Précédent
- 1
- 2
/!\ Désactive tous tes logiciels de protection /!\
• Télécharge (de sUBs) ComboFix sur ton Bureau.
• Fais un clic-droit sur ComboFix.exe ( pour vista : choisis "Exécuter en temps qu'administrateur".
• Ne touche à rien pendant le scan.
• Lorsque la recherche sera terminée, un rapport apparaîtra. Poste ce rapport (C:\Combofix.txt) dans ta prochaine réponse.
Tutoriel officiel de Combofix
ComboFix 09-07-24.01 - NICOLAS 26/07/2009 11:02.2.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.255.92 [GMT 2:00]
Running from: d:\documents and settings\NICOLAS\Bureau\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\Installer\13460b.msi
c:\windows\Installer\14e172.msi
c:\windows\Installer\17965d.msp
c:\windows\Installer\1d3c53.msi
c:\windows\Installer\2f05cb.msi
c:\windows\Installer\31b01.msi
c:\windows\Installer\3796b.msi
c:\windows\Installer\4e012.msi
c:\windows\Installer\4e019.msi
c:\windows\Installer\4e020.msi
c:\windows\Installer\4e027.msi
c:\windows\Installer\4e02e.msi
c:\windows\Installer\4e035.msi
c:\windows\Installer\4e044.msi
c:\windows\Installer\4e04b.msi
c:\windows\Installer\4e052.msi
c:\windows\Installer\4e05f.msi
c:\windows\Installer\4e066.msi
c:\windows\Installer\4e06d.msi
c:\windows\Installer\4e079.msi
c:\windows\Installer\4e080.msi
c:\windows\Installer\4e094.msi
c:\windows\Installer\4e09c.msi
c:\windows\Installer\4e0a3.msi
c:\windows\Installer\4e0aa.msi
c:\windows\Installer\4e0b6.msi
c:\windows\Installer\4e0bf.msi
c:\windows\Installer\4e0c6.msi
c:\windows\Installer\4e0d2.msi
c:\windows\Installer\4e0d9.msi
c:\windows\Installer\4e0e5.msi
c:\windows\Installer\4e0ed.msi
c:\windows\Installer\4e0f6.msi
c:\windows\Installer\4e102.msi
c:\windows\Installer\4e10a.msi
c:\windows\Installer\4e117.msi
c:\windows\Installer\4e11e.msi
c:\windows\Installer\4e125.msi
c:\windows\Installer\4e12c.msi
c:\windows\Installer\4e134.msi
c:\windows\Installer\4e13b.msi
c:\windows\Installer\4e143.msi
c:\windows\Installer\4e149.msi
c:\windows\Installer\50c229.msp
c:\windows\Installer\6b5f55.msi
c:\windows\Installer\7d8fb3.msi
c:\windows\Installer\7d8fcb.msi
c:\windows\Installer\7d8fd2.msi
c:\windows\Installer\7d8fd9.msi
c:\windows\Installer\7d8fe0.msi
c:\windows\Installer\7d8fe8.msi
c:\windows\Installer\7d8ff4.msi
c:\windows\Installer\7d8ffb.msi
c:\windows\Installer\80dd2.msi
c:\windows\Installer\80ea7.msi
c:\windows\Installer\80ef2.msp
c:\windows\Installer\a61c2e.msi
c:\windows\Installer\f66fd.msi
.
((((((((((((((((((((((((( Files Created from 2009-06-26 to 2009-07-26 )))))))))))))))))))))))))))))))
.
