supprimer cheval de troie TR/Dropper Gen Résolu/Fermé

Question

Bonjour,


J'aimerai avoir de l'aide pour supprimer un cheval de troi (TR/Dropper.Gen) de mon pc,j'ai essayé avec malwarebyte's,avira en mode sans echec mais rien n'y fait il reviens toujours...


Merci d'avance pour votre aide

Voici mon rapport HiJackThis:





Logfile of random's system information tool 1.06 (written by random/random)
Run by vincent at 2009-11-05 20:20:19
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 12 GB (59%) free of 20 GB
Total RAM: 3327 MB (73% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:20:27, on 05/11/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
D:\Avira\AntiVir Desktop\sched.exe
D:\a-squared Free\a2service.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\DOCUME~1\vincent\APPLIC~1\MICROS~1\clipsrv.exe
D:\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RunDll32.exe
D:\i tunes\iTunesHelper.exe
D:\TrendMicro Scan\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\lclock.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
D:\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\iPod\bin\iPodService.exe
D:\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\vincent\Mes documents\RSIT.exe
C:\Program Files	rend micro\vincent.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.fr/toolbar/ie8/sidebar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.fr/toolbar/ie8/sidebar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/keyword/%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Favoris
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [QuickTime Task] "D:\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avgnt] "D:\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "D:\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner.exe" /S
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Google Quick Search Box] "C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe"  /autorun
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Adobe Reader\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [CmUsbSound] RunDll32 cmcnfgu.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "D:\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [iTunesHelper] "D:\i tunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\TrendMicro Scan\bin\jusched.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LClock] lclock.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\Shockwave 11\SwHelper_1151601.exe -Update -1151601 -"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB6.3; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" -"http://saison7.fighting-club.com/salle3d.asp?num=11"
O4 - HKLM\..\Policies\Explorer\Run: [ClipSrv] C:\DOCUME~1\vincent\APPLIC~1\MICROS~1\clipsrv.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [Cisvc] C:\DOCUME~1\vincent\LOCALS~1\APPLIC~1\cisvc.exe /waitservice
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [Spool] C:\DOCUME~1\vincent\LOCALS~1\Temp\spoolsv.exe /waitservice (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'Default user')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [Spool] C:\DOCUME~1\vincent\LOCALS~1\Temp\spoolsv.exe /waitservice (User 'Default user')
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_A54B7D6FB1DA63EA.dll/cmsidewiki.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\TrendMicro Scan\bin
pjpi150_03.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\TrendMicro Scan\bin
pjpi150_03.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {40F576AD-8680-4F9E-9490-99D069CD665F} (System Requirements Lab Class) - http://srtest-cdn.systemrequirementslab.com.s3.amazonaws.com/bin/sysreqlabdetect.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos-beta/OnlineScanner.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - http://javadl-esd.sun.com/update/1.5.0/jinstall-1_5_0_03-windows-i586.cab
O16 - DPF: {E6BB2089-163F-466B-812A-748096614DFD} (CAScanner Control) - http://cainternetsecurity.net/scanner/cascanner.cab
O20 - AppInit_DLLs:  
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - D:\a-squared Free\a2service.exe
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - D:\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - D:\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Utilisateur anonyme · Answer

/!\ A l'attention de ceux qui passent sur ce sujet /!\ 
Le logiciel qui suit n'est pas à utiliser à la légère et peut faire des dégâts s'il est mal utilisé ! Ne le faites que si un helpeur du forum qui connait bien cet outil vous l'a recommandé. 

/!\ Désactive tous tes logiciels de protection /!\ 

• Télécharge combofix(de sUBs) sur ton Bureau. 
• Double-clique sur ComboFix.exe afin de le lancer. 
• Il va te demander d'installer la console de récupération : accepte. (important en cas de problème)
• Ne touche à rien pendant le scan. 
• Lorsque la recherche sera terminée, un rapport apparaîtra. Poste ce rapport (C:\Combofix.txt) dans ta prochaine réponse. 
#Si combofix ne veut pas se lancer renommes le en ccm.exe et éxécutes le en mode sans échec .
Tutoriel officiel de Combofix : http://www.bleepingcomputer.com/combofix/fr/comment-utiliser¬-combofix

