Virus empeche d'ouvrir HijackThis
Résolu
tobor
-
Utilisateur anonyme -
Utilisateur anonyme -
Bonjour,
J'ai un probleme, quand j'ouvre internet explorer l'ordi gele et je suis obligé de faire un reset, j'ai réussi a installer firefox avec ma clef usb et je peut aller sur internet, c'est déja ça, sauf que les pages sont redirigé, j'ai réussi a installer Antivir et je vous donne le rapport. J'ai winxp sp3 pentium 4 2.8.
Merci de bien vouloir m'aider.
Avira AntiVir Personal
Report file date: 25 juillet 2009 14:15
Scanning for 1567743 virus strains and unwanted programs.
Licensee : Avira AntiVir Personal - FREE Antivirus
Serial number : 0000149996-ADJIE-0000001
Platform : Windows XP
Windows version : (Service Pack 3) [5.1.2600]
Boot mode : Normally booted
Username : Administrateur
Computer name : DELL
Version information:
BUILD.DAT : 9.0.0.403 17961 Bytes 2009-06-03 17:05:00
AVSCAN.EXE : 9.0.3.6 466689 Bytes 2009-05-11 08:14:47
AVSCAN.DLL : 9.0.3.0 40705 Bytes 2009-02-27 09:58:24
LUKE.DLL : 9.0.3.2 209665 Bytes 2009-02-20 10:35:49
LUKERES.DLL : 9.0.2.0 12033 Bytes 2009-02-27 09:58:52
ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 2008-10-27 11:30:36
ANTIVIR1.VDF : 7.1.4.132 5707264 Bytes 2009-06-24 11:57:15
ANTIVIR2.VDF : 7.1.4.253 1779200 Bytes 2009-07-19 11:57:29
ANTIVIR3.VDF : 7.1.5.28 214528 Bytes 2009-07-24 11:57:31
Engineversion : 8.2.0.228
AEVDF.DLL : 8.1.1.1 106868 Bytes 2009-04-30 10:52:04
AESCRIPT.DLL : 8.1.2.18 442746 Bytes 2009-07-25 11:57:46
AESCN.DLL : 8.1.2.4 127348 Bytes 2009-07-25 11:57:44
AERDL.DLL : 8.1.2.4 430452 Bytes 2009-07-25 11:57:44
AEPACK.DLL : 8.1.3.18 401783 Bytes 2009-05-27 15:07:20
AEOFFICE.DLL : 8.1.0.38 196987 Bytes 2009-07-25 11:57:42
AEHEUR.DLL : 8.1.0.143 1864055 Bytes 2009-07-25 11:57:41
AEHELP.DLL : 8.1.5.3 233846 Bytes 2009-07-25 11:57:34
AEGEN.DLL : 8.1.1.50 352629 Bytes 2009-07-25 11:57:33
AEEMU.DLL : 8.1.0.9 393588 Bytes 2008-10-09 13:32:40
AECORE.DLL : 8.1.7.6 184694 Bytes 2009-07-25 11:57:32
AEBB.DLL : 8.1.0.3 53618 Bytes 2008-10-09 13:32:40
AVWINLL.DLL : 9.0.0.3 18177 Bytes 2008-12-12 07:47:59
AVPREF.DLL : 9.0.0.1 43777 Bytes 2008-12-05 09:32:15
AVREP.DLL : 8.0.0.3 155905 Bytes 2009-01-20 13:34:28
AVREG.DLL : 9.0.0.0 36609 Bytes 2008-12-05 09:32:09
AVARKT.DLL : 9.0.0.3 292609 Bytes 2009-03-24 14:05:41
AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 2009-01-30 09:37:08
SQLITE3.DLL : 3.6.1.0 326401 Bytes 2009-01-28 14:03:49
SMTPLIB.DLL : 9.2.0.25 28417 Bytes 2009-02-02 07:21:33
NETNT.DLL : 9.0.0.0 11521 Bytes 2008-12-05 09:32:10
RCIMAGE.DLL : 9.0.0.25 2438913 Bytes 2009-05-15 14:39:58
RCTEXT.DLL : 9.0.37.0 86785 Bytes 2009-04-17 09:19:48
Configuration settings for the scan:
Jobname.............................: Complete system scan
Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp
Logging.............................: low
Primary action......................: interactive
Secondary action....................: ignore
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: C:,
Process scan........................: on
Scan registry.......................: on
Search for rootkits.................: on
Integrity checking of system files..: off
Scan all files......................: All files
Scan archives.......................: on
Recursion depth.....................: 20
Smart extensions....................: on
Macro heuristic.....................: on
File heuristic......................: medium
Start of the scan: 25 juillet 2009 14:15
Starting search for hidden objects.
HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ESQULserv.sys\modules
[INFO] The registry entry is invisible.
HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ESQULserv.sys\start
[INFO] The registry entry is invisible.
HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ESQULserv.sys\type
[INFO] The registry entry is invisible.
HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ESQULserv.sys\imagepath
[INFO] The registry entry is invisible.
HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ESQULserv.sys\group
[INFO] The registry entry is invisible.
'7549' objects were checked, '5' hidden objects were found.
The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'avgcsrvx.exe' - '1' Module(s) have been scanned
Scan process 'nmsrvc.exe' - '1' Module(s) have been scanned
Scan process 'avgemc.exe' - '1' Module(s) have been scanned
Scan process 'avgnsx.exe' - '1' Module(s) have been scanned
Scan process 'avgrsx.exe' - '1' Module(s) have been scanned
Scan process 'avgam.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'jqs.exe' - '1' Module(s) have been scanned
Scan process 'avgwdsvc.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'TeaTimer.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'nmapp.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'avgtray.exe' - '1' Module(s) have been scanned
Scan process 'igfxpers.exe' - '1' Module(s) have been scanned
Scan process 'hkcmd.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'savedump.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
39 processes with 39 modules were scanned
Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Starting to scan executable files (registry).
The registry was scanned ( '60' files ).
Starting the file scan:
Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
[NOTE] This file is a Windows system file.
[NOTE] This file cannot be opened for scanning.
C:\Documents and Settings\Administrateur\Local Settings\Temp\5df3805d-e8d3-4c10-ba5f-f556744291eb.tmp
[0] Archive type: CAB (Microsoft)
--> F2913_HPProductSupportWebsite.url.C72289A0_334F_47B2_9027_660ACF342337
[WARNING] No further files can be extracted from this archive. The archive will be closed
C:\Documents and Settings\Administrateur\Local Settings\Temp\610bfb0e-1d47-46d2-b227-fc89ae0c01ac.tmp
[0] Archive type: CAB (Microsoft)
--> F1308_hpobnz08.exe.843BC64F_8F28_4156_976C_445607111FBD
[WARNING] No further files can be extracted from this archive. The archive will be closed
[WARNING] No further files can be extracted from this archive. The archive will be closed
C:\WINDOWS\Temp\2715aafa-4e3b-4be4-91af-5225e8a06485.tmp
[0] Archive type: CAB (Microsoft)
--> Windows6.0-KB949247-v6001-x86.cab
[WARNING] No further files can be extracted from this archive. The archive will be closed
[WARNING] No further files can be extracted from this archive. The archive will be closed
C:\WINDOWS\Temp\387d0037-4049-4700-9bd4-ba48cbf2dda7.tmp
[0] Archive type: CAB (Microsoft)
--> 0
[WARNING] No further files can be extracted from this archive. The archive will be closed
[WARNING] No further files can be extracted from this archive. The archive will be closed
End of the scan: 25 juillet 2009 14:39
Used time: 23:50 Minute(s)
The scan has been done completely.