2009-07-25 19:25 . 2009-07-25 20:06 -------- d-----w- D:\UsbFix
2009-07-25 18:11 . 2009-07-25 18:12 -------- d-----w- d:\program files\trend micro
2009-07-25 18:11 . 2009-07-25 18:12 -------- d-----w- D:\rsit
2009-07-25 15:58 . 2009-07-25 15:58 -------- d-----w- d:\documents and settings\NICOLAS\Application Data\Malwarebytes
2009-07-25 15:58 . 2009-07-13 11:36 38160 ----a-w- d:\windows\system32\drivers\mbamswissarmy.sys
2009-07-25 15:58 . 2009-07-25 15:58 -------- d-----w- d:\documents and settings\All Users\Application Data\Malwarebytes
2009-07-25 15:58 . 2009-07-25 15:58 -------- d-----w- d:\program files\Malwarebytes' Anti-Malware
2009-07-25 15:58 . 2009-07-13 11:36 19096 ----a-w- d:\windows\system32\drivers\mbam.sys
2009-07-25 15:32 . 2009-03-03 09:21 9985 ----a-w- d:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\updguirc.dll
2009-07-25 15:32 . 2009-07-25 15:32 404225 ----a-w- d:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\update.exe
2009-07-25 15:32 . 2008-10-20 06:38 126721 ----a-w- d:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\scewxmlw.dll
2009-07-25 15:23 . 2009-03-30 08:32 96104 ----a-w- d:\windows\system32\drivers\avipbb.sys
2009-07-25 15:23 . 2009-03-24 14:07 55640 ----a-w- d:\windows\system32\drivers\avgntflt.sys
2009-07-25 15:23 . 2009-02-13 10:28 22360 ----a-w- d:\windows\system32\drivers\avgntmgr.sys
2009-07-25 15:23 . 2009-02-13 10:17 45416 ----a-w- d:\windows\system32\drivers\avgntdd.sys
2009-07-25 15:23 . 2009-07-25 15:23 -------- d-----w- d:\program files\Avira
2009-07-25 15:23 . 2009-07-25 15:23 -------- d-----w- d:\documents and settings\All Users\Application Data\Avira
2009-07-24 17:03 . 2009-07-24 17:18 -------- d-----w- d:\windows\BDOSCAN8
2009-07-24 10:53 . 2009-07-24 10:53 -------- d-----w- d:\documents and settings\NICOLAS\Application Data\KC Softwares
2009-07-24 10:53 . 2009-06-30 19:19 54784 ----a-w- d:\documents and settings\All Users\Application Data\SeekService\seekservice115.exe
2009-07-24 10:50 . 2009-07-24 14:03 -------- d-----w- d:\program files\SeekService
2009-07-24 10:50 . 2009-07-24 10:53 -------- d-----w- d:\documents and settings\All Users\Application Data\SeekService
2009-07-24 10:50 . 2009-07-24 10:50 -------- d-----w- d:\program files\KC Softwares
2009-07-13 16:14 . 2009-07-13 16:14 -------- d-----w- d:\windows\Sun
2009-07-08 14:33 . 2009-07-08 14:33 -------- d-----w- d:\program files\JavaFX
2009-07-08 14:29 . 2009-07-08 14:29 -------- d-----w- d:\program files\Sun
2009-07-08 14:27 . 2009-07-08 14:26 410984 ----a-w- d:\windows\system32\deploytk.dll
2009-07-08 14:20 . 2009-07-08 14:25 -------- d-----w- d:\program files\Java
2009-07-01 17:54 . 2009-07-01 17:54 -------- d-----w- d:\documents and settings\NICOLAS\Local Settings\Application Data\Invisionsoft
2009-06-26 16:07 . 2009-06-26 16:12 -------- d-----w- d:\program files\PortableOpenOffice
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-25 20:06 . 2001-08-28 12:00 76746 ----a-w- d:\windows\system32\perfc00C.dat
2009-07-25 20:06 . 2001-08-28 12:00 473904 ----a-w- d:\windows\system32\perfh00C.dat
2009-07-25 16:51 . 2009-06-19 18:59 -------- d-----w- d:\program files\Game_Maker7
2009-06-25 16:58 . 2009-06-25 16:58 -------- d-----w- d:\documents and settings\NICOLAS\Application Data\AeroSnapApp
2009-06-25 16:57 . 2009-06-25 16:57 -------- d-----w- d:\program files\AeroSnap
2009-06-25 15:58 . 2009-04-04 13:10 -------- d--h--w- d:\program files\InstallShield Installation Information
2009-06-19 17:31 . 2009-06-19 17:31 -------- d-----w- d:\program files\inKline Global