virus44 · Answer

Bonsoir nanard4700 Voici mon rapport combofix: Mon pc est il durement verolé? ComboFix 09-11-05.01 - vincent 05/11/2009 20:46.1.4 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.3327.2600 [GMT 1:00] Lancé depuis: c:\documents and settings\vincent\Mes documents\ComboFix.exe AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7} AV: ZoneAlarm Security Suite Antivirus *On-access scanning disabled* (Updated) {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF} FW: COMODO Firewall Pro *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B} FW: ZoneAlarm Security Suite Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B} . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\vincent\Application Data\Microsoft\clipsrv.exe c:\documents and settings\vincent\Local Settings\Application Data\cisvc.exe c:\windows\system32\msconfig.exe . ((((((((((((((((((((((((((((( Fichiers créés du 2009-10-05 au 2009-11-05 )))))))))))))))))))))))))))))))))))) . 2009-11-05 19:38 . 2009-11-05 19:38 117760 ----a-w- c:\documents and settings\vincent\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL 2009-11-05 19:37 . 2009-11-05 19:37 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com 2009-11-05 19:37 . 2009-11-05 19:37 -------- d-----w- c:\documents and settings\vincent\Application Data\SUPERAntiSpyware.com 2009-11-05 19:37 . 2009-11-05 19:37 -------- d-----w- c:\program files\Fichiers communs\Wise Installation Wizard 2009-11-05 16:11 . 2009-11-05 14:23 102664 ----a-w- c:\windows\system32\drivers mcomm.sys 2009-11-05 14:23 . 2009-11-05 16:11 -------- d-----w- c:\documents and settings\vincent\.housecall6.6 2009-11-05 14:18 . 2009-11-05 14:18 -------- d-----w- c:\windows\Sun 2009-11-05 14:17 . 2009-11-05 14:17 -------- d-----w- c:\program files\Fichiers communs\Java 2009-11-05 14:09 . 2009-11-05 14:09 -------- d-----w- c:\documents and settings\All Users\Application Data\CA 2009-11-05 06:02 . 2009-11-05 17:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-11-04 16:13 . 2009-11-04 16:13 23 --sha-w- c:\windows\system32\edacded0_x.dat 2009-11-04 15:44 . 2009-11-04 15:54 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP 2009-11-04 14:10 . 2009-11-04 14:10 -------- d-----w- c:\documents and settings\vincent\Application Data\SFR 2009-11-04 13:45 . 2009-05-18 13:17 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys 2009-11-04 13:45 . 2008-04-17 12:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll 2009-11-04 01:21 . 2009-11-04 01:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky SDK 2009-11-04 01:14 . 2009-11-04 01:14 4212 ---ha-w- c:\windows\system32\zllictbl.dat 2009-11-04 01:14 . 2009-10-17 00:39 72584 ----a-w- c:\windows\zllsputility.exe 2009-11-04 01:14 . 2009-10-12 17:15 128016 ----a-w- c:\windows\system32\drivers\kl1.sys 2009-11-04 01:13 . 2009-10-17 00:39 69000 ----a-w- c:\windows\system32\zlcomm.dll 2009-11-04 01:13 . 2009-10-17 00:39 103816 ----a-w- c:\windows\system32\zlcommdb.dll 2009-11-04 01:13 . 2009-11-05 16:19 -------- d-----w- c:\windows\system32\ZoneLabs 2009-11-04 01:13 . 2009-10-17 00:39 1238408 ----a-w- c:\windows\system32\zpeng25.dll 2009-11-04 01:12 . 2009-11-05 17:39 -------- d-----w- c:\windows\Internet Logs 2009-11-03 12:13 . 2009-11-03 12:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Electronic Arts 2009-11-03 12:13 . 2009-11-03 12:13 -------- d-----w- C:\ProgramData 2009-11-02 20:08 . 2009-11-02 20:08 -------- d-----w- c:\documents and settings\vincent\Application Data\Auslogics 2009-11-02 18:45 . 2009-11-05 19:20 -------- d-----w- c:\program files rend micro 2009-11-02 18:45 . 2009-11-02 18:45 -------- d-----w- C: sit 2009-11-02 17:14 . 2001-08-23 16:47 5632 ----a-w- c:\windows\system32\ptpusb.dll 2009-11-02 17:14 . 