Virus Net-Worm.Win32.Kido.ix Fermé

Question

Bonjour,voila mon probleme , donc il ya 2-3 jours Kaspersky Anti-virus m'annonce qu'il ya un Virus Net-Worm.Win32.Kido.ix sur ma machine , j'ai installer RSIT et j'aimerais que quelqu'un maide pour supprimer ce virus svp , je peut poster mes pages de logs apres analyse avec RSIT si on me demande.

Merci :)

Van · Answer

up

archet9 · Answer

Hello Van

Regardes ici:
http://www.clubic.com/telecharger-fiche282762-net-worm-win32-kido-removing-tool.html

Donnes nous le resultat stp....

merci (je comptes sur toi....) 

a+

Van · Answer

Merci d'avoir repondu archet9 ,c'est en cours de scan :)

Van · Answer

ca me met qu'aucune infection n'a etait trouver

archet9 · Answer

Colles ton RSIT stp....

a+

Van · Answer

info.txt logfile of random's system information tool 1.06 2009-06-30 19:24:19

======Uninstall list======

-->C:\PROGRA~1\Yahoo!\Common\UNYT_W~1.EXE
-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Ad-Aware-->"C:\Documents and Settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}\Ad-AwareAE.exe" REMOVE=TRUE MODIFY=FALSE
Ad-Aware-->C:\Documents and Settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}\Ad-AwareAE.exe
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Assistant de connexion Windows Live-->MsiExec.exe /I{DCE8CD14-FBF5-4464-B9A4-E18E473546C7}
ATI - Utilitaire de désinstallation du logiciel-->C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI AVIVO Codecs-->MsiExec.exe /I{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}
ATI Catalyst Control Center-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{055EE59D-217B-43A7-ABFF-507B966405D8}\setup.exe" -l0x0 
ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
ATI HYDRAVISION-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3EA9D975-BFDC-4E8E-B88B-0446FBC8CA66}\setup.exe" 
ATI Parental Control & Encoder-->MsiExec.exe /I{36CDA33B-909B-4719-97D1-C4B99309BDC7}
ATI Problem Report Wizard-->MsiExec.exe /X{5DA6F06A-B389-407B-BF8C-1548767914D8}
BitComet 1.12-->C:\Program Files\BitComet\uninst.exe
Catalyst Control Center - Branding-->MsiExec.exe /I{D3B1C799-CB73-42DE-BA0F-2344793A095C}
CCleaner (remove only)-->"E:\CCleaner\uninst.exe"
Choice Guard-->MsiExec.exe /I{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}
Counter-Strike: Source-->"C:\Program Files\Steam\steam.exe" steam://uninstall/240
Counter-Strike-->"C:\Program Files\Steam\steam.exe" steam://uninstall/10
Crawler Toolbar with Web Security Guard-->C:\PROGRA~1\Crawler\Toolbar\CToolbar.exe uninst
Day of Defeat: Source-->"C:\Program Files\Steam\steam.exe" steam://uninstall/300
DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Plus DirectShow Filters-->C:\Program Files\DivX\DivXDSFiltersUninstall.exe /DSFILTERS
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
Fraps (remove only)-->"C:\Fraps\uninstall.exe"
Galerie de photos Windows Live-->MsiExec.exe /X{44E54A81-9D91-4AA1-9417-80AFF134F5FF}
HijackThis 2.0.2-->"C:\Program Files	rend micro\HijackThis.exe" /uninstall
Installation Windows Live-->C:\Program Files\Windows Live\Installer\wlarp.exe
Installation Windows Live-->MsiExec.exe /I{7370DF47-B4F9-4279-BFC3-3F09919F720D}
J2SE Runtime Environment 5.0-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150000}
Junk Mail filter update-->MsiExec.exe /I{4DE3E3D9-AE81-45DE-9195-3015F7B1DBF3}
Kaspersky Anti-Virus 6.0-->MsiExec.exe /I{75193929-9A52-4CA4-98DE-8C7296940920}
Kaspersky Anti-Virus 6.0-->MsiExec.exe /I{75193929-9A52-4CA4-98DE-8C7296940920}
Kit d'installation-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9C650676-CDDB-42C0-8D11-3EEB7F791F99}\setup.exe" -l0x40c  -usb
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Mozilla Firefox (3.0.11)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSN-->C:\Program Files\MSN\MsnInstaller\msninst.exe /Action:ARP
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
Outil de téléchargement Windows Live-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
PunkBuster Services-->C:\WINDOWS\system32\pbsvc.exe -u
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x40c  -removeonly
Segoe UI-->MsiExec.exe /I{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}
Spyware Terminator-->"C:\Program Files\Spyware Terminator\unins000.exe"
Steam-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
USB MODEM Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{042E2C9D-6647-4C5F-9CEF-387D72023128}\setup.exe" -l0x9 UNINSTALL
VC80CRTRedist - 8.0.50727.762-->MsiExec.exe /I{767CC44C-9BBC-438D-BAD3-FD4595DD148B}
Visual C++ 2008 x86 Runtime - (v9.0.30729)-->MsiExec.exe /X{F333A33D-125C-32A2-8DCE-5C5D14231E27}
Visual C++ 2008 x86 Runtime - v9.0.30729.01-->C:\WINDOWS\system32\msiexec.exe /x {F333A33D-125C-32A2-8DCE-5C5D14231E27} /qb+ REBOOTPROMPT=""
Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
Windows Live Call-->MsiExec.exe /I{82C7B308-0BDD-49D8-8EA5-9CD3A3F9DF41}
Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
Windows Live Mail-->MsiExec.exe /I{63DC2DA0-2A6C-4C38-9249-B75395458657}
Windows Live Messenger-->MsiExec.exe /X{059C042E-796A-4ACC-A81A-ECC2010BB78C}
Windows Live OneCare safety scanner-->RunDll32.exe "C:\Program Files\Windows Live Safety Center\wlscCore.dll",UninstallFunction WLSC_SCANNER_PRODUCT
Windows Live Sync-->MsiExec.exe /X{9C5EB781-0D37-44B8-9A58-77B3E4BF5F5E}
Windows Live Writer-->MsiExec.exe /X{2231CE39-B963-4B9D-823A-F412ECA637B1}
Yahoo! Toolbar-->C:\PROGRA~1\Yahoo!\Common\UNYT_W~1.EXE

======Security center information======

AV: Kaspersky Anti-Virus
FW: Kaspersky Anti-Virus (disabled)

======System event log======

Computer Name: PERSO-0F57AD69F
Event Code: 26
Message: Application popup : rundll32.exe - Image incorrecte : L'application ou la DLL C:\DOCUME~1\SAMY\LOCALS~1\Temp\odbc_inc.DLL n'est pas une image Windows valide. Vérifiez à l'aide de votre disquette d'installation. 