4273 Scanned directories
186809 Files were scanned
0 Viruses and/or unwanted programs were found
0 Files were classified as suspicious
0 files were deleted
0 Viruses and unwanted programs were repaired
0 Files were moved to quarantine
0 Files were renamed
1 Files cannot be scanned
186808 Files not concerned
7069 Archives were scanned
8 Warnings
1 Notes
7549 Objects were scanned with rootkit scan
5 Hidden objects were found
J'ai un probleme, quand j'ouvre internet explorer l'ordi gele et je suis obligé de faire un reset, j'ai réussi a installer firefox avec ma clef usb et je peut aller sur internet, c'est déja ça, sauf que les pages sont redirigé, j'ai réussi a installer Antivir et je vous donne le rapport. J'ai winxp sp3 pentium 4 2.8.
Merci de bien vouloir m'aider.
Avira AntiVir Personal
Report file date: 25 juillet 2009 14:15
Scanning for 1567743 virus strains and unwanted programs.
Licensee : Avira AntiVir Personal - FREE Antivirus
Serial number : 0000149996-ADJIE-0000001
Platform : Windows XP
Windows version : (Service Pack 3) [5.1.2600]
Boot mode : Normally booted
Username : Administrateur
Computer name : DELL
Version information:
BUILD.DAT : 9.0.0.403 17961 Bytes 2009-06-03 17:05:00
AVSCAN.EXE : 9.0.3.6 466689 Bytes 2009-05-11 08:14:47
AVSCAN.DLL : 9.0.3.0 40705 Bytes 2009-02-27 09:58:24
LUKE.DLL : 9.0.3.2 209665 Bytes 2009-02-20 10:35:49
LUKERES.DLL : 9.0.2.0 12033 Bytes 2009-02-27 09:58:52
ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 2008-10-27 11:30:36
ANTIVIR1.VDF : 7.1.4.132 5707264 Bytes 2009-06-24 11:57:15
ANTIVIR2.VDF : 7.1.4.253 1779200 Bytes 2009-07-19 11:57:29
ANTIVIR3.VDF : 7.1.5.28 214528 Bytes 2009-07-24 11:57:31
Engineversion : 8.2.0.228
AEVDF.DLL : 8.1.1.1 106868 Bytes 2009-04-30 10:52:04
AESCRIPT.DLL : 8.1.2.18 442746 Bytes 2009-07-25 11:57:46
AESCN.DLL : 8.1.2.4 127348 Bytes 2009-07-25 11:57:44
AERDL.DLL : 8.1.2.4 430452 Bytes 2009-07-25 11:57:44
AEPACK.DLL : 8.1.3.18 401783 Bytes 2009-05-27 15:07:20
AEOFFICE.DLL : 8.1.0.38 196987 Bytes 2009-07-25 11:57:42
AEHEUR.DLL : 8.1.0.143 1864055 Bytes 2009-07-25 11:57:41
AEHELP.DLL : 8.1.5.3 233846 Bytes 2009-07-25 11:57:34
AEGEN.DLL : 8.1.1.50 352629 Bytes 2009-07-25 11:57:33
AEEMU.DLL : 8.1.0.9 393588 Bytes 2008-10-09 13:32:40
AECORE.DLL : 8.1.7.6 184694 Bytes 2009-07-25 11:57:32
AEBB.DLL : 8.1.0.3 53618 Bytes 2008-10-09 13:32:40
AVWINLL.DLL : 9.0.0.3 18177 Bytes 2008-12-12 07:47:59
AVPREF.DLL : 9.0.0.1 43777 Bytes 2008-12-05 09:32:15
AVREP.DLL : 8.0.0.3 155905 Bytes 2009-01-20 13:34:28
AVREG.DLL : 9.0.0.0 36609 Bytes 2008-12-05 09:32:09
AVARKT.DLL : 9.0.0.3 292609 Bytes 2009-03-24 14:05:41
AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 2009-01-30 09:37:08
SQLITE3.DLL : 3.6.1.0 326401 Bytes 2009-01-28 14:03:49
SMTPLIB.DLL : 9.2.0.25 28417 Bytes 2009-02-02 07:21:33
NETNT.DLL : 9.0.0.0 11521 Bytes 2008-12-05 09:32:10
RCIMAGE.DLL : 9.0.0.25 2438913 Bytes 2009-05-15 14:39:58
RCTEXT.DLL : 9.0.37.0 86785 Bytes 2009-04-17 09:19:48
Configuration settings for the scan:
Jobname.............................: Complete system scan
Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp
Logging.............................: low
Primary action......................: interactive
Secondary action....................: ignore
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: C:,
Process scan........................: on
Scan registry.......................: on
Search for rootkits.................: on
Integrity checking of system files..: off
Scan all files......................: All files
Scan archives.......................: on
Recursion depth.....................: 20
Smart extensions....................: on
Macro heuristic.....................: on
File heuristic......................: medium
Start of the scan: 25 juillet 2009 14:15
Starting search for hidden objects.
HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ESQULserv.sys\modules
[INFO] The registry entry is invisible.
HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ESQULserv.sys\start
[INFO] The registry entry is invisible.
HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ESQULserv.sys\type
[INFO] The registry entry is invisible.
HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ESQULserv.sys\imagepath
[INFO] The registry entry is invisible.
HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ESQULserv.sys\group
[INFO] The registry entry is invisible.
'7549' objects were checked, '5' hidden objects were found.
The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'avgcsrvx.exe' - '1' Module(s) have been scanned
Scan process 'nmsrvc.exe' - '1' Module(s) have been scanned
Scan process 'avgemc.exe' - '1' Module(s) have been scanned
Scan process 'avgnsx.exe' - '1' Module(s) have been scanned
Scan process 'avgrsx.exe' - '1' Module(s) have been scanned
Scan process 'avgam.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'jqs.exe' - '1' Module(s) have been scanned
Scan process 'avgwdsvc.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'TeaTimer.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'nmapp.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'avgtray.exe' - '1' Module(s) have been scanned
Scan process 'igfxpers.exe' - '1' Module(s) have been scanned
Scan process 'hkcmd.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'savedump.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
39 processes with 39 modules were scanned
Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Starting to scan executable files (registry).
