SaveSoldier, une plaie =(
Lunyo
-
eZula -
eZula -
Bonjour, voila, depuis avant-hier, il se trouve que j'ai des "redirections" intempestives .... Rien de grave jusque là, pensant pouvoir les supprimer. Ensuite j'ai remarqué que dès que j'ouvrais une page, une fenetre s'affiche me disant que pour proteger mon ordinateur de cette page je devais installer un logociel ... Venant de reinstaller Bitdefender, j'ai cru que ça faisait parti de la nouvelle version, alors je l'ai installé. Resultat, je me retrouve avec SaveSoldier, qui d'après un site, est un logiciel espion qui m'annonce de fausses detection de spyware pour que j'achète la version complète (et où bien sur je dois mettre mon numéro de carte de crédit). J'ai suivit en détail ce qui était écrit sur le site, et j'ai du oublier quelque chose, car il est toujours là, et c'est une vraie plaie. (Ouais selon lui j'ai 712 spywares sur mon ordinateur ) ... Peut-être que quelqu'un sait comment s'en debarrasser (et aussi les pubs qui me redirectionnent sur Ebay ou sur un site de recherche dès que j'ai envie de venir ici -_- )
Merci.
Merci.
A voir également:
- SaveSoldier, une plaie =(
- Lire une clé usb sur freebox player pop - Forum Format et connectique vidéo
- Comment copier un cd sur une clé usb avec media player - Forum Audio
- Lecteur windows media copier musiques USB ✓ - Forum Audio
- Remettre une ancienne version de Flash Player ✓ - Forum Logiciels
- Télécharger une vidéo du lecteur JM Player ? - Forum Téléchargement
24 réponses
desolé j'étais parti ... J'espère que c'est celui là :
ComboFix 09-08-21.02 - Florian 22/08/2009 22:04.2.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.3070.2497 [GMT 2:00]
Running from: c:\documents and settings\Florian\Bureau\braviax.exe.exe
Command switches used :: c:\documents and settings\Florian\Bureau\CFScript.txt
AV: Bitdefender Antivirus *On-access scanning enabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
FW: BitDefender Pare-feu *disabled* {4055920F-2E99-48A8-A270-4243D2B8F242}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
"c:\windows\system32\1z6895p9mbot71b.dll"
"c:\windows\system32\20052spambot9zc.dll"
"c:\windows\system32\20125v9rus34z.bin"
"c:\windows\system32\21513spa95ot2z2.exe"
"c:\windows\system32\251asteal2z279.bin"
"c:\windows\system32\25499zo5m73c.dll"
"c:\windows\system32\25595worm728z.exe"
"c:\windows\system32\26939spamb5tz4.bin"
"c:\windows\system32\28058t9ojz54.exe"
"c:\windows\system32\29441hackt9ol5f8z.bin"
"c:\windows\system32\29912spamb5t75fz.dll"
"c:\windows\system32\2z35sp932d5.dll"
"c:\windows\system32\2z547spambot97b.dll"
"c:\windows\system32\2z7735ir9s71e.exe"
"c:\windows\system32\313509ozm99.bin"
"c:\windows\system32\32181hacktz9l6d5.dll"
"c:\windows\system32\37875ot-a-9irus71cz.dll"
"c:\windows\system32\3ac25te9l169z.bin"
"c:\windows\system32\4795h5ckzool635.exe"
"c:\windows\system32\4z19spywa5e3249.bin"
"c:\windows\system32\52a3adzware1059.bin"
"c:\windows\system32\53759ackdooz2528.bin"
"c:\windows\system32\55c9azdware35989.dll"
"c:\windows\system32\55e6thief19z4.bin"
"c:\windows\system32\5d56viz5959.dll"
"c:\windows\system32\6008tr9j25z.dll"
"c:\windows\system32\609no5-a-vir9s7z9.exe"
"c:\windows\system32\6583viruz5d59.bin"
"c:\windows\system32\65z6vi959.exe"
"c:\windows\system32\6946sp5waze961.dll"
"c:\windows\system32\6c95a9zware465.bin"
"c:\windows\system32\7e80downlo9dzr1551.dll"
"c:\windows\system32\90csparsz1925.dll"
"c:\windows\system32\9895spamb5t4z3.dll"
"c:\windows\system32\994wo5m1bz.exe"
"c:\windows\system32\d9z5hreat27973.exe"
"c:\windows\system32\rezumatenoi.dat"
"c:\windows\system32\z43t9o57b3.bin"
"c:\windows\system32\z6b1thief19795.bin"
"c:\windows\system32\z769vi5us665.exe"
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\1z06steal559.ocx
c:\windows\system32\1z2125roj499.ocx
c:\windows\system32\1z25st5a91203.exe
c:\windows\system32\1z394v5rus1af9.cpl
c:\windows\system32\1z6895p9mbot71b.dll
c:\windows\system32\1z758s9y188.dll
c:\windows\system32\1z859tr9jd8.bin
c:\windows\system32\1ze59hief2219.ocx
c:\windows\system32\20052spambot9zc.dll
c:\windows\system32\20125v9rus34z.bin
c:\windows\system32\20893not-a-vi9us5z4.bin
c:\windows\system32\20995zpam9ot5f95.dll
c:\windows\system32\210559ief2606z.dll
c:\windows\system32\2120ziru539b.ocx
c:\windows\system32\21259virzs.dll
c:\windows\system32\21452spambzt9f7.cpl
c:\windows\system32\21513spa95ot2z2.exe
c:\windows\system32\217179pzmbotd5.cpl
c:\windows\system32\2179ad5warz792.cpl
c:\windows\system32\22288t9zj1b5.ocx
c:\windows\system32\22479zp59bot6ff.bin
c:\windows\system32\2283stza917965.ocx
c:\windows\system32\23z7h9cktool75e.cpl
c:\windows\system32\24552troj549z.cpl
c:\windows\system32\24fthr5atz6791.bin
c:\windows\system32\24z15tr95205.cpl
c:\windows\system32\2509zha5ktool162.ocx
c:\windows\system32\251asteal2z279.bin
c:\windows\system32\25395zirus59.ocx
c:\windows\system32\25457spz193.dll
c:\windows\system32\2545spyz289.dll
c:\windows\system32\25499zo5m73c.dll
c:\windows\system32\25558noz-a-virus495.cpl
c:\windows\system32\25595worm728z.exe
c:\windows\system32\25753wo9z2ae.cpl
c:\windows\system32\2591zroj2c7.dll
c:\windows\system32\2595t9reat2320z.dll