2004-08-03 21:58 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys 2009-11-02 17:14 . 2004-08-19 15:09 159232 ----a-w- c:\windows\system32\ptpusd.dll 2009-11-02 16:54 . 2009-11-05 18:29 -------- d-----w- c:\documents and settings\vincent\Tracing 2009-11-02 16:46 . 2009-11-02 16:46 -------- d-----w- c:\program files\Microsoft 2009-11-02 16:46 . 2009-11-02 16:46 -------- d-----w- c:\program files\Windows Live SkyDrive 2009-11-02 16:45 . 2009-11-02 16:46 -------- d-----w- c:\program files\Windows Live 2009-11-02 14:39 . 2009-11-02 14:39 -------- d-----w- c:\program files\iPod 2009-11-02 14:39 . 2009-11-02 14:39 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD} 2009-11-02 14:39 . 2009-11-02 14:39 -------- d-----w- c:\program files\Bonjour 2009-11-02 14:39 . 2009-11-02 14:39 -------- d-----w- c:\program files\Apple Software Update 2009-11-02 14:39 . 2009-08-28 18:42 40448 ----a-w- c:\windows\system32\drivers\usbaapl.sys 2009-11-02 14:39 . 2009-08-28 18:42 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll 2009-11-02 14:38 . 2009-11-02 15:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple 2009-11-02 14:38 . 2009-11-02 14:39 -------- d-----w- c:\program files\Fichiers communs\Apple 2009-11-02 00:28 . 2009-11-02 00:28 -------- d-----w- c:\documents and settings\vincent\Application Data\Malwarebytes 2009-11-02 00:27 . 2009-09-10 13:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-11-02 00:27 . 2009-11-02 00:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-11-02 00:27 . 2009-09-10 13:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-10-31 14:02 . 2009-11-05 17:38 -------- d-----w- c:\windows\BDOSCAN8 2009-10-31 13:26 . 2009-10-31 13:26 -------- d-----r- c:\documents and settings\NetworkService\Favoris 2009-10-30 15:46 . 2009-10-30 15:46 -------- d-----w- c:\documents and settings\vincent\Local Settings\Application Data\Fallout3 2009-10-30 15:35 . 2008-09-18 19:07 121064 ------r- c:\documents and settings\All Users\Application Data\Fallout3\setup.exe 2009-10-30 15:35 . 2009-10-30 15:35 -------- d-----w- c:\documents and settings\All Users\Application Data\Fallout3 2009-10-29 23:39 . 2009-11-02 19:51 -------- d-----w- c:\documents and settings\vincent\Local Settings\Application Data\VirtuaTennis2009 2009-10-29 23:37 . 2009-03-09 14:27 453456 ----a-w- c:\windows\system32\d3dx10_41.dll 2009-10-29 23:37 . 2009-03-09 14:27 1846632 ----a-w- c:\windows\system32\D3DCompiler_41.dll 2009-10-29 23:37 . 2009-03-16 13:18 69448 ----a-w- c:\windows\system32\XAPOFX1_3.dll 2009-10-29 23:37 . 2009-03-16 13:18 517448 ----a-w- c:\windows\system32\XAudio2_4.dll 2009-10-29 23:37 . 2009-03-16 13:18 235352 ----a-w- c:\windows\system32\xactengine3_4.dll 2009-10-29 23:37 . 2009-03-16 13:18 22360 ----a-w- c:\windows\system32\X3DAudio1_6.dll 2009-10-29 23:37 . 2009-03-09 14:27 4178264 ----a-w- c:\windows\system32\D3DX9_41.dll 2009-10-29 17:18 . 2009-10-29 17:18 -------- d-----w- c:\program files\SystemRequirementsLab 2009-10-28 19:58 . 2009-10-28 19:58 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe 2009-10-27 21:20 . 2009-10-27 21:20 -------- d-----w- c:\program files\Fichiers communs\Windows Live 2009-10-27 21:20 . 2009-10-27 21:20 -------- d-----w- c:\program files\Microsoft Silverlight 2009-10-27 19:58 . 2009-10-27 19:58 -------- d-----w- c:\windows\system32\CatRoot_bak 2009-10-27 15:52 . 2009-10-28 18:39 -------- d-----w- c:\documents and settings\All Users\Application Data\F4 2009-10-27 15:49 . 2009-10-27 15:49 -------- d-----w- c:\documents and settings\vincent\Application Data\F4 2009-10-27 13:41 . 2009-11-04 15:58 -------- d-----w- c:\documents and settings\vincent\Local Settings\Application Data\Unity 2009-10-27 13:40 . 