Record Number: 995
Source Name: Application Popup
Time Written: 20090516162112.000000+120
Event Type: Informations
User: 

Computer Name: PERSO-0F57AD69F
Event Code: 26
Message: Application popup : rundll32.exe - Image incorrecte : L'application ou la DLL C:\DOCUME~1\SAMY\LOCALS~1\Temp\odbc_inc.DLL n'est pas une image Windows valide. Vérifiez à l'aide de votre disquette d'installation. 

Record Number: 994
Source Name: Application Popup
Time Written: 20090516162111.000000+120
Event Type: Informations
User: 

Computer Name: PERSO-0F57AD69F
Event Code: 26
Message: Application popup : rundll32.exe - Image incorrecte : L'application ou la DLL C:\DOCUME~1\SAMY\LOCALS~1\Temp\odbc_inc.DLL n'est pas une image Windows valide. Vérifiez à l'aide de votre disquette d'installation. 

Record Number: 993
Source Name: Application Popup
Time Written: 20090516162110.000000+120
Event Type: Informations
User: 

Computer Name: PERSO-0F57AD69F
Event Code: 26
Message: Application popup : rundll32.exe - Image incorrecte : L'application ou la DLL C:\DOCUME~1\SAMY\LOCALS~1\Temp\odbc_inc.DLL n'est pas une image Windows valide. Vérifiez à l'aide de votre disquette d'installation. 

Record Number: 992
Source Name: Application Popup
Time Written: 20090516162109.000000+120
Event Type: Informations
User: 

Computer Name: PERSO-0F57AD69F
Event Code: 26
Message: Application popup : rundll32.exe - Image incorrecte : L'application ou la DLL C:\DOCUME~1\SAMY\LOCALS~1\Temp\odbc_inc.DLL n'est pas une image Windows valide. Vérifiez à l'aide de votre disquette d'installation. 

Record Number: 991
Source Name: Application Popup
Time Written: 20090516162107.000000+120
Event Type: Informations
User: 

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static;C:\Program Files\Fichiers communs\DivX Shared
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 107 Stepping 2, AuthenticAMD
"PROCESSOR_REVISION"=6b02
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------

Van · Answer

ogfile of random's system information tool 1.06 (written by random/random)
Run by SAMY at 2009-06-30 19:22:18
Microsoft Windows XP Édition familiale Service Pack 2
System drive C: has 219 GB (92%) free of 238 GB
Total RAM: 3326 MB (81% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:24:17, on 30/06/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0\bin\jusched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\SAMY\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\internet explorer\iexplore.exe
C:\PROGRA~1\Crawler\Toolbar\CToolbar.exe
C:\Documents and Settings\SAMY\Bureau\RSIT.exe
C:\Program Files	rend micro\SAMY.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.atcomet.com/b/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet	ools\BitCometBHO_1.3.3.2.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: &Crawler lišta - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\SAMY\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: Tout télécharger avec BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Télécharger avec BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: Télécharger toutes les vidéos avec BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin
pjpi150.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin
pjpi150.dll
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet	ools\BitCometBHO_1.3.3.2.dll/206 (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} (Battlefield Heroes Updater) - https://www.battlefieldheroes.com/static/updater/BFHUpdater_4.0.21.0.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

archet9 · Answer

Télécharges FindyKill de Chiquitine29 : 
 http://sd-1.archive-host.com/membres/up/127028005715545653/C­hangelogFindyKill.txt  

->Enregistres le sur ton bureau et pas ailleurs ! 

!! Déconnectes toi et fermes toute applications en cours !! 

( Si ton anti-virus s'affolle au moment de l'enregistrement ou de l'utilisation de l'outil , ignore l'alerte ...) 

-> Cliques sur "FindyKill.exe" pour lancer l'installe de l'outil . Ne touche surtout pas aux paramètres d'installation. 

--> Double cliques sur le raccourci " FindyKill " qui est sur ton bureau . 

-->choisis l'option 1 ( recherche ) . 
Puis laisses travailler l'outil sans rien toucher ... 

Une fois terminé, postes le rapport FindyKill.txt qui est généré ... 

( Note : le rapport est sauvegardé à la racine du disque -> C:\FindyKill.txt ) 

a+

Van · Answer

Le lien marche pas :(

Van · Answer

up

archet9 · Answer

http://sd-1.archive-host.com/membres/up/116615172019703188

Van · Answer

Ok merci je te tiens au courant vite :)

Van · Answer

désolée archet9 mais le lien ne marche toujours pas ca me met qu'une page est manquante.

Van · Answer

up

Van · Answer

up , toujours besoin d'aide :(

archet9 · Answer

Télécharge Toolbar-S&D (Team IDN) sur ton Bureau. 
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2 

* Lance l'installation du programme en exécutant le fichier téléchargé. 
* Double-clique maintenant sur le raccourci de Toolbar-S&D. 
* Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée. 
* Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche. 
* Poste le rapport généré. (C:\TB.txt)

a+

Van · Answer

-----------\  ToolBar S&D 1.2.8   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 2
   X86-based PC ( Multiprocessor Free : AMD Athlon(tm) 64 X2 Dual Core Processor 5200+ )
   BIOS : Award Modular BIOS v6.00PG
   USER : SAMY ( Administrator )
   BOOT : Normal boot
   Antivirus : Kaspersky Anti-Virus 6.0.2.621 (Activated)
   Firewall  : Kaspersky Anti-Virus 6.0.2.621 (Not Activated)
   A:\ (USB)
   C:\ (Local Disk) - NTFS - Total:232 Go (Free:213 Go)
   D:\ (CD or DVD)
   E:\ (Local Disk) - NTFS - Total:149 Go (Free:112 Go)

   "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
   Option : [1] ( 02/07/2009| 0:45 )

   -----------\  Recherche de Fichiers / Dossiers ...