c:\windows\system32\26099za5ktool4fd.dll
c:\windows\system32\26125hazkt5ol91e.exe
c:\windows\system32\26939spamb5tz4.bin
c:\windows\system32\269zaddwar5275.dll
c:\windows\system32\2742vir9s65z.exe
c:\windows\system32\28058t9ojz54.exe
c:\windows\system32\283819azkto5l329.dll
c:\windows\system32\28591ha9ktool5fz.bin
c:\windows\system32\28899trzj55.bin
c:\windows\system32\28z49troj598.dll
c:\windows\system32\29029s5amzot269.exe
c:\windows\system32\2906thre5t2918z.dll
c:\windows\system32\29441hackt9ol5f8z.bin
c:\windows\system32\29492hacktool559z.exe
c:\windows\system32\295279zoj9b.ocx
c:\windows\system32\29544zro970a.ocx
c:\windows\system32\29552tzo57b89.bin
c:\windows\system32\2955zhreat51253.ocx
c:\windows\system32\2967spywaz51490.exe
c:\windows\system32\296addwa5981z.dll
c:\windows\system32\29912spamb5t75fz.dll
c:\windows\system32\29bdaddwa5e31z59.dll
c:\windows\system32\2a73zteal2590.bin
c:\windows\system32\2bfste5l1199z.exe
c:\windows\system32\2c5bzteal5941.bin
c:\windows\system32\2ca5dzwnload591466.exe
c:\windows\system32\2d6a9hrza56289.ocx
c:\windows\system32\2d6edow5lo9derz282.exe
c:\windows\system32\2z35sp932d5.dll
c:\windows\system32\2z547spambot97b.dll
c:\windows\system32\2z57backdo9r1592.ocx
c:\windows\system32\2z7735ir9s71e.exe
c:\windows\system32\2z788v5r9s6bc.cpl
c:\windows\system32\2z792wo5m124.exe
c:\windows\system32\2z8439py575.exe
c:\windows\system32\2z8465py922.dll
c:\windows\system32\30165szam5ot971.exe
c:\windows\system32\30842not-a-zi9u515d.exe
c:\windows\system32\3085zsp53489.bin
c:\windows\system32\3093zhreat9145.ocx
c:\windows\system32\310z7hackt9ol3095.bin
c:\windows\system32\313509ozm99.bin
c:\windows\system32\31503w5rmz919.dll
c:\windows\system32\31581trzj55a9.dll
c:\windows\system32\32181hacktz9l6d5.dll
c:\windows\system32\32745ot9a-vzrus183.cpl
c:\windows\system32\3345addware28z9.ocx
c:\windows\system32\3536zpar9e403.ocx
c:\windows\system32\355azackdoor1795.cpl
c:\windows\system32\356bstea9z605.exe
c:\windows\system32\3571zhief1939.ocx
c:\windows\system32\35726z9rusbb.dll
c:\windows\system32\35czthreat31159.ocx
c:\windows\system32\37875ot-a-9irus71cz.dll
c:\windows\system32\385bthreat9829z.cpl
c:\windows\system32\3881z9o5504.dll
c:\windows\system32\3915troz1a4.ocx
c:\windows\system32\3916noz-a-vir5s3109.ocx
c:\windows\system32\39310not-a-5izus42d.ocx
c:\windows\system32\3950zddware2985.bin
c:\windows\system32\3953zteal2817.dll
c:\windows\system32\3985threat12257z.ocx
c:\windows\system32\39addownloader5z9.exe
c:\windows\system32\3a5cth9ef3038z.cpl
c:\windows\system32\3a6495zkdoor925.dll
c:\windows\system32\3ac25te9l169z.bin
c:\windows\system32\3ac7down9oaderz527.dll
c:\windows\system32\3de759arsz2299.cpl
c:\windows\system32\3fz3s9e5l1956.exe
c:\windows\system32\3z224hack9o5l257.exe
c:\windows\system32\3z396v5rus90a.bin
c:\windows\system32\3z987spy3c5.bin
c:\windows\system32\3za9thie52626.ocx
c:\windows\system32\3zdabackdoo59154.ocx
c:\windows\system32\40195hie92248z.dll
c:\windows\system32\420viz59111.cpl
c:\windows\system32\449teal5716z.bin
c:\windows\system32\46599parsz1620.ocx
c:\windows\system32\4795h5ckzool635.exe
c:\windows\system32\490baddza5e2476.bin
c:\windows\system32\492dz9wnloader3155.bin
c:\windows\system32\493bv5r12z9.cpl
c:\windows\system32\49c3azdwa5e239.exe
c:\windows\system32\49e5ste5z111.dll
c:\windows\system32\4az0t9r5at17747.bin
c:\windows\system32\4d55pyw9re6z5.bin
c:\windows\system32\4f75zhief1059.dll
c:\windows\system32\4z19spywa5e3249.bin
c:\windows\system32\4z709pywar51244.exe
c:\windows\system32\4z90b5ckdoor880.cpl
c:\windows\system32\501bsteaz1935.cpl
c:\windows\system32\5050downlozder35589.cpl
c:\windows\system32\50899hackzool712.ocx
c:\windows\system32\509cspyzare81.ocx
c:\windows\system32\509vir59z1.bin
c:\windows\system32\51090not-a-9iruz17f.exe
c:\windows\system32\517b9pyzar51334.bin
c:\windows\system32\519cad5ware2z72.cpl
c:\windows\system32\51e99t5zl2813.bin
c:\windows\system32\5285spz8a9.cpl
c:\windows\system32\52948spy3d4z.dll
c:\windows\system32\52a3adzware1059.bin
c:\windows\system32\5352zir209.ocx
c:\windows\system32\53759ackdooz2528.bin
c:\windows\system32\5399backdo5z3067.cpl
c:\windows\system32\53acste9lz583.ocx
c:\windows\system32\53e9vi5z589.bin
c:\windows\system32\545cd9wnloadez1087.bin
c:\windows\system32\549ebac9door133z.dll
c:\windows\system32\55229pzware1358.exe
c:\windows\system32\555ddownload9z1008.dll
c:\windows\system32\555zdownloader2915.ocx
c:\windows\system32\559dtzreat31386.bin
c:\windows\system32\559fdownloader7z9.cpl
c:\windows\system32\55c8downl9adzr2577.ocx
c:\windows\system32\55c9azdware35989.dll
c:\windows\system32\55e6thief19z4.bin
c:\windows\system32\55f1sz9al1757.dll
c:\windows\system32\56005irzs179.cpl
c:\windows\system32\5615vir9z317.bin
c:\windows\system32\563dtz5eat1359.bin
c:\windows\system32\56409irus29z.exe
c:\windows\system32\56435tzo9a9.dll
c:\windows\system32\5758sz9al815.ocx
c:\windows\system32\58247viz9s22a.ocx
c:\windows\system32\5859thizf2459.ocx
c:\windows\system32\585zthi9f2406.dll
c:\windows\system32\586thzef18965.dll
c:\windows\system32\58baz5r957.dll
c:\windows\system32\597dz95rse2325.cpl
c:\windows\system32\59925iz2999.dll
c:\windows\system32\5998vir2z31.cpl