The registry was scanned ( '60' files ).
Starting the file scan:
Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
[NOTE] This file is a Windows system file.
[NOTE] This file cannot be opened for scanning.
C:\Documents and Settings\Administrateur\Local Settings\Temp\5df3805d-e8d3-4c10-ba5f-f556744291eb.tmp
[0] Archive type: CAB (Microsoft)
--> F2913_HPProductSupportWebsite.url.C72289A0_334F_47B2_9027_660ACF342337
[WARNING] No further files can be extracted from this archive. The archive will be closed
C:\Documents and Settings\Administrateur\Local Settings\Temp\610bfb0e-1d47-46d2-b227-fc89ae0c01ac.tmp
[0] Archive type: CAB (Microsoft)
--> F1308_hpobnz08.exe.843BC64F_8F28_4156_976C_445607111FBD
[WARNING] No further files can be extracted from this archive. The archive will be closed
[WARNING] No further files can be extracted from this archive. The archive will be closed
C:\WINDOWS\Temp\2715aafa-4e3b-4be4-91af-5225e8a06485.tmp
[0] Archive type: CAB (Microsoft)
--> Windows6.0-KB949247-v6001-x86.cab
[WARNING] No further files can be extracted from this archive. The archive will be closed
[WARNING] No further files can be extracted from this archive. The archive will be closed
C:\WINDOWS\Temp\387d0037-4049-4700-9bd4-ba48cbf2dda7.tmp
[0] Archive type: CAB (Microsoft)
--> 0
[WARNING] No further files can be extracted from this archive. The archive will be closed
[WARNING] No further files can be extracted from this archive. The archive will be closed
End of the scan: 25 juillet 2009 14:39
Used time: 23:50 Minute(s)
The scan has been done completely.
4273 Scanned directories
186809 Files were scanned
0 Viruses and/or unwanted programs were found
0 Files were classified as suspicious
0 files were deleted
0 Viruses and unwanted programs were repaired
0 Files were moved to quarantine
0 Files were renamed
1 Files cannot be scanned
186808 Files not concerned
7069 Archives were scanned
8 Warnings
1 Notes
7549 Objects were scanned with rootkit scan
5 Hidden objects were found
A voir également:
- Virus empeche d'ouvrir HijackThis
- Hijackthis - Télécharger - Antivirus & Antimalwares
- Comment ouvrir un fichier epub ? - Guide
- Ouvrir fichier .bin - Guide
- Ouvrir fichier .dat - Guide
- Ouvrir avec - Guide
87 réponses
Une fenetre antivir est apparu disant A virus or unwanted program was found
what should happen witch the file
eicar-test-signature virus
move to quarantine
delete
rename
deny access
ignore
quesque je fais
what should happen witch the file
eicar-test-signature virus
move to quarantine
delete
rename
deny access
ignore
quesque je fais
voici le rapport je revien dans 4 heures...
ComboFix 09-07-26.03 - Administrateur 2009-07-27 13:10.1.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.2.1036.18.1022.716 [GMT -4:00]
Running from: c:\documents and settings\Administrateur\Bureau\Jocelyn.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\drivers\ESQULuuhdmulcjdtwnbgrndpmexcpuyxatyke.sys
c:\windows\system32\ESQULkobcrhlrayyjopqqejmejadltkpgvabr.dll
c:\windows\system32\ESQULomafnxbbctjbfkatvaoyrodlgymkyrsp.dll
c:\windows\system32\ESQULzcounter
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_ESQULserv.sys
((((((((((((((((((((((((( Files Created from 2009-06-27 to 2009-07-27 )))))))))))))))))))))))))))))))
.
2009-07-27 14:32 . 2009-07-13 17:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-27 14:32 . 2009-07-27 14:32 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-27 14:32 . 2009-07-27 14:32 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\Malwarebytes
2009-07-27 14:32 . 2009-07-13 17:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-25 16:35 . 2009-07-25 16:35 -------- d-----w- C:\_OTL
2009-07-25 15:26 . 2009-07-25 15:29 -------- d-----w- C:\WORT
2009-07-25 14:15 . 2009-07-25 14:33 -------- d-----w- C:\UsbFix
2009-07-25 13:28 . 2009-07-25 13:28 -------- d-----w- c:\program files\Trend Micro
2009-07-25 11:54 . 2009-03-30 08:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-07-25 11:54 . 2009-02-13 10:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-07-25 11:54 . 2009-03-24 14:08 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-07-25 11:54 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-07-25 11:54 . 2009-07-25 11:54 -------- d-----w- c:\program files\Avira
2009-07-25 11:54 . 2009-07-25 11:54 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\Avira
2009-07-23 18:09 . 2009-07-23 18:09 0 ----a-w- c:\windows\nsreg.dat
2009-07-23 18:09 . 2009-07-23 18:09 -------- d-----w- c:\documents and settings\Administrateur\Local Settings\Application Data\Mozilla
2009-07-21 18:11 . 2009-07-21 18:11 -------- d--h--w- c:\windows\system32\GroupPolicy
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-26 23:35 . 2006-01-05 14:32 84526 ----a-w- c:\windows\system32\perfc00C.dat
2009-07-26 23:35 . 2006-01-05 14:32 510324 ----a-w- c:\windows\system32\perfh00C.dat
2009-07-25 14:45 . 2009-01-31 12:28 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\avg8
2009-07-23 18:37 . 2009-07-23 18:20 -------- d-----w- c:\documents and settings\Administrateur\Application Data\HouseCall 6.6
2009-07-19 09:12 . 2009-02-02 15:02 -------- d-----w- c:\program files\PokerStars
2009-07-19 00:01 . 2009-02-04 16:24 -------- d-----w- c:\documents and settings\Administrateur\Application Data\LimeWire
2009-07-07 15:24 . 2009-01-31 12:27 16328 ----a-w- c:\documents and settings\Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-27 09:41 . 2009-02-13 18:27 -------- d-----w- c:\program files\Pivot Stickfigure Animator
2009-06-27 09:11 . 2009-06-27 09:11 152576 ----a-w- c:\documents and settings\Administrateur\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-06-23 19:28 . 2009-06-14 16:02 37 ----a-w- c:\windows\popcinfot.dat
2009-06-16 14:40 . 2006-01-05 14:32 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:40 . 2006-01-05 14:32 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 11:48 . 2009-05-18 17:29 -------- d-----w- c:\program files\Google
2009-06-14 16:02 . 2009-06-14 16:02 0 ----a-w- c:\windows\popcreg.dat
2009-06-03 19:10 . 2006-01-05 14:32 1297408 ----a-w- c:\windows\system32\quartz.dll
2009-05-07 15:33 . 2006-01-05 14:32 348672 ----a-w- c:\windows\system32\localspl.dll
2009-04-29 04:45 . 2006-01-05 14:32 827392 ----a-w- c:\windows\system32\wininet.dll
2009-04-29 04:45 . 2006-01-05 14:32 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-07-15 22:31 . 2009-07-23 18:08 137208 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-05-18 39408]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-04 136600]
"nmapp"="c:\program files\Pure Networks\Network Magic\nmapp.exe" [2007-03-14 321088]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
c:\docume~1\ALLUSE~1\MENUDM~1\PROGRA~1\DMARRA~1\
hp psc 1000 series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe [2002-12-2 147456]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDP:Service de découverte DHCP
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-07-25 108289]
S2 gupdate1c9d7de4dc4b67e;Service Google Update (gupdate1c9d7de4dc4b67e);c:\program files\Google\Update\GoogleUpdate.exe [2009-05-18 133104]
.