2009-10-27 13:52 -------- d-----w- c:\windows\system32\Adobe 2009-10-27 02:00 . 2009-10-27 02:00 -------- d-----w- c:\windows\system32\KB905474 2009-10-27 02:00 . 2009-03-10 21:26 1438080 ----a-w- c:\windows\system32\KB905474\wganotifypackageinner.exe 2009-10-27 02:00 . 2009-03-10 21:18 454024 ----a-w- c:\windows\system32\KB905474\wgasetup.exe 2009-10-27 01:13 . 2009-08-06 18:23 274288 ----a-w- c:\windows\system32\mucltui.dll 2009-10-27 01:13 . 2009-08-06 18:23 215920 ----a-w- c:\windows\system32\muweb.dll 2009-10-26 20:07 . 2008-11-13 14:17 177664 ------w- c:\windows\system32\dllcache\wintrust.dll 2009-10-26 20:07 . 2008-11-13 14:17 605696 ------w- c:\windows\system32\dllcache\crypt32.dll 2009-10-26 16:51 . 2009-10-26 16:51 -------- d-----w- c:\program files\Microsoft Games for Windows - LIVE 2009-10-26 16:51 . 2009-10-26 16:51 -------- d-----w- c:\windows\system32\xlive 2009-10-26 12:26 . 2009-10-26 12:26 -------- d-----w- c:\documents and settings\vincent\Local Settings\Application Data\Monte Cristo 2009-10-25 22:33 . 2009-10-25 22:33 -------- d-----w- c:\documents and settings\All Users\Application Data\ATI 2009-10-25 22:31 . 2009-09-25 15:35 593920 ------w- c:\windows\system32\ati2sgag.exe 2009-10-25 22:31 . 2009-10-25 22:32 -------- d-----w- c:\program files\ATI Technologies 2009-10-25 21:53 . 2009-10-25 21:54 63488 ----a-w- c:\windows\xobglu16.dll 2009-10-25 21:53 . 2009-10-25 21:54 38466 ----a-w- c:\windows\xobglu32.dll 2009-10-25 21:42 . 1996-10-14 00:24 131917 ----a-w- c:\windows\unstall.exe 2009-10-25 13:19 . 2009-10-25 13:19 -------- d-----w- c:\program files\Fichiers communs\DirectX 2009-10-25 13:15 . 2009-10-25 13:15 -------- d-----w- c:\windows\Logs 2009-10-24 00:46 . 2009-10-24 00:46 -------- d-----w- c:\documents and settings\All Users\Application Data\SimCity Societies 2009-10-23 19:45 . 2006-01-03 04:07 61440 ----a-w- c:\windows\system\cmsnxeye.exe 2009-10-23 19:45 . 2005-12-21 06:41 253952 ----a-w- c:\windows\system32\cmdrvrmu.exe 2009-10-23 19:45 . 2005-03-07 06:29 45056 ----a-w- c:\windows\system32\cmdrvrmu.dll 2009-10-23 19:45 . 2004-02-18 06:19 16384 ----a-w- c:\windows\system32\cmpropu.dll 2009-10-23 19:45 . 2004-02-13 07:39 98304 ----a-w- c:\windows\system32\cmudau.dll 2009-10-23 19:45 . 2002-04-29 07:04 917504 ----a-w- c:\windows\system\cmds3du.dll 2009-10-23 19:45 . 2001-11-23 04:08 712704 ----a-w- c:\windows\system32\a3dpropu.dll 2009-10-23 19:45 . 2009-10-23 19:45 -------- d-----w- c:\program files\Speed Link 2009-10-23 11:12 . 2006-03-24 03:30 1414528 ----a-w- c:\windows\system32\drivers\cmudaxu.sys 2009-10-22 18:41 . 2008-10-15 10:49 53618 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\CONFIG\AVWIN.INIaebb.dll 2009-10-22 17:15 . 2009-10-22 17:15 -------- d-----w- c:\windows\UbiSoft 2009-10-22 16:00 . 2009-10-22 16:00 -------- d-----w- c:\documents and settings\vincent\Application Data\DeepBurner 2009-10-21 18:58 . 2001-08-23 15:47 8704 ----a-w- c:\windows\system32\kbdjpn.dll 2009-10-21 18:58 . 2001-08-23 15:47 8192 ----a-w- c:\windows\system32\kbdkor.dll 2009-10-21 18:58 . 2001-08-17 20:55 6144 ----a-w- c:\windows\system32\kbd106.dll 2009-10-21 18:58 . 2001-08-17 20:55 6144 ----a-w- c:\windows\system32\kbd101c.dll 2009-10-21 18:58 . 2001-08-17 20:55 5632 ----a-w- c:\windows\system32\kbd103.dll 2009-10-21 18:58 . 2001-08-17 20:55 6144 ----a-w- c:\windows\system32\kbd101b.dll 2009-10-21 18:16 . 2009-10-02 22:15 483707 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aescript.dll 2009-10-21 18:16 . 2009-09-15 15:58 106867 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aevdf.dll 2009-10-21 18:16 . 2009-09-03 15:24 127346 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aescn.dll 2009-10-21 18:16 . 2009-10-07 21:27 2011511 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aeheur.dll 2009-10-21 18:16 . 