c:\windows\system32\5999s5yware3069z.exe
c:\windows\system32\59dbstea5266z.ocx
c:\windows\system32\59e1thiefz45.cpl
c:\windows\system32\5a2thre9tz0356.cpl
c:\windows\system32\5a6eszy5are3169.cpl
c:\windows\system32\5aads9za5696.cpl
c:\windows\system32\5b2fvir695z.bin
c:\windows\system32\5b9dsp95ze509.bin
c:\windows\system32\5cz9sp9rse2226.ocx
c:\windows\system32\5d56viz5959.dll
c:\windows\system32\5das9zrse1711.exe
c:\windows\system32\5f259ir2z42.bin
c:\windows\system32\5z15troj9b0.ocx
c:\windows\system32\5z8fad9ware935.exe
c:\windows\system32\5z95pyware2967.exe
c:\windows\system32\5z97steal195.ocx
c:\windows\system32\5zbf9teal2621.ocx
c:\windows\system32\6008tr9j25z.dll
c:\windows\system32\6085notza-virus7589.exe
c:\windows\system32\609no5-a-vir9s7z9.exe
c:\windows\system32\60z1not-5-vir9s4f5.ocx
c:\windows\system32\63925hiefz909.bin
c:\windows\system32\6527thzeat95118.exe
c:\windows\system32\6564troj359z.cpl
c:\windows\system32\6583viruz5d59.bin
c:\windows\system32\65fdszeal2592.dll
c:\windows\system32\65z6vi959.exe
c:\windows\system32\687t9iez5965.ocx
c:\windows\system32\6946sp5waze961.dll
c:\windows\system32\69bspz5are2761.cpl
c:\windows\system32\6a519py5arez182.cpl
c:\windows\system32\6b55downloadzr1749.bin
c:\windows\system32\6c95a9zware465.bin
c:\windows\system32\6cc9backdozr1596.dll
c:\windows\system32\6da5add9zre1215.bin
c:\windows\system32\6e24zo59loader2524.cpl
c:\windows\system32\6ez1vir5239.dll
c:\windows\system32\6z59backdoor9991.ocx
c:\windows\system32\6z98s9a5se895.cpl
c:\windows\system32\7035thizf29489.bin
c:\windows\system32\7155zte5l2829.ocx
c:\windows\system32\71905py9z.cpl
c:\windows\system32\739esparsez53.dll
c:\windows\system32\7435ddware9232z.dll
c:\windows\system32\748esp95are2814z.bin
c:\windows\system32\75b2s9ealz45.exe
c:\windows\system32\76475hiefz199.dll
c:\windows\system32\774395reatz8916.dll
c:\windows\system32\7795spywarz970.ocx
c:\windows\system32\7795zpyware1061.exe
c:\windows\system32\7803thiz59114.bin
c:\windows\system32\78ccstz5l919.bin
c:\windows\system32\791fadzwa5e2704.dll
c:\windows\system32\7994spars9155z.dll
c:\windows\system32\79z65ot-a-virus9d4.dll
c:\windows\system32\7bf4zpar9e1540.exe
c:\windows\system32\7c51spy9zre2918.cpl
c:\windows\system32\7d9steal55z.exe
c:\windows\system32\7e80downlo9dzr1551.dll
c:\windows\system32\7e99threzt6524.ocx
c:\windows\system32\7z5d59ckdoor1887.ocx
c:\windows\system32\8059zacktool49d.ocx
c:\windows\system32\83195ozm69.cpl
c:\windows\system32\8549szy593.cpl
c:\windows\system32\85759orm88z.dll
c:\windows\system32\8722n9t-a-vizus345.exe
c:\windows\system32\87615pzmbot2139.dll
c:\windows\system32\8f5downl9ad5z274.exe
c:\windows\system32\8z63troj459.ocx
c:\windows\system32\90868tr5j6d3z.exe
c:\windows\system32\90csparsz1925.dll
c:\windows\system32\90ffst5al241z.exe
c:\windows\system32\90z3s5yware600.cpl
c:\windows\system32\914dstealz1545.cpl
c:\windows\system32\91z04sp53b7.exe
c:\windows\system32\92138z5rus242.dll
c:\windows\system32\926ethi5f21z1.cpl
c:\windows\system32\93700trzj3915.dll
c:\windows\system32\93z45roj3c2.ocx
c:\windows\system32\945szeal2959.bin
c:\windows\system32\94cdspaz5e815.exe
c:\windows\system32\9510viz301.dll
c:\windows\system32\954wzrm25.dll
c:\windows\system32\9581szy499.exe
c:\windows\system32\959985zoj79f.exe
c:\windows\system32\9857troz55.ocx
c:\windows\system32\98919pamz5t205.exe
c:\windows\system32\9895spamb5t4z3.dll
c:\windows\system32\99315t5zj3e.exe
c:\windows\system32\993zv5rus45.bin
c:\windows\system32\994wo5m1bz.exe
c:\windows\system32\9955trojzfd.dll
c:\windows\system32\9992zpy7b25.exe
c:\windows\system32\9995szy765.bin
c:\windows\system32\9a1s5zware949.ocx
c:\windows\system32\9acaaddwar526z0.bin
c:\windows\system32\9d0zvir1915.ocx
c:\windows\system32\9d6bdzwnloade5591.ocx
c:\windows\system32\9db7adzware8295.cpl
c:\windows\system32\9f49t5ief1595z.ocx
c:\windows\system32\9f52thief16z8.dll
c:\windows\system32\9z44spam5ot52a9.dll
c:\windows\system32\9z9fspar5e3217.cpl
c:\windows\system32\d9z5hreat27973.exe
c:\windows\system32\db5ba9kdoo5z186.ocx
c:\windows\system32\ea0sp9r5e1z05.exe
c:\windows\system32\fb1backzoor9250.bin
c:\windows\system32\rezumatenoi.dat
c:\windows\system32\z0456hac5tool19d.bin
c:\windows\system32\z101not-a-v5rus696.ocx
c:\windows\system32\z1109t95j35a.cpl
c:\windows\system32\z126s5e9l2280.ocx
c:\windows\system32\z2631v59us7e0.cpl
c:\windows\system32\z2759t5oj2e6.bin
c:\windows\system32\z2b8ste59176.ocx
c:\windows\system32\z3756spya89.bin
c:\windows\system32\z38449acktool5d75.ocx
c:\windows\system32\z39659py724.exe
c:\windows\system32\z43t9o57b3.bin
c:\windows\system32\z457threat16609.cpl
c:\windows\system32\z5176virus68d9.exe
c:\windows\system32\z51dow9loader1795.dll
c:\windows\system32\z6548not-a-vi5us69e.cpl
c:\windows\system32\z6a5threat5009.ocx
c:\windows\system32\z6b1thief19795.bin
c:\windows\system32\z769vi5us665.exe
c:\windows\system32\z793troj9c5.dll
c:\windows\system32\z901sparse2506.ocx
c:\windows\system32\z989vir885.dll
c:\windows\system32\zb85backdo9r1599.cpl
c:\windows\system32\zc9bthi952203.dll
c:\windows\system32\zdb6thie919395.ocx
.
((((((((((((((((((((((((( Files Created from 2009-07-22 to 2009-08-22 )))))))))))))))))))))))))))))))
.