   C:\Program Files\Crawler
   C:\Program Files\Crawler\Download
   C:\Program Files\Crawler\Toolbar
   C:\Program Files\Crawler\Toolbar\adrkeys.dat
   C:\Program Files\Crawler\Toolbar\Cache
   C:\Program Files\Crawler\Toolbar\COMMON_FF.dat
   C:\Program Files\Crawler\Toolbar\confirm.dat
   C:\Program Files\Crawler\Toolbar\ctbcomm.dll
   C:\Program Files\Crawler\Toolbar\ctbr.dll
   C:\Program Files\Crawler\Toolbar\CTConf.dat
   C:\Program Files\Crawler\Toolbar\CTipsDef.dll
   C:\Program Files\Crawler\Toolbar\CToolbar.exe
   C:\Program Files\Crawler\Toolbar\CUpdate.exe
   C:\Program Files\Crawler\Toolbar\firefox
   C:\Program Files\Crawler\Toolbar\Languages
   C:\Program Files\Crawler\Toolbar\lookfor.dat
   C:\Program Files\Crawler\Toolbar\majorse.dat
   C:\Program Files\Crawler\Toolbarootmenu.dat
   C:\Program Files\Crawler\Toolbar\services.dat
   C:\Program Files\Crawler\Toolbar\STWSGLanguageAct
   C:\Program Files\Crawler\Toolbar\STWSG_FF.dat
   C:\Program Files\Crawler\Toolbar\TBR5LanguageAct
   C:\Program Files\Crawler\Toolbar\Update
   C:\Program Files\Crawler\Toolbar\WebSecurityGuard.dll
   C:\Program Files\Crawler\Toolbar\WSGData
   C:\Program Files\Crawler\Toolbar\Cache\COMMON
   C:\Program Files\Crawler\Toolbar\Cache\STWSG
   C:\Program Files\Crawler\Toolbar\Cache\COMMON\CLEANUP_BMP.dat
   C:\Program Files\Crawler\Toolbar\Cache\COMMON\CLEANUP_CHBMP.dat
   C:\Program Files\Crawler\Toolbar\Cache\COMMON\CLEANUP_MENU.dat
   C:\Program Files\Crawler\Toolbar\Cache\COMMON\DIRLIST_CHBMP.dat
   C:\Program Files\Crawler\Toolbar\Cache\COMMON\DIRLIST_MENU.dat
   C:\Program Files\Crawler\Toolbar\Cache\COMMON\ECARDS_CHBMP.dat
   C:\Program Files\Crawler\Toolbar\Cache\COMMON\ECARDS_MENU.dat
   C:\Program Files\Crawler\Toolbar\Cache\COMMON\EMAIL_CHBMP.dat
   C:\Program Files\Crawler\Toolbar\Cache\COMMON\GAMES_CHBMP.dat
   C:\Program Files\Crawler\Toolbar\Cache\COMMON\GAMES_MENU.dat
   C:\Program Files\Crawler\Toolbar\Cache\COMMON\SHOP_CHBMP.dat
   C:\Program Files\Crawler\Toolbar\Cache\COMMON\SPELL_CHBMP.dat
   C:\Program Files\Crawler\Toolbar\Cache\COMMON\TRAVEL_CHBMP.dat
   C:\Program Files\Crawler\Toolbar\Cache\COMMON\WAYBACK_CHBMP.dat
   C:\Program Files\Crawler\Toolbar\Cache\COMMON\WP_CHBMP.dat
   C:\Program Files\Crawler\Toolbar\Cache\COMMON\YP_CHBMP.dat
   C:\Program Files\Crawler\Toolbar\Cache\STWSG\STBUTTON_BMP.dat
   C:\Program Files\Crawler\Toolbar\Cache\STWSG\STBUTTON_CHBMP.dat
   C:\Program Files\Crawler\Toolbar\Cache\STWSG\STBUTTON_MENU.dat
   C:\Program Files\Crawler\Toolbar\Cache\STWSG\WSGBUTTON_BMP.dat
   C:\Program Files\Crawler\Toolbar\Cache\STWSG\WSGBUTTON_CHBMP.dat
   C:\Program Files\Crawler\Toolbar\Cache\STWSG\WSGBUTTON_MENU.dat
   C:\Program Files\Crawler\Toolbar\firefox\chrome
   C:\Program Files\Crawler\Toolbar\firefox\chrome.manifest
   C:\Program Files\Crawler\Toolbar\firefox\components
   C:\Program Files\Crawler\Toolbar\firefox\install.ini
   C:\Program Files\Crawler\Toolbar\firefox\install.rdf
   C:\Program Files\Crawler\Toolbar\firefox\stwsg_ff.ini
   C:\Program Files\Crawler\Toolbar\firefox\chrome\common.jar
   C:\Program Files\Crawler\Toolbar\firefox\chrome\stwsg.jar
   C:\Program Files\Crawler\Toolbar\firefox\components\xcomm.dll
   C:\Program Files\Crawler\Toolbar\firefox\components\xplugin.xpt
   C:\Program Files\Crawler\Toolbar\firefox\components\xshared.dll
   C:\Program Files\Crawler\Toolbar\firefox\components\xshared.xpt
   C:\Program Files\Crawler\Toolbar\firefox\components\xsupport.dll
   C:\Program Files\Crawler\Toolbar\firefox\components\xsupport.xpt
   C:\Program Files\Crawler\Toolbar\firefox\components\xwsg.dll
   C:\Program Files\Crawler\Toolbar\Languages\STWSG_CS.cab
   C:\Program Files\Crawler\Toolbar\Languages\STWSG_DE.cab
   C:\Program Files\Crawler\Toolbar\Languages\STWSG_EN.cab
   C:\Program Files\Crawler\Toolbar\Languages\STWSG_ES.cab
   C:\Program Files\Crawler\Toolbar\Languages\STWSG_FF.cab
   C:\Program Files\Crawler\Toolbar\Languages\STWSG_FR.cab
   C:\Program Files\Crawler\Toolbar\Languages\STWSG_IT.cab
   C:\Program Files\Crawler\Toolbar\Languages\STWSG_NL.cab
   C:\Program Files\Crawler\Toolbar\Languages\STWSG_PT-BR.cab
   C:\Program Files\Crawler\Toolbar\Languages\STWSG_PT.cab
   C:\Program Files\Crawler\Toolbar\Languages\TBR5_CS.cab
   C:\Program Files\Crawler\Toolbar\Languages\TBR5_DE.cab
   C:\Program Files\Crawler\Toolbar\Languages\TBR5_EN.cab
   C:\Program Files\Crawler\Toolbar\Languages\TBR5_ES.cab
   C:\Program Files\Crawler\Toolbar\Languages\TBR5_FR.cab
   C:\Program Files\Crawler\Toolbar\Languages\TBR5_IT.cab
   C:\Program Files\Crawler\Toolbar\Languages\TBR5_NL.cab
   C:\Program Files\Crawler\Toolbar\Languages\TBR5_PL.cab
   C:\Program Files\Crawler\Toolbar\Languages\TBR5_PT-BR.cab
   C:\Program Files\Crawler\Toolbar\Languages\TBR5_PT.cab
   C:\Program Files\Crawler\Toolbar\Languages\TBR5_RU.cab
   C:\Program Files\Crawler\Toolbar\STWSGLanguageAct\info.ini
   C:\Program Files\Crawler\Toolbar\STWSGLanguageAct\language.ini
   C:\Program Files\Crawler\Toolbar\TBR5LanguageAct\info.ini
   C:\Program Files\Crawler\Toolbar\TBR5LanguageAct\language.ini
   C:\Program Files\Crawler\Toolbar\Update\domains.cab
   C:\Program Files\Crawler\Toolbar\WSGData\domains
   C:\Program Files\Crawler\Toolbar\WSGData\g_S-1-5-21-1078081533-1532298954-839522115-1005.dat
   C:\Program Files\Crawler\Toolbar\WSGData\p_S-1-5-21-1078081533-1532298954-839522115-1005.dat
   C:\Program Files\Crawler\Toolbar\WSGData\ud_S-1-5-21-1078081533-1532298954-839522115-1005.dat
   C:\Program Files\Crawler\Toolbar\WSGData\wfilter.dat
   C:\Program Files\Crawler\Toolbar\WSGData\w_S-1-5-21-1078081533-1532298954-839522115-1005.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_000.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_000_diff.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_001.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_001_diff.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_002.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_002_diff.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_003.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_003_diff.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_004.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_004_diff.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_005.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_005_diff.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_006.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_006_diff.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_007.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_007_diff.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_008.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_008_diff.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_009.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_009_diff.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_010.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_010_diff.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_011.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_011_diff.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_012.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_012_diff.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_013.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_013_diff.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_014.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_014_diff.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_015.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_015_diff.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_016.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_016_diff.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_017.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_017_diff.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_018.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_018_diff.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_019.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_019_diff.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_020.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_020_diff.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_021.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_021_diff.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_022.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_022_diff.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_023.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_023_diff.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_024.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_024_diff.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_025.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_025_diff.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_026.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_026_diff.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_027.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_027_diff.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_028.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_028_diff.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_029.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_029_diff.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_030.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_030_diff.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_031.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_031_diff.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_032.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_032_diff.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_033.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_033_diff.dat
   C:\Program Files\Crawler\Toolbar\WSGData\domains\index.dat
   C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\Barre d'outils Crawler