2009-10-02 22:15 479604 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aerdl.dll 2009-10-21 18:16 . 2009-10-02 22:15 393587 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aeemu.dll 2009-10-21 18:16 . 2009-10-02 22:15 364916 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aegen.dll 2009-10-21 18:16 . 2009-09-15 15:58 422261 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aepack.dll 2009-10-21 18:16 . 2009-09-15 15:57 184693 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aecore.dll 2009-10-21 18:16 . 2009-09-03 15:24 237940 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aehelp.dll 2009-10-21 18:16 . 2009-06-17 14:32 196987 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aeoffice.dll 2009-10-21 18:16 . 2008-10-15 10:49 53618 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aebb.dll 2009-10-21 18:06 . 2009-10-21 18:06 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite 2009-10-21 18:06 . 2009-10-21 18:06 -------- d-----w- c:\program files\DAEMON Tools Toolbar 2009-10-21 18:02 . 2009-10-21 18:02 721904 ----a-w- c:\windows\system32\drivers\sptd.sys 2009-10-21 18:02 . 2009-10-21 18:11 -------- d-----w- c:\documents and settings\vincent\Application Data\DAEMON Tools Lite 2009-10-21 14:53 . 2009-10-21 14:53 -------- d-----w- c:\windows\system32\Lang 2009-10-21 13:41 . 2009-10-21 13:41 664 ----a-w- c:\windows\system32\d3d9caps.dat . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2009-11-05 17:26 . 2001-08-28 18:00 93408 ----a-w- c:\windows\system32\perfc00C.dat 2009-11-05 17:26 . 2001-08-28 18:00 532828 ----a-w- c:\windows\system32\perfh00C.dat 2009-11-05 15:00 . 2009-06-11 10:28 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-11-02 16:54 . 2009-06-11 17:35 12912 ----a-w- c:\documents and settings\vincent\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-10-28 19:04 . 2009-11-04 17:40 89600 ----a-w- c:\windows\system32\drivers\clipsrv.exe.vzr 2009-10-22 02:53 . 2009-06-11 14:20 -------- d-----w- c:\program files\Fichiers communs\Adobe 2009-10-21 13:27 . 2009-06-11 00:39 -------- d-----w- c:\program files\Fichiers communs\InstallShield 2009-09-23 22:59 . 2009-09-23 22:59 4481024 ----a-w- c:\windows\system32\drivers\ati2mtag.sys 2009-09-23 22:39 . 2009-09-23 22:39 446464 ----a-w- c:\windows\system32\ATIDEMGX.dll 2009-09-23 22:38 . 2009-09-23 22:38 299520 ----a-w- c:\windows\system32\ati2dvag.dll 2009-09-23 22:21 . 2009-09-23 22:21 204800 ----a-w- c:\windows\system32\atipdlxx.dll 2009-09-23 22:21 . 2009-09-23 22:21 155648 ----a-w- c:\windows\system32\Oemdspif.dll 2009-09-23 22:21 . 2009-09-23 22:21 26112 ----a-w- c:\windows\system32\Ati2mdxx.exe 2009-09-23 22:20 . 2009-09-23 22:20 43520 ----a-w- c:\windows\system32\ati2edxx.dll 2009-09-23 22:20 . 2009-09-23 22:20 155648 ----a-w- c:\windows\system32\ati2evxx.dll 2009-09-23 22:19 . 2009-09-23 22:19 602112 ----a-w- c:\windows\system32\ati2evxx.exe 2009-09-23 22:17 . 2009-09-23 22:17 53248 ----a-w- c:\windows\system32\ATIDDC.DLL 2009-09-23 22:11 . 2009-09-23 22:11 311296 ----a-w- c:\windows\system32\atiiiexx.dll 2009-09-23 22:09 . 2009-09-23 22:09 3506080 ----a-w- c:\windows\system32\ati3duag.dll 2009-09-23 21:58 . 2009-09-23 21:58 12644352 ----a-w- c:\windows\system32\atioglxx.dll 2009-09-23 21:53 . 2009-09-23 21:53 2096384 ----a-w- c:\windows\system32\ativvaxx.dll 2009-09-23 21:53 . 2009-09-23 21:53 887724 ----a-w- c:\windows\system32\ativva6x.dat 2009-09-23 21:53 . 2009-09-23 21:53 3 ----a-w- c:\windows\system32\ativva5x.dat 2009-09-23 21:36 . 2009-09-23 21:36 65024 ----a-w- c:\windows\system32\atimpc32.dll 2009-09-23 21:36 . 2009-09-23 21:36 65024 ----a-w- c:\windows\system32\amdpcom32.dll 2009-09-23 21:32 . 