des conséquences assez embêtantes pour l'utilisateur.
voilà le rapport :
ComboFix 09-06-25.01 - Yohann 26/06/2009 22:48.2 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.33.1036.18.2041.1080 [GMT 2:00]
Lancé depuis: c:\users\Yohann\Desktop\ComboFix.exe
Commutateurs utilisés :: c:\users\Yohann\Desktop\CFScript.txt
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\Cicle Developement
c:\programdata\Eq Anti Fork Live
c:\programdata\Eq Anti Fork Live\ooze copy.dat
c:\programdata\KnobExtra
c:\windows\System32\autochk.exe . . . est infecté!!
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-05-26 au 2009-06-26 ))))))))))))))))))))))))))))))))))))
.
2009-06-26 20:53 . 2009-06-26 20:57 17408 ----a-w- c:\windows\system32\rpcnetp.exe
2009-06-26 20:14 . 2009-02-05 20:06 51376 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-06-26 20:14 . 2009-02-05 20:06 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-06-26 20:14 . 2009-02-05 20:04 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-06-26 20:14 . 2009-02-05 20:07 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-06-26 20:14 . 2009-02-05 20:07 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-06-26 20:14 . 2009-02-05 20:11 1256296 ----a-w- c:\windows\system32\aswBoot.exe
2009-06-26 20:14 . 2009-02-05 20:06 51792 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2009-06-26 20:14 . 2009-06-26 20:14 -------- d-----w- c:\program files\Alwil Software
2009-06-26 19:57 . 2009-06-26 20:58 -------- d-----w- c:\users\Yohann\AppData\Local\temp
2009-06-26 19:48 . 2008-04-21 06:28 384 ----a-w- c:\windows\myClean.bat
2009-06-24 01:33 . 2009-06-24 01:33 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-06-23 18:53 . 2009-06-23 18:53 -------- d-----w- C:\_OTM
2009-06-23 18:32 . 2009-06-23 18:32 -------- d-----w- C:\rsit
2009-06-23 17:28 . 2009-06-23 17:44 -------- d-----w- C:\Lop SD
2009-06-22 04:35 . 2009-05-09 05:50 915456 ----a-w- c:\windows\system32\wininet.dll
2009-06-22 04:35 . 2009-05-09 05:34 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-06-21 21:20 . 2009-06-21 21:20 -------- d-----w- c:\users\Yohann\AppData\Roaming\Malwarebytes
2009-06-21 21:20 . 2009-06-17 09:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-21 21:20 . 2009-06-21 21:20 -------- d-----w- c:\programdata\Malwarebytes
2009-06-21 21:20 . 2009-06-21 21:20 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-21 21:20 . 2009-06-17 09:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-21 21:12 . 2009-06-21 21:12 -------- d-----w- c:\program files\Trend Micro
2009-06-21 14:29 . 2009-06-21 14:29 -------- d-----w- c:\programdata\LightScribe
2009-06-21 13:30 . 2009-06-21 13:30 393216 ----a-w- c:\programdata\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_fr_0C51F9E1D600D10B.dll
2009-06-20 07:15 . 2009-06-24 18:06 -------- d-----w- c:\users\Yohann\AppData\Roaming\LimeWire
2009-06-20 07:15 . 2009-06-20 07:15 -------- d-----w- c:\program files\LimeWire
2009-06-17 21:33 . 2009-06-17 21:33 -------- d-----w- c:\users\Yohann\AppData\Roaming\InterVideo
2009-06-17 20:46 . 2009-06-17 20:46 -------- d-----w- c:\programdata\Messenger Plus!
2009-06-17 09:07 . 2007-05-31 17:30 266088 ----a-w- c:\windows\system32\xactengine2_8.dll
2009-06-17 09:07 . 2007-05-31 17:29 18280 ----a-w- c:\windows\system32\x3daudio1_2.dll
2009-06-17 09:07 . 2007-05-16 14:45 443752 ----a-w- c:\windows\system32\d3dx10_34.dll
2009-06-17 09:07 . 2007-05-16 14:45 3497832 ----a-w- c:\windows\system32\d3dx9_34.dll
2009-06-17 09:07 . 2007-05-16 14:45 1124720 ----a-w- c:\windows\system32\D3DCompiler_34.dll
2009-06-17 09:07 . 2007-03-15 14:57 443752 ----a-w- c:\windows\system32\d3dx10_33.dll
2009-06-17 09:07 . 2007-03-12 14:42 1123696 ----a-w- c:\windows\system32\D3DCompiler_33.dll
2009-06-17 09:07 . 2006-11-29 11:06 440080 ----a-w- c:\windows\system32\d3dx10.dll
2009-06-17 09:06 . 2009-06-17 09:06 103736 ----a-w- c:\users\Yohann\AppData\Roaming\PnkBstrB.exe
2009-06-17 09:06 . 2009-06-17 09:06 103736 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-06-17 09:06 . 2009-06-17 09:06 66872 ----a-w- c:\windows\system32\PnkBstrA.exe
2009-06-17 08:52 . 2009-06-17 08:52 -------- d-----w- c:\program files\Activision
2009-06-17 07:49 . 2009-06-17 07:49 -------- d-----w- c:\program files\Messenger Plus! Live
2009-06-17 05:58 . 2009-06-26 20:22 -------- d-----w- c:\users\Yohann\Tracing
2009-06-17 00:13 . 2009-06-18 01:19 -------- d-----w- c:\program files\Microsoft Silverlight
2009-06-17 00:12 . 2009-06-17 00:12 -------- d-----w- c:\program files\Microsoft Office Outlook Connector
2009-06-17 00:11 . 2009-06-17 00:11 -------- dc----w- c:\windows\system32\DRVSTORE
2009-06-17 00:11 . 2009-02-06 16:08 55280 ----a-w- c:\windows\system32\drivers\fssfltr.sys
2009-06-17 00:10 . 2009-06-17 00:10 -------- d-----w- c:\program files\Microsoft Sync Framework
2009-06-17 00:08 . 2009-06-17 00:08 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2009-06-17 00:05 . 2009-06-17 00:13 -------- d-----w- c:\program files\Microsoft
2009-06-17 00:05 . 2009-06-17 00:05 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-06-16 22:28 . 2009-06-16 22:28 -------- d-----w- c:\program files\Common Files\Windows Live
2009-06-16 22:13 . 2009-06-16 22:14 -------- dcsh--w- c:\program files\Common Files\WindowsLiveInstaller
2009-06-16 22:12 . 2009-06-17 00:11 -------- d-----w- c:\program files\Windows Live
2009-06-16 22:12 . 2009-06-16 22:12 -------- d-----w- c:\programdata\WLInstaller
2009-06-16 18:24 . 2009-06-26 20:51 12 ----a-w- c:\windows\bthservsdp.dat
2009-06-16 17:03 . 2009-06-19 07:21 -------- d-----w- c:\users\Yohann\AppData\Local\Microsoft Games
2009-06-16 16:47 . 2009-06-16 16:47 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-16 16:23 . 2008-10-22 01:22 2048 ----a-w- c:\windows\system32\tzres.dll
2009-06-16 16:00 . 2008-06-20 01:14 43544 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2009-06-16 16:00 . 2008-06-20 01:14 105016 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-06-16 16:00 . 2008-06-20 01:14 97800 ----a-w- c:\windows\system32\infocardapi.dll
2009-06-16 16:00 . 2008-06-20 01:14 11264 ----a-w- c:\windows\system32\icardres.dll
2009-06-16 16:00 . 2008-06-20 01:14 622080 ----a-w- c:\windows\system32\icardagt.exe
2009-06-16 16:00 . 2008-06-20 01:14 781344 ----a-w- c:\windows\system32\PresentationNative_v0300.dll
2009-06-16 16:00 . 2008-06-20 01:14 326160 ----a-w- c:\windows\system32\PresentationHost.exe
2009-06-16 15:56 . 2008-07-27 18:03 96760 ----a-w- c:\windows\system32\dfshim.dll
2009-06-16 15:55 . 2008-07-27 18:03 282112 ----a-w- c:\windows\system32\mscoree.dll
2009-06-16 15:55 . 2008-07-27 18:03 41984 ----a-w- c:\windows\system32\netfxperf.dll