2009-08-22 16:39 . 2009-08-22 16:44 -------- d-----w- C:\Genproc
2009-08-22 15:33 . 2009-08-22 15:33 -------- d-----w- c:\documents and settings\Florian\Application Data\Bitdefender
2009-08-22 15:29 . 2009-08-22 15:29 -------- d-----w- c:\program files\Softwin
2009-08-22 15:27 . 2009-01-18 21:30 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys
2009-08-22 15:27 . 2009-08-22 15:39 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-08-22 15:27 . 2009-01-18 21:43 2892112 -c--a-w- c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}\Ad-AwareAE.exe
2009-08-22 15:22 . 2009-08-22 15:22 -------- d-----w- c:\program files\CCleaner
2009-08-22 15:08 . 2009-08-22 15:08 396800 ----a-w- c:\windows\system32\i5128pxa.exe
2009-08-22 12:47 . 2009-08-22 16:17 -------- d-----w- c:\documents and settings\Florian\Tracing
2009-08-22 08:24 . 2009-08-22 08:24 -------- d-----w- c:\program files\Microsoft
2009-08-22 08:20 . 2009-08-22 08:20 -------- d-----w- c:\program files\Fichiers communs\Windows Live
2009-08-21 14:51 . 2009-08-22 15:23 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-08-21 14:51 . 2009-08-22 15:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-21 14:50 . 2009-08-22 15:27 -------- d-----w- c:\program files\Lavasoft
2009-08-20 19:07 . 2009-08-20 19:07 0 ----a-w- c:\windows\system32\wsbl.dat
2009-08-20 19:07 . 2009-08-20 19:07 0 ----a-w- c:\windows\system32\ph_white.dat
2009-08-20 19:07 . 2009-08-20 19:07 0 ----a-w- c:\windows\system32\ph_summ.dat
2009-08-20 19:07 . 2009-08-20 19:07 0 ----a-w- c:\windows\system32\ph_black.dat
2009-08-20 14:17 . 2009-08-20 14:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Blizzard Entertainment
2009-08-20 13:37 . 2009-08-20 13:37 4 ----a-w- c:\windows\system32\aspdict-en.dat
2009-08-20 13:37 . 2009-08-20 13:37 16 ----a-w- c:\windows\system32\asdict.dat
2009-08-20 13:37 . 2009-08-20 13:37 0 ----a-w- c:\windows\system32\pcwords.dat
2009-08-20 13:30 . 2009-08-22 15:13 -------- d-----w- c:\documents and settings\All Users\Application Data\BitDefender
2009-08-20 13:12 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2009-08-05 09:00 . 2009-08-05 09:00 205312 -c----w- c:\windows\system32\dllcache\mswebdvd.dll
2009-07-29 04:35 . 2009-07-29 04:35 81920 -c----w- c:\windows\system32\dllcache\fontsub.dll
2009-07-29 04:35 . 2009-07-29 04:35 119808 -c----w- c:\windows\system32\dllcache\t2embed.dll
2009-07-26 14:44 . 2009-07-26 14:44 48448 ----a-w- c:\windows\system32\sirenacm.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-22 20:03 . 2008-10-15 12:22 81984 ----a-w- c:\windows\system32\bdod.bin
2009-08-22 17:20 . 2008-10-15 20:57 -------- d-sh--w- c:\windows\Fonts\'
2009-08-22 16:32 . 2009-03-21 16:17 -------- d-----w- c:\program files\trend micro
2009-08-22 15:29 . 2008-10-15 12:18 -------- d-----w- c:\program files\Fichiers communs\Softwin
2009-08-22 15:27 . 2009-07-11 00:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-08-22 15:13 . 2008-12-11 16:10 -------- d-----w- c:\program files\Fichiers communs\BitDefender
2009-08-22 08:24 . 2008-10-15 12:39 -------- d-----w- c:\program files\Windows Live
2009-08-22 08:18 . 2008-10-15 12:36 -------- d-----w- c:\program files\MSN Messenger
2009-08-20 14:45 . 2008-12-24 11:29 -------- d-----w- c:\program files\World of Warcraft
2009-08-20 13:30 . 2008-12-11 16:11 -------- d-----w- c:\program files\BitDefender
2009-08-05 09:00 . 2008-10-15 11:30 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-29 04:35 . 2001-08-28 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-07-29 04:35 . 2001-08-28 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-07-17 19:03 . 2008-10-25 14:30 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-12 10:21 . 2008-10-25 14:58 233472 ------w- c:\windows\system32\wmpdxm.dll
2009-07-11 00:53 . 2009-06-30 23:16 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-07-03 20:53 . 2009-02-14 23:39 -------- d-----w- c:\program files\DivX
2009-07-01 08:08 . 2009-07-01 08:08 -------- d-----w- c:\documents and settings\Florian\Application Data\Friday's games
2009-06-26 16:50 . 2008-10-25 14:30 670720 ------w- c:\windows\system32\wininet.dll
2009-06-26 16:50 . 2008-10-25 14:58 81920 ------w- c:\windows\system32\ieencode.dll
2009-06-25 08:26 . 2008-10-25 14:30 56832 ----a-w- c:\windows\system32\secur32.dll
2009-06-25 08:26 . 2001-08-28 12:00 736768 ----a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:26 . 2001-08-28 12:00 54272 ----a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:26 . 2001-08-28 12:00 147456 ----a-w- c:\windows\system32\schannel.dll
2009-06-25 08:26 . 2001-08-28 12:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-06-25 08:26 . 2008-10-25 14:30 301568 ----a-w- c:\windows\system32\kerberos.dll
2009-06-24 11:18 . 2001-08-28 12:00 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-15 10:44 . 2002-08-29 09:45 78848 ----a-w- c:\windows\system32\telnet.exe
2009-06-15 10:44 . 2008-10-25 14:30 82944 ----a-w- c:\windows\system32\tlntsess.exe
2009-06-10 14:14 . 2008-10-25 14:30 85504 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 07:21 . 2008-10-25 14:30 2066432 ----a-w- c:\windows\system32\mstscax.dll
2009-06-10 06:15 . 2001-08-28 12:00 132096 ----a-w- c:\windows\system32\wkssvc.dll
2009-06-03 19:10 . 2008-10-15 11:30 1297408 ----a-w- c:\windows\system32\quartz.dll
2009-08-21 08:34 . 2009-08-20 13:32 44544 ----a-w- c:\program files\mozilla firefox\components\FFComm.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2008-03-24 13524992]
"NvMediaCenter"="c:\windows\System32\NvMcTray.dll" [2008-03-24 86016]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-15 136600]
"ISUSPM"="c:\program files\Fichiers communs\InstallShield\UpdateService\ISUSPM.exe" [2006-03-20 213936]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-01-18 506712]
"BDMCon"="c:\program files\Softwin\BitDefender10\bdmcon.exe" [2007-04-02 290816]
"BDAgent"="c:\program files\Softwin\BitDefender10\bdagent.exe" [2007-03-26 69632]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-03-24 1626112]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2008-02-13 16857600]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
hp psc 1000 series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe [2003-4-6 147456]
hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-4-6 28672]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /p \??\E:\0autocheck autochk *
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\InterVideo\\DVD8\\WinDVD.exe"=
"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.0.9.9551-to-3.1.0.9767-frFR-downloader.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.0.10192-to-3.2.0.10314-frFR-downloader.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [22/08/2009 17:27 64160]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [18/01/2009 23:34 921936]
.
Contents of the 'Scheduled Tasks' folder
2009-08-22 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 21:34]
2009-08-21 c:\windows\Tasks\FRU Task 2003-04-06 08:52ewlett-Packard2003-04-06 08:52p psc 1200 series5E771253C1676EBED677BF361FDFC537825E15B8240074929.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-05 22:52]
2009-08-21 c:\windows\Tasks\WebReg 20090821111624.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqwrg.exe [2003-04-05 23:01]
.
.
------- Supplementary Scan -------
.