2009-09-23 21:32 561152 ----a-w- c:\windows\system32\atikvmag.dll 2009-09-23 21:31 . 2009-09-23 21:31 45056 ----a-w- c:\windows\system32\aticalrt.dll 2009-09-23 21:31 . 2009-09-23 21:31 45056 ----a-w- c:\windows\system32\aticalcl.dll 2009-09-23 21:30 . 2009-09-23 21:30 167936 ----a-w- c:\windows\system32\atiadlxx.dll 2009-09-23 21:29 . 2009-09-23 21:29 17408 ----a-w- c:\windows\system32\atitvo32.dll 2009-09-23 21:29 . 2009-09-23 21:29 3489792 ----a-w- c:\windows\system32\aticaldd.dll 2009-09-23 21:28 . 2009-09-23 21:28 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll 2009-09-23 21:27 . 2009-09-23 21:27 401408 ----a-w- c:\windows\system32\atiok3x2.dll 2009-09-23 21:23 . 2009-09-23 21:23 638976 ----a-w- c:\windows\system32\ati2cqag.dll 2009-09-16 16:23 . 2009-09-16 16:23 491192 ----a-w- c:\documents and settings\All Users\Application Data\F4\EoS-Launcher.exe 2009-09-11 14:12 . 2004-08-19 20:09 136192 ----a-w- c:\windows\system32\msv1_0.dll 2009-09-04 20:46 . 2004-08-19 20:09 58880 ----a-w- c:\windows\system32\msasn1.dll 2009-09-01 19:55 . 2009-09-01 19:55 195855 ----a-w- c:\windows\system32\atiicdxx.dat 2009-08-29 07:56 . 2007-04-18 14:32 916480 ----a-w- c:\windows\system32\wininet.dll 2009-08-26 13:04 . 2009-06-14 14:04 53248 ----a-w- c:\windows\system32\CSVer.dll 2009-08-26 08:15 . 2007-07-16 14:27 247326 ----a-w- c:\windows\system32\strmdll.dll 2009-08-10 09:01 . 2009-08-10 09:01 21712 ----a-w- c:\documents and settings\All Users\Application Data\F4\IHelper.exe . ------- Sigcheck ------- [-] 2007-07-18 . FA7C7C2B461130A792ADF6A28F1D652B . 506368 . . [5.1.2600.2180] . . c:\windows\system32\winlogon.exe [-] 2004-11-28 18:36 . AB3D62010AF342203FFA60C2D94DBC68 . 8704 . . [1] . . c:\windows\system32\sfcfiles.dll . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-16 39408] "SpybotSD TeaTimer"="d:\spybot - search & destroy\TeaTimer.exe" [2009-03-05 2260480] "SUPERAntiSpyware"="d:\super anti spy ware\SUPERAntiSpyware.exe" [2009-10-12 2000112] "LClock"="lclock.exe" - c:\windows\LClock.exe [2004-12-08 65536] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "Shockwave Updater"="c:\windows\system32\Adobe\Shockwave 11\SwHelper_1151601.exe" [2009-07-31 468408] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "QuickTime Task"="d:\quicktime\qttask.exe" [2009-09-04 417792] "avgnt"="d:\avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153] "RivaTunerStartupDaemon"="d: ivatuner v2.24 msi master overclocking arena 2009 edition\RivaTuner.exe" [2009-08-22 2781184] "Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-10-16 122880] "Adobe Reader Speed Launcher"="d:\adobe reader\Reader\Reader_sl.exe" [2008-10-14 39792] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-09-25 98304] "Malwarebytes Anti-Malware (reboot)"="d:\malwarebytes' anti-malware\mbam.exe" [2009-09-10 1312080] "iTunesHelper"="d:\i tunes\iTunesHelper.exe" [2009-10-28 141600] "ZoneAlarm Client"="d:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-10-17 1037192] "SunJavaUpdateSched"="d: rendmicro scan\bin\jusched.exe" [2005-04-13 36975] "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2008-07-03 16876032] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-19 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "LSD_III"="c:\windows\LSD\end.cmd" [2007-08-07 2336] "tscuninstall"="c:\windows\system32 scupgrd.exe" [2004-08-19 44544] "nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2009-03-08 128512] c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMBalloonTip"= 0 (0x0) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "d:\super anti spy ware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\!SASWinLogon] 2009-09-03 14:21 548352 ----a-w- d:\super anti spy ware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\Network