2009-06-16 15:54 . 2008-07-27 18:03 158720 ----a-w- c:\windows\system32\mscorier.dll
2009-06-16 15:54 . 2008-07-27 18:03 83968 ----a-w- c:\windows\system32\mscories.dll
2009-06-16 15:51 . 2009-06-16 15:51 -------- d-----w- c:\program files\MSXML 4.0
2009-06-16 15:48 . 2009-04-30 12:37 428544 ----a-w- c:\windows\system32\EncDec.dll
2009-06-16 15:48 . 2009-04-30 12:37 293376 ----a-w- c:\windows\system32\psisdecd.dll
2009-06-16 15:47 . 2008-06-26 01:45 12240896 ----a-w- c:\windows\system32\NlsLexicons0007.dll
2009-06-16 15:47 . 2008-06-26 01:45 2644480 ----a-w- c:\windows\system32\NlsLexicons0009.dll
2009-06-16 15:46 . 2008-06-26 03:29 801280 ----a-w- c:\windows\system32\NaturalLanguage6.dll
2009-06-16 15:42 . 2009-04-23 12:42 636928 ----a-w- c:\windows\system32\localspl.dll
2009-06-16 15:39 . 2008-04-10 05:12 738304 ----a-w- c:\windows\system32\inetcomm.dll
2009-06-16 15:39 . 2008-04-26 08:08 1314816 ----a-w- c:\windows\system32\quartz.dll
2009-06-16 15:28 . 2008-09-10 03:40 1334272 ----a-w- c:\windows\system32\msxml6.dll
2009-06-16 15:25 . 2009-06-20 09:59 -------- d-----w- c:\users\Yohann\AppData\Local\Adobe
2009-06-16 15:24 . 2009-06-21 13:30 -------- d-----w- c:\users\Yohann\AppData\Local\Google
2009-06-16 15:24 . 2009-06-26 19:37 -------- d-----w- c:\programdata\NOS
2009-06-16 15:24 . 2009-06-26 19:37 -------- d-----w- c:\program files\NOS
2009-06-16 15:23 . 2009-06-21 13:13 -------- d-----w- c:\program files\Google
2009-06-16 15:18 . 2008-10-16 21:13 1809944 ----a-w- c:\windows\system32\wuaueng.dll
2009-06-16 15:18 . 2008-10-16 21:09 51224 ----a-w- c:\windows\system32\wuauclt.exe
2009-06-16 15:18 . 2008-10-16 21:09 43544 ----a-w- c:\windows\system32\wups2.dll
2009-06-16 15:18 . 2008-10-16 20:56 1524736 ----a-w- c:\windows\system32\wucltux.dll
2009-06-16 15:17 . 2008-10-16 21:08 34328 ----a-w- c:\windows\system32\wups.dll
2009-06-16 15:17 . 2008-10-16 20:55 83456 ----a-w- c:\windows\system32\wudriver.dll
2009-06-16 15:17 . 2008-10-16 21:12 561688 ----a-w- c:\windows\system32\wuapi.dll
2009-06-16 15:17 . 2008-10-16 12:08 162064 ----a-w- c:\windows\system32\wuwebv.dll
2009-06-16 15:17 . 2008-10-16 11:56 31232 ----a-w- c:\windows\system32\wuapp.exe
2009-06-16 15:02 . 2009-06-16 15:02 -------- d-----w- c:\users\Yohann\AppData\Roaming\ATI
2009-06-16 15:02 . 2009-06-16 15:02 -------- d-----w- c:\users\Yohann\AppData\Local\ATI
2009-06-16 15:02 . 2009-06-16 15:02 -------- d-----w- c:\programdata\ATI
2009-06-16 15:02 . 2009-06-21 14:41 -------- d-----w- c:\users\Yohann\AppData\Roaming\HPQLOG
2009-06-16 15:01 . 2009-06-18 06:41 115312 ----a-w- c:\users\Yohann\AppData\Local\GDIPFONTCACHEV1.DAT
2009-06-16 15:01 . 2009-06-16 15:01 44 ----a-w- c:\windows\system\hpsysdrv.dat
2009-06-16 14:52 . 2009-06-16 14:52 -------- d-----w- c:\users\Yohann\AppData\Roaming\Hewlett-Packard
2009-06-16 14:49 . 2009-06-16 14:49 -------- d-----w- c:\program files\HP Webcam Application
2009-06-16 14:48 . 2008-03-07 13:35 180224 ----a-w- c:\windows\system32\rsnp2uvc.dll
2009-06-16 14:48 . 2009-06-16 14:48 -------- d-----w- c:\program files\Common Files\SNP2UVC
2009-06-16 14:48 . 2008-04-10 15:27 1804160 ----a-w- c:\windows\system32\drivers\snp2uvc.sys
2009-06-16 14:48 . 2007-07-05 06:28 176128 ----a-w- c:\windows\system32\csnp2uvc.dll
2009-06-16 14:48 . 2007-05-10 04:16 28160 ----a-w- c:\windows\system32\drivers\sncduvc.sys
2009-06-16 14:48 . 2009-06-16 14:48 -------- d-----w- c:\windows\Hewlett-Packard
2009-06-16 14:47 . 2009-06-16 14:47 -------- d-----w- c:\users\Yohann\Bluetooth Software
2009-06-16 14:47 . 2008-02-01 09:41 80936 ----a-w- c:\windows\system32\drivers\btwavdt.sys
2009-06-16 14:47 . 2008-02-01 09:41 80424 ----a-w- c:\windows\system32\drivers\btwaudio.sys
2009-06-16 14:47 . 2008-02-01 09:41 16168 ----a-w- c:\windows\system32\drivers\btwrchid.sys
2009-06-16 14:47 . 2008-02-01 09:41 233472 ----a-w- c:\windows\system32\BtwRSupport.dll
2009-06-16 14:46 . 2009-06-16 14:46 -------- d-----w- c:\windows\system32\es-MX
2009-06-16 14:46 . 2009-06-16 14:46 -------- d-----w- c:\windows\system32\es-AR
2009-06-16 14:46 . 2009-06-16 14:46 -------- d-----w- c:\program files\WIDCOMM
2009-06-16 14:42 . 2009-06-16 14:43 -------- d-----w- c:\program files\ATI Technologies
2009-06-16 14:42 . 2009-06-16 14:42 -------- d-----w- c:\program files\ATI
2009-06-16 14:41 . 2009-06-16 14:41 -------- d-----w- c:\users\Yohann\AppData\Roaming\InstallShield
2009-06-16 14:32 . 2009-06-16 14:32 -------- d-sh--we c:\programdata\Modèles
2009-06-16 14:32 . 2009-06-16 14:32 -------- d-sh--we c:\programdata\Menu Démarrer
2009-06-16 14:32 . 2009-06-16 14:32 -------- d-sh--we c:\program files\Fichiers communs
2009-06-16 14:32 . 2009-06-16 14:32 -------- d-sh--we c:\users\Default\Voisinage réseau
2009-06-16 14:32 . 2009-06-16 14:32 -------- d-sh--we c:\users\Default\Voisinage d'impression
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-26 20:57 . 2008-06-18 08:38 -------- d-----w- c:\programdata\hpqLog
2009-06-26 20:57 . 2008-04-17 10:29 17408 ----a-w- c:\windows\system32\rpcnetp.dll
2009-06-26 20:27 . 2008-04-15 21:57 713542 ----a-w- c:\windows\system32\perfh00C.dat
2009-06-26 20:27 . 2008-04-15 21:57 143542 ----a-w- c:\windows\system32\perfc00C.dat
2009-06-26 20:21 . 2008-06-18 09:17 -------- d-----w- c:\program files\McAfee
2009-06-26 19:47 . 2008-06-18 09:19 -------- d-----w- c:\programdata\SiteAdvisor
2009-06-24 01:32 . 2008-06-18 09:20 -------- d-----w- c:\program files\Java
2009-06-19 01:03 . 2008-06-18 08:57 -------- d-----w- c:\programdata\Microsoft Help
2009-06-18 01:06 . 2008-06-18 09:03 -------- d-----w- c:\program files\Microsoft Works
2009-06-17 09:06 . 2008-06-18 08:50 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-16 16:51 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-06-16 14:52 . 2008-06-18 08:51 -------- d-----w- c:\programdata\Hewlett-Packard
2009-06-16 14:41 . 2008-06-18 08:02 -------- d-----w- c:\program files\Analog Devices
2009-06-16 14:41 . 2008-06-18 08:02 -------- d-----w- c:\programdata\SonicFocus
2009-06-16 14:41 . 2009-06-16 14:41 0 --sha-r- c:\windows\system32\drivers\103C_HP_bNB_6830s_Y5336AN_0U_QCNU9112CM7_E480268-A41_4A_I30E9_SHP_V95.1C_68PZD F.0A_T090220_WV3-1_L40C_M2042_J250_7Intel_86FD_92.00_#080618_N_(KU404ET#ABF)_XMOBILE_CN10_Z_2F.0A_G100295C2.MRK
2009-06-16 14:32 . 2009-06-16 14:32 -------- d-sh--we c:\programdata\Modèles
2009-06-16 14:32 . 2009-06-16 14:32 -------- d-sh--we c:\programdata\Menu Démarrer
2009-04-23 12:43 . 2009-06-16 15:42 784896 ----a-w- c:\windows\system32\rpcrt4.dll
2009-04-21 11:55 . 2009-06-16 15:42 2033152 ----a-w- c:\windows\system32\win32k.sys
2008-06-18 08:50 . 2008-06-18 08:50 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.