   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Start Page"="http://google.atcomet.com/b/"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home"


   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !


   1 - "C:\ToolBar SD\TB_1.txt" - 02/07/2009| 0:46 - Option : [1]

   -----------\  Fin du rapport a  0:46:27,18



Parcontre apres ca , ca me met que mon pare feu na pas l'autorisation pour AVP ou un truc du genre c'est rien de grave? :)

Van · Answer

Up :(

Van · Answer

up need toujours de l'help

archet9 · Answer

Reprends TOOLBAR S&D
Et cette fois choisis l'option: 2
Copies/colles le rapport stp

a+

Van · Answer

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 2
   X86-based PC ( Multiprocessor Free : AMD Athlon(tm) 64 X2 Dual Core Processor 5200+ )
   BIOS : Award Modular BIOS v6.00PG
   USER : SAMY ( Administrator )
   BOOT : Normal boot
   Antivirus : Kaspersky Anti-Virus 6.0.2.621 (Not Activated)
   Firewall  : Kaspersky Anti-Virus 6.0.2.621 (Not Activated)
   A:\ (USB)
   C:\ (Local Disk) - NTFS - Total:232 Go (Free:214 Go)
   D:\ (CD or DVD)
   E:\ (Local Disk) - NTFS - Total:149 Go (Free:112 Go)

   "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
   Option : [2] ( 02/07/2009|21:09 )

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Start Page"="http://google.atcomet.com/b/"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Start Page"="https://www.msn.com/fr-fr/"


   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !


   1 - "C:\ToolBar SD\TB_1.txt" - 02/07/2009| 0:46 - Option : [1]
   2 - "C:\ToolBar SD\TB_2.txt" - 02/07/2009|21:10 - Option : [2]

   -----------\  Fin du rapport a 21:10:24,64

Van · Answer

up

archet9 · Answer

---> Télécharge ComboFix.exe de sUBs sur ton Bureau : 
http://download.bleepingcomputer.com/sUBs/ComboFix.exe 

/!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\ 

---> Double-clique sur Combofix.exe 
Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...". 
Accepte en cliquant sur "Oui" 

---> Mets-le en langue française F 
Tape sur la touche 1 (Yes) pour démarrer le scan. 

/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\ 
En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire. 

Une fois le scan achevé, un rapport va s'afficher : Poste son contenu 

/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\ 

Note : Le rapport se trouve également là : C:\ComboFix.txt

a+

Van · Answer

ComboFix 09-07-02.02 - SAMY 03/07/2009 20:03.4 - NTFSx86
Microsoft Windows XP Édition familiale  5.1.2600.2.1252.33.1036.18.3326.2901 [GMT 2:00]
Lancé depuis: c:\documents and settings\SAMY\Bureau\ComboFix.exe
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Anti-Virus *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\ATIODCLI.exe
c:\windows\system32\ATIODE.exe

.
(((((((((((((((((((((((((((((   Fichiers créés du 2009-06-03 au 2009-07-03  ))))))))))))))))))))))))))))))))))))
.

