[!] Pubs intempestives sous Vista S.V.P. !
Kanii
-
Narco!4 Messages postés 2446 Statut Contributeur -
Narco!4 Messages postés 2446 Statut Contributeur -
Bonjour,
J'ai des pubs intempestives sous forme de fenêtre Internet.
Je pensai que c'était un problème avec mon navigateur mozilla, mais les pubs sont présentes sur Internet Explorer.
J'ai déjà fais des recherches sur Google en vain.
Quelqu'un aurait une solution ?
Merci d'avance :) !
(Je suis sous Vista)
J'ai des pubs intempestives sous forme de fenêtre Internet.
Je pensai que c'était un problème avec mon navigateur mozilla, mais les pubs sont présentes sur Internet Explorer.
J'ai déjà fais des recherches sur Google en vain.
Quelqu'un aurait une solution ?
Merci d'avance :) !
(Je suis sous Vista)
A voir également:
- [!] Pubs intempestives sous Vista S.V.P. !
- Bloquer les pubs youtube - Accueil - Streaming
- Windows vista - Télécharger - Divers Utilitaires
- Supprimer les pubs - Guide
- Clé windows vista - Guide
- Windows Vista SP1 - Télécharger - Divers Utilitaires
22 réponses
Bonjour,
télécharge GenProc http://www.genproc.com/GenProc.exe
double-clique sur GenProc.exe et poste le contenu du rapport qui s'ouvre
télécharge GenProc http://www.genproc.com/GenProc.exe
double-clique sur GenProc.exe et poste le contenu du rapport qui s'ouvre
J'ai le message d'erreur "C:/Windows/system32/cscript.exe n'est pas une application Win32 valide."
Qu'est-ce que je fais ?
Merci encore :)
Qu'est-ce que je fais ?
Merci encore :)
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
[*] Télécharge combofix (sUBs) http://download.bleepingcomputer.com/sUBs/ComboFix.exe sur ton Bureau
[*] Double clique combofix.exe et suis les instructions.
[*] Installe la console de récupération si proposé et continue.
[*] Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.
NOTE : Le rapport se trouve également ici : C:\Combofix.txt
[*] Double clique combofix.exe et suis les instructions.
[*] Installe la console de récupération si proposé et continue.
[*] Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.
NOTE : Le rapport se trouve également ici : C:\Combofix.txt
Décidément !!!
"C:/XXXXXXXXXXXXXXX/XXXXXXXXX.cfxxe n'est pas une application Win32 valide."
Le message se répète 3 à 4 fois et il est marqué dans le terminal bleu "Accès refusé"
Merci de tes réponses aussi rapides !
"C:/XXXXXXXXXXXXXXX/XXXXXXXXX.cfxxe n'est pas une application Win32 valide."
Le message se répète 3 à 4 fois et il est marqué dans le terminal bleu "Accès refusé"
Merci de tes réponses aussi rapides !
[*] Rends-toi à cette adresse afin de télécharger FindyKill (créé par Chiquitine29) :
[*] https://www.androidworld.fr/
[*] Clique sur [b]TÉLÉCHARGER/b et enregistre-le sur ton bureau.
[*] [url=http://pagesperso-orange.fr/NosTools/tuto_fyk2.html][u]tutoriel recherche/u/url
[*] [b]/!\ Ne fais pas le nettoyage tout dessuite /!\/b
[*] Double clic sur le raccourci FindyKill sur ton bureau, l'installation se fera automatiquement
[*] Au menu principal,choisi l option 1 (Recherche)
[*] Post le rapport FindyKill.txt
/list
* Note : le rapport FindyKill.txt est sauvegardé a la racine du disque
[*] https://www.androidworld.fr/
[*] Clique sur [b]TÉLÉCHARGER/b et enregistre-le sur ton bureau.
[*] [url=http://pagesperso-orange.fr/NosTools/tuto_fyk2.html][u]tutoriel recherche/u/url
[*] [b]/!\ Ne fais pas le nettoyage tout dessuite /!\/b
[*] Double clic sur le raccourci FindyKill sur ton bureau, l'installation se fera automatiquement
[*] Au menu principal,choisi l option 1 (Recherche)
[*] Post le rapport FindyKill.txt
/list
* Note : le rapport FindyKill.txt est sauvegardé a la racine du disque
Voilà,
(Le message d'erreur a encore eu lieu, mais j'ai laissé faire.)