(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
--- c:\windows\System32\rpcnetp.exe ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File size: 17408
Created time: 2009-06-26 20:18
Modified time: 2009-06-26 20:21
MD5: 5A186198384A33FF53FB5B3A26368BB3
SHA1: B3DEC5473D1AB94DD8BB73B636A8DCC5134008FC
((((((((((((((((((((((((((((( SnapShot@2009-06-26_19.55.46 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-04-17 10:30 . 2009-06-26 19:48 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-04-17 10:30 . 2009-06-26 20:57 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-04-17 10:30 . 2009-06-26 19:48 49152 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-04-17 10:30 . 2009-06-26 20:57 49152 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-04-17 10:30 . 2009-06-26 19:48 49152 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-04-17 10:30 . 2009-06-26 20:57 49152 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-06-16 16:59 . 2009-06-26 20:59 5948 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1394742981-1742767709-1642677689-1004_UserData.bin
+ 2009-06-26 20:52 . 2009-06-26 20:57 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2009-06-26 04:21 . 2009-06-26 19:03 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2009-06-26 04:21 . 2009-06-26 19:03 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-06-26 20:52 . 2009-06-26 20:57 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-06-19 20:44 . 2009-06-26 20:55 150520 c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2006-11-02 13:05 . 2009-06-26 20:59 100980 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 10:33 . 2009-06-26 20:27 625582 c:\windows\System32\perfh009.dat
- 2006-11-02 10:33 . 2009-06-26 19:09 625582 c:\windows\System32\perfh009.dat
+ 2006-11-02 10:33 . 2009-06-26 20:27 117144 c:\windows\System32\perfc009.dat
- 2006-11-02 10:33 . 2009-06-26 19:09 117144 c:\windows\System32\perfc009.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-03-18 2289664]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-02-06 3885408]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-06-21 39408]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-04-18 178712]
"accrdsub"="c:\program files\ActivIdentity\ActivClient\accrdsub.exe" [2007-05-15 293168]
"PTHOSTTR"="c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE" [2008-05-08 238984]
"CognizanceTS"="c:\progra~1\HEWLET~1\IAM\Bin\ASTSVCC.dll" [2008-05-21 24848]
"PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2008-05-12 318488]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-27 1045800]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-04-15 70912]
"File Sanitizer"="c:\program files\Hewlett-Packard\File Sanitizer\CoreShredder.exe" [2008-05-02 10244096]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-24 148888]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-05-14 177456]
"WatchDog"="c:\program files\InterVideo\DVD Check\DVDCheck.exe" [2008-05-24 197904]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2008-04-04 1314816]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-1-16 727592]
DVD Check.lnk - c:\program files\InterVideo\DVD Check\DVDCheck.exe [2008-6-18 197904]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"FilterAdministratorToken"= 1 (0x1)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\APSHook.dll c:\windows\System32\APSHook.dll c:\windows\System32\APSHook.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer2"=wdmaud.drv
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli ASWLNPkg
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{36A4BBC5-0A1A-4D0F-87E9-C9601168FD0F}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{0D63D014-898A-48B4-B1FC-972F9B8BA154}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync
"{FC58988B-2CE6-49CF-8199-897CBA332176}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{D8F0A442-2EF8-4BA0-8675-CD175FF3BBBE}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{9F18E239-8650-46B7-B49D-7B05AD4E0152}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{9B29CB20-F4D0-4357-A799-31DB50769022}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{0CBFE391-2725-4ADA-B0B0-5540BF8D6309}"= UDP:c:\program files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"{CDFEA762-B6DE-470E-8E0A-DD7567411731}"= TCP:c:\program files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
R0 SbAlg;SbAlg;c:\windows\System32\drivers\SbAlg.sys [14/05/2008 02:36 51376]
R0 SbFsLock;SbFsLock;c:\windows\System32\drivers\SbFsLock.sys [14/05/2008 02:36 12928]
R1 aswSP;avast! Self Protection;c:\windows\System32\drivers\aswSP.sys [26/06/2009 22:14 114768]
R1 RsvLock;RsvLock;c:\windows\System32\drivers\rsvlock.sys [14/05/2008 02:36 12496]
R2 accoca;ActivClient Middleware Service;c:\program files\ActivIdentity\ActivClient\accoca.exe [16/05/2007 01:08 182576]
R2 ASBroker;Logon Session Broker;c:\windows\System32\svchost.exe -k Cognizance [21/01/2008 04:23 21504]
R2 ASChannel;Local Communication Channel;c:\windows\System32\svchost.exe -k Cognizance [21/01/2008 04:23 21504]
R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [26/06/2009 22:14 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [26/06/2009 22:14 51792]
R2 HP ProtectTools Service;HP ProtectTools Service;c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe [14/05/2008 22:41 34184]
R2 HpFkCryptService;Drive Encryption Service;c:\program files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [14/05/2008 02:35 256512]
R2 HPFSService;File Sanitizer for HP ProtectTools;c:\program files\Hewlett-Packard\File Sanitizer\HPFSService.exe [18/06/2008 11:20 77824]
R2 hpsrv;HP Service;c:\windows\System32\hpservice.exe [07/04/2008 20:13 24936]
R2 pdfcDispatcher;PDF Document Manager;c:\program files\PDF Complete\pdfsvc.exe [18/06/2008 10:50 576024]
R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [18/06/2008 11:21 193840]
R3 NETw5v32;Pilote de carte Intel(R) Wireless WiFi Link pour Windows Vista 32 bits ;c:\windows\System32\drivers\NETw5v32.sys [28/04/2008 08:29 3658752]
RUnknown rpcnetp;rpcnetp; [x]
S2 0288391246045635mcinstcleanup;McAfee Application Installer Cleanup (0288391246045635);c:\users\Yohann\AppData\Local\Temp\028839~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service --> c:\users\Yohann\AppData\Local\Temp\028839~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service [?]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\System32\drivers\b57nd60x.sys [21/01/2008 04:23 179712]
S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [17/06/2009 02:11 55280]
S3 fsssvc;Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [06/02/2009 18:08 533360]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\System32\drivers\mbamswissarmy.sys [21/06/2009 23:20 38160]
S3 RoxMediaDB10;RoxMediaDB10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [08/04/2008 14:12 1112560]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Cognizance REG_MULTI_SZ ASBroker ASChannel
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
bthsvcs REG_MULTI_SZ BthServ
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Contenu du dossier 'Tâches planifiées'
2009-06-26 c:\windows\Tasks\User_Feed_Synchronization-{7B780B48-2074-446D-8864-2E018D9F0FAC}.job
- c:\windows\system32\msfeedssync.exe [2009-06-22 11:31]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fr_mq&c=83&bd=all&pf=cmnb
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Envoyer au périphérique &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: Envoyer l'&image au périphérique Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-26 22:58
Windows 6.0.6001 Service Pack 1 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pdfcDispatcher]
"ImagePath"="c:\program files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'lsass.exe'(712)
c:\program files\Hewlett-Packard\IAM\bin\ASWLNPkg.dll
c:\program files\Hewlett-Packard\IAM\bin\ItMsg.dll
- - - - - - - > 'Explorer.exe'(2624)
c:\program files\Hewlett-Packard\IAM\Bin\ItClient.dll
c:\windows\system32\btmmhook.dll
c:\program files\Hewlett-Packard\File Sanitizer\HPPMDesktopIcon.dll
c:\windows\system32\btncopy.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\System32\Ati2evxx.exe
c:\windows\System32\audiodg.exe
c:\windows\System32\Ati2evxx.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\System32\AEADISRV.EXE
c:\windows\System32\agrsmsvc.exe
c:\program files\ActivIdentity\ActivClient\acevents.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\System32\PnkBstrA.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Hewlett-Packard\Shared\hpqWmiEx.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\servicing\TrustedInstaller.exe
c:\program files\Hewlett-Packard\IAM\Bin\asghost.exe
c:\windows\System32\conime.exe
c:\program files\Alwil Software\Avast4\ashDisp.exe
c:\program files\Hewlett-Packard\HP Quick Launch Buttons\VolCtrl.exe
c:\program files\ActivIdentity\ActivClient\acevents.exe
c:\program files\WIDCOMM\Bluetooth Software\BTStackServer.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
c:\program files\Hewlett-Packard\Shared\HpqToaster.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\program files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
c:\windows\System32\wbem\WMIADAP.exe
.