2009-07-03 01:11 . 2009-07-03 01:11	--------	d-----w-	c:\documents and settings\SAMY\Application Data\vlc
2009-07-03 01:10 . 2009-07-03 01:10	--------	d-----w-	c:\program files\VideoLAN
2009-07-02 19:39 . 2009-07-02 19:55	--------	d-----w-	c:\documents and settings\All Users\Application Data\Skype
2009-07-02 00:54 . 2009-07-02 00:54	--------	d-----w-	c:\documents and settings\SAMY\Local Settings\Application Data\Help
2009-07-01 22:36 . 2009-07-02 19:10	--------	d-----w-	C:\ToolBar SD
2009-06-30 17:22 . 2009-06-30 17:24	--------	d-----w-	c:\program files	rend micro
2009-06-29 01:03 . 2009-06-29 01:03	139152	----a-w-	c:\windows\system32\drivers\PnkBstrK.sys
2009-06-29 01:03 . 2009-06-29 01:03	111928	----a-w-	c:\windows\system32\PnkBstrB.exe
2009-06-29 01:03 . 2009-06-29 01:03	75064	----a-w-	c:\windows\system32\PnkBstrA.exe
2009-06-29 00:44 . 2009-06-25 14:36	1291640	----a-w-	c:\documents and settings\SAMY\Application Data\Mozilla\Firefox\Profiles\l9rbjkg5.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\BFHUpdater.exe
2009-06-29 00:44 . 2009-06-25 14:36	729088	----a-w-	c:\documents and settings\SAMY\Application Data\Mozilla\Firefox\Profiles\l9rbjkg5.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins
pBFHUpdater.dll
2009-06-29 00:22 . 2009-06-29 01:03	139152	----a-w-	c:\documents and settings\SAMY\Application Data\PnkBstrK.sys
2009-06-29 00:21 . 2009-06-29 01:03	794408	----a-w-	c:\windows\system32\pbsvc.exe
2009-06-28 00:55 . 2009-07-03 12:48	--------	d-----w-	C:\Fraps
2009-06-26 16:25 . 2009-06-26 16:25	152576	----a-w-	c:\documents and settings\SAMY\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-06-23 22:16 . 2009-06-23 22:16	--------	d-----w-	c:\documents and settings\SAMY\Local Settings\Application Data\Blizzard Entertainment
2009-06-19 23:56 . 2009-06-19 23:56	--------	d-----w-	c:\program files\Fichiers communs\DivX Shared
2009-06-19 23:56 . 2009-06-19 23:57	--------	d-----w-	c:\program files\DivX
2009-06-16 23:11 . 2009-07-01 22:51	--------	d-----w-	C:\Downloads
2009-06-16 23:11 . 2009-06-16 23:11	1048576	----a-w-	c:\documents and settings\SAMY\Application Data\Mozilla\Firefox\Profiles\l9rbjkg5.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\components\IBitCometExtension.dll
2009-06-16 23:11 . 2009-07-03 18:01	--------	d-----w-	c:\program files\BitComet
2009-06-13 11:59 . 2009-07-03 01:37	--------	d---a-w-	c:\documents and settings\All Users\Application Data\TEMP
2009-06-13 11:25 . 2009-06-18 17:08	--------	d-----w-	c:\program files\Windows Live Safety Center