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Florian\Application Data\Mozilla\Firefox\Profiles\uf3rv23o.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr
FF - component: c:\program files\Mozilla Firefox\components\FFComm.dll
---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-22 22:07
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2009-08-22 22:07
ComboFix-quarantined-files.txt 2009-08-22 20:07
ComboFix2.txt 2009-08-22 17:27
Pre-Run: 99 240 243 200 octets libres
Post-Run: 99 229 224 960 octets libres
500 --- E O F --- 2009-08-20 17:56
ComboFix 09-08-21.02 - Florian 22/08/2009 22:04.2.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.3070.2497 [GMT 2:00]
Running from: c:\documents and settings\Florian\Bureau\braviax.exe.exe
Command switches used :: c:\documents and settings\Florian\Bureau\CFScript.txt
AV: Bitdefender Antivirus *On-access scanning enabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
FW: BitDefender Pare-feu *disabled* {4055920F-2E99-48A8-A270-4243D2B8F242}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
"c:\windows\system32\1z6895p9mbot71b.dll"
"c:\windows\system32\20052spambot9zc.dll"
"c:\windows\system32\20125v9rus34z.bin"
"c:\windows\system32\21513spa95ot2z2.exe"
"c:\windows\system32\251asteal2z279.bin"
"c:\windows\system32\25499zo5m73c.dll"
"c:\windows\system32\25595worm728z.exe"
"c:\windows\system32\26939spamb5tz4.bin"
"c:\windows\system32\28058t9ojz54.exe"
"c:\windows\system32\29441hackt9ol5f8z.bin"
"c:\windows\system32\29912spamb5t75fz.dll"
"c:\windows\system32\2z35sp932d5.dll"
"c:\windows\system32\2z547spambot97b.dll"
"c:\windows\system32\2z7735ir9s71e.exe"
"c:\windows\system32\313509ozm99.bin"
"c:\windows\system32\32181hacktz9l6d5.dll"
"c:\windows\system32\37875ot-a-9irus71cz.dll"
"c:\windows\system32\3ac25te9l169z.bin"
"c:\windows\system32\4795h5ckzool635.exe"
"c:\windows\system32\4z19spywa5e3249.bin"
"c:\windows\system32\52a3adzware1059.bin"
"c:\windows\system32\53759ackdooz2528.bin"
"c:\windows\system32\55c9azdware35989.dll"
"c:\windows\system32\55e6thief19z4.bin"
"c:\windows\system32\5d56viz5959.dll"
"c:\windows\system32\6008tr9j25z.dll"
"c:\windows\system32\609no5-a-vir9s7z9.exe"
"c:\windows\system32\6583viruz5d59.bin"
"c:\windows\system32\65z6vi959.exe"
"c:\windows\system32\6946sp5waze961.dll"
"c:\windows\system32\6c95a9zware465.bin"
"c:\windows\system32\7e80downlo9dzr1551.dll"
"c:\windows\system32\90csparsz1925.dll"
"c:\windows\system32\9895spamb5t4z3.dll"
"c:\windows\system32\994wo5m1bz.exe"
"c:\windows\system32\d9z5hreat27973.exe"
"c:\windows\system32\rezumatenoi.dat"
"c:\windows\system32\z43t9o57b3.bin"
"c:\windows\system32\z6b1thief19795.bin"
"c:\windows\system32\z769vi5us665.exe"
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\1z06steal559.ocx
c:\windows\system32\1z2125roj499.ocx
c:\windows\system32\1z25st5a91203.exe
c:\windows\system32\1z394v5rus1af9.cpl
c:\windows\system32\1z6895p9mbot71b.dll
c:\windows\system32\1z758s9y188.dll
c:\windows\system32\1z859tr9jd8.bin
c:\windows\system32\1ze59hief2219.ocx
c:\windows\system32\20052spambot9zc.dll
c:\windows\system32\20125v9rus34z.bin
c:\windows\system32\20893not-a-vi9us5z4.bin
c:\windows\system32\20995zpam9ot5f95.dll
c:\windows\system32\210559ief2606z.dll
c:\windows\system32\2120ziru539b.ocx
c:\windows\system32\21259virzs.dll
c:\windows\system32\21452spambzt9f7.cpl
c:\windows\system32\21513spa95ot2z2.exe
c:\windows\system32\217179pzmbotd5.cpl
c:\windows\system32\2179ad5warz792.cpl
c:\windows\system32\22288t9zj1b5.ocx
c:\windows\system32\22479zp59bot6ff.bin
c:\windows\system32\2283stza917965.ocx
c:\windows\system32\23z7h9cktool75e.cpl
c:\windows\system32\24552troj549z.cpl
c:\windows\system32\24fthr5atz6791.bin
c:\windows\system32\24z15tr95205.cpl
c:\windows\system32\2509zha5ktool162.ocx
c:\windows\system32\251asteal2z279.bin
c:\windows\system32\25395zirus59.ocx
c:\windows\system32\25457spz193.dll
c:\windows\system32\2545spyz289.dll
c:\windows\system32\25499zo5m73c.dll
c:\windows\system32\25558noz-a-virus495.cpl
c:\windows\system32\25595worm728z.exe
c:\windows\system32\25753wo9z2ae.cpl
c:\windows\system32\2591zroj2c7.dll
c:\windows\system32\2595t9reat2320z.dll
c:\windows\system32\26099za5ktool4fd.dll
c:\windows\system32\26125hazkt5ol91e.exe
c:\windows\system32\26939spamb5tz4.bin
c:\windows\system32\269zaddwar5275.dll
c:\windows\system32\2742vir9s65z.exe
c:\windows\system32\28058t9ojz54.exe
c:\windows\system32\283819azkto5l329.dll
c:\windows\system32\28591ha9ktool5fz.bin
c:\windows\system32\28899trzj55.bin
c:\windows\system32\28z49troj598.dll
c:\windows\system32\29029s5amzot269.exe
c:\windows\system32\2906thre5t2918z.dll
c:\windows\system32\29441hackt9ol5f8z.bin
c:\windows\system32\29492hacktool559z.exe
c:\windows\system32\295279zoj9b.ocx
c:\windows\system32\29544zro970a.ocx
c:\windows\system32\29552tzo57b89.bin
c:\windows\system32\2955zhreat51253.ocx
c:\windows\system32\2967spywaz51490.exe
c:\windows\system32\296addwa5981z.dll
c:\windows\system32\29912spamb5t75fz.dll
c:\windows\system32\29bdaddwa5e31z59.dll
c:\windows\system32\2a73zteal2590.bin
c:\windows\system32\2bfste5l1199z.exe
c:\windows\system32\2c5bzteal5941.bin
c:\windows\system32\2ca5dzwnload591466.exe
c:\windows\system32\2d6a9hrza56289.ocx
c:\windows\system32\2d6edow5lo9derz282.exe
c:\windows\system32\2z35sp932d5.dll
c:\windows\system32\2z547spambot97b.dll
c:\windows\system32\2z57backdo9r1592.ocx
c:\windows\system32\2z7735ir9s71e.exe
c:\windows\system32\2z788v5r9s6bc.cpl
c:\windows\system32\2z792wo5m124.exe
c:\windows\system32\2z8439py575.exe
c:\windows\system32\2z8465py922.dll
c:\windows\system32\30165szam5ot971.exe
c:\windows\system32\30842not-a-zi9u515d.exe
c:\windows\system32\3085zsp53489.bin
c:\windows\system32\3093zhreat9145.ocx
c:\windows\system32\310z7hackt9ol3095.bin
c:\windows\system32\313509ozm99.bin
c:\windows\system32\31503w5rmz919.dll
c:\windows\system32\31581trzj55a9.dll
c:\windows\system32\32181hacktz9l6d5.dll
c:\windows\system32\32745ot9a-vzrus183.cpl
c:\windows\system32\3345addware28z9.ocx
c:\windows\system32\3536zpar9e403.ocx
c:\windows\system32\355azackdoor1795.cpl
c:\windows\system32\356bstea9z605.exe
c:\windows\system32\3571zhief1939.ocx
c:\windows\system32\35726z9rusbb.dll
c:\windows\system32\35czthreat31159.ocx
c:\windows\system32\37875ot-a-9irus71cz.dll
c:\windows\system32\385bthreat9829z.cpl
c:\windows\system32\3881z9o5504.dll
c:\windows\system32\3915troz1a4.ocx
c:\windows\system32\3916noz-a-vir5s3109.ocx
c:\windows\system32\39310not-a-5izus42d.ocx
c:\windows\system32\3950zddware2985.bin