**************************************************************************
.
Heure de fin: 2009-06-26 23:02 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-06-26 21:02
ComboFix2.txt 2009-06-26 19:57
Avant-CF: 183 943 888 896 octets libres
Après-CF: 183 808 524 288 octets libres
375 --- E O F --- 2009-06-26 18:19
ComboFix 09-06-25.01 - Yohann 26/06/2009 22:48.2 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.33.1036.18.2041.1080 [GMT 2:00]
Lancé depuis: c:\users\Yohann\Desktop\ComboFix.exe
Commutateurs utilisés :: c:\users\Yohann\Desktop\CFScript.txt
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\Cicle Developement
c:\programdata\Eq Anti Fork Live
c:\programdata\Eq Anti Fork Live\ooze copy.dat
c:\programdata\KnobExtra
c:\windows\System32\autochk.exe . . . est infecté!!
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-05-26 au 2009-06-26 ))))))))))))))))))))))))))))))))))))
.
2009-06-26 20:53 . 2009-06-26 20:57 17408 ----a-w- c:\windows\system32\rpcnetp.exe
2009-06-26 20:14 . 2009-02-05 20:06 51376 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-06-26 20:14 . 2009-02-05 20:06 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-06-26 20:14 . 2009-02-05 20:04 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-06-26 20:14 . 2009-02-05 20:07 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-06-26 20:14 . 2009-02-05 20:07 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-06-26 20:14 . 2009-02-05 20:11 1256296 ----a-w- c:\windows\system32\aswBoot.exe
2009-06-26 20:14 . 2009-02-05 20:06 51792 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2009-06-26 20:14 . 2009-06-26 20:14 -------- d-----w- c:\program files\Alwil Software
2009-06-26 19:57 . 2009-06-26 20:58 -------- d-----w- c:\users\Yohann\AppData\Local\temp
2009-06-26 19:48 . 2008-04-21 06:28 384 ----a-w- c:\windows\myClean.bat
2009-06-24 01:33 . 2009-06-24 01:33 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-06-23 18:53 . 2009-06-23 18:53 -------- d-----w- C:\_OTM
2009-06-23 18:32 . 2009-06-23 18:32 -------- d-----w- C:\rsit
2009-06-23 17:28 . 2009-06-23 17:44 -------- d-----w- C:\Lop SD
2009-06-22 04:35 . 2009-05-09 05:50 915456 ----a-w- c:\windows\system32\wininet.dll
2009-06-22 04:35 . 2009-05-09 05:34 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-06-21 21:20 . 2009-06-21 21:20 -------- d-----w- c:\users\Yohann\AppData\Roaming\Malwarebytes
2009-06-21 21:20 . 2009-06-17 09:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-21 21:20 . 2009-06-21 21:20 -------- d-----w- c:\programdata\Malwarebytes
2009-06-21 21:20 . 2009-06-21 21:20 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-21 21:20 . 2009-06-17 09:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-21 21:12 . 2009-06-21 21:12 -------- d-----w- c:\program files\Trend Micro
2009-06-21 14:29 . 2009-06-21 14:29 -------- d-----w- c:\programdata\LightScribe
2009-06-21 13:30 . 2009-06-21 13:30 393216 ----a-w- c:\programdata\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_fr_0C51F9E1D600D10B.dll
2009-06-20 07:15 . 2009-06-24 18:06 -------- d-----w- c:\users\Yohann\AppData\Roaming\LimeWire
2009-06-20 07:15 . 2009-06-20 07:15 -------- d-----w- c:\program files\LimeWire
2009-06-17 21:33 . 2009-06-17 21:33 -------- d-----w- c:\users\Yohann\AppData\Roaming\InterVideo
2009-06-17 20:46 . 2009-06-17 20:46 -------- d-----w- c:\programdata\Messenger Plus!
2009-06-17 09:07 . 2007-05-31 17:30 266088 ----a-w- c:\windows\system32\xactengine2_8.dll
2009-06-17 09:07 . 2007-05-31 17:29 18280 ----a-w- c:\windows\system32\x3daudio1_2.dll
2009-06-17 09:07 . 2007-05-16 14:45 443752 ----a-w- c:\windows\system32\d3dx10_34.dll
2009-06-17 09:07 . 2007-05-16 14:45 3497832 ----a-w- c:\windows\system32\d3dx9_34.dll
2009-06-17 09:07 . 2007-05-16 14:45 1124720 ----a-w- c:\windows\system32\D3DCompiler_34.dll
2009-06-17 09:07 . 2007-03-15 14:57 443752 ----a-w- c:\windows\system32\d3dx10_33.dll
2009-06-17 09:07 . 2007-03-12 14:42 1123696 ----a-w- c:\windows\system32\D3DCompiler_33.dll
2009-06-17 09:07 . 2006-11-29 11:06 440080 ----a-w- c:\windows\system32\d3dx10.dll
2009-06-17 09:06 . 2009-06-17 09:06 103736 ----a-w- c:\users\Yohann\AppData\Roaming\PnkBstrB.exe
2009-06-17 09:06 . 2009-06-17 09:06 103736 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-06-17 09:06 . 2009-06-17 09:06 66872 ----a-w- c:\windows\system32\PnkBstrA.exe
2009-06-17 08:52 . 2009-06-17 08:52 -------- d-----w- c:\program files\Activision
2009-06-17 07:49 . 2009-06-17 07:49 -------- d-----w- c:\program files\Messenger Plus! Live
2009-06-17 05:58 . 2009-06-26 20:22 -------- d-----w- c:\users\Yohann\Tracing
2009-06-17 00:13 . 2009-06-18 01:19 -------- d-----w- c:\program files\Microsoft Silverlight
2009-06-17 00:12 . 2009-06-17 00:12 -------- d-----w- c:\program files\Microsoft Office Outlook Connector
2009-06-17 00:11 . 2009-06-17 00:11 -------- dc----w- c:\windows\system32\DRVSTORE
2009-06-17 00:11 . 2009-02-06 16:08 55280 ----a-w- c:\windows\system32\drivers\fssfltr.sys
2009-06-17 00:10 . 2009-06-17 00:10 -------- d-----w- c:\program files\Microsoft Sync Framework
2009-06-17 00:08 . 2009-06-17 00:08 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2009-06-17 00:05 . 2009-06-17 00:13 -------- d-----w- c:\program files\Microsoft
2009-06-17 00:05 . 2009-06-17 00:05 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-06-16 22:28 . 2009-06-16 22:28 -------- d-----w- c:\program files\Common Files\Windows Live
2009-06-16 22:13 . 2009-06-16 22:14 -------- dcsh--w- c:\program files\Common Files\WindowsLiveInstaller
2009-06-16 22:12 . 2009-06-17 00:11 -------- d-----w- c:\program files\Windows Live
2009-06-16 22:12 . 2009-06-16 22:12 -------- d-----w- c:\programdata\WLInstaller
2009-06-16 18:24 . 2009-06-26 20:51 12 ----a-w- c:\windows\bthservsdp.dat
2009-06-16 17:03 . 2009-06-19 07:21 -------- d-----w- c:\users\Yohann\AppData\Local\Microsoft Games
2009-06-16 16:47 . 2009-06-16 16:47 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-16 16:23 . 2008-10-22 01:22 2048 ----a-w- c:\windows\system32\tzres.dll
2009-06-16 16:00 . 2008-06-20 01:14 43544 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2009-06-16 16:00 . 2008-06-20 01:14 105016 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-06-16 16:00 . 2008-06-20 01:14 97800 ----a-w- c:\windows\system32\infocardapi.dll
2009-06-16 16:00 . 2008-06-20 01:14 11264 ----a-w- c:\windows\system32\icardres.dll
2009-06-16 16:00 . 2008-06-20 01:14 622080 ----a-w- c:\windows\system32\icardagt.exe
2009-06-16 16:00 . 2008-06-20 01:14 781344 ----a-w- c:\windows\system32\PresentationNative_v0300.dll
2009-06-16 16:00 . 2008-06-20 01:14 326160 ----a-w- c:\windows\system32\PresentationHost.exe