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-03 18:05 . 2009-04-26 16:06	21819424	--sha-w-	c:\windows\system32\drivers\fidbox.dat
2009-07-03 18:05 . 2009-04-26 16:06	699936	--sha-w-	c:\windows\system32\drivers\fidbox2.dat
2009-07-03 17:58 . 2004-08-05 12:00	75266	----a-w-	c:\windows\system32\perfc00C.dat
2009-07-03 17:58 . 2004-08-05 12:00	468072	----a-w-	c:\windows\system32\perfh00C.dat
2009-07-03 17:54 . 2009-04-26 16:06	--------	d-----w-	c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-07-03 17:54 . 2009-05-11 23:34	--------	d-----w-	c:\program files\Steam
2009-07-03 17:31 . 2009-04-26 16:06	67328	--sha-w-	c:\windows\system32\drivers\fidbox2.idx
2009-07-03 17:31 . 2009-04-26 16:06	293024	--sha-w-	c:\windows\system32\drivers\fidbox.idx
2009-06-29 00:58 . 2009-04-27 12:51	--------	d-----w-	c:\documents and settings\SAMY\Application Data\Spyware Terminator
2009-06-28 14:19 . 2009-06-19 23:57	--------	d-----w-	c:\documents and settings\SAMY\Application Data\DivX
2009-06-23 17:14 . 2009-04-27 12:51	--------	d-----w-	c:\program files\Spyware Terminator
2009-06-17 16:11 . 2009-04-27 12:51	--------	d-----w-	c:\documents and settings\All Users\Application Data\Spyware Terminator
2009-05-23 18:56 . 2009-05-23 18:56	--------	d-----w-	c:\documents and settings\SAMY\Application Data\Malwarebytes
2009-05-23 18:56 . 2009-05-23 18:56	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2009-05-23 18:56 . 2009-05-23 18:56	--------	d-----w-	c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-23 14:04 . 2009-05-23 14:04	--------	d-----w-	c:\program files\Yahoo!
2009-05-23 14:04 . 2009-05-23 14:04	--------	d-----w-	c:\documents and settings\SAMY\Application Data\Yahoo!
2009-05-23 14:04 . 2009-05-23 14:04	--------	d-----w-	c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-05-20 16:09 . 2009-04-26 16:06	94643	----a-w-	c:\windows\system32\drivers\klick.dat
2009-05-20 16:09 . 2009-04-26 16:06	105395	----a-w-	c:\windows\system32\drivers\klin.dat
2009-05-15 23:22 . 2009-05-15 23:21	204	----a-w-	c:\windows\baidueee.vbs
2009-05-01 21:03 . 2009-06-19 23:57	9464	------w-	c:\windows\system32\drivers\cdralw2k.sys
2009-05-01 21:03 . 2009-06-19 23:57	9336	------w-	c:\windows\system32\drivers\cdr4_xp.sys
2009-05-01 21:03 . 2009-06-19 23:57	43528	------w-	c:\windows\system32\drivers\PxHelp20.sys
2009-05-01 21:03 . 2009-06-19 23:57	129784	------w-	c:\windows\system32\pxafs.dll
2009-05-01 21:03 . 2009-06-19 23:57	120056	------w-	c:\windows\system32\pxcpyi64.exe
2009-05-01 21:03 . 2009-06-19 23:57	118520	------w-	c:\windows\system32\pxinsi64.exe
2009-05-01 21:02 . 2009-05-01 21:02	90112	----a-w-	c:\windows\system32\dpl100.dll
2009-05-01 21:02 . 2009-05-01 21:02	823296	----a-w-	c:\windows\system32\divx_xx0c.dll
2009-05-01 21:02 . 2009-05-01 21:02	823296	----a-w-	c:\windows\system32\divx_xx07.dll
2009-05-01 21:02 . 2009-05-01 21:02	815104	----a-w-	c:\windows\system32\divx_xx0a.dll
2009-05-01 21:02 . 2009-05-01 21:02	811008	----a-w-	c:\windows\system32\divx_xx16.dll
2009-05-01 21:02 . 2009-05-01 21:02	802816	----a-w-	c:\windows\system32\divx_xx11.dll
2009-05-01 21:02 . 2009-05-01 21:02	685056	----a-w-	c:\windows\system32\DivX.dll
2009-05-01 11:28 . 2009-05-01 11:28	1915520	----a-w-	c:\documents and settings\SAMY\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
2009-04-27 12:51 . 2009-04-27 12:51	6144	----a-w-	c:\documents and settings\All Users\Application Data\Spyware Terminator\sp_rsdel.exe
2009-04-27 12:51 . 2009-04-27 12:51	5632	----a-w-	c:\documents and settings\All Users\Application Data\Spyware Terminator\fileobjinfo.sys
2009-04-27 12:51 . 2009-04-27 12:51	142592	----a-w-	c:\windows\system32\drivers\sp_rsdrv2.sys
2009-04-27 12:37 . 2009-04-26 20:06	76507	----a-w-	c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-04-27 12:31 . 2009-04-27 12:32	64160	----a-w-	c:\windows\system32\drivers\Lbd.sys
2009-04-27 12:31 . 2009-04-27 12:31	64160	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Drivers\32\lbd.sys
2009-04-27 12:31 . 2009-04-27 12:31	73064	----a-w-	c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Drivers\32\AAWDriverTool.exe
2009-04-26 20:03 . 2009-04-26 20:03	21892	----a-w-	c:\windows\system32\emptyregdb.dat
2009-04-26 15:56 . 2009-04-26 15:56	319488	----a-w-	c:\windows\HideWin.exe
2009-04-26 15:47 . 2009-04-26 15:47	0	----a-w-	c:\windows
sreg.dat
2009-04-26 15:34 . 2009-04-26 20:50	12912	----a-w-	c:\documents and settings\SAMY\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-26 15:20 . 2009-04-26 15:20	0	----a-w-	c:\windows\ativpsrm.bin
2009-04-26 15:17 . 2009-04-26 15:17	9158	----a-r-	c:\documents and settings\SAMY\Application Data\Microsoft\Installer\{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}\ARPPRODUCTICON.exe
2009-04-06 13:32 . 2009-05-23 18:56	38496	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-06 13:32 . 2009-05-23 18:56	15504	----a-w-	c:\windows\system32\drivers\mbam.sys
2009-05-01 21:02 . 2009-05-01 21:02	1044480	----a-w-	c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02	200704	----a-w-	c:\program files\mozilla firefox\plugins\ssldivx.dll
.