- - - - ORPHANS REMOVED - - - -
Notify-avgrsstarter - avgrsstx.dll
.
------- Supplementary Scan -------
.
uInternet Connection Wizard,ShellNext = iexplore
Handler: intu-ir2008 - {729D3592-92E7-4cbc-8E44-3C22B3F457B3} - c:\program files\ImpotRapide 2008\ic2008pp.dll
FF - ProfilePath - c:\docume~1\ADMINI~1\APPLIC~1\Mozilla\Firefox\Profiles\cn7l0ojp.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/webhp?hl=fr
FF - plugin: c:\program files\Google\Google Updater\2.4.1591.6512\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.
**************************************************************************
catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-27 13:22
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
c:\windows\TEMP\CR_1EC.tmp
c:\windows\TEMP\CR_27F.tmp
c:\windows\TEMP\Perflib_Perfdata_160.dat 16384 bytes
c:\windows\TEMP\Perflib_Perfdata_4c0.dat 16384 bytes
c:\windows\TEMP\WGAErrLog.txt 483 bytes
c:\windows\TEMP\59f30a02-91f2-448f-aa28-2dcf058165a5.tmp
c:\windows\TEMP\fadb1aed-31db-4e35-8bf6-a24bb5f7a377.tmp
c:\windows\TEMP\CR_2C6.tmp
scan completed successfully
hidden files: 8
**************************************************************************
.
Completion time: 2009-07-27 13:24
ComboFix-quarantined-files.txt 2009-07-27 17:24
Pre-Run: 29 097 992 192 octets libres
Post-Run: 29 103 292 416 octets libres
171 --- E O F --- 2009-07-26 01:00
ComboFix 09-07-26.03 - Administrateur 2009-07-27 13:10.1.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.2.1036.18.1022.716 [GMT -4:00]
Running from: c:\documents and settings\Administrateur\Bureau\Jocelyn.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\drivers\ESQULuuhdmulcjdtwnbgrndpmexcpuyxatyke.sys
c:\windows\system32\ESQULkobcrhlrayyjopqqejmejadltkpgvabr.dll
c:\windows\system32\ESQULomafnxbbctjbfkatvaoyrodlgymkyrsp.dll
c:\windows\system32\ESQULzcounter
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_ESQULserv.sys
((((((((((((((((((((((((( Files Created from 2009-06-27 to 2009-07-27 )))))))))))))))))))))))))))))))
.
2009-07-27 14:32 . 2009-07-13 17:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-27 14:32 . 2009-07-27 14:32 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-27 14:32 . 2009-07-27 14:32 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\Malwarebytes
2009-07-27 14:32 . 2009-07-13 17:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-25 16:35 . 2009-07-25 16:35 -------- d-----w- C:\_OTL
2009-07-25 15:26 . 2009-07-25 15:29 -------- d-----w- C:\WORT
2009-07-25 14:15 . 2009-07-25 14:33 -------- d-----w- C:\UsbFix
2009-07-25 13:28 . 2009-07-25 13:28 -------- d-----w- c:\program files\Trend Micro
2009-07-25 11:54 . 2009-03-30 08:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-07-25 11:54 . 2009-02-13 10:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-07-25 11:54 . 2009-03-24 14:08 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-07-25 11:54 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-07-25 11:54 . 2009-07-25 11:54 -------- d-----w- c:\program files\Avira
2009-07-25 11:54 . 2009-07-25 11:54 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\Avira
2009-07-23 18:09 . 2009-07-23 18:09 0 ----a-w- c:\windows\nsreg.dat
2009-07-23 18:09 . 2009-07-23 18:09 -------- d-----w- c:\documents and settings\Administrateur\Local Settings\Application Data\Mozilla
2009-07-21 18:11 . 2009-07-21 18:11 -------- d--h--w- c:\windows\system32\GroupPolicy
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-26 23:35 . 2006-01-05 14:32 84526 ----a-w- c:\windows\system32\perfc00C.dat
2009-07-26 23:35 . 2006-01-05 14:32 510324 ----a-w- c:\windows\system32\perfh00C.dat
2009-07-25 14:45 . 2009-01-31 12:28 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\avg8
2009-07-23 18:37 . 2009-07-23 18:20 -------- d-----w- c:\documents and settings\Administrateur\Application Data\HouseCall 6.6
2009-07-19 09:12 . 2009-02-02 15:02 -------- d-----w- c:\program files\PokerStars
2009-07-19 00:01 . 2009-02-04 16:24 -------- d-----w- c:\documents and settings\Administrateur\Application Data\LimeWire
2009-07-07 15:24 . 2009-01-31 12:27 16328 ----a-w- c:\documents and settings\Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-27 09:41 . 2009-02-13 18:27 -------- d-----w- c:\program files\Pivot Stickfigure Animator
2009-06-27 09:11 . 2009-06-27 09:11 152576 ----a-w- c:\documents and settings\Administrateur\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-06-23 19:28 . 2009-06-14 16:02 37 ----a-w- c:\windows\popcinfot.dat
2009-06-16 14:40 . 2006-01-05 14:32 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:40 . 2006-01-05 14:32 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 11:48 . 2009-05-18 17:29 -------- d-----w- c:\program files\Google
2009-06-14 16:02 . 2009-06-14 16:02 0 ----a-w- c:\windows\popcreg.dat
2009-06-03 19:10 . 2006-01-05 14:32 1297408 ----a-w- c:\windows\system32\quartz.dll
2009-05-07 15:33 . 2006-01-05 14:32 348672 ----a-w- c:\windows\system32\localspl.dll
2009-04-29 04:45 . 2006-01-05 14:32 827392 ----a-w- c:\windows\system32\wininet.dll
2009-04-29 04:45 . 2006-01-05 14:32 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-07-15 22:31 . 2009-07-23 18:08 137208 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-05-18 39408]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-04 136600]
"nmapp"="c:\program files\Pure Networks\Network Magic\nmapp.exe" [2007-03-14 321088]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
c:\docume~1\ALLUSE~1\MENUDM~1\PROGRA~1\DMARRA~1\
hp psc 1000 series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe [2002-12-2 147456]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDP:Service de découverte DHCP
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-07-25 108289]
S2 gupdate1c9d7de4dc4b67e;Service Google Update (gupdate1c9d7de4dc4b67e);c:\program files\Google\Update\GoogleUpdate.exe [2009-05-18 133104]
.