2009-06-16 15:56 . 2008-07-27 18:03 96760 ----a-w- c:\windows\system32\dfshim.dll
2009-06-16 15:55 . 2008-07-27 18:03 282112 ----a-w- c:\windows\system32\mscoree.dll
2009-06-16 15:55 . 2008-07-27 18:03 41984 ----a-w- c:\windows\system32\netfxperf.dll
2009-06-16 15:54 . 2008-07-27 18:03 158720 ----a-w- c:\windows\system32\mscorier.dll
2009-06-16 15:54 . 2008-07-27 18:03 83968 ----a-w- c:\windows\system32\mscories.dll
2009-06-16 15:51 . 2009-06-16 15:51 -------- d-----w- c:\program files\MSXML 4.0
2009-06-16 15:48 . 2009-04-30 12:37 428544 ----a-w- c:\windows\system32\EncDec.dll
2009-06-16 15:48 . 2009-04-30 12:37 293376 ----a-w- c:\windows\system32\psisdecd.dll
2009-06-16 15:47 . 2008-06-26 01:45 12240896 ----a-w- c:\windows\system32\NlsLexicons0007.dll
2009-06-16 15:47 . 2008-06-26 01:45 2644480 ----a-w- c:\windows\system32\NlsLexicons0009.dll
2009-06-16 15:46 . 2008-06-26 03:29 801280 ----a-w- c:\windows\system32\NaturalLanguage6.dll
2009-06-16 15:42 . 2009-04-23 12:42 636928 ----a-w- c:\windows\system32\localspl.dll
2009-06-16 15:39 . 2008-04-10 05:12 738304 ----a-w- c:\windows\system32\inetcomm.dll
2009-06-16 15:39 . 2008-04-26 08:08 1314816 ----a-w- c:\windows\system32\quartz.dll
2009-06-16 15:28 . 2008-09-10 03:40 1334272 ----a-w- c:\windows\system32\msxml6.dll
2009-06-16 15:25 . 2009-06-20 09:59 -------- d-----w- c:\users\Yohann\AppData\Local\Adobe
2009-06-16 15:24 . 2009-06-21 13:30 -------- d-----w- c:\users\Yohann\AppData\Local\Google
2009-06-16 15:24 . 2009-06-26 19:37 -------- d-----w- c:\programdata\NOS
2009-06-16 15:24 . 2009-06-26 19:37 -------- d-----w- c:\program files\NOS
2009-06-16 15:23 . 2009-06-21 13:13 -------- d-----w- c:\program files\Google
2009-06-16 15:18 . 2008-10-16 21:13 1809944 ----a-w- c:\windows\system32\wuaueng.dll
2009-06-16 15:18 . 2008-10-16 21:09 51224 ----a-w- c:\windows\system32\wuauclt.exe
2009-06-16 15:18 . 2008-10-16 21:09 43544 ----a-w- c:\windows\system32\wups2.dll
2009-06-16 15:18 . 2008-10-16 20:56 1524736 ----a-w- c:\windows\system32\wucltux.dll
2009-06-16 15:17 . 2008-10-16 21:08 34328 ----a-w- c:\windows\system32\wups.dll
2009-06-16 15:17 . 2008-10-16 20:55 83456 ----a-w- c:\windows\system32\wudriver.dll
2009-06-16 15:17 . 2008-10-16 21:12 561688 ----a-w- c:\windows\system32\wuapi.dll
2009-06-16 15:17 . 2008-10-16 12:08 162064 ----a-w- c:\windows\system32\wuwebv.dll
2009-06-16 15:17 . 2008-10-16 11:56 31232 ----a-w- c:\windows\system32\wuapp.exe
2009-06-16 15:02 . 2009-06-16 15:02 -------- d-----w- c:\users\Yohann\AppData\Roaming\ATI
2009-06-16 15:02 . 2009-06-16 15:02 -------- d-----w- c:\users\Yohann\AppData\Local\ATI
2009-06-16 15:02 . 2009-06-16 15:02 -------- d-----w- c:\programdata\ATI
2009-06-16 15:02 . 2009-06-21 14:41 -------- d-----w- c:\users\Yohann\AppData\Roaming\HPQLOG
2009-06-16 15:01 . 2009-06-18 06:41 115312 ----a-w- c:\users\Yohann\AppData\Local\GDIPFONTCACHEV1.DAT
2009-06-16 15:01 . 2009-06-16 15:01 44 ----a-w- c:\windows\system\hpsysdrv.dat
2009-06-16 14:52 . 2009-06-16 14:52 -------- d-----w- c:\users\Yohann\AppData\Roaming\Hewlett-Packard
2009-06-16 14:49 . 2009-06-16 14:49 -------- d-----w- c:\program files\HP Webcam Application
2009-06-16 14:48 . 2008-03-07 13:35 180224 ----a-w- c:\windows\system32\rsnp2uvc.dll
2009-06-16 14:48 . 2009-06-16 14:48 -------- d-----w- c:\program files\Common Files\SNP2UVC
2009-06-16 14:48 . 2008-04-10 15:27 1804160 ----a-w- c:\windows\system32\drivers\snp2uvc.sys
2009-06-16 14:48 . 2007-07-05 06:28 176128 ----a-w- c:\windows\system32\csnp2uvc.dll
2009-06-16 14:48 . 2007-05-10 04:16 28160 ----a-w- c:\windows\system32\drivers\sncduvc.sys
2009-06-16 14:48 . 2009-06-16 14:48 -------- d-----w- c:\windows\Hewlett-Packard
2009-06-16 14:47 . 2009-06-16 14:47 -------- d-----w- c:\users\Yohann\Bluetooth Software
2009-06-16 14:47 . 2008-02-01 09:41 80936 ----a-w- c:\windows\system32\drivers\btwavdt.sys
2009-06-16 14:47 . 2008-02-01 09:41 80424 ----a-w- c:\windows\system32\drivers\btwaudio.sys
2009-06-16 14:47 . 2008-02-01 09:41 16168 ----a-w- c:\windows\system32\drivers\btwrchid.sys
2009-06-16 14:47 . 2008-02-01 09:41 233472 ----a-w- c:\windows\system32\BtwRSupport.dll
2009-06-16 14:46 . 2009-06-16 14:46 -------- d-----w- c:\windows\system32\es-MX
2009-06-16 14:46 . 2009-06-16 14:46 -------- d-----w- c:\windows\system32\es-AR
2009-06-16 14:46 . 2009-06-16 14:46 -------- d-----w- c:\program files\WIDCOMM
2009-06-16 14:42 . 2009-06-16 14:43 -------- d-----w- c:\program files\ATI Technologies
2009-06-16 14:42 . 2009-06-16 14:42 -------- d-----w- c:\program files\ATI
2009-06-16 14:41 . 2009-06-16 14:41 -------- d-----w- c:\users\Yohann\AppData\Roaming\InstallShield
2009-06-16 14:32 . 2009-06-16 14:32 -------- d-sh--we c:\programdata\Modèles
2009-06-16 14:32 . 2009-06-16 14:32 -------- d-sh--we c:\programdata\Menu Démarrer
2009-06-16 14:32 . 2009-06-16 14:32 -------- d-sh--we c:\program files\Fichiers communs
2009-06-16 14:32 . 2009-06-16 14:32 -------- d-sh--we c:\users\Default\Voisinage réseau
2009-06-16 14:32 . 2009-06-16 14:32 -------- d-sh--we c:\users\Default\Voisinage d'impression
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-26 20:57 . 2008-06-18 08:38 -------- d-----w- c:\programdata\hpqLog
2009-06-26 20:57 . 2008-04-17 10:29 17408 ----a-w- c:\windows\system32\rpcnetp.dll
2009-06-26 20:27 . 2008-04-15 21:57 713542 ----a-w- c:\windows\system32\perfh00C.dat
2009-06-26 20:27 . 2008-04-15 21:57 143542 ----a-w- c:\windows\system32\perfc00C.dat
2009-06-26 20:21 . 2008-06-18 09:17 -------- d-----w- c:\program files\McAfee
2009-06-26 19:47 . 2008-06-18 09:19 -------- d-----w- c:\programdata\SiteAdvisor
2009-06-24 01:32 . 2008-06-18 09:20 -------- d-----w- c:\program files\Java
2009-06-19 01:03 . 2008-06-18 08:57 -------- d-----w- c:\programdata\Microsoft Help
2009-06-18 01:06 . 2008-06-18 09:03 -------- d-----w- c:\program files\Microsoft Works
2009-06-17 09:06 . 2008-06-18 08:50 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-16 16:51 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-06-16 14:52 . 2008-06-18 08:51 -------- d-----w- c:\programdata\Hewlett-Packard
2009-06-16 14:41 . 2008-06-18 08:02 -------- d-----w- c:\program files\Analog Devices
2009-06-16 14:41 . 2008-06-18 08:02 -------- d-----w- c:\programdata\SonicFocus
2009-06-16 14:41 . 2009-06-16 14:41 0 --sha-r- c:\windows\system32\drivers\103C_HP_bNB_6830s_Y5336AN_0U_QCNU9112CM7_E480268-A41_4A_I30E9_SHP_V95.1C_68PZD F.0A_T090220_WV3-1_L40C_M2042_J250_7Intel_86FD_92.00_#080618_N_(KU404ET#ABF)_XMOBILE_CN10_Z_2F.0A_G100295C2.MRK
2009-06-16 14:32 . 2009-06-16 14:32 -------- d-sh--we c:\programdata\Modèles
2009-06-16 14:32 . 2009-06-16 14:32 -------- d-sh--we c:\programdata\Menu Démarrer