############################## | FindyKill V5.014 |
############################## | Processus actifs |
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\winlogon.exe
C:\Program Files\Dell\DellDock\DockLogin.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\WLANExt.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\aestsrv.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\system32\STacSV.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe
C:\Windows\OEM02Mon.exe
C:\Program Files\Dell\MediaDirect\PCMService.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Users\R\Program Files\DNA\btdna.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Windows\system32\wbem\wmiprvse.exe
c:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\explorer.exe
C:\Windows\system32\conime.exe
################## | C: |
################## | C:\Windows |
################## | C:\Windows\system32 |
################## | C:\Windows\system32\drivers |
################## | C:\Users\R\AppData\Roaming |
################## | Temporary Internet Files |
################## | Registre / Clés infectieuses |
Présent ! [HKLM\software\microsoft\security center\Svc] "AntiVirusOverride"
Présent ! [HKLM\software\microsoft\security center\Svc] "FirewallOverride"
################## | Etat / Services / Informations |
# Affichage des fichiers cachés : OK
# Mode sans echec : OK
# Uac : OK
# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 )
# EapHost -> Start = 3 ( Good = 2 | Bad = 4 )
# Wlansvc -> Start = 2 ( Good = 2 | Bad = 4 )
# SharedAccess -> Start = 3 ( Good = 2 | Bad = 4 )
# windefend -> Start = 2 ( Good = 2 | Bad = 4 )
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 )
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 )
################## | Cracks / Keygens / Serials |
################## | ! Fin du rapport # FindyKill V5.014 ! |
(Le message d'erreur a encore eu lieu, mais j'ai laissé faire.)
############################## | FindyKill V5.014 |
############################## | Processus actifs |
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\winlogon.exe
C:\Program Files\Dell\DellDock\DockLogin.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\WLANExt.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\aestsrv.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\system32\STacSV.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe
C:\Windows\OEM02Mon.exe
C:\Program Files\Dell\MediaDirect\PCMService.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Users\R\Program Files\DNA\btdna.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Windows\system32\wbem\wmiprvse.exe
c:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\explorer.exe
C:\Windows\system32\conime.exe
################## | C: |
################## | C:\Windows |
################## | C:\Windows\system32 |
################## | C:\Windows\system32\drivers |
################## | C:\Users\R\AppData\Roaming |
################## | Temporary Internet Files |
################## | Registre / Clés infectieuses |
Présent ! [HKLM\software\microsoft\security center\Svc] "AntiVirusOverride"
Présent ! [HKLM\software\microsoft\security center\Svc] "FirewallOverride"
################## | Etat / Services / Informations |
# Affichage des fichiers cachés : OK
# Mode sans echec : OK
# Uac : OK
# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 )
# EapHost -> Start = 3 ( Good = 2 | Bad = 4 )
# Wlansvc -> Start = 2 ( Good = 2 | Bad = 4 )
# SharedAccess -> Start = 3 ( Good = 2 | Bad = 4 )
# windefend -> Start = 2 ( Good = 2 | Bad = 4 )
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 )
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 )
################## | Cracks / Keygens / Serials |
################## | ! Fin du rapport # FindyKill V5.014 ! |
ComboFix 09-11-09.02 - R 11/11/2009 12:46.1.2 - NTFSx86
Lancé depuis: c:\users\R\Desktop\ComboFix.exe
.
[i] ADS - Windows: deleted 24 bytes in 1 streams. /i
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\$recycle.bin\S-1-5-21-2746947571-3893594193-687437354-500
c:\$recycle.bin\S-1-5-21-3395499582-3656299844-1299793059-500
c:\program files\Internet Saving Optimizer