c:\windows\system32\3953zteal2817.dll
c:\windows\system32\3985threat12257z.ocx
c:\windows\system32\39addownloader5z9.exe
c:\windows\system32\3a5cth9ef3038z.cpl
c:\windows\system32\3a6495zkdoor925.dll
c:\windows\system32\3ac25te9l169z.bin
c:\windows\system32\3ac7down9oaderz527.dll
c:\windows\system32\3de759arsz2299.cpl
c:\windows\system32\3fz3s9e5l1956.exe
c:\windows\system32\3z224hack9o5l257.exe
c:\windows\system32\3z396v5rus90a.bin
c:\windows\system32\3z987spy3c5.bin
c:\windows\system32\3za9thie52626.ocx
c:\windows\system32\3zdabackdoo59154.ocx
c:\windows\system32\40195hie92248z.dll
c:\windows\system32\420viz59111.cpl
c:\windows\system32\449teal5716z.bin
c:\windows\system32\46599parsz1620.ocx
c:\windows\system32\4795h5ckzool635.exe
c:\windows\system32\490baddza5e2476.bin
c:\windows\system32\492dz9wnloader3155.bin
c:\windows\system32\493bv5r12z9.cpl
c:\windows\system32\49c3azdwa5e239.exe
c:\windows\system32\49e5ste5z111.dll
c:\windows\system32\4az0t9r5at17747.bin
c:\windows\system32\4d55pyw9re6z5.bin
c:\windows\system32\4f75zhief1059.dll
c:\windows\system32\4z19spywa5e3249.bin
c:\windows\system32\4z709pywar51244.exe
c:\windows\system32\4z90b5ckdoor880.cpl
c:\windows\system32\501bsteaz1935.cpl
c:\windows\system32\5050downlozder35589.cpl
c:\windows\system32\50899hackzool712.ocx
c:\windows\system32\509cspyzare81.ocx
c:\windows\system32\509vir59z1.bin
c:\windows\system32\51090not-a-9iruz17f.exe
c:\windows\system32\517b9pyzar51334.bin
c:\windows\system32\519cad5ware2z72.cpl
c:\windows\system32\51e99t5zl2813.bin
c:\windows\system32\5285spz8a9.cpl
c:\windows\system32\52948spy3d4z.dll
c:\windows\system32\52a3adzware1059.bin
c:\windows\system32\5352zir209.ocx
c:\windows\system32\53759ackdooz2528.bin
c:\windows\system32\5399backdo5z3067.cpl
c:\windows\system32\53acste9lz583.ocx
c:\windows\system32\53e9vi5z589.bin
c:\windows\system32\545cd9wnloadez1087.bin
c:\windows\system32\549ebac9door133z.dll
c:\windows\system32\55229pzware1358.exe
c:\windows\system32\555ddownload9z1008.dll
c:\windows\system32\555zdownloader2915.ocx
c:\windows\system32\559dtzreat31386.bin
c:\windows\system32\559fdownloader7z9.cpl
c:\windows\system32\55c8downl9adzr2577.ocx
c:\windows\system32\55c9azdware35989.dll
c:\windows\system32\55e6thief19z4.bin
c:\windows\system32\55f1sz9al1757.dll
c:\windows\system32\56005irzs179.cpl
c:\windows\system32\5615vir9z317.bin
c:\windows\system32\563dtz5eat1359.bin
c:\windows\system32\56409irus29z.exe
c:\windows\system32\56435tzo9a9.dll
c:\windows\system32\5758sz9al815.ocx
c:\windows\system32\58247viz9s22a.ocx
c:\windows\system32\5859thizf2459.ocx
c:\windows\system32\585zthi9f2406.dll
c:\windows\system32\586thzef18965.dll
c:\windows\system32\58baz5r957.dll
c:\windows\system32\597dz95rse2325.cpl
c:\windows\system32\59925iz2999.dll
c:\windows\system32\5998vir2z31.cpl
c:\windows\system32\5999s5yware3069z.exe
c:\windows\system32\59dbstea5266z.ocx
c:\windows\system32\59e1thiefz45.cpl
c:\windows\system32\5a2thre9tz0356.cpl
c:\windows\system32\5a6eszy5are3169.cpl
c:\windows\system32\5aads9za5696.cpl
c:\windows\system32\5b2fvir695z.bin
c:\windows\system32\5b9dsp95ze509.bin
c:\windows\system32\5cz9sp9rse2226.ocx
c:\windows\system32\5d56viz5959.dll
c:\windows\system32\5das9zrse1711.exe
c:\windows\system32\5f259ir2z42.bin
c:\windows\system32\5z15troj9b0.ocx
c:\windows\system32\5z8fad9ware935.exe
c:\windows\system32\5z95pyware2967.exe
c:\windows\system32\5z97steal195.ocx
c:\windows\system32\5zbf9teal2621.ocx
c:\windows\system32\6008tr9j25z.dll
c:\windows\system32\6085notza-virus7589.exe
c:\windows\system32\609no5-a-vir9s7z9.exe
c:\windows\system32\60z1not-5-vir9s4f5.ocx
c:\windows\system32\63925hiefz909.bin
c:\windows\system32\6527thzeat95118.exe
c:\windows\system32\6564troj359z.cpl
c:\windows\system32\6583viruz5d59.bin
c:\windows\system32\65fdszeal2592.dll
c:\windows\system32\65z6vi959.exe
c:\windows\system32\687t9iez5965.ocx
c:\windows\system32\6946sp5waze961.dll
c:\windows\system32\69bspz5are2761.cpl
c:\windows\system32\6a519py5arez182.cpl
c:\windows\system32\6b55downloadzr1749.bin
c:\windows\system32\6c95a9zware465.bin
c:\windows\system32\6cc9backdozr1596.dll
c:\windows\system32\6da5add9zre1215.bin
c:\windows\system32\6e24zo59loader2524.cpl
c:\windows\system32\6ez1vir5239.dll
c:\windows\system32\6z59backdoor9991.ocx
c:\windows\system32\6z98s9a5se895.cpl
c:\windows\system32\7035thizf29489.bin
c:\windows\system32\7155zte5l2829.ocx
c:\windows\system32\71905py9z.cpl
c:\windows\system32\739esparsez53.dll
c:\windows\system32\7435ddware9232z.dll
c:\windows\system32\748esp95are2814z.bin
c:\windows\system32\75b2s9ealz45.exe
c:\windows\system32\76475hiefz199.dll
c:\windows\system32\774395reatz8916.dll
c:\windows\system32\7795spywarz970.ocx
c:\windows\system32\7795zpyware1061.exe
c:\windows\system32\7803thiz59114.bin
c:\windows\system32\78ccstz5l919.bin
c:\windows\system32\791fadzwa5e2704.dll
c:\windows\system32\7994spars9155z.dll
c:\windows\system32\79z65ot-a-virus9d4.dll
c:\windows\system32\7bf4zpar9e1540.exe
c:\windows\system32\7c51spy9zre2918.cpl
c:\windows\system32\7d9steal55z.exe
c:\windows\system32\7e80downlo9dzr1551.dll
c:\windows\system32\7e99threzt6524.ocx
c:\windows\system32\7z5d59ckdoor1887.ocx
c:\windows\system32\8059zacktool49d.ocx
c:\windows\system32\83195ozm69.cpl
c:\windows\system32\8549szy593.cpl
c:\windows\system32\85759orm88z.dll
c:\windows\system32\8722n9t-a-vizus345.exe
c:\windows\system32\87615pzmbot2139.dll
c:\windows\system32\8f5downl9ad5z274.exe
c:\windows\system32\8z63troj459.ocx
c:\windows\system32\90868tr5j6d3z.exe
c:\windows\system32\90csparsz1925.dll
c:\windows\system32\90ffst5al241z.exe
c:\windows\system32\90z3s5yware600.cpl
c:\windows\system32\914dstealz1545.cpl
c:\windows\system32\91z04sp53b7.exe
c:\windows\system32\92138z5rus242.dll
c:\windows\system32\926ethi5f21z1.cpl
c:\windows\system32\93700trzj3915.dll
c:\windows\system32\93z45roj3c2.ocx
c:\windows\system32\945szeal2959.bin
c:\windows\system32\94cdspaz5e815.exe
c:\windows\system32\9510viz301.dll
c:\windows\system32\954wzrm25.dll
c:\windows\system32\9581szy499.exe
c:\windows\system32\959985zoj79f.exe
c:\windows\system32\9857troz55.ocx
c:\windows\system32\98919pamz5t205.exe
c:\windows\system32\9895spamb5t4z3.dll
c:\windows\system32\99315t5zj3e.exe
c:\windows\system32\993zv5rus45.bin
c:\windows\system32\994wo5m1bz.exe
c:\windows\system32\9955trojzfd.dll
c:\windows\system32\9992zpy7b25.exe
c:\windows\system32\9995szy765.bin
c:\windows\system32\9a1s5zware949.ocx
c:\windows\system32\9acaaddwar526z0.bin
c:\windows\system32\9d0zvir1915.ocx