- - - - ORPHANS REMOVED - - - -
Notify-avgrsstarter - avgrsstx.dll
.
------- Supplementary Scan -------
.
uInternet Connection Wizard,ShellNext = iexplore
Handler: intu-ir2008 - {729D3592-92E7-4cbc-8E44-3C22B3F457B3} - c:\program files\ImpotRapide 2008\ic2008pp.dll
FF - ProfilePath - c:\docume~1\ADMINI~1\APPLIC~1\Mozilla\Firefox\Profiles\cn7l0ojp.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/webhp?hl=fr
FF - plugin: c:\program files\Google\Google Updater\2.4.1591.6512\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.
**************************************************************************
catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-27 13:22
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
c:\windows\TEMP\CR_1EC.tmp
c:\windows\TEMP\CR_27F.tmp
c:\windows\TEMP\Perflib_Perfdata_160.dat 16384 bytes
c:\windows\TEMP\Perflib_Perfdata_4c0.dat 16384 bytes
c:\windows\TEMP\WGAErrLog.txt 483 bytes
c:\windows\TEMP\59f30a02-91f2-448f-aa28-2dcf058165a5.tmp
c:\windows\TEMP\fadb1aed-31db-4e35-8bf6-a24bb5f7a377.tmp
c:\windows\TEMP\CR_2C6.tmp
scan completed successfully
hidden files: 8
**************************************************************************
.
Completion time: 2009-07-27 13:24
ComboFix-quarantined-files.txt 2009-07-27 17:24
Pre-Run: 29 097 992 192 octets libres
Post-Run: 29 103 292 416 octets libres
171 --- E O F --- 2009-07-26 01:00
__________________________________________________________
=>/!\ ATTENTION /!\ Le script qui suit a été écrit spécialement cet ordinateur,<=
=>il est fort déconseillé de le transposer sur un autre ordinateur !<=====|
---------------------------------------------------------------
Toujours avec toutes les protections désactivées, fais ceci :
♦ Ouvre le bloc-notes (Menu démarrer --> programmes --> accessoires --> bloc-notes)
♦ Copie/colle dans le bloc-notes ce qui est entre les lignes ci dessous (sans les lignes) :
----------------------------------------------------------
File::
c:\windows\TEMP\CR_1EC.tmp
c:\windows\TEMP\CR_27F.tmp
c:\windows\TEMP\59f30a02-91f2-448f-aa28-2dcf058165a5.tmp
c:\windows\TEMP\fadb1aed-31db-4e35-8bf6-a24bb5f7a377.tmp
c:\windows\TEMP\CR_2C6.tmp
------------------------------------------------------------------
♦ Enregistre ce fichier sur ton Bureau (et pas ailleurs !) sous le nom CFScript.txt
♦ Quitte le Bloc Notes
♦ Fais un glisser/déposer de ce fichier CFScript sur le fichier C-Fix.exe (combofix) Comme ceci
♦ Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
♦ Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
♦ Si le fichier ne s'ouvre pas, il se trouve ici => C:\ComboFix.txt
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
Voici le rapport.
ComboFix 09-07-26.03 - Administrateur 2009-07-27 17:35.2.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.2.1036.18.1022.712 [GMT -4:00]
Running from: c:\documents and settings\Administrateur\Bureau\Jocelyn.exe
Command switches used :: c:\documents and settings\Administrateur\Bureau\CFScript.txt
AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
"c:\windows\TEMP\59f30a02-91f2-448f-aa28-2dcf058165a5.tmp"
"c:\windows\TEMP\CR_1EC.tmp"
"c:\windows\TEMP\CR_27F.tmp"
"c:\windows\TEMP\CR_2C6.tmp"
"c:\windows\TEMP\fadb1aed-31db-4e35-8bf6-a24bb5f7a377.tmp"
.
((((((((((((((((((((((((( Files Created from 2009-06-27 to 2009-07-27 )))))))))))))))))))))))))))))))
.
2009-07-27 14:32 . 2009-07-13 17:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-27 14:32 . 2009-07-27 14:32 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-27 14:32 . 2009-07-27 14:32 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\Malwarebytes
2009-07-27 14:32 . 2009-07-13 17:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-25 16:35 . 2009-07-25 16:35 -------- d-----w- C:\_OTL
2009-07-25 15:26 . 2009-07-25 15:29 -------- d-----w- C:\WORT
2009-07-25 14:15 . 2009-07-25 14:33 -------- d-----w- C:\UsbFix
2009-07-25 13:28 . 2009-07-25 13:28 -------- d-----w- c:\program files\Trend Micro
2009-07-25 11:54 . 2009-03-30 08:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-07-25 11:54 . 2009-02-13 10:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-07-25 11:54 . 2009-03-24 14:08 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-07-25 11:54 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-07-25 11:54 . 2009-07-25 11:54 -------- d-----w- c:\program files\Avira
2009-07-25 11:54 . 2009-07-25 11:54 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\Avira
2009-07-23 18:09 . 2009-07-23 18:09 0 ----a-w- c:\windows\nsreg.dat
2009-07-23 18:09 . 2009-07-23 18:09 -------- d-----w- c:\documents and settings\Administrateur\Local Settings\Application Data\Mozilla
2009-07-21 18:11 . 2009-07-21 18:11 -------- d--h--w- c:\windows\system32\GroupPolicy
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-26 23:35 . 2006-01-05 14:32 84526 ----a-w- c:\windows\system32\perfc00C.dat
2009-07-26 23:35 . 2006-01-05 14:32 510324 ----a-w- c:\windows\system32\perfh00C.dat
2009-07-25 14:45 . 2009-01-31 12:28 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\avg8
2009-07-23 18:37 . 2009-07-23 18:20 -------- d-----w- c:\documents and settings\Administrateur\Application Data\HouseCall 6.6
2009-07-19 09:12 . 2009-02-02 15:02 -------- d-----w- c:\program files\PokerStars
2009-07-19 00:01 . 2009-02-04 16:24 -------- d-----w- c:\documents and settings\Administrateur\Application Data\LimeWire
2009-07-07 15:24 . 2009-01-31 12:27 16328 ----a-w- c:\documents and settings\Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-27 09:41 . 2009-02-13 18:27 -------- d-----w- c:\program files\Pivot Stickfigure Animator
2009-06-27 09:11 . 2009-06-27 09:11 152576 ----a-w- c:\documents and settings\Administrateur\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-06-23 19:28 . 2009-06-14 16:02 37 ----a-w- c:\windows\popcinfot.dat
2009-06-16 14:40 . 2006-01-05 14:32 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:40 . 2006-01-05 14:32 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 11:48 . 2009-05-18 17:29 -------- d-----w- c:\program files\Google
2009-06-14 16:02 . 2009-06-14 16:02 0 ----a-w- c:\windows\popcreg.dat
2009-06-03 19:10 . 2006-01-05 14:32 1297408 ----a-w- c:\windows\system32\quartz.dll
2009-05-07 15:33 . 2006-01-05 14:32 348672 ----a-w- c:\windows\system32\localspl.dll
2009-04-29 04:45 . 2006-01-05 14:32 827392 ----a-w- c:\windows\system32\wininet.dll
2009-04-29 04:45 . 2006-01-05 14:32 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-07-15 22:31 . 2009-07-23 18:08 137208 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-05-18 39408]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-04 136600]
"nmapp"="c:\program files\Pure Networks\Network Magic\nmapp.exe" [2007-03-14 321088]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
c:\docume~1\ALLUSE~1\MENUDM~1\PROGRA~1\DMARRA~1\
hp psc 1000 series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe [2002-12-2 147456]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
[BU]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDP:Service de découverte DHCP
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-07-25 108289]
S2 gupdate1c9d7de4dc4b67e;Service Google Update (gupdate1c9d7de4dc4b67e);c:\program files\Google\Update\GoogleUpdate.exe [2009-05-18 133104]
.