(((((((((((((((((((((((((((((   SnapShot@2009-05-23_19.36.54   )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-06-19 23:57 . 2009-05-01 21:03	88824              c:\windows\system32\vxblock.dll
+ 2009-06-19 23:57 . 2009-05-01 21:03	64760              c:\windows\system32\pxinsa64.exe
+ 2009-06-19 23:57 . 2009-05-01 21:03	72440              c:\windows\system32\pxhpinst.exe
+ 2009-06-19 23:57 . 2009-05-01 21:03	66296              c:\windows\system32\pxcpya64.exe
- 2004-08-05 12:00 . 2009-05-23 19:25	62344              c:\windows\system32\perfc009.dat
+ 2004-08-05 12:00 . 2009-07-03 17:58	62344              c:\windows\system32\perfc009.dat
- 2009-04-27 12:37 . 2009-04-27 12:32	15688              c:\windows\system32\lsdelete.exe
+ 2009-04-27 12:37 . 2009-06-08 12:32	15688              c:\windows\system32\lsdelete.exe
+ 2008-01-14 12:15 . 2008-01-14 12:15	81920              c:\windows\system32\frapsvid.dll
+ 2009-04-26 15:33 . 2009-04-26 15:33	23040              c:\windows\Installer\b1cd5.msi
+ 2009-04-26 15:33 . 2009-04-26 15:33	25088              c:\windows\Installer\b1cc8.msi
+ 2009-04-26 15:32 . 2009-04-26 15:32	28160              c:\windows\Installer\b1cc2.msi
+ 2009-04-26 15:32 . 2009-04-26 15:32	83456              c:\windows\Installer\b1ca4.msi
+ 2009-04-26 15:32 . 2009-04-26 15:32	59904              c:\windows\Installer\b1c9e.msi
+ 2009-06-19 23:57 . 2009-05-01 21:03	379640              c:\windows\system32\pxwave.dll
+ 2009-06-19 23:57 . 2009-05-01 21:03	187128              c:\windows\system32\pxmas.dll
+ 2009-06-19 23:57 . 2009-05-01 21:03	518904              c:\windows\system32\pxdrv.dll
+ 2009-06-19 23:57 . 2009-05-01 21:03	551672              c:\windows\system32\px.dll
- 2004-08-05 12:00 . 2009-05-23 19:25	401064              c:\windows\system32\perfh009.dat
+ 2004-08-05 12:00 . 2009-07-03 17:58	401064              c:\windows\system32\perfh009.dat
+ 2009-04-26 20:12 . 2009-04-26 20:12	227840              c:\windows\Installer\fc64e.msi
+ 2009-04-26 20:11 . 2009-04-26 20:11	261632              c:\windows\Installer\fc648.msi
+ 2009-04-27 12:28 . 2009-04-27 12:28	570368              c:\windows\Installer\dd54b.msi
+ 2009-04-27 12:28 . 2009-04-27 12:28	236032              c:\windows\Installer\dd546.msi
+ 2009-04-26 15:34 . 2009-04-26 15:34	570880              c:\windows\Installer\b1cf4.msi
+ 2009-04-26 15:34 . 2009-04-26 15:34	782336              c:\windows\Installer\b1ced.msi
+ 2009-04-26 15:34 . 2009-04-26 15:34	484352              c:\windows\Installer\b1ce7.msi
+ 2009-04-26 15:33 . 2009-04-26 15:33	891904              c:\windows\Installer\b1ce1.msi
+ 2009-04-26 15:33 . 2009-04-26 15:33	817664              c:\windows\Installer\b1cdb.msi
+ 2009-04-26 15:33 . 2009-04-26 15:33	431104              c:\windows\Installer\b1ccf.msi
+ 2009-04-26 15:32 . 2009-04-26 15:32	140288              c:\windows\Installer\b1cbc.msi
+ 2009-04-26 15:32 . 2009-04-26 15:32	202752              c:\windows\Installer\b1cb6.msi
+ 2009-04-26 15:32 . 2009-04-26 15:32	337408              c:\windows\Installer\b1cb0.msi
+ 2009-04-26 15:32 . 2009-04-26 15:32	152576              c:\windows\Installer\b1caa.msi
+ 2009-04-26 15:32 . 2009-04-26 15:32	107008              c:\windows\Installer\b1c98.msi
+ 2009-04-26 15:32 . 2009-04-26 15:32	301056              c:\windows\Installer\b1c92.msi
+ 2009-06-19 23:56 . 2009-06-19 23:56	152576              c:\windows\Installer\2e9f932.msi
+ 2009-04-26 15:19 . 2009-04-26 15:19	925696              c:\windows\Installer\183161.msi
+ 2009-04-26 15:18 . 2009-04-26 15:18	210944              c:\windows\Installer\18314c.msi
+ 2009-04-26 15:18 . 2009-04-26 15:18	248832              c:\windows\Installer\183146.msi
+ 2009-04-26 15:18 . 2009-04-26 15:18	248832              c:\windows\Installer\183140.msi
+ 2009-04-26 15:18 . 2009-04-26 15:18	251392              c:\windows\Installer\18313a.msi
+ 2009-04-26 15:18 . 2009-04-26 15:18	251392              c:\windows\Installer\183134.msi
+ 2009-04-26 15:18 . 2009-04-26 15:18	251392              c:\windows\Installer\18312e.msi
+ 2009-04-26 15:18 . 2009-04-26 15:18	251392              c:\windows\Installer\183128.msi
+ 2009-04-26 15:18 . 2009-04-26 15:18	251392              c:\windows\Installer\183122.msi
+ 2009-04-26 15:18 . 2009-04-26 15:18	251392              c:\windows\Installer\18311c.msi
+ 2009-04-26 15:18 . 2009-04-26 15:18	251392              c:\windows\Installer\183116.msi
+ 2009-04-26 15:18 . 2009-04-26 15:18	251392              c:\windows\Installer\183110.msi
+ 2009-04-26 15:18 . 2009-04-26 15:18	248320              c:\windows\Installer\18310a.msi
+ 2009-04-26 15:18 . 2009-04-26 15:18	248832              c:\windows\Installer\183104.msi
+ 2009-04-26 15:18 . 2009-04-26 15:18	248832              c:\windows\Installer\1830fe.msi
+ 2009-04-26 15:18 . 2009-04-26 15:18	251392              c:\windows\Installer\1830f8.msi
+ 2009-04-26 15:17 . 2009-04-26 15:17	249344              c:\windows\Installer\1830f2.msi
+ 2009-04-26 15:17 . 2009-04-26 15:17	251392              c:\windows\Installer\1830ec.msi
+ 2009-04-26 15:17 . 2009-04-26 15:17	249344              c:\windows\Installer\1830e6.msi
+ 2009-04-26 15:17 . 2009-04-26 15:17	252416              c:\windows\Installer\1830e0.msi
+ 2009-04-26 15:17 . 2009-04-26 15:17	251904              c:\windows\Installer\1830da.msi
+ 2009-04-26 15:17 . 2009-04-26 15:17	249344              c:\windows\Installer\1830d4.msi
+ 2009-04-26 15:17 . 2009-04-26 15:17	251904              c:\windows\Installer\1830ce.msi
+ 2009-04-26 15:17 . 2009-04-26 15:17	251392              c:\windows\Installer\1830c8.msi
+ 2009-04-26 15:17 . 2009-04-26 15:17	428032              c:\windows\Installer\1830c2.msi
+ 2009-04-26 15:17 . 2009-04-26 15:17	228864              c:\windows\Installer\1830bc.msi
+ 2009-04-26 15:17 . 2009-04-26 15:17	275968              c:\windows\Installer\1830b6.msi
+ 2009-04-26 15:17 . 2009-04-26 15:17	196608              c:\windows\Installer\1830b0.msi
+ 2009-04-26 15:17 . 2009-04-26 15:17	278528              c:\windows\Installer\1830aa.msi
+ 2009-04-26 15:17 . 2009-04-26 15:17	304128              c:\windows\Installer\1830a4.msi
+ 2009-04-26 15:17 . 2009-04-26 15:17	199168              c:\windows\Installer\18309e.msi
+ 2009-04-26 15:17 . 2009-04-26 15:17	284160              c:\windows\Installer\183098.msi
+ 2009-04-26 15:17 . 2009-04-26 15:17	321536              c:\windows\Installer\183092.msi
+ 2009-04-26 15:17 . 2009-04-26 15:17	274944              c:\windows\Installer\18308c.msi
+ 2009-04-26 15:17 . 2009-04-26 15:17	774144              c:\windows\Installer\183086.msi
+ 2009-04-26 20:17 . 2009-04-26 20:17	265216              c:\windows\Installer\15a25.msi
+ 2007-09-28 02:41 . 2007-09-28 02:41	381960              c:\windows\Downloaded Program Files\GAME_UNO1.dll
+ 2009-06-25 14:36 . 2009-06-25 14:36	222584              c:\windows\Downloaded Program Files\BFHUpdater.dll
+ 2004-08-05 12:00 . 2004-08-05 12:00	1355776              c:\windows\system32\webfldrs.msi
+ 2009-06-19 23:57 . 2009-05-01 21:03	1628920              c:\windows\system32\pxsfs.dll
+ 2009-04-26 20:11 . 2009-04-26 20:11	3453440              c:\windows\Installer\f4a33.msi
+ 2009-05-11 23:34 . 2009-05-11 23:34	1100288              c:\windows\Installer\2bddcc5.msi
+ 2009-04-26 16:06 . 2009-04-26 16:06	2807296              c:\windows\Installer\2a3715.msi
+ 2009-04-26 15:18 . 2009-04-26 15:18	3649536              c:\windows\Installer\183159.msi
+ 2009-04-26 15:18 . 2009-04-26 15:18	1068544              c:\windows\Installer\183152.msi
+ 2009-04-26 15:15 . 2009-04-26 15:15	2109440              c:\windows\Installer\16aaa7.msi
+ 2009-06-25 14:36 . 2009-06-25 14:36	1291640              c:\windows\Downloaded Program Files\BFHUpdater.exe
+ 2009-04-26 20:15 . 2009-04-26 20:12	10331648              c:\windows\system32\config\systemprofile\Local Settings\Application Data\{3248F0A6-6813-11D6-A77B-00B0D0150000}\J2SE Runtime Environment 5.0.msi
+ 2005-09-23 05:48 . 2005-09-23 05:48	24863744              c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0
etfx.msi
.
-- Instantané actualisé --
.
(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-05 15360]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"Steam"="c:\program files\Steam\Steam.exe" [2009-06-11 1217784]
"Google Update"="c:\documents and settings\SAMY\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-05-23 133104]
"BitComet"="c:\program files\BitComet\BitComet.exe" [2009-05-18 2592056]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0\bin\jusched.exe" [2009-04-26 36972]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-06-08 518488]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2008-08-26 16851456]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-05 15360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"c:\Program Files\Messenger\msmsgs.exe"=
"c:\Program Files\Windows Live\Messenger\wlcsdk.exe"=
"c:\Program Files\Windows Live\Messenger\msnmsgr.exe"=
"c:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"=
"e:\Jeux\Wow\Launcher.exe"=
"e:\Jeux\Wow\WoW-3.0.9.9551-to-3.1.0.9767-frFR-downloader.exe"=
"c:\Program Files\Steam\steamapps\gemini93200@hotmail.com\counter-strike source\hl2.exe"=
"c:\Program Files\Steam\steamapps\gemini93200@hotmail.com\day of defeat source\hl2.exe"=
"c:\Program Files\Steam\steamapps\gemini93200@hotmail.com\counter-strike\hl.exe"=
"c:\Program Files\BitComet\BitComet.exe"=
"e:\Jeux\3.0.1.8874 EU PTR Installer\World of Warcraft Public Test\WoW-0.1.2-frFR-downloader.exe"=
"e:\Jeux\3.0.1.8874 EU PTR Installer\World of Warcraft Public Test\Launcher.exe"=
"c:\Program Files\Steam\steamapps\shinzo_recon@hotmail.com707\counter-strike source\hl2.exe"=
"c:\Program Files\Steam\steamapps\antoineleboss\counter-strike\hl.exe"=
"e:\Jeux\3.0.1.8874 EU PTR Installer\World of Warcraft Public Test\WoW-0.2.0-frFR-downloader.exe"=
"c:\WINDOWS\system32\PnkBstrA.exe"=
"c:\WINDOWS\system32\PnkBstrB.exe"=
"c:\Program Files\Steam\steamapps\shinzo_recon@hotmail.com707\counter-strike\hl.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
"24231:TCP"= 24231:TCP:BitComet 24231 TCP
"24231:UDP"= 24231:UDP:BitComet 24231 UDP