2009-06-19 17:23 . 2009-06-19 17:23 -------- d-----w- d:\documents and settings\NICOLAS\Application Data\FastStone
2009-06-16 14:40 . 2001-08-28 12:00 81920 ----a-w- d:\windows\system32\fontsub.dll
2009-06-16 14:40 . 2001-08-28 12:00 119808 ----a-w- d:\windows\system32\t2embed.dll
2009-06-05 17:22 . 2009-06-05 17:21 -------- d-----w- d:\documents and settings\NICOLAS\Application Data\vlc
2009-06-03 19:10 . 2009-04-04 13:44 1297408 ----a-w- d:\windows\system32\quartz.dll
2009-05-25 16:29 . 2009-05-25 16:29 128 ----a-w- d:\documents and settings\DAVID\Local Settings\Application Data\fusioncache.dat
2009-05-25 16:28 . 2009-05-25 16:28 13688 ----a-w- d:\documents and settings\DAVID\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-13 05:04 . 2001-08-28 12:00 915456 ----a-w- d:\windows\system32\wininet.dll
2009-05-08 12:23 . 2009-05-08 12:23 131 ----a-w- d:\documents and settings\ISABELLE\Local Settings\Application Data\fusioncache.dat
2009-05-08 12:22 . 2009-05-08 12:22 13688 ----a-w- d:\documents and settings\ISABELLE\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-07 15:33 . 2001-08-28 12:00 348672 ----a-w- d:\windows\system32\localspl.dll
2009-05-02 17:09 . 2009-04-04 12:57 76487 ----a-w- d:\windows\PCHEALTH\HELPCTR\OfflineCache\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="d:\windows\system32\ctfmon.exe" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="d:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-02-22 339968]
"ATICCC"="d:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-02-22 32768]
"NeroCheck"="d:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Adobe Reader Speed Launcher"="d:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"SunJavaUpdateSched"="d:\program files\Java\jre6\bin\jusched.exe" [2009-07-08 148888]
"avgnt"="d:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"SoundMan"="SOUNDMAN.EXE" - d:\windows\SOUNDMAN.EXE [2002-06-18 46592]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="d:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
"ATICCC"="d:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-02-22 32768]
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^ATI CATALYST System Tray.lnk]
path=d:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\ATI CATALYST System Tray.lnk
backup=d:\windows\pss\ATI CATALYST System Tray.lnkCommon Startup
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk]
path=d:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk
backup=d:\windows\pss\Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnkCommon Startup
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"d:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"d:\\Program Files\\Metin2_France\\metin2.bin"=
"d:\\WINDOWS\\system32\\dplaysvr.exe"=
R0 BsStor;InCD Storage Helper Driver;d:\windows\system32\drivers\bsstor.sys [04/04/2009 16:05 9344]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;d:\program files\Avira\AntiVir Desktop\sched.exe [25/07/2009 17:23 108289]
R2 BsUDF;InCD UDF Driver;d:\windows\system32\drivers\bsudf.sys [04/04/2009 16:05 441728]
R2 SeekService Service;SeekService Service;d:\documents and settings\All Users\Application Data\SeekService\seekservice115.exe [24/07/2009 12:53 54784]
S3 getPlus(R) Helper;getPlus(R) Helper;d:\program files\NOS\bin\getPlus_HelperSvc.exe [17/04/2009 10:19 33176]
S3 SG762_XP;SAGEM 802.11g XG762 1211B Driver;d:\windows\system32\drivers\WlanBZXP.sys [08/04/2009 12:05 450560]
S3 ZDCndis5;ZDCndis5 Protocol Driver;\??\d:\windows\System32\ZDCndis5.SYS --> d:\windows\System32\ZDCndis5.SYS [?]
.