Diagnostic\xpnetdiag.exe"= "%windir%\system32\sessmgr.exe"= "e:\COH\RelicCOH.exe"= "e:\COH\RelicDownloader\RelicDownloader.exe"= "e:\Empire of Sports\NetworkDiagnostic.exe"= "e:\Empire of Sports\EmpireOfSports.exe"= "c:\Program Files\Bonjour\mDNSResponder.exe"= "c:\Program Files\Windows Live\Messenger\wlcsdk.exe"= "c:\Program Files\Windows Live\Messenger\msnmsgr.exe"= "e:\mirrors\Binaries\MirrorsEdge.exe"= R0 mv61xx;mv61xx;c:\windows\system32\drivers\mv61xx.sys [20/03/2009 04:53 154664] R1 SASDIFSV;SASDIFSV;d:\super anti spy ware\sasdifsv.sys [12/10/2009 21:24 9968] R1 SASKUTIL;SASKUTIL;d:\super anti spy ware\SASKUTIL.SYS [12/10/2009 21:24 74480] R2 AntiVirSchedulerService;Avira AntiVir Planificateur;d:\avira\AntiVir Desktop\sched.exe [15/10/2009 22:18 108289] R3 L1e;Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1e51x86.sys [19/10/2009 14:21 39424] R3 SASENUM;SASENUM;d:\super anti spy ware\SASENUM.SYS [12/10/2009 21:24 7408] S3 cmudau32;C-Media USB UDA Sound Interface;c:\windows\system32\drivers\cmudaxu.sys [23/10/2009 12:12 1414528] S3 cpuz130;cpuz130;\??\c:\docume~1\vincent\LOCALS~1\Temp\cpuz130\cpuz_x32.sys --> c:\docume~1\vincent\LOCALS~1\Temp\cpuz130\cpuz_x32.sys [?] S3 EverestDriver;Lavalys EVEREST Kernel Driver;d:\everest ultimate edition\kerneld.wnt [15/10/2009 22:50 27248] S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [23/09/2009 13:50 238960] S3 PciCon;PciCon;\??\g:\pcicon.sys --> g:\PciCon.sys [?] --- Autres Services/Pilotes en mémoire --- *NewlyCreated* - MBR *NewlyCreated* - PROCEXP113 *NewlyCreated* - SASDIFSV *NewlyCreated* - SASENUM *NewlyCreated* - SASKUTIL *Deregistered* - cpuz132 *Deregistered* - mbr *Deregistered* - PROCEXP113 . Contenu du dossier 'Tâches planifiées' 2009-11-02 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] 2009-11-04 c:\windows\Tasks\User_Feed_Synchronization-{1F94FC4D-EFF2-436B-8DD2-2E15FEF24212}.job - c:\windows\system32\msfeedssync.exe [2006-10-17 02:31] 2009-11-02 c:\windows\Tasks\WGASetup.job - c:\windows\system32\KB905474\wgasetup.exe [2009-10-27 21:18] . . ------- Examen supplémentaire ------- . uInternet Settings,ProxyOverride = local uSearchURL,(Default) = hxxp://www.google.fr/keyword/%s IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_A54B7D6FB1DA63EA.dll/cmsidewiki.html DPF: {40F576AD-8680-4F9E-9490-99D069CD665F} - hxxp://srtest-cdn.systemrequirementslab.com.s3.amazonaws.com/bin/sysreqlabdetect.cab DPF: {E6BB2089-163F-466B-812A-748096614DFD} - hxxp://cainternetsecurity.net/scanner/cascanner.cab . - - - - ORPHELINS SUPPRIMES - - - - HKLM-Run-CmUsbSound - cmcnfgu.cpl HKLM-Explorer_Run-ClipSrv - c:\docume~1\vincent\APPLIC~1\MICROS~1\clipsrv.exe HKCU-Explorer_Run-Cisvc - c:\docume~1\vincent\LOCALS~1\APPLIC~1\cisvc.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-11-05 20:49 Windows 5.1.2600 Service Pack 2 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully called modules: NTKRNLMP.EXE catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8AC311F8]<< kernel: MBR read successfully detected MBR rootkit hooks: \Driver\atapi -> 0x8ac311f8 Warning: possible MBR rootkit infection ! user & kernel MBR OK Use "Recovery Console" command "fixmbr" to clear infection ! ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver] "ImagePath"="\??\d:\everest ultimate edition\kerneld.wnt" . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'winlogon.exe'(804) c:\windows\system32\Ati2evxx.dll . Heure de fin: 2009-11-05 20:50 ComboFix-quarantined-files.txt 2009-11-05 19:50 Avant-CF: 12 115 566 592 octets libres Après-CF: 12 149 043 200 octets libres WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect /kernel=ntkrnlmp.exe - - End Of File - - B19FC730017680016EAE6800D7B76BC7