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [27/04/2009 14:32 64160]
R3 PALLADIA;Palladia 300/400 Usb Adsl Modem;c:\windows\system32\drivers\usbiad.sys [26/04/2009 23:02 31547]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [18/01/2009 23:34 1005904]
S3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [26/04/2009 17:13 93184]
.
Contenu du dossier 'Tâches planifiées'

2009-06-15 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 12:32]

2009-07-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1078081533-1532298954-839522115-1005Core.job
- c:\documents and settings\SAMY\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-05-23 13:18]

2009-07-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1078081533-1532298954-839522115-1005UA.job
- c:\documents and settings\SAMY\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-05-23 13:18]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://google.atcomet.com/b/
mWindow Title = 
IE: Tout télécharger avec BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: Télécharger avec BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: Télécharger toutes les vidéos avec BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm
DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} - hxxps://www.battlefieldheroes.com/static/updater/BFHUpdater_4.0.21.0.cab
FF - ProfilePath - c:\documents and settings\SAMY\Application Data\Mozilla\Firefox\Profiles\l9rbjkg5.default\
FF - component: c:\documents and settings\SAMY\Application Data\Mozilla\Firefox\Profiles\l9rbjkg5.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\components\IBitCometExtension.dll
FF - plugin: c:\documents and settings\SAMY\Application Data\Mozilla\Firefox\Profiles\l9rbjkg5.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins
pBFHUpdater.dll
FF - plugin: c:\documents and settings\SAMY\Local Settings\Application Data\Google\Update\1.2.183.7
pGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre1.5.0\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0\bin\NPJPI150.dll
FF - plugin: c:\program files\Java\jre1.5.0\bin\NPOJI610.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-03 20:05
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(828)
c:\windows\system32\Ati2evxx.dll
.
Heure de fin: 2009-07-03 20:06
ComboFix-quarantined-files.txt  2009-07-03 18:06
ComboFix2.txt  2009-06-29 16:26
ComboFix3.txt  2009-05-23 19:43

Avant-CF: 229 295 144 960 octets libres
Après-CF: 229 891 162 112 octets libres

285

Van · Answer

up

archet9 · Answer

Re

Un nouveau Rsit stp....


a+

Virus Net-Worm.Win32.Kido.ix

26 réponses

Discussions similaires