2009-04-23 12:43 . 2009-06-16 15:42 784896 ----a-w- c:\windows\system32\rpcrt4.dll
2009-04-21 11:55 . 2009-06-16 15:42 2033152 ----a-w- c:\windows\system32\win32k.sys
2008-06-18 08:50 . 2008-06-18 08:50 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.
(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
--- c:\windows\System32\rpcnetp.exe ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File size: 17408
Created time: 2009-06-26 20:18
Modified time: 2009-06-26 20:21
MD5: 5A186198384A33FF53FB5B3A26368BB3
SHA1: B3DEC5473D1AB94DD8BB73B636A8DCC5134008FC
((((((((((((((((((((((((((((( SnapShot@2009-06-26_19.55.46 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-04-17 10:30 . 2009-06-26 19:48 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-04-17 10:30 . 2009-06-26 20:57 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-04-17 10:30 . 2009-06-26 19:48 49152 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-04-17 10:30 . 2009-06-26 20:57 49152 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-04-17 10:30 . 2009-06-26 19:48 49152 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-04-17 10:30 . 2009-06-26 20:57 49152 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-06-16 16:59 . 2009-06-26 20:59 5948 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1394742981-1742767709-1642677689-1004_UserData.bin
+ 2009-06-26 20:52 . 2009-06-26 20:57 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2009-06-26 04:21 . 2009-06-26 19:03 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2009-06-26 04:21 . 2009-06-26 19:03 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-06-26 20:52 . 2009-06-26 20:57 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-06-19 20:44 . 2009-06-26 20:55 150520 c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2006-11-02 13:05 . 2009-06-26 20:59 100980 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 10:33 . 2009-06-26 20:27 625582 c:\windows\System32\perfh009.dat
- 2006-11-02 10:33 . 2009-06-26 19:09 625582 c:\windows\System32\perfh009.dat
+ 2006-11-02 10:33 . 2009-06-26 20:27 117144 c:\windows\System32\perfc009.dat
- 2006-11-02 10:33 . 2009-06-26 19:09 117144 c:\windows\System32\perfc009.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-03-18 2289664]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-02-06 3885408]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-06-21 39408]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-04-18 178712]
"accrdsub"="c:\program files\ActivIdentity\ActivClient\accrdsub.exe" [2007-05-15 293168]
"PTHOSTTR"="c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE" [2008-05-08 238984]
"CognizanceTS"="c:\progra~1\HEWLET~1\IAM\Bin\ASTSVCC.dll" [2008-05-21 24848]
"PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2008-05-12 318488]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-27 1045800]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-04-15 70912]
"File Sanitizer"="c:\program files\Hewlett-Packard\File Sanitizer\CoreShredder.exe" [2008-05-02 10244096]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-24 148888]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-05-14 177456]
"WatchDog"="c:\program files\InterVideo\DVD Check\DVDCheck.exe" [2008-05-24 197904]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2008-04-04 1314816]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-1-16 727592]
DVD Check.lnk - c:\program files\InterVideo\DVD Check\DVDCheck.exe [2008-6-18 197904]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"FilterAdministratorToken"= 1 (0x1)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\APSHook.dll c:\windows\System32\APSHook.dll c:\windows\System32\APSHook.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer2"=wdmaud.drv
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli ASWLNPkg
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{36A4BBC5-0A1A-4D0F-87E9-C9601168FD0F}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{0D63D014-898A-48B4-B1FC-972F9B8BA154}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync
"{FC58988B-2CE6-49CF-8199-897CBA332176}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{D8F0A442-2EF8-4BA0-8675-CD175FF3BBBE}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{9F18E239-8650-46B7-B49D-7B05AD4E0152}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{9B29CB20-F4D0-4357-A799-31DB50769022}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{0CBFE391-2725-4ADA-B0B0-5540BF8D6309}"= UDP:c:\program files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"{CDFEA762-B6DE-470E-8E0A-DD7567411731}"= TCP:c:\program files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
R0 SbAlg;SbAlg;c:\windows\System32\drivers\SbAlg.sys [14/05/2008 02:36 51376]
R0 SbFsLock;SbFsLock;c:\windows\System32\drivers\SbFsLock.sys [14/05/2008 02:36 12928]
R1 aswSP;avast! Self Protection;c:\windows\System32\drivers\aswSP.sys [26/06/2009 22:14 114768]
R1 RsvLock;RsvLock;c:\windows\System32\drivers\rsvlock.sys [14/05/2008 02:36 12496]
R2 accoca;ActivClient Middleware Service;c:\program files\ActivIdentity\ActivClient\accoca.exe [16/05/2007 01:08 182576]
R2 ASBroker;Logon Session Broker;c:\windows\System32\svchost.exe -k Cognizance [21/01/2008 04:23 21504]
R2 ASChannel;Local Communication Channel;c:\windows\System32\svchost.exe -k Cognizance [21/01/2008 04:23 21504]
R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [26/06/2009 22:14 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [26/06/2009 22:14 51792]
R2 HP ProtectTools Service;HP ProtectTools Service;c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe [14/05/2008 22:41 34184]
R2 HpFkCryptService;Drive Encryption Service;c:\program files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [14/05/2008 02:35 256512]
R2 HPFSService;File Sanitizer for HP ProtectTools;c:\program files\Hewlett-Packard\File Sanitizer\HPFSService.exe [18/06/2008 11:20 77824]
R2 hpsrv;HP Service;c:\windows\System32\hpservice.exe [07/04/2008 20:13 24936]
R2 pdfcDispatcher;PDF Document Manager;c:\program files\PDF Complete\pdfsvc.exe [18/06/2008 10:50 576024]
R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [18/06/2008 11:21 193840]
R3 NETw5v32;Pilote de carte Intel(R) Wireless WiFi Link pour Windows Vista 32 bits ;c:\windows\System32\drivers\NETw5v32.sys [28/04/2008 08:29 3658752]
RUnknown rpcnetp;rpcnetp; [x]
S2 0288391246045635mcinstcleanup;McAfee Application Installer Cleanup (0288391246045635);c:\users\Yohann\AppData\Local\Temp\028839~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service --> c:\users\Yohann\AppData\Local\Temp\028839~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service [?]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\System32\drivers\b57nd60x.sys [21/01/2008 04:23 179712]