.
------- Supplementary Scan -------
.
uInternet Connection Wizard,ShellNext = iexplore
Handler: intu-ir2008 - {729D3592-92E7-4cbc-8E44-3C22B3F457B3} - c:\program files\ImpotRapide 2008\ic2008pp.dll
FF - ProfilePath - c:\docume~1\ADMINI~1\APPLIC~1\Mozilla\Firefox\Profiles\cn7l0ojp.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/webhp?hl=fr
FF - plugin: c:\program files\Google\Google Updater\2.4.1591.6512\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.
**************************************************************************
driver loading error catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-27 17:38
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
c:\windows\TEMP\CR_1EC.tmp
c:\windows\TEMP\CR_27F.tmp
c:\windows\TEMP\Perflib_Perfdata_160.dat 16384 bytes
c:\windows\TEMP\Perflib_Perfdata_4c0.dat 16384 bytes
c:\windows\TEMP\WGAErrLog.txt 483 bytes
c:\windows\TEMP\59f30a02-91f2-448f-aa28-2dcf058165a5.tmp
c:\windows\TEMP\fadb1aed-31db-4e35-8bf6-a24bb5f7a377.tmp
c:\windows\TEMP\CR_2C6.tmp
scan completed successfully
hidden files: 8
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(3784)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\eappprxy.dll
.
Completion time: 2009-07-27 17:40
ComboFix-quarantined-files.txt 2009-07-27 21:40
ComboFix2.txt 2009-07-27 17:24
Pre-Run: 29 116 133 376 octets libres
Post-Run: 29 095 010 304 octets libres
176 --- E O F --- 2009-07-26 01:00
ComboFix 09-07-26.03 - Administrateur 2009-07-27 17:35.2.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.2.1036.18.1022.712 [GMT -4:00]
Running from: c:\documents and settings\Administrateur\Bureau\Jocelyn.exe
Command switches used :: c:\documents and settings\Administrateur\Bureau\CFScript.txt
AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
"c:\windows\TEMP\59f30a02-91f2-448f-aa28-2dcf058165a5.tmp"
"c:\windows\TEMP\CR_1EC.tmp"
"c:\windows\TEMP\CR_27F.tmp"
"c:\windows\TEMP\CR_2C6.tmp"
"c:\windows\TEMP\fadb1aed-31db-4e35-8bf6-a24bb5f7a377.tmp"
.
((((((((((((((((((((((((( Files Created from 2009-06-27 to 2009-07-27 )))))))))))))))))))))))))))))))
.
2009-07-27 14:32 . 2009-07-13 17:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-27 14:32 . 2009-07-27 14:32 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-27 14:32 . 2009-07-27 14:32 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\Malwarebytes
2009-07-27 14:32 . 2009-07-13 17:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-25 16:35 . 2009-07-25 16:35 -------- d-----w- C:\_OTL
2009-07-25 15:26 . 2009-07-25 15:29 -------- d-----w- C:\WORT
2009-07-25 14:15 . 2009-07-25 14:33 -------- d-----w- C:\UsbFix
2009-07-25 13:28 . 2009-07-25 13:28 -------- d-----w- c:\program files\Trend Micro
2009-07-25 11:54 . 2009-03-30 08:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-07-25 11:54 . 2009-02-13 10:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-07-25 11:54 . 2009-03-24 14:08 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-07-25 11:54 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-07-25 11:54 . 2009-07-25 11:54 -------- d-----w- c:\program files\Avira
2009-07-25 11:54 . 2009-07-25 11:54 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\Avira
2009-07-23 18:09 . 2009-07-23 18:09 0 ----a-w- c:\windows\nsreg.dat
2009-07-23 18:09 . 2009-07-23 18:09 -------- d-----w- c:\documents and settings\Administrateur\Local Settings\Application Data\Mozilla
2009-07-21 18:11 . 2009-07-21 18:11 -------- d--h--w- c:\windows\system32\GroupPolicy
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-26 23:35 . 2006-01-05 14:32 84526 ----a-w- c:\windows\system32\perfc00C.dat
2009-07-26 23:35 . 2006-01-05 14:32 510324 ----a-w- c:\windows\system32\perfh00C.dat
2009-07-25 14:45 . 2009-01-31 12:28 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\avg8
2009-07-23 18:37 . 2009-07-23 18:20 -------- d-----w- c:\documents and settings\Administrateur\Application Data\HouseCall 6.6
2009-07-19 09:12 . 2009-02-02 15:02 -------- d-----w- c:\program files\PokerStars
2009-07-19 00:01 . 2009-02-04 16:24 -------- d-----w- c:\documents and settings\Administrateur\Application Data\LimeWire
2009-07-07 15:24 . 2009-01-31 12:27 16328 ----a-w- c:\documents and settings\Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-27 09:41 . 2009-02-13 18:27 -------- d-----w- c:\program files\Pivot Stickfigure Animator
2009-06-27 09:11 . 2009-06-27 09:11 152576 ----a-w- c:\documents and settings\Administrateur\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-06-23 19:28 . 2009-06-14 16:02 37 ----a-w- c:\windows\popcinfot.dat
2009-06-16 14:40 . 2006-01-05 14:32 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:40 . 2006-01-05 14:32 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 11:48 . 2009-05-18 17:29 -------- d-----w- c:\program files\Google
2009-06-14 16:02 . 2009-06-14 16:02 0 ----a-w- c:\windows\popcreg.dat
2009-06-03 19:10 . 2006-01-05 14:32 1297408 ----a-w- c:\windows\system32\quartz.dll
2009-05-07 15:33 . 2006-01-05 14:32 348672 ----a-w- c:\windows\system32\localspl.dll
2009-04-29 04:45 . 2006-01-05 14:32 827392 ----a-w- c:\windows\system32\wininet.dll
2009-04-29 04:45 . 2006-01-05 14:32 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-07-15 22:31 . 2009-07-23 18:08 137208 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-05-18 39408]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-04 136600]
"nmapp"="c:\program files\Pure Networks\Network Magic\nmapp.exe" [2007-03-14 321088]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
c:\docume~1\ALLUSE~1\MENUDM~1\PROGRA~1\DMARRA~1\
hp psc 1000 series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe [2002-12-2 147456]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
[BU]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDP:Service de découverte DHCP
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-07-25 108289]
S2 gupdate1c9d7de4dc4b67e;Service Google Update (gupdate1c9d7de4dc4b67e);c:\program files\Google\Update\GoogleUpdate.exe [2009-05-18 133104]
.