c:\program files\Internet Saving Optimizer\3.7.0.4550\adwpx.exe
c:\program files\Internet Saving Optimizer\3.7.0.4550\Data\config.md
c:\program files\Internet Saving Optimizer\3.7.0.4550\FF\chrome.manifest
c:\program files\Internet Saving Optimizer\3.7.0.4550\FF\chrome\content\NPAddOn.js
c:\program files\Internet Saving Optimizer\3.7.0.4550\FF\chrome\content\NPAddOn.xul
c:\program files\Internet Saving Optimizer\3.7.0.4550\FF\chrome\NPAddOn.jar
c:\program files\Internet Saving Optimizer\3.7.0.4550\FF\components\NPFFAddOn.dll
c:\program files\Internet Saving Optimizer\3.7.0.4550\FF\components\NPFFAddOn.xpt
c:\program files\Internet Saving Optimizer\3.7.0.4550\FF\components\NPFFHelperComponent.js
c:\program files\Internet Saving Optimizer\3.7.0.4550\FF\install.rdf
c:\program files\Internet Saving Optimizer\3.7.0.4550\NPCommon.dll
c:\program files\Internet Saving Optimizer\3.7.0.4550\NPIEAddOn.dll
c:\program files\Internet Saving Optimizer\3.7.0.4550\unins000.dat
c:\program files\Internet Saving Optimizer\3.7.0.4550\unins000.exe
c:\program files\Media Access Startup
c:\program files\Media Access Startup\1.5.6.910\Data\config.md
c:\program files\Media Access Startup\1.5.6.910\FF\chrome.manifest
c:\program files\Media Access Startup\1.5.6.910\FF\chrome\content\HPAddOn.js
c:\program files\Media Access Startup\1.5.6.910\FF\chrome\content\HPAddOn.xul
c:\program files\Media Access Startup\1.5.6.910\FF\chrome\HPAddOn.jar
c:\program files\Media Access Startup\1.5.6.910\FF\components\HPFFAddOn.dll
c:\program files\Media Access Startup\1.5.6.910\FF\components\HPFFAddOn.xpt
c:\program files\Media Access Startup\1.5.6.910\FF\components\HPFFHelperComponent.js
c:\program files\Media Access Startup\1.5.6.910\FF\install.rdf
c:\program files\Media Access Startup\1.5.6.910\HPCommon.dll
c:\program files\Media Access Startup\1.5.6.910\hppx.exe
c:\program files\Media Access Startup\1.5.6.910\MAHelper.exe
c:\program files\Media Access Startup\1.5.6.910\unins000.dat
c:\program files\Media Access Startup\1.5.6.910\unins000.exe
c:\users\R\AppData\Roaming\Desktopicon
c:\users\R\AppData\Roaming\Desktopicon\eBayShortcuts.exe
c:\windows\msnimport.exe
c:\windows\system32\jdns_sd.dll
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-10-11 au 2009-11-11 ))))))))))))))))))))))))))))))))))))
.
2009-11-11 11:56 . 2009-11-11 11:57 -------- d-----w- c:\users\R\AppData\Local\temp
2009-11-11 11:56 . 2009-11-11 11:56 -------- d-----w- c:\users\Default\AppData\Local\temp
2009-11-02 19:42 . 2009-11-02 19:42 -------- d-----w- c:\program files\iPod
2009-11-02 19:42 . 2009-11-02 19:42 4096 d-----w- c:\program files\iTunes
2009-11-02 19:33 . 2009-11-02 19:33 79144 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2009-10-30 09:18 . 2009-08-07 02:24 44768 ----a-w- c:\windows\system32\wups2.dll
2009-10-30 09:18 . 2009-08-07 02:24 53472 ----a-w- c:\windows\system32\wuauclt.exe
2009-10-30 09:18 . 2009-08-07 02:23 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-10-30 09:18 . 2009-08-07 01:45 2421760 ----a-w- c:\windows\system32\wucltux.dll
2009-10-30 09:18 . 2009-08-07 02:24 35552 ----a-w- c:\windows\system32\wups.dll
2009-10-30 09:18 . 2009-08-07 02:23 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-10-30 09:18 . 2009-08-07 01:44 87552 ----a-w- c:\windows\system32\wudriver.dll
2009-10-30 09:18 . 2009-08-06 18:23 171608 ----a-w- c:\windows\system32\wuwebv.dll
2009-10-30 09:18 . 2009-08-06 17:44 33792 ----a-w- c:\windows\system32\wuapp.exe
2009-10-27 18:21 . 2009-09-10 15:21 310784 ----a-w- c:\windows\system32\unregmp2.exe
2009-10-27 18:21 . 2009-09-10 15:21 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2009-10-21 16:44 . 2009-10-21 16:53 -------- d-----w- C:\FindyKill
2009-10-20 22:00 . 2009-10-20 22:00 -------- d-----w- C:\cf04e6701d4c61663b9f62d46116f08f
2009-10-20 21:38 . 2009-10-20 21:38 6736 ----a-w- c:\windows\system32\drivers\PROCEXP90.SYS
2009-10-20 19:40 . 2009-10-20 20:42 4096 d-----w- C:\GenProc
2009-10-19 18:50 . 2009-10-19 18:50 -------- d-----w- c:\program files\CCleaner
2009-10-17 20:12 . 2009-10-17 20:12 653560 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2009-10-16 17:41 . 2009-09-10 17:30 213504 ----a-w- c:\windows\system32\msv1_0.dll