c:\windows\system32\9d6bdzwnloade5591.ocx
c:\windows\system32\9db7adzware8295.cpl
c:\windows\system32\9f49t5ief1595z.ocx
c:\windows\system32\9f52thief16z8.dll
c:\windows\system32\9z44spam5ot52a9.dll
c:\windows\system32\9z9fspar5e3217.cpl
c:\windows\system32\d9z5hreat27973.exe
c:\windows\system32\db5ba9kdoo5z186.ocx
c:\windows\system32\ea0sp9r5e1z05.exe
c:\windows\system32\fb1backzoor9250.bin
c:\windows\system32\rezumatenoi.dat
c:\windows\system32\z0456hac5tool19d.bin
c:\windows\system32\z101not-a-v5rus696.ocx
c:\windows\system32\z1109t95j35a.cpl
c:\windows\system32\z126s5e9l2280.ocx
c:\windows\system32\z2631v59us7e0.cpl
c:\windows\system32\z2759t5oj2e6.bin
c:\windows\system32\z2b8ste59176.ocx
c:\windows\system32\z3756spya89.bin
c:\windows\system32\z38449acktool5d75.ocx
c:\windows\system32\z39659py724.exe
c:\windows\system32\z43t9o57b3.bin
c:\windows\system32\z457threat16609.cpl
c:\windows\system32\z5176virus68d9.exe
c:\windows\system32\z51dow9loader1795.dll
c:\windows\system32\z6548not-a-vi5us69e.cpl
c:\windows\system32\z6a5threat5009.ocx
c:\windows\system32\z6b1thief19795.bin
c:\windows\system32\z769vi5us665.exe
c:\windows\system32\z793troj9c5.dll
c:\windows\system32\z901sparse2506.ocx
c:\windows\system32\z989vir885.dll
c:\windows\system32\zb85backdo9r1599.cpl
c:\windows\system32\zc9bthi952203.dll
c:\windows\system32\zdb6thie919395.ocx
.
((((((((((((((((((((((((( Files Created from 2009-07-22 to 2009-08-22 )))))))))))))))))))))))))))))))
.
2009-08-22 16:39 . 2009-08-22 16:44 -------- d-----w- C:\Genproc
2009-08-22 15:33 . 2009-08-22 15:33 -------- d-----w- c:\documents and settings\Florian\Application Data\Bitdefender
2009-08-22 15:29 . 2009-08-22 15:29 -------- d-----w- c:\program files\Softwin
2009-08-22 15:27 . 2009-01-18 21:30 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys
2009-08-22 15:27 . 2009-08-22 15:39 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-08-22 15:27 . 2009-01-18 21:43 2892112 -c--a-w- c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}\Ad-AwareAE.exe
2009-08-22 15:22 . 2009-08-22 15:22 -------- d-----w- c:\program files\CCleaner
2009-08-22 15:08 . 2009-08-22 15:08 396800 ----a-w- c:\windows\system32\i5128pxa.exe
2009-08-22 12:47 . 2009-08-22 16:17 -------- d-----w- c:\documents and settings\Florian\Tracing
2009-08-22 08:24 . 2009-08-22 08:24 -------- d-----w- c:\program files\Microsoft
2009-08-22 08:20 . 2009-08-22 08:20 -------- d-----w- c:\program files\Fichiers communs\Windows Live
2009-08-21 14:51 . 2009-08-22 15:23 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-08-21 14:51 . 2009-08-22 15:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-21 14:50 . 2009-08-22 15:27 -------- d-----w- c:\program files\Lavasoft
2009-08-20 19:07 . 2009-08-20 19:07 0 ----a-w- c:\windows\system32\wsbl.dat
2009-08-20 19:07 . 2009-08-20 19:07 0 ----a-w- c:\windows\system32\ph_white.dat
2009-08-20 19:07 . 2009-08-20 19:07 0 ----a-w- c:\windows\system32\ph_summ.dat
2009-08-20 19:07 . 2009-08-20 19:07 0 ----a-w- c:\windows\system32\ph_black.dat
2009-08-20 14:17 . 2009-08-20 14:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Blizzard Entertainment
2009-08-20 13:37 . 2009-08-20 13:37 4 ----a-w- c:\windows\system32\aspdict-en.dat
2009-08-20 13:37 . 2009-08-20 13:37 16 ----a-w- c:\windows\system32\asdict.dat
2009-08-20 13:37 . 2009-08-20 13:37 0 ----a-w- c:\windows\system32\pcwords.dat
2009-08-20 13:30 . 2009-08-22 15:13 -------- d-----w- c:\documents and settings\All Users\Application Data\BitDefender
2009-08-20 13:12 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2009-08-05 09:00 . 2009-08-05 09:00 205312 -c----w- c:\windows\system32\dllcache\mswebdvd.dll
2009-07-29 04:35 . 2009-07-29 04:35 81920 -c----w- c:\windows\system32\dllcache\fontsub.dll
2009-07-29 04:35 . 2009-07-29 04:35 119808 -c----w- c:\windows\system32\dllcache\t2embed.dll
2009-07-26 14:44 . 2009-07-26 14:44 48448 ----a-w- c:\windows\system32\sirenacm.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-22 20:03 . 2008-10-15 12:22 81984 ----a-w- c:\windows\system32\bdod.bin
2009-08-22 17:20 . 2008-10-15 20:57 -------- d-sh--w- c:\windows\Fonts\'
2009-08-22 16:32 . 2009-03-21 16:17 -------- d-----w- c:\program files\trend micro
2009-08-22 15:29 . 2008-10-15 12:18 -------- d-----w- c:\program files\Fichiers communs\Softwin
2009-08-22 15:27 . 2009-07-11 00:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-08-22 15:13 . 2008-12-11 16:10 -------- d-----w- c:\program files\Fichiers communs\BitDefender
2009-08-22 08:24 . 2008-10-15 12:39 -------- d-----w- c:\program files\Windows Live
2009-08-22 08:18 . 2008-10-15 12:36 -------- d-----w- c:\program files\MSN Messenger
2009-08-20 14:45 . 2008-12-24 11:29 -------- d-----w- c:\program files\World of Warcraft
2009-08-20 13:30 . 2008-12-11 16:11 -------- d-----w- c:\program files\BitDefender
2009-08-05 09:00 . 2008-10-15 11:30 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-29 04:35 . 2001-08-28 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-07-29 04:35 . 2001-08-28 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-07-17 19:03 . 2008-10-25 14:30 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-12 10:21 . 2008-10-25 14:58 233472 ------w- c:\windows\system32\wmpdxm.dll
2009-07-11 00:53 . 2009-06-30 23:16 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-07-03 20:53 . 2009-02-14 23:39 -------- d-----w- c:\program files\DivX
2009-07-01 08:08 . 2009-07-01 08:08 -------- d-----w- c:\documents and settings\Florian\Application Data\Friday's games
2009-06-26 16:50 . 2008-10-25 14:30 670720 ------w- c:\windows\system32\wininet.dll
2009-06-26 16:50 . 2008-10-25 14:58 81920 ------w- c:\windows\system32\ieencode.dll
2009-06-25 08:26 . 2008-10-25 14:30 56832 ----a-w- c:\windows\system32\secur32.dll
2009-06-25 08:26 . 2001-08-28 12:00 736768 ----a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:26 . 2001-08-28 12:00 54272 ----a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:26 . 2001-08-28 12:00 147456 ----a-w- c:\windows\system32\schannel.dll
2009-06-25 08:26 . 2001-08-28 12:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-06-25 08:26 . 2008-10-25 14:30 301568 ----a-w- c:\windows\system32\kerberos.dll
2009-06-24 11:18 . 2001-08-28 12:00 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-15 10:44 . 2002-08-29 09:45 78848 ----a-w- c:\windows\system32\telnet.exe
2009-06-15 10:44 . 2008-10-25 14:30 82944 ----a-w- c:\windows\system32\tlntsess.exe