S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [17/06/2009 02:11 55280]
S3 fsssvc;Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [06/02/2009 18:08 533360]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\System32\drivers\mbamswissarmy.sys [21/06/2009 23:20 38160]
S3 RoxMediaDB10;RoxMediaDB10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [08/04/2008 14:12 1112560]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Cognizance REG_MULTI_SZ ASBroker ASChannel
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
bthsvcs REG_MULTI_SZ BthServ
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Contenu du dossier 'Tâches planifiées'
2009-06-26 c:\windows\Tasks\User_Feed_Synchronization-{7B780B48-2074-446D-8864-2E018D9F0FAC}.job
- c:\windows\system32\msfeedssync.exe [2009-06-22 11:31]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fr_mq&c=83&bd=all&pf=cmnb
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Envoyer au périphérique &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: Envoyer l'&image au périphérique Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-26 22:58
Windows 6.0.6001 Service Pack 1 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pdfcDispatcher]
"ImagePath"="c:\program files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'lsass.exe'(712)
c:\program files\Hewlett-Packard\IAM\bin\ASWLNPkg.dll
c:\program files\Hewlett-Packard\IAM\bin\ItMsg.dll
- - - - - - - > 'Explorer.exe'(2624)
c:\program files\Hewlett-Packard\IAM\Bin\ItClient.dll
c:\windows\system32\btmmhook.dll
c:\program files\Hewlett-Packard\File Sanitizer\HPPMDesktopIcon.dll
c:\windows\system32\btncopy.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\System32\Ati2evxx.exe
c:\windows\System32\audiodg.exe
c:\windows\System32\Ati2evxx.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\System32\AEADISRV.EXE
c:\windows\System32\agrsmsvc.exe
c:\program files\ActivIdentity\ActivClient\acevents.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\System32\PnkBstrA.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Hewlett-Packard\Shared\hpqWmiEx.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\servicing\TrustedInstaller.exe
c:\program files\Hewlett-Packard\IAM\Bin\asghost.exe
c:\windows\System32\conime.exe
c:\program files\Alwil Software\Avast4\ashDisp.exe
c:\program files\Hewlett-Packard\HP Quick Launch Buttons\VolCtrl.exe
c:\program files\ActivIdentity\ActivClient\acevents.exe
c:\program files\WIDCOMM\Bluetooth Software\BTStackServer.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
c:\program files\Hewlett-Packard\Shared\HpqToaster.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\program files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
c:\windows\System32\wbem\WMIADAP.exe
.
**************************************************************************
.
Heure de fin: 2009-06-26 23:02 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-06-26 21:02
ComboFix2.txt 2009-06-26 19:57
Avant-CF: 183 943 888 896 octets libres
Après-CF: 183 808 524 288 octets libres
375 --- E O F --- 2009-06-26 18:19
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
premierement tu n'a encore rien fait qui l'a aider
deusiemement on n'a decouvert que autochk.exe etait infecter grace au programe que je proposais
et que tu ne favorisais pas
et troisiemement c'est tres enfantin d'essayer de te prouver en continuant de me contredire
ce topic est pour aider quelqun pas pour debatre de c'est qui qui pisse plus loin que l'autre
deusiemement on n'a decouvert que autochk.exe etait infecter grace au programe que je proposais
et que tu ne favorisais pas
et troisiemement c'est tres enfantin d'essayer de te prouver en continuant de me contredire
ce topic est pour aider quelqun pas pour debatre de c'est qui qui pisse plus loin que l'autre
soit autre chose
c;est autre chose est peut etre le systeme restore qui fait un back up de linffection
donc on vas le desactive
click droit sur poste de travail / propriete et click sur systeme restore et met le a off
ensuite repace malwarebite pour voir si ca marche
par la suite il faudra reactiver le system restore
c;est autre chose est peut etre le systeme restore qui fait un back up de linffection
donc on vas le desactive
click droit sur poste de travail / propriete et click sur systeme restore et met le a off
ensuite repace malwarebite pour voir si ca marche
par la suite il faudra reactiver le system restore
Si tu désactives la restauration système, l'utilisateur fait comment pour revenir en arrière si Windows bogue ?
Mieux vaut avoir des points de restauration infectés que pas de point de restauration.
Mieux vaut avoir des points de restauration infectés que pas de point de restauration.
c'est la seul solution sinon l'infection cera toujours presante sur le disk dans un point de restauration
https://www.mcafee.com/enterprise/en-us/threat-center.html#none
https://www.mcafee.com/enterprise/en-us/threat-center.html#none
On désactive/réactive la restauration système à la fin. En plus, quand on réactive la restauration système, un point de restauration se crée.
Des points de restauration infectés ne peuvent infecter le système seulement si l'utilisateur utilise la restauration système.
Des points de restauration infectés ne peuvent infecter le système seulement si l'utilisateur utilise la restauration système.
mais de quoi tu parle!!!!!!!!!!!!
bon moi je me retire du topic
prisita je te conseille de faire ce que je t'ai dit car c'est la methode proposer par mcafee
sinon tu peux toujours perde ton temps a scanner et poster tes logs encore et encore
bon moi je me retire du topic
prisita je te conseille de faire ce que je t'ai dit car c'est la methode proposer par mcafee
sinon tu peux toujours perde ton temps a scanner et poster tes logs encore et encore
"Mais de quoi tu parle!!!!!!!!!!!!"
--> Tu devrais le savoir, c'est toi qui a commencé à m'en parler.
"prisita je te conseille de faire ce que je t'ai dit car c'est la methode proposer par mcafee"
--> Ça ne va pas l'aider. De plus, qui te dit que l'utilisateur comprend l'anglais ?
"sinon tu peux toujours perde ton temps a scanner et poster tes logs encore et encore"
--> Tu lui as bien proposé ComboFix alors que tu n'as pas l'air de savoir analyser le rapport. Au moins, je sais où je vais avec les rapports.
--> Tu devrais le savoir, c'est toi qui a commencé à m'en parler.
"prisita je te conseille de faire ce que je t'ai dit car c'est la methode proposer par mcafee"
--> Ça ne va pas l'aider. De plus, qui te dit que l'utilisateur comprend l'anglais ?