2009-10-16 17:41 . 2009-08-05 14:22 3597896 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-10-16 17:41 . 2009-08-05 14:22 3546184 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-10-16 17:41 . 2009-08-31 13:55 293376 ----a-w- c:\windows\system32\psisdecd.dll
2009-10-16 17:41 . 2009-08-31 13:55 428544 ----a-w- c:\windows\system32\EncDec.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-11 11:51 . 2009-02-15 17:06 4096 d-----w- c:\users\R\AppData\Roaming\DNA
2009-11-11 11:25 . 2008-08-11 21:38 669566 ----a-w- c:\windows\system32\perfh00C.dat
2009-11-11 11:25 . 2008-08-11 21:38 123556 ----a-w- c:\windows\system32\perfc00C.dat
2009-11-11 11:20 . 2009-05-27 17:26 27459 ----a-w- c:\programdata\nvModes.dat
2009-11-11 00:02 . 2008-08-11 11:52 2372 ----a-w- c:\windows\bthservsdp.dat
2009-11-10 21:26 . 2008-08-05 20:09 4096 d-----w- c:\program files\Messenger Plus! Live
2009-11-07 18:54 . 2008-08-05 21:01 8192 d-----w- c:\users\R\AppData\Roaming\LimeWire
2009-11-02 19:42 . 2008-08-05 21:38 -------- d-----w- c:\program files\Common Files\Apple
2009-11-02 19:42 . 2009-10-02 15:59 195456 ------w- c:\windows\system32\MpSigStub.exe
2009-11-02 19:17 . 2009-08-11 17:43 8192 d-----w- c:\program files\Safari
2009-10-31 09:11 . 2008-08-12 16:48 4096 d-----w- c:\users\R\AppData\Roaming\Skype
2009-10-31 09:11 . 2008-08-12 16:49 4096 d-----w- c:\users\R\AppData\Roaming\skypePM
2009-10-17 16:07 . 2006-11-02 11:18 4096 d-----w- c:\program files\Windows Mail
2009-09-30 16:22 . 2008-08-13 09:57 7592 ----a-w- c:\users\R\AppData\Local\d3d9caps.dat
2009-09-23 16:42 . 2009-08-28 23:04 -------- d-----w- c:\programdata\Sukoku
2009-09-14 09:44 . 2009-10-16 17:40 144896 ----a-w- c:\windows\system32\drivers\srv2.sys
2009-09-06 13:02 . 2009-09-06 13:02 3584 ----a-r- c:\users\R\AppData\Roaming\Microsoft\Installer\{121634B0-2F4B-11D3-ADA3-00C04F52DD52}\Icon386ED4E3.exe
2009-09-04 12:24 . 2009-10-16 17:40 61440 ----a-w- c:\windows\system32\msasn1.dll
2009-09-02 08:23 . 2008-08-11 12:20 75304 ----a-w- c:\users\R\AppData\Local\GDIPFONTCACHEV1.DAT
2009-08-28 17:42 . 2009-08-28 17:42 40448 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-08-28 17:42 . 2009-08-28 17:42 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-08-28 12:39 . 2009-09-02 22:31 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-08-28 10:15 . 2009-09-02 22:31 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-27 05:22 . 2009-10-16 17:40 916480 ----a-w- c:\windows\system32\wininet.dll
2009-08-27 05:17 . 2009-10-16 17:40 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-08-27 05:17 . 2009-10-16 17:40 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-08-27 03:42 . 2009-10-16 17:40 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-08-21 09:37 . 2009-08-28 23:03 3020324 -c----w- c:\programdata\{FB94CE54-2703-4BFF-8E94-A0AD14C0FA22}\Setup.exe
2009-08-20 17:25 . 2009-08-20 17:25 1961720 ----a-w- c:\users\R\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
2009-08-18 22:47 . 2009-05-30 16:37 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-08-14 17:07 . 2009-09-09 21:29 897608 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-08-14 16:29 . 2009-09-09 21:29 104960 ----a-w- c:\windows\system32\netiohlp.dll
2009-08-14 16:29 . 2009-09-09 21:29 17920 ----a-w- c:\windows\system32\netevent.dll
2009-08-14 14:16 . 2009-09-09 21:29 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2009-08-14 14:16 . 2009-09-09 21:29 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2009-08-14 14:16 . 2009-09-09 21:29 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2009-08-14 14:16 . 2009-09-09 21:29 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2009-08-14 14:16 . 2009-09-09 21:29 19968 ----a-w- c:\windows\system32\ARP.EXE
2009-08-14 14:16 . 2009-09-09 21:29 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2009-08-14 14:16 . 2009-09-09 21:29 10240 ----a-w- c:\windows\system32\finger.exe
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
2008-12-17 17:54 . 2008-07-31 20:14 74 --sh--r- c:\windows\CT4CET.bin
2006-05-03 09:06 . 2009-08-15 23:52 163328 --sh--r- c:\windows\System32\flvDX.dll