Contents of the 'Scheduled Tasks' folder
2009-07-26 d:\windows\Tasks\User_Feed_Synchronization-{5E5A1E96-792F-4DC5-A67C-56C9126598D4}.job
- d:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
2009-07-26 d:\windows\Tasks\User_Feed_Synchronization-{7E4309E8-10C7-4FD3-B2B4-8751F6E03605}.job
- d:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://google.fr/
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-26 11:17
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(660)
d:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-07-26 11:21
ComboFix-quarantined-files.txt 2009-07-26 09:21
Pre-Run: 26 702 262 272 octets libres
Post-Run: 28 029 693 952 octets libres
193 --- E O F --- 2009-07-15 18:13
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.255.92 [GMT 2:00]
Running from: d:\documents and settings\NICOLAS\Bureau\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\Installer\13460b.msi
c:\windows\Installer\14e172.msi
c:\windows\Installer\17965d.msp
c:\windows\Installer\1d3c53.msi
c:\windows\Installer\2f05cb.msi
c:\windows\Installer\31b01.msi
c:\windows\Installer\3796b.msi
c:\windows\Installer\4e012.msi
c:\windows\Installer\4e019.msi
c:\windows\Installer\4e020.msi
c:\windows\Installer\4e027.msi
c:\windows\Installer\4e02e.msi
c:\windows\Installer\4e035.msi
c:\windows\Installer\4e044.msi
c:\windows\Installer\4e04b.msi
c:\windows\Installer\4e052.msi
c:\windows\Installer\4e05f.msi
c:\windows\Installer\4e066.msi
c:\windows\Installer\4e06d.msi
c:\windows\Installer\4e079.msi
c:\windows\Installer\4e080.msi
c:\windows\Installer\4e094.msi
c:\windows\Installer\4e09c.msi
c:\windows\Installer\4e0a3.msi
c:\windows\Installer\4e0aa.msi
c:\windows\Installer\4e0b6.msi
c:\windows\Installer\4e0bf.msi
c:\windows\Installer\4e0c6.msi
c:\windows\Installer\4e0d2.msi
c:\windows\Installer\4e0d9.msi
c:\windows\Installer\4e0e5.msi
c:\windows\Installer\4e0ed.msi
c:\windows\Installer\4e0f6.msi
c:\windows\Installer\4e102.msi
c:\windows\Installer\4e10a.msi
c:\windows\Installer\4e117.msi
c:\windows\Installer\4e11e.msi
c:\windows\Installer\4e125.msi
c:\windows\Installer\4e12c.msi
c:\windows\Installer\4e134.msi
c:\windows\Installer\4e13b.msi
c:\windows\Installer\4e143.msi
c:\windows\Installer\4e149.msi
c:\windows\Installer\50c229.msp
c:\windows\Installer\6b5f55.msi
c:\windows\Installer\7d8fb3.msi
c:\windows\Installer\7d8fcb.msi
c:\windows\Installer\7d8fd2.msi
c:\windows\Installer\7d8fd9.msi
c:\windows\Installer\7d8fe0.msi
c:\windows\Installer\7d8fe8.msi
c:\windows\Installer\7d8ff4.msi
c:\windows\Installer\7d8ffb.msi
c:\windows\Installer\80dd2.msi
c:\windows\Installer\80ea7.msi
c:\windows\Installer\80ef2.msp
c:\windows\Installer\a61c2e.msi
c:\windows\Installer\f66fd.msi
.
((((((((((((((((((((((((( Files Created from 2009-06-26 to 2009-07-26 )))))))))))))))))))))))))))))))
.