"sinon tu peux toujours perde ton temps a scanner et poster tes logs encore et encore"
--> Tu lui as bien proposé ComboFix alors que tu n'as pas l'air de savoir analyser le rapport. Au moins, je sais où je vais avec les rapports.
a-squared 4.5.0.18 2009.06.26 -
AhnLab-V3 5.0.0.2 2009.06.25 -
AntiVir 7.9.0.196 2009.06.25 -
Antiy-AVL 2.0.3.1 2009.06.26 -
Authentium 5.1.2.4 2009.06.25 -
Avast 4.8.1335.0 2009.06.25 -
AVG 8.5.0.339 2009.06.25 -
BitDefender 7.2 2009.06.26 -
CAT-QuickHeal 10.00 2009.06.25 -
ClamAV 0.94.1 2009.06.26 -
Comodo 1424 2009.06.26 -
DrWeb 5.0.0.12182 2009.06.26 -
eSafe 7.0.17.0 2009.06.25 -
eTrust-Vet 31.6.6580 2009.06.26 -
F-Prot 4.4.4.56 2009.06.25 -
F-Secure 8.0.14470.0 2009.06.25 -
Fortinet 3.117.0.0 2009.06.26 -
GData 19 2009.06.26 -
Ikarus T3.1.1.59.0 2009.06.26 -
Jiangmin 11.0.706 2009.06.25 -
K7AntiVirus 7.10.768 2009.06.19 -
Kaspersky 7.0.0.125 2009.06.26 -
McAfee 5657 2009.06.25 -
McAfee+Artemis 5657 2009.06.25 -
McAfee-GW-Edition 6.7.6 2009.06.25 -
Microsoft 1.4803 2009.06.26 -
NOD32 4190 2009.06.26 -
Norman 6.01.09 2009.06.25 -
nProtect 2009.1.8.0 2009.06.26 -
Panda 10.0.0.16 2009.06.26 -
PCTools 4.4.2.0 2009.06.25 -
Prevx 3.0 2009.06.26 -
Rising 21.35.34.00 2009.06.25 -
Sophos 4.43.0 2009.06.26 -
Sunbelt 3.2.1858.2 2009.06.25 -
Symantec 1.4.4.12 2009.06.26 -
TheHacker 6.3.4.3.354 2009.06.25 -
TrendMicro 8.950.0.1094 2009.06.26 -
VBA32 3.12.10.7 2009.06.26 -
ViRobot 2009.6.25.1804 2009.06.25 -
VirusBuster 4.6.5.0 2009.06.25 -
Information additionnelle
File size: 642560 bytes
MD5 : b91bc36040c812ad5b127c6ee18895af
SHA1 : 84e61412ffe0277361b0e19eb7f01d632ea45ce1
SHA256: 8cc355e9230edb67043a633f78725847a4589d206ffb91a20be9505d58bdc771
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x16CE
timedatestamp.....: 0x45676936 (Fri Nov 24 22:50:46 2006)
machinetype.......: 0x14C (Intel I386)
( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x9CE 0xA00 6.08 f189542e08c559931787766ce6450847
.cdata 0x2000 0x4400 0x4400 6.00 5a186198384a33ff53fb5b3a26368bb3
.mdata 0x7000 0x300 0x400 1.74 88192dcaae8771af957eb9352792661d
.reloc 0x8000 0x60 0x200 1.51 737c7c8641e2692a26d3adfc985b4135
( 1 imports )
> ntdll.dll: NtCreateKey, NtOpenProcessToken, NtCreateFile, NtClose, NtAdjustPrivilegesToken, NtDeleteFile, NtWriteFile, RtlInitUnicodeString, NtSetSecurityObject, NtTerminateProcess, NtSetValueKey, NtQuerySecurityObject, NtReadFile, RtlQueryEnvironmentVariable_U, NtQueryInformationToken, RtlUnwind, wcscpy
( 0 exports )
TrID : File type identification
Generic Win/DOS Executable (50.0%)
DOS Executable Generic (49.9%)
ssdeep: 12288:K522HlaA/v5Lze6Z02L7lN2/07qCAEC6+sPZ/AhFN:K522H1X5HL22W/8qCvX+sah3
PEiD : -
packers (F-Prot): embedded
RDS : NSRL Reference Data Set
-
AhnLab-V3 5.0.0.2 2009.06.25 -
AntiVir 7.9.0.196 2009.06.25 -
Antiy-AVL 2.0.3.1 2009.06.26 -
Authentium 5.1.2.4 2009.06.25 -
Avast 4.8.1335.0 2009.06.25 -
AVG 8.5.0.339 2009.06.25 -
BitDefender 7.2 2009.06.26 -
CAT-QuickHeal 10.00 2009.06.25 -
ClamAV 0.94.1 2009.06.26 -
Comodo 1424 2009.06.26 -
DrWeb 5.0.0.12182 2009.06.26 -
eSafe 7.0.17.0 2009.06.25 -
eTrust-Vet 31.6.6580 2009.06.26 -
F-Prot 4.4.4.56 2009.06.25 -
F-Secure 8.0.14470.0 2009.06.25 -
Fortinet 3.117.0.0 2009.06.26 -
GData 19 2009.06.26 -
Ikarus T3.1.1.59.0 2009.06.26 -
Jiangmin 11.0.706 2009.06.25 -
K7AntiVirus 7.10.768 2009.06.19 -
Kaspersky 7.0.0.125 2009.06.26 -
McAfee 5657 2009.06.25 -
McAfee+Artemis 5657 2009.06.25 -
McAfee-GW-Edition 6.7.6 2009.06.25 -
Microsoft 1.4803 2009.06.26 -
NOD32 4190 2009.06.26 -
Norman 6.01.09 2009.06.25 -
nProtect 2009.1.8.0 2009.06.26 -
Panda 10.0.0.16 2009.06.26 -
PCTools 4.4.2.0 2009.06.25 -
Prevx 3.0 2009.06.26 -
Rising 21.35.34.00 2009.06.25 -
Sophos 4.43.0 2009.06.26 -
Sunbelt 3.2.1858.2 2009.06.25 -
Symantec 1.4.4.12 2009.06.26 -
TheHacker 6.3.4.3.354 2009.06.25 -
TrendMicro 8.950.0.1094 2009.06.26 -
VBA32 3.12.10.7 2009.06.26 -
ViRobot 2009.6.25.1804 2009.06.25 -
VirusBuster 4.6.5.0 2009.06.25 -
Information additionnelle
File size: 642560 bytes
MD5 : b91bc36040c812ad5b127c6ee18895af
SHA1 : 84e61412ffe0277361b0e19eb7f01d632ea45ce1
SHA256: 8cc355e9230edb67043a633f78725847a4589d206ffb91a20be9505d58bdc771
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x16CE
timedatestamp.....: 0x45676936 (Fri Nov 24 22:50:46 2006)
machinetype.......: 0x14C (Intel I386)
( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x9CE 0xA00 6.08 f189542e08c559931787766ce6450847
.cdata 0x2000 0x4400 0x4400 6.00 5a186198384a33ff53fb5b3a26368bb3
.mdata 0x7000 0x300 0x400 1.74 88192dcaae8771af957eb9352792661d
.reloc 0x8000 0x60 0x200 1.51 737c7c8641e2692a26d3adfc985b4135
( 1 imports )
> ntdll.dll: NtCreateKey, NtOpenProcessToken, NtCreateFile, NtClose, NtAdjustPrivilegesToken, NtDeleteFile, NtWriteFile, RtlInitUnicodeString, NtSetSecurityObject, NtTerminateProcess, NtSetValueKey, NtQuerySecurityObject, NtReadFile, RtlQueryEnvironmentVariable_U, NtQueryInformationToken, RtlUnwind, wcscpy
( 0 exports )
TrID : File type identification
Generic Win/DOS Executable (50.0%)
DOS Executable Generic (49.9%)
ssdeep: 12288:K522HlaA/v5Lze6Z02L7lN2/07qCAEC6+sPZ/AhFN:K522H1X5HL22W/8qCvX+sah3
PEiD : -
packers (F-Prot): embedded
RDS : NSRL Reference Data Set
-
http://www.virustotal.com/fr/analisis/8cc355e9230edb67043a633f78725847a4589d206ffb91a20be9505d58bdc771-1245986285
j'ai trouvé ce fichié là c:\windows\system32\rpcnetp.dll
je fais l'analyse de ça au lieu de c:\windows\system32\rpcnetp.exe
ya une difference?
je fais l'analyse de ça au lieu de c:\windows\system32\rpcnetp.exe
ya une difference?
D'après le rapport ComboFix, le fichier c:\windows\system32\rpcnetp.exe est présent. Il est peut-être caché :
http://www.vista-xp.fr/forum/topic16.html
http://www.vista-xp.fr/forum/topic16.html