2007-02-21 10:47 . 2009-08-15 23:52 31232 --sh--r- c:\windows\System32\msfDX.dll
2008-03-16 12:30 . 2009-08-15 23:52 216064 --sh--r- c:\windows\System32\nbDX.dll
2008-08-01 05:45 . 2008-08-01 05:45 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-07-26 3883856]
"BitTorrent DNA"="c:\users\R\Program Files\DNA\btdna.exe" [2009-10-03 323392]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2007-09-24 159744]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2008-01-02 405504]
"OEM02Mon.exe"="c:\windows\OEM02Mon.exe" [2007-12-03 36864]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-03-11 16384]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2008-02-29 17920]
"PCMService"="c:\program files\Dell\MediaDirect\PCMService.exe" [2007-12-21 184320]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"DELL Webcam Manager"="c:\program files\Dell\Dell Webcam Manager\DellWMgr.exe" [2007-07-27 118784]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-06-09 13543968]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-06-09 92704]
"NVHotkey"="c:\windows\system32\nvHotkey.dll" [2008-06-09 96800]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-06-08 198160]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-04 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-10-28 141600]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2008-02-29 76304]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-07-31 20:23 10536 ----a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKLM\~\startupfolder\C:^Users^R^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^BitTorrent Acceleration Patch.lnk]
path=c:\users\R\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BitTorrent Acceleration Patch.lnk
backup=c:\windows\pss\BitTorrent Acceleration Patch.lnk.Startup
backupExtension=.Startup
[HKLM\~\startupfolder\C:^Users^R^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^PdaNet Desktop.lnk]
path=c:\users\R\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PdaNet Desktop.lnk
backup=c:\windows\pss\PdaNet Desktop.lnk.Startup
backupExtension=.Startup
S2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\aestsrv.exe [2008-01-02 73728]
S2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-07-14 108289]
--- Autres Services/Pilotes en mémoire ---
*NewlyCreated* - MBR
*NewlyCreated* - PROCEXP113
*Deregistered* - mbr
*Deregistered* - mfehidk
*Deregistered* - MPFP
*Deregistered* - PROCEXP113
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
.
.
------- Examen supplémentaire -------
.
uInternet Settings,ProxyServer = proxy.free.fr:3128
uInternet Settings,ProxyOverride = *.local
IE: Envoyer au périphérique &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: Envoyer l'&image au périphérique Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
FF - ProfilePath - c:\users\R\AppData\Roaming\Mozilla\Firefox\Profiles\3qv5x2n1.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.theprizeday.com/today.php|facebook.com
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\users\R\Program Files\DNA\plugins\npbtdna.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.
- - - - ORPHELINS SUPPRIMES - - - -
HKCU-Run-Microsoft_Manager - c:\windows\Explorer_.exe
AddRemove-Avidemux 2.4 - c:\program files\Avidemux 2.4\uninstall.exe
AddRemove-Sukoku - c:\program files\Sukoku\uninstall.exe
AddRemove-{16B6279B-9FF5-41fb-8BF9-404324F5DD1F}}_is1 - c:\program files\Media Access Startup\1.5.6.910\unins000.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-11 12:56
Windows 6.0.6001 Service Pack 1 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys iastor.sys spmz.sys hal.dll >>UNKNOWN [0x85887938]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\atapi -> 0x858d11f8
Warning: possible MBR rootkit infection !
user & kernel MBR OK
Use "Recovery Console" command "fixmbr" to clear infection !
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Heure de fin: 2009-11-11 13:00
ComboFix-quarantined-files.txt 2009-11-11 12:00
Avant-CF: 74 086 572 032 octets libres
Après-CF: 80 162 566 144 octets libres
- - End Of File - - 23223148C18B771AD175403A7A0F36FE
Lancé depuis: c:\users\R\Desktop\ComboFix.exe
.