Utilisateur anonyme · Answer

Oui il est bien vérolé .

* Télécharge mbr.exe de Gmer ici : http://www2.gmer.net/mbr/mbr.exe et enregistre le fichier sur le Bureau.
* Merci à Malekal pour le tutoriel
* Désactive tes protections et coupe la connexion. (Antivirus et antispywares, HIPS et autre résident)
* Double clique sur mbr.exe
* Un rapport sera généré : mbr.log
* En cas d'infection, ce message "MBR rootkit code detected" va apparaitre.
* Pour supprimer le rootkit aller dans le menu Démarrer=> Exécuter et tapez la commande : "%userprofile%\Bureau\mbr" -f
* (veuillez à bien respecter les guillemets)
* Dans le mbr.log cette ligne apparaitra "original MBR restored successfully !"
* Réactive tes protections .Poste ce rapport et supprime le ensuite.

o Pour vérifier désactive tes protections et coupe la connexion. (Antivirus et antispywares, HIPS et autre résident)
o Relance mbr.exe
o Réactive tes protections.
o Le nouveau mbr.log devrait être celui-ci :
o Stealth MBR rootkit detector 0.2.4 by Gmer, http://www.gmer.net
o device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK

virus44 · Answer

Rebonsoir nanard

Apparament mbr na rien trouvé,donc je n'ai pas eu a faire la manip:  * Pour supprimer le rootkit aller dans le menu Démarrer=> Exécuter et tapez la commande : "%userprofile%\Bureau\mbr" -f 


Voici le rapport:

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK

Utilisateur anonyme · Answer

/!\ ATTENTION /!\ Le script qui suit a été écrit spécialement pour virus44, il n'est pas transposable sur un autre ordinateur ! 
• Télécharge ce dossier virus44.zip
• Fais un clic-droit dessus --> Extraire tout --> choisis le Bureau comme destination 
• Un autre dossier va apparaitre, prends le fichier CFScript.txt qui se trouve à l'intérieur et place le sur le Bureau et pas ailleurs.
• Désactive tes logiciels de protection 
• Fais un glisser/déposer de ce fichier CFScript.txt sur le fichier Combofix.exe 
comme ceci :http://img155.imageshack.us/img155/4837/cfscriptop0.gif 
• Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal ! Ne touche à rien tant que le scan n'est pas terminé. 
• Une fois le scan achevé, un rapport va s'afficher: poste son contenu. 
• Si le fichier ne s'ouvre pas, il se trouve ici &#8594; C:\ComboFix.txt

virus44 · Answer

Bonjour Nanard En ce qui concerne la manip glisser/déposer ce fichier CFScript.txt