.
------- Supplementary Scan -------
.
uInternet Connection Wizard,ShellNext = iexplore
Handler: intu-ir2008 - {729D3592-92E7-4cbc-8E44-3C22B3F457B3} - c:\program files\ImpotRapide 2008\ic2008pp.dll
FF - ProfilePath - c:\docume~1\ADMINI~1\APPLIC~1\Mozilla\Firefox\Profiles\cn7l0ojp.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/webhp?hl=fr
FF - plugin: c:\program files\Google\Google Updater\2.4.1591.6512\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.
**************************************************************************
driver loading error catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-27 17:38
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
c:\windows\TEMP\CR_1EC.tmp
c:\windows\TEMP\CR_27F.tmp
c:\windows\TEMP\Perflib_Perfdata_160.dat 16384 bytes
c:\windows\TEMP\Perflib_Perfdata_4c0.dat 16384 bytes
c:\windows\TEMP\WGAErrLog.txt 483 bytes
c:\windows\TEMP\59f30a02-91f2-448f-aa28-2dcf058165a5.tmp
c:\windows\TEMP\fadb1aed-31db-4e35-8bf6-a24bb5f7a377.tmp
c:\windows\TEMP\CR_2C6.tmp
scan completed successfully
hidden files: 8
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(3784)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\eappprxy.dll
.
Completion time: 2009-07-27 17:40
ComboFix-quarantined-files.txt 2009-07-27 21:40
ComboFix2.txt 2009-07-27 17:24
Pre-Run: 29 116 133 376 octets libres
Post-Run: 29 095 010 304 octets libres
176 --- E O F --- 2009-07-26 01:00
Malwarebytes devrait marcher maintenant que le rootkit est dégagé
essaie de faire un scan complet apres mise a jour
essaie de faire un scan complet apres mise a jour
Bon c'est terminé, apres le scan l'ordi a redémarré et il a fait un scan disk et il a fait des suppression de l'entrée d'index.... je vais mettre 2 rapports un avant la suppression et un apres.
Malwarebytes' Anti-Malware 1.39
Version de la base de données: 2518
Windows 5.1.2600 Service Pack 3
2009-07-28 12:02:18 André
mbam-log-2009-07-28 (12-02-12).txt
Type de recherche: Examen complet (C:\|E:\|)
Eléments examinés: 125318
Temps écoulé: 1 hour(s), 21 minute(s), 28 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 3
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
c:\Qoobox\quarantine\C\WINDOWS\system32\ESQULomafnxbbctjbfkatvaoyrodlgymkyrsp.dll.vir (Trojan.TDSS) -> No action taken.
c:\system volume information\_restore{2fbb84e2-5dcf-4c29-a0ee-47f155c21214}\RP177\A0023156.dll (Trojan.TDSS) -> No action taken.
c:\WINDOWS\Tasks\{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job (Trojan.FakeAlert) -> No action taken.
le deuxième
Malwarebytes' Anti-Malware 1.39
Version de la base de données: 2518
Windows 5.1.2600 Service Pack 3
2009-07-28 12:03:11 André
mbam-log-2009-07-28 (12-03-11).txt
Type de recherche: Examen complet (C:\|E:\|)
Eléments examinés: 125318
Temps écoulé: 1 hour(s), 21 minute(s), 28 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 3
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
c:\Qoobox\quarantine\C\WINDOWS\system32\ESQULomafnxbbctjbfkatvaoyrodlgymkyrsp.dll.vir (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\system volume information\_restore{2fbb84e2-5dcf-4c29-a0ee-47f155c21214}\RP177\A0023156.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\Tasks\{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job (Trojan.FakeAlert) -> Quarantined and deleted successfully.
Malwarebytes' Anti-Malware 1.39
Version de la base de données: 2518
Windows 5.1.2600 Service Pack 3
2009-07-28 12:02:18 André
mbam-log-2009-07-28 (12-02-12).txt
Type de recherche: Examen complet (C:\|E:\|)
Eléments examinés: 125318
Temps écoulé: 1 hour(s), 21 minute(s), 28 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 3
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
c:\Qoobox\quarantine\C\WINDOWS\system32\ESQULomafnxbbctjbfkatvaoyrodlgymkyrsp.dll.vir (Trojan.TDSS) -> No action taken.
c:\system volume information\_restore{2fbb84e2-5dcf-4c29-a0ee-47f155c21214}\RP177\A0023156.dll (Trojan.TDSS) -> No action taken.
c:\WINDOWS\Tasks\{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job (Trojan.FakeAlert) -> No action taken.
le deuxième
Malwarebytes' Anti-Malware 1.39
Version de la base de données: 2518
Windows 5.1.2600 Service Pack 3
2009-07-28 12:03:11 André
mbam-log-2009-07-28 (12-03-11).txt
Type de recherche: Examen complet (C:\|E:\|)
Eléments examinés: 125318
Temps écoulé: 1 hour(s), 21 minute(s), 28 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 3
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
c:\Qoobox\quarantine\C\WINDOWS\system32\ESQULomafnxbbctjbfkatvaoyrodlgymkyrsp.dll.vir (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\system volume information\_restore{2fbb84e2-5dcf-4c29-a0ee-47f155c21214}\RP177\A0023156.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\Tasks\{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job (Trojan.FakeAlert) -> Quarantined and deleted successfully.
si tu as vraiment un doute ^^:
Télécharge Superantispyware (SAS)
Choisis "enregistrer" et enregistre-le sur ton bureau.
Double-clique sur l'icône d'installation qui vient de se créer et suis les instructions.
Créé une icône sur le bureau.
Double-clique sur l'icône de SAS (une tête dans un cercle rouge barré) pour le lancer.
- Si l'outil te demande de mettre à jour le programme ("update the program definitions", clique sur yes.
- Sous Configuration and Preferences, clique sur le bouton "Preferences"
- Clique sur l'onglet "Scanning Control "
- Dans "Scanner Options ", assure toi que la case devant lles lignes suivantes est cochée :
Close browsers before scanning
Scan for tracking cookies
Terminate memory threats before quarantining
- Laisse les autres lignes décochées.