[i] ADS - Windows: deleted 24 bytes in 1 streams. /i
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\$recycle.bin\S-1-5-21-2746947571-3893594193-687437354-500
c:\$recycle.bin\S-1-5-21-3395499582-3656299844-1299793059-500
c:\program files\Internet Saving Optimizer
c:\program files\Internet Saving Optimizer\3.7.0.4550\adwpx.exe
c:\program files\Internet Saving Optimizer\3.7.0.4550\Data\config.md
c:\program files\Internet Saving Optimizer\3.7.0.4550\FF\chrome.manifest
c:\program files\Internet Saving Optimizer\3.7.0.4550\FF\chrome\content\NPAddOn.js
c:\program files\Internet Saving Optimizer\3.7.0.4550\FF\chrome\content\NPAddOn.xul
c:\program files\Internet Saving Optimizer\3.7.0.4550\FF\chrome\NPAddOn.jar
c:\program files\Internet Saving Optimizer\3.7.0.4550\FF\components\NPFFAddOn.dll
c:\program files\Internet Saving Optimizer\3.7.0.4550\FF\components\NPFFAddOn.xpt
c:\program files\Internet Saving Optimizer\3.7.0.4550\FF\components\NPFFHelperComponent.js
c:\program files\Internet Saving Optimizer\3.7.0.4550\FF\install.rdf
c:\program files\Internet Saving Optimizer\3.7.0.4550\NPCommon.dll
c:\program files\Internet Saving Optimizer\3.7.0.4550\NPIEAddOn.dll
c:\program files\Internet Saving Optimizer\3.7.0.4550\unins000.dat
c:\program files\Internet Saving Optimizer\3.7.0.4550\unins000.exe
c:\program files\Media Access Startup
c:\program files\Media Access Startup\1.5.6.910\Data\config.md
c:\program files\Media Access Startup\1.5.6.910\FF\chrome.manifest
c:\program files\Media Access Startup\1.5.6.910\FF\chrome\content\HPAddOn.js
c:\program files\Media Access Startup\1.5.6.910\FF\chrome\content\HPAddOn.xul
c:\program files\Media Access Startup\1.5.6.910\FF\chrome\HPAddOn.jar
c:\program files\Media Access Startup\1.5.6.910\FF\components\HPFFAddOn.dll
c:\program files\Media Access Startup\1.5.6.910\FF\components\HPFFAddOn.xpt
c:\program files\Media Access Startup\1.5.6.910\FF\components\HPFFHelperComponent.js
c:\program files\Media Access Startup\1.5.6.910\FF\install.rdf
c:\program files\Media Access Startup\1.5.6.910\HPCommon.dll
c:\program files\Media Access Startup\1.5.6.910\hppx.exe
c:\program files\Media Access Startup\1.5.6.910\MAHelper.exe
c:\program files\Media Access Startup\1.5.6.910\unins000.dat
c:\program files\Media Access Startup\1.5.6.910\unins000.exe
c:\users\R\AppData\Roaming\Desktopicon
c:\users\R\AppData\Roaming\Desktopicon\eBayShortcuts.exe
c:\windows\msnimport.exe
c:\windows\system32\jdns_sd.dll
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-10-11 au 2009-11-11 ))))))))))))))))))))))))))))))))))))
.
2009-11-11 11:56 . 2009-11-11 11:57 -------- d-----w- c:\users\R\AppData\Local\temp
2009-11-11 11:56 . 2009-11-11 11:56 -------- d-----w- c:\users\Default\AppData\Local\temp
2009-11-02 19:42 . 2009-11-02 19:42 -------- d-----w- c:\program files\iPod
2009-11-02 19:42 . 2009-11-02 19:42 4096 d-----w- c:\program files\iTunes
2009-11-02 19:33 . 2009-11-02 19:33 79144 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2009-10-30 09:18 . 2009-08-07 02:24 44768 ----a-w- c:\windows\system32\wups2.dll
2009-10-30 09:18 . 2009-08-07 02:24 53472 ----a-w- c:\windows\system32\wuauclt.exe
2009-10-30 09:18 . 2009-08-07 02:23 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-10-30 09:18 . 2009-08-07 01:45 2421760 ----a-w- c:\windows\system32\wucltux.dll
2009-10-30 09:18 . 2009-08-07 02:24 35552 ----a-w- c:\windows\system32\wups.dll
2009-10-30 09:18 . 2009-08-07 02:23 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-10-30 09:18 . 2009-08-07 01:44 87552 ----a-w- c:\windows\system32\wudriver.dll
2009-10-30 09:18 . 2009-08-06 18:23 171608 ----a-w- c:\windows\system32\wuwebv.dll
2009-10-30 09:18 . 2009-08-06 17:44 33792 ----a-w- c:\windows\system32\wuapp.exe
2009-10-27 18:21 . 2009-09-10 15:21 310784 ----a-w- c:\windows\system32\unregmp2.exe
2009-10-27 18:21 . 2009-09-10 15:21 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2009-10-21 16:44 . 2009-10-21 16:53 -------- d-----w- C:\FindyKill
2009-10-20 22:00 . 2009-10-20 22:00 -------- d-----w- C:\cf04e6701d4c61663b9f62d46116f08f
2009-10-20 21:38 . 2009-10-20 21:38 6736 ----a-w- c:\windows\system32\drivers\PROCEXP90.SYS
2009-10-20 19:40 . 2009-10-20 20:42 4096 d-----w- C:\GenProc