2009-07-25 19:25 . 2009-07-25 20:06 -------- d-----w- D:\UsbFix
2009-07-25 18:11 . 2009-07-25 18:12 -------- d-----w- d:\program files\trend micro
2009-07-25 18:11 . 2009-07-25 18:12 -------- d-----w- D:\rsit
2009-07-25 15:58 . 2009-07-25 15:58 -------- d-----w- d:\documents and settings\NICOLAS\Application Data\Malwarebytes
2009-07-25 15:58 . 2009-07-13 11:36 38160 ----a-w- d:\windows\system32\drivers\mbamswissarmy.sys
2009-07-25 15:58 . 2009-07-25 15:58 -------- d-----w- d:\documents and settings\All Users\Application Data\Malwarebytes
2009-07-25 15:58 . 2009-07-25 15:58 -------- d-----w- d:\program files\Malwarebytes' Anti-Malware
2009-07-25 15:58 . 2009-07-13 11:36 19096 ----a-w- d:\windows\system32\drivers\mbam.sys
2009-07-25 15:32 . 2009-03-03 09:21 9985 ----a-w- d:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\updguirc.dll
2009-07-25 15:32 . 2009-07-25 15:32 404225 ----a-w- d:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\update.exe
2009-07-25 15:32 . 2008-10-20 06:38 126721 ----a-w- d:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\scewxmlw.dll
2009-07-25 15:23 . 2009-03-30 08:32 96104 ----a-w- d:\windows\system32\drivers\avipbb.sys
2009-07-25 15:23 . 2009-03-24 14:07 55640 ----a-w- d:\windows\system32\drivers\avgntflt.sys
2009-07-25 15:23 . 2009-02-13 10:28 22360 ----a-w- d:\windows\system32\drivers\avgntmgr.sys
2009-07-25 15:23 . 2009-02-13 10:17 45416 ----a-w- d:\windows\system32\drivers\avgntdd.sys
2009-07-25 15:23 . 2009-07-25 15:23 -------- d-----w- d:\program files\Avira
2009-07-25 15:23 . 2009-07-25 15:23 -------- d-----w- d:\documents and settings\All Users\Application Data\Avira
2009-07-24 17:03 . 2009-07-24 17:18 -------- d-----w- d:\windows\BDOSCAN8
2009-07-24 10:53 . 2009-07-24 10:53 -------- d-----w- d:\documents and settings\NICOLAS\Application Data\KC Softwares
2009-07-24 10:53 . 2009-06-30 19:19 54784 ----a-w- d:\documents and settings\All Users\Application Data\SeekService\seekservice115.exe
2009-07-24 10:50 . 2009-07-24 14:03 -------- d-----w- d:\program files\SeekService
2009-07-24 10:50 . 2009-07-24 10:53 -------- d-----w- d:\documents and settings\All Users\Application Data\SeekService
2009-07-24 10:50 . 2009-07-24 10:50 -------- d-----w- d:\program files\KC Softwares
2009-07-13 16:14 . 2009-07-13 16:14 -------- d-----w- d:\windows\Sun
2009-07-08 14:33 . 2009-07-08 14:33 -------- d-----w- d:\program files\JavaFX
2009-07-08 14:29 . 2009-07-08 14:29 -------- d-----w- d:\program files\Sun
2009-07-08 14:27 . 2009-07-08 14:26 410984 ----a-w- d:\windows\system32\deploytk.dll
2009-07-08 14:20 . 2009-07-08 14:25 -------- d-----w- d:\program files\Java
2009-07-01 17:54 . 2009-07-01 17:54 -------- d-----w- d:\documents and settings\NICOLAS\Local Settings\Application Data\Invisionsoft
2009-06-26 16:07 . 2009-06-26 16:12 -------- d-----w- d:\program files\PortableOpenOffice
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-25 20:06 . 2001-08-28 12:00 76746 ----a-w- d:\windows\system32\perfc00C.dat
2009-07-25 20:06 . 2001-08-28 12:00 473904 ----a-w- d:\windows\system32\perfh00C.dat
2009-07-25 16:51 . 2009-06-19 18:59 -------- d-----w- d:\program files\Game_Maker7
2009-06-25 16:58 . 2009-06-25 16:58 -------- d-----w- d:\documents and settings\NICOLAS\Application Data\AeroSnapApp
2009-06-25 16:57 . 2009-06-25 16:57 -------- d-----w- d:\program files\AeroSnap
2009-06-25 15:58 . 2009-04-04 13:10 -------- d--h--w- d:\program files\InstallShield Installation Information
2009-06-19 17:31 . 2009-06-19 17:31 -------- d-----w- d:\program files\inKline Global
2009-06-19 17:23 . 2009-06-19 17:23 -------- d-----w- d:\documents and settings\NICOLAS\Application Data\FastStone
2009-06-16 14:40 . 2001-08-28 12:00 81920 ----a-w- d:\windows\system32\fontsub.dll
2009-06-16 14:40 . 2001-08-28 12:00 119808 ----a-w- d:\windows\system32\t2embed.dll
2009-06-05 17:22 . 2009-06-05 17:21 -------- d-----w- d:\documents and settings\NICOLAS\Application Data\vlc