- Clique sur le bouton "Close" pour quitter l'écran du centre de contrôle.
- Dans la fenêtre principale, clique, dans "Scan for Harmful Software", sur "Scan your computer".
Dans la colonne de gauche, coche C:\Fixed Drive.
Dans la colonne de droite, sous "Complete scan", clique sur "Perform Complete Scan"
Clique sur "next" pour lancer le scan. Patiente pendant la durée du scan.
A la fin du scan, une fenêtre de résultats s'ouvre . Clique sur OK.
Assure toi que toutes les lignes de la fenêtre blanche sont cochées et clique sur "Next".
Tout ce qui a été trouvé sera mis en quarantaine. S'il t'es demandé de redémarrer l'ordi ("reboot"), clique sur Yes.
Pour recopier les informations sur le forum, fais ceci :
- après le redémarrage de l'ordi, double-clique sur l'icône pour lancer SAS.
- Clique sur "Preferences" puis sur l'onglet "Statistics/Logs ".
- Dans "scanners logs", double-clique sur SUPERAntiSpyware Scan Log.
- Le rapport va s'ouvrir dans ton éditeur de texte par défaut.
- Copie son contenu dans ta réponse.
Regarde bien le tuto SUPERAntiSpyware il est très bien expliqué.
Télécharge Superantispyware (SAS)
Choisis "enregistrer" et enregistre-le sur ton bureau.
Double-clique sur l'icône d'installation qui vient de se créer et suis les instructions.
Créé une icône sur le bureau.
Double-clique sur l'icône de SAS (une tête dans un cercle rouge barré) pour le lancer.
- Si l'outil te demande de mettre à jour le programme ("update the program definitions", clique sur yes.
- Sous Configuration and Preferences, clique sur le bouton "Preferences"
- Clique sur l'onglet "Scanning Control "
- Dans "Scanner Options ", assure toi que la case devant lles lignes suivantes est cochée :
Close browsers before scanning
Scan for tracking cookies
Terminate memory threats before quarantining
- Laisse les autres lignes décochées.
- Clique sur le bouton "Close" pour quitter l'écran du centre de contrôle.
- Dans la fenêtre principale, clique, dans "Scan for Harmful Software", sur "Scan your computer".
Dans la colonne de gauche, coche C:\Fixed Drive.
Dans la colonne de droite, sous "Complete scan", clique sur "Perform Complete Scan"
Clique sur "next" pour lancer le scan. Patiente pendant la durée du scan.
A la fin du scan, une fenêtre de résultats s'ouvre . Clique sur OK.
Assure toi que toutes les lignes de la fenêtre blanche sont cochées et clique sur "Next".
Tout ce qui a été trouvé sera mis en quarantaine. S'il t'es demandé de redémarrer l'ordi ("reboot"), clique sur Yes.
Pour recopier les informations sur le forum, fais ceci :
- après le redémarrage de l'ordi, double-clique sur l'icône pour lancer SAS.
- Clique sur "Preferences" puis sur l'onglet "Statistics/Logs ".
- Dans "scanners logs", double-clique sur SUPERAntiSpyware Scan Log.
- Le rapport va s'ouvrir dans ton éditeur de texte par défaut.
- Copie son contenu dans ta réponse.
Regarde bien le tuto SUPERAntiSpyware il est très bien expliqué.
Merci.
Voici le rapport.
SUPERAntiSpyware Scan Log
https://www.superantispyware.com/
Generated 07/28/2009 at 07:29 PM
Application Version : 4.27.1000
Core Rules Database Version : 4024
Trace Rules Database Version: 1964
Scan type : Complete Scan
Total Scan Time : 00:33:40
Memory items scanned : 500
Memory threats detected : 0
Registry items scanned : 4677
Registry threats detected : 0
File items scanned : 46539
File threats detected : 34
Adware.Tracking Cookie
C:\Documents and Settings\Administrateur\Cookies\administrateur@partypoker[1].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@lfstmedia[2].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@couponmountain[1].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@estat[1].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@bs.serving-sys[2].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@track.oainternetservices[1].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@serving-sys[2].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@rcmcaprod.122.2o7[1].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@networldmedia[2].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@ads.networldmedia[3].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@xml.trafficengine[2].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@atdmt[2].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@vitamine.networldmedia[2].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@www.pillsexpert[2].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@xiti[1].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@myroitracking[1].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@content.yieldmanager.edgesuite[1].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@shopica[1].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@stopzilla[2].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@videoegg.adbureau[2].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@content.yieldmanager[3].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@ads.rncmedia[2].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@clicksor[2].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@ads.radiox[1].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@www.stopzilla[1].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@content.yieldmanager[1].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@pro-market[2].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@canoe.112.2o7[1].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@2o7[2].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@ads.networldmedia[1].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@bellcan.adbureau[2].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@ad2.yieldmanager[1].txt
C:\WINDOWS\system32\config\systemprofile\Cookies\system@ads.xapads[2].txt
C:\WINDOWS\system32\config\systemprofile\Cookies\system@invitemedia[1].txt
Voici le rapport.
SUPERAntiSpyware Scan Log
https://www.superantispyware.com/
Generated 07/28/2009 at 07:29 PM
Application Version : 4.27.1000
Core Rules Database Version : 4024
Trace Rules Database Version: 1964
Scan type : Complete Scan
Total Scan Time : 00:33:40
Memory items scanned : 500
Memory threats detected : 0
Registry items scanned : 4677
Registry threats detected : 0
File items scanned : 46539
File threats detected : 34
Adware.Tracking Cookie
C:\Documents and Settings\Administrateur\Cookies\administrateur@partypoker[1].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@lfstmedia[2].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@couponmountain[1].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@estat[1].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@bs.serving-sys[2].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@track.oainternetservices[1].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@serving-sys[2].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@rcmcaprod.122.2o7[1].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@networldmedia[2].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@ads.networldmedia[3].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@xml.trafficengine[2].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@atdmt[2].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@vitamine.networldmedia[2].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@www.pillsexpert[2].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@xiti[1].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@myroitracking[1].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@content.yieldmanager.edgesuite[1].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@shopica[1].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@stopzilla[2].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@videoegg.adbureau[2].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@content.yieldmanager[3].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@ads.rncmedia[2].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@clicksor[2].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@ads.radiox[1].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@www.stopzilla[1].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@content.yieldmanager[1].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@pro-market[2].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@canoe.112.2o7[1].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@2o7[2].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@ads.networldmedia[1].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@bellcan.adbureau[2].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@ad2.yieldmanager[1].txt
C:\WINDOWS\system32\config\systemprofile\Cookies\system@ads.xapads[2].txt
C:\WINDOWS\system32\config\systemprofile\Cookies\system@invitemedia[1].txt