2009-10-19 18:50 . 2009-10-19 18:50 -------- d-----w- c:\program files\CCleaner
2009-10-17 20:12 . 2009-10-17 20:12 653560 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2009-10-16 17:41 . 2009-09-10 17:30 213504 ----a-w- c:\windows\system32\msv1_0.dll
2009-10-16 17:41 . 2009-08-05 14:22 3597896 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-10-16 17:41 . 2009-08-05 14:22 3546184 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-10-16 17:41 . 2009-08-31 13:55 293376 ----a-w- c:\windows\system32\psisdecd.dll
2009-10-16 17:41 . 2009-08-31 13:55 428544 ----a-w- c:\windows\system32\EncDec.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-11 11:51 . 2009-02-15 17:06 4096 d-----w- c:\users\R\AppData\Roaming\DNA
2009-11-11 11:25 . 2008-08-11 21:38 669566 ----a-w- c:\windows\system32\perfh00C.dat
2009-11-11 11:25 . 2008-08-11 21:38 123556 ----a-w- c:\windows\system32\perfc00C.dat
2009-11-11 11:20 . 2009-05-27 17:26 27459 ----a-w- c:\programdata\nvModes.dat
2009-11-11 00:02 . 2008-08-11 11:52 2372 ----a-w- c:\windows\bthservsdp.dat
2009-11-10 21:26 . 2008-08-05 20:09 4096 d-----w- c:\program files\Messenger Plus! Live
2009-11-07 18:54 . 2008-08-05 21:01 8192 d-----w- c:\users\R\AppData\Roaming\LimeWire
2009-11-02 19:42 . 2008-08-05 21:38 -------- d-----w- c:\program files\Common Files\Apple
2009-11-02 19:42 . 2009-10-02 15:59 195456 ------w- c:\windows\system32\MpSigStub.exe
2009-11-02 19:17 . 2009-08-11 17:43 8192 d-----w- c:\program files\Safari
2009-10-31 09:11 . 2008-08-12 16:48 4096 d-----w- c:\users\R\AppData\Roaming\Skype
2009-10-31 09:11 . 2008-08-12 16:49 4096 d-----w- c:\users\R\AppData\Roaming\skypePM
2009-10-17 16:07 . 2006-11-02 11:18 4096 d-----w- c:\program files\Windows Mail
2009-09-30 16:22 . 2008-08-13 09:57 7592 ----a-w- c:\users\R\AppData\Local\d3d9caps.dat
2009-09-23 16:42 . 2009-08-28 23:04 -------- d-----w- c:\programdata\Sukoku
2009-09-14 09:44 . 2009-10-16 17:40 144896 ----a-w- c:\windows\system32\drivers\srv2.sys
2009-09-06 13:02 . 2009-09-06 13:02 3584 ----a-r- c:\users\R\AppData\Roaming\Microsoft\Installer\{121634B0-2F4B-11D3-ADA3-00C04F52DD52}\Icon386ED4E3.exe
2009-09-04 12:24 . 2009-10-16 17:40 61440 ----a-w- c:\windows\system32\msasn1.dll
2009-09-02 08:23 . 2008-08-11 12:20 75304 ----a-w- c:\users\R\AppData\Local\GDIPFONTCACHEV1.DAT
2009-08-28 17:42 . 2009-08-28 17:42 40448 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-08-28 17:42 . 2009-08-28 17:42 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-08-28 12:39 . 2009-09-02 22:31 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-08-28 10:15 . 2009-09-02 22:31 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-27 05:22 . 2009-10-16 17:40 916480 ----a-w- c:\windows\system32\wininet.dll
2009-08-27 05:17 . 2009-10-16 17:40 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-08-27 05:17 . 2009-10-16 17:40 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-08-27 03:42 . 2009-10-16 17:40 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-08-21 09:37 . 2009-08-28 23:03 3020324 -c----w- c:\programdata\{FB94CE54-2703-4BFF-8E94-A0AD14C0FA22}\Setup.exe
2009-08-20 17:25 . 2009-08-20 17:25 1961720 ----a-w- c:\users\R\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
2009-08-18 22:47 . 2009-05-30 16:37 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-08-14 17:07 . 2009-09-09 21:29 897608 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-08-14 16:29 . 2009-09-09 21:29 104960 ----a-w- c:\windows\system32\netiohlp.dll
2009-08-14 16:29 . 2009-09-09 21:29 17920 ----a-w- c:\windows\system32\netevent.dll
2009-08-14 14:16 . 2009-09-09 21:29 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2009-08-14 14:16 . 2009-09-09 21:29 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2009-08-14 14:16 . 2009-09-09 21:29 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2009-08-14 14:16 . 2009-09-09 21:29 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2009-08-14 14:16 . 2009-09-09 21:29 19968 ----a-w- c:\windows\system32\ARP.EXE
2009-08-14 14:16 . 2009-09-09 21:29 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2009-08-14 14:16 . 2009-09-09 21:29 10240 ----a-w- c:\windows\system32\finger.exe
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