2009-06-03 19:10 . 2009-04-04 13:44 1297408 ----a-w- d:\windows\system32\quartz.dll
2009-05-25 16:29 . 2009-05-25 16:29 128 ----a-w- d:\documents and settings\DAVID\Local Settings\Application Data\fusioncache.dat
2009-05-25 16:28 . 2009-05-25 16:28 13688 ----a-w- d:\documents and settings\DAVID\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-13 05:04 . 2001-08-28 12:00 915456 ----a-w- d:\windows\system32\wininet.dll
2009-05-08 12:23 . 2009-05-08 12:23 131 ----a-w- d:\documents and settings\ISABELLE\Local Settings\Application Data\fusioncache.dat
2009-05-08 12:22 . 2009-05-08 12:22 13688 ----a-w- d:\documents and settings\ISABELLE\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-07 15:33 . 2001-08-28 12:00 348672 ----a-w- d:\windows\system32\localspl.dll
2009-05-02 17:09 . 2009-04-04 12:57 76487 ----a-w- d:\windows\PCHEALTH\HELPCTR\OfflineCache\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="d:\windows\system32\ctfmon.exe" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="d:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-02-22 339968]
"ATICCC"="d:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-02-22 32768]
"NeroCheck"="d:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Adobe Reader Speed Launcher"="d:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"SunJavaUpdateSched"="d:\program files\Java\jre6\bin\jusched.exe" [2009-07-08 148888]
"avgnt"="d:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"SoundMan"="SOUNDMAN.EXE" - d:\windows\SOUNDMAN.EXE [2002-06-18 46592]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="d:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
"ATICCC"="d:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-02-22 32768]
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^ATI CATALYST System Tray.lnk]
path=d:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\ATI CATALYST System Tray.lnk
backup=d:\windows\pss\ATI CATALYST System Tray.lnkCommon Startup
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk]
path=d:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk
backup=d:\windows\pss\Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnkCommon Startup
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"d:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"d:\\Program Files\\Metin2_France\\metin2.bin"=
"d:\\WINDOWS\\system32\\dplaysvr.exe"=
R0 BsStor;InCD Storage Helper Driver;d:\windows\system32\drivers\bsstor.sys [04/04/2009 16:05 9344]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;d:\program files\Avira\AntiVir Desktop\sched.exe [25/07/2009 17:23 108289]
R2 BsUDF;InCD UDF Driver;d:\windows\system32\drivers\bsudf.sys [04/04/2009 16:05 441728]
R2 SeekService Service;SeekService Service;d:\documents and settings\All Users\Application Data\SeekService\seekservice115.exe [24/07/2009 12:53 54784]
S3 getPlus(R) Helper;getPlus(R) Helper;d:\program files\NOS\bin\getPlus_HelperSvc.exe [17/04/2009 10:19 33176]
S3 SG762_XP;SAGEM 802.11g XG762 1211B Driver;d:\windows\system32\drivers\WlanBZXP.sys [08/04/2009 12:05 450560]
S3 ZDCndis5;ZDCndis5 Protocol Driver;\??\d:\windows\System32\ZDCndis5.SYS --> d:\windows\System32\ZDCndis5.SYS [?]
.
Contents of the 'Scheduled Tasks' folder
2009-07-26 d:\windows\Tasks\User_Feed_Synchronization-{5E5A1E96-792F-4DC5-A67C-56C9126598D4}.job
- d:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
2009-07-26 d:\windows\Tasks\User_Feed_Synchronization-{7E4309E8-10C7-4FD3-B2B4-8751F6E03605}.job
- d:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://google.fr/
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-26 11:17
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(660)
d:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-07-26 11:21
ComboFix-quarantined-files.txt 2009-07-26 09:21
Pre-Run: 26 702 262 272 octets libres
Post-Run: 28 029 693 952 octets libres
193 --- E O F --- 2009-07-15 18:13
Précédent
- 1
- 2