2009-06-10 14:14 . 2008-10-25 14:30 85504 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 07:21 . 2008-10-25 14:30 2066432 ----a-w- c:\windows\system32\mstscax.dll
2009-06-10 06:15 . 2001-08-28 12:00 132096 ----a-w- c:\windows\system32\wkssvc.dll
2009-06-03 19:10 . 2008-10-15 11:30 1297408 ----a-w- c:\windows\system32\quartz.dll
2009-08-21 08:34 . 2009-08-20 13:32 44544 ----a-w- c:\program files\mozilla firefox\components\FFComm.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2008-03-24 13524992]
"NvMediaCenter"="c:\windows\System32\NvMcTray.dll" [2008-03-24 86016]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-15 136600]
"ISUSPM"="c:\program files\Fichiers communs\InstallShield\UpdateService\ISUSPM.exe" [2006-03-20 213936]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-01-18 506712]
"BDMCon"="c:\program files\Softwin\BitDefender10\bdmcon.exe" [2007-04-02 290816]
"BDAgent"="c:\program files\Softwin\BitDefender10\bdagent.exe" [2007-03-26 69632]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-03-24 1626112]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2008-02-13 16857600]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
hp psc 1000 series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe [2003-4-6 147456]
hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-4-6 28672]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /p \??\E:\0autocheck autochk *
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\InterVideo\\DVD8\\WinDVD.exe"=
"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.0.9.9551-to-3.1.0.9767-frFR-downloader.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.0.10192-to-3.2.0.10314-frFR-downloader.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [22/08/2009 17:27 64160]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [18/01/2009 23:34 921936]
.
Contents of the 'Scheduled Tasks' folder
2009-08-22 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 21:34]
2009-08-21 c:\windows\Tasks\FRU Task 2003-04-06 08:52ewlett-Packard2003-04-06 08:52p psc 1200 series5E771253C1676EBED677BF361FDFC537825E15B8240074929.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-05 22:52]
2009-08-21 c:\windows\Tasks\WebReg 20090821111624.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqwrg.exe [2003-04-05 23:01]
.
.
------- Supplementary Scan -------
.
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Florian\Application Data\Mozilla\Firefox\Profiles\uf3rv23o.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr
FF - component: c:\program files\Mozilla Firefox\components\FFComm.dll
---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-22 22:07
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2009-08-22 22:07
ComboFix-quarantined-files.txt 2009-08-22 20:07
ComboFix2.txt 2009-08-22 17:27
Pre-Run: 99 240 243 200 octets libres
Post-Run: 99 229 224 960 octets libres
500 --- E O F --- 2009-08-20 17:56
Tu seras la demain ? Car je pense pas pouvoir y faire ce soir, mais le topic reste la toute facon, sinon bah je te dis un gros merci pour ta patience et ton aide ^^
Bonjour me revoila. J'ai fait ce que tu m'as dit, voilà le rapport :
ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=6
# iexplore.exe=6.00.2900.5512 (xpsp.080413-2105)
# OnlineScanner.ocx=1.0.0.6048
# api_version=3.0.2
# EOSSerial=6d13a791380c634d819911cd4df7ce10
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2009-08-23 09:22:40
# local_time=2009-08-23 11:22:40 (+0100, Paris, Madrid (heure d'été))
# country="France"
# lang=1036
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=2051 21 28 83 31919062500
# scanned=63182
# found=6
# cleaned=6
# scan_time=2330
C:\Documents and Settings\Florian\Mes documents\MSNFix\incl\Hostsclean.exe Win32/Packed.Autoit.Gen application (supprimé - mis en quarantaine) 00000000000000000000000000000000 C
C:\Qoobox\Quarantine\C\WINDOWS\system32\MSIVXbiqtgenaltikmkvwaqjtoyunowuijtbt.dll.vir Win32/Olmarik.JI cheval de troie (nettoyé par suppression - mis en quarantaine) 00000000000000000000000000000000 C
C:\Qoobox\Quarantine\C\WINDOWS\system32\MSIVXifmcdtomkhbpnrnomqsqdulynyvxtssv.dll.vir Win32/TrojanClicker.Agent.NHI cheval de troie (nettoyé par suppression - mis en quarantaine) 00000000000000000000000000000000 C
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\_MSIVXltpogrkcxeypapydobvdyibhoygvkkye_.sys.zip Win32/TrojanClicker.Agent.NGF cheval de troie (supprimé - mis en quarantaine) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{6BF6B138-0DF0-4111-A55E-DEFC300A30DE}\RP168\A0205748.dll Win32/Olmarik.JI cheval de troie (nettoyé par suppression - mis en quarantaine) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{6BF6B138-0DF0-4111-A55E-DEFC300A30DE}\RP168\A0205750.dll Win32/TrojanClicker.Agent.NHI cheval de troie (nettoyé par suppression - mis en quarantaine) 00000000000000000000000000000000 C
ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=6
# iexplore.exe=6.00.2900.5512 (xpsp.080413-2105)
# OnlineScanner.ocx=1.0.0.6048
# api_version=3.0.2
# EOSSerial=6d13a791380c634d819911cd4df7ce10
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2009-08-23 09:22:40
# local_time=2009-08-23 11:22:40 (+0100, Paris, Madrid (heure d'été))
# country="France"
# lang=1036
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=2051 21 28 83 31919062500
# scanned=63182
# found=6
# cleaned=6
# scan_time=2330
C:\Documents and Settings\Florian\Mes documents\MSNFix\incl\Hostsclean.exe Win32/Packed.Autoit.Gen application (supprimé - mis en quarantaine) 00000000000000000000000000000000 C
C:\Qoobox\Quarantine\C\WINDOWS\system32\MSIVXbiqtgenaltikmkvwaqjtoyunowuijtbt.dll.vir Win32/Olmarik.JI cheval de troie (nettoyé par suppression - mis en quarantaine) 00000000000000000000000000000000 C
C:\Qoobox\Quarantine\C\WINDOWS\system32\MSIVXifmcdtomkhbpnrnomqsqdulynyvxtssv.dll.vir Win32/TrojanClicker.Agent.NHI cheval de troie (nettoyé par suppression - mis en quarantaine) 00000000000000000000000000000000 C
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\_MSIVXltpogrkcxeypapydobvdyibhoygvkkye_.sys.zip Win32/TrojanClicker.Agent.NGF cheval de troie (supprimé - mis en quarantaine) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{6BF6B138-0DF0-4111-A55E-DEFC300A30DE}\RP168\A0205748.dll Win32/Olmarik.JI cheval de troie (nettoyé par suppression - mis en quarantaine) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{6BF6B138-0DF0-4111-A55E-DEFC300A30DE}\RP168\A0205750.dll Win32/TrojanClicker.Agent.NHI cheval de troie (nettoyé par suppression - mis en quarantaine) 00000000000000000000000000000000 C