2008-12-17 17:54 . 2008-07-31 20:14 74 --sh--r- c:\windows\CT4CET.bin
2006-05-03 09:06 . 2009-08-15 23:52 163328 --sh--r- c:\windows\System32\flvDX.dll
2007-02-21 10:47 . 2009-08-15 23:52 31232 --sh--r- c:\windows\System32\msfDX.dll
2008-03-16 12:30 . 2009-08-15 23:52 216064 --sh--r- c:\windows\System32\nbDX.dll
2008-08-01 05:45 . 2008-08-01 05:45 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-07-26 3883856]
"BitTorrent DNA"="c:\users\R\Program Files\DNA\btdna.exe" [2009-10-03 323392]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2007-09-24 159744]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2008-01-02 405504]
"OEM02Mon.exe"="c:\windows\OEM02Mon.exe" [2007-12-03 36864]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-03-11 16384]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2008-02-29 17920]
"PCMService"="c:\program files\Dell\MediaDirect\PCMService.exe" [2007-12-21 184320]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"DELL Webcam Manager"="c:\program files\Dell\Dell Webcam Manager\DellWMgr.exe" [2007-07-27 118784]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-06-09 13543968]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-06-09 92704]
"NVHotkey"="c:\windows\system32\nvHotkey.dll" [2008-06-09 96800]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-06-08 198160]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-04 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-10-28 141600]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2008-02-29 76304]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-07-31 20:23 10536 ----a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKLM\~\startupfolder\C:^Users^R^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^BitTorrent Acceleration Patch.lnk]
path=c:\users\R\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BitTorrent Acceleration Patch.lnk
backup=c:\windows\pss\BitTorrent Acceleration Patch.lnk.Startup
backupExtension=.Startup
[HKLM\~\startupfolder\C:^Users^R^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^PdaNet Desktop.lnk]
path=c:\users\R\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PdaNet Desktop.lnk
backup=c:\windows\pss\PdaNet Desktop.lnk.Startup
backupExtension=.Startup
S2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\aestsrv.exe [2008-01-02 73728]
S2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-07-14 108289]
--- Autres Services/Pilotes en mémoire ---
*NewlyCreated* - MBR
*NewlyCreated* - PROCEXP113
*Deregistered* - mbr
*Deregistered* - mfehidk
*Deregistered* - MPFP
*Deregistered* - PROCEXP113
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
.
.
------- Examen supplémentaire -------
.
uInternet Settings,ProxyServer = proxy.free.fr:3128
uInternet Settings,ProxyOverride = *.local
IE: Envoyer au périphérique &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: Envoyer l'&image au périphérique Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
FF - ProfilePath - c:\users\R\AppData\Roaming\Mozilla\Firefox\Profiles\3qv5x2n1.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.theprizeday.com/today.php|facebook.com
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\users\R\Program Files\DNA\plugins\npbtdna.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.
- - - - ORPHELINS SUPPRIMES - - - -
HKCU-Run-Microsoft_Manager - c:\windows\Explorer_.exe
AddRemove-Avidemux 2.4 - c:\program files\Avidemux 2.4\uninstall.exe
AddRemove-Sukoku - c:\program files\Sukoku\uninstall.exe
AddRemove-{16B6279B-9FF5-41fb-8BF9-404324F5DD1F}}_is1 - c:\program files\Media Access Startup\1.5.6.910\unins000.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-11 12:56
Windows 6.0.6001 Service Pack 1 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys iastor.sys spmz.sys hal.dll >>UNKNOWN [0x85887938]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\atapi -> 0x858d11f8
Warning: possible MBR rootkit infection !
user & kernel MBR OK
Use "Recovery Console" command "fixmbr" to clear infection !
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Heure de fin: 2009-11-11 13:00
ComboFix-quarantined-files.txt 2009-11-11 12:00
Avant-CF: 74 086 572 032 octets libres
Après-CF: 80 162 566 144 octets libres
- - End Of File - - 23223148C18B771AD175403A7A0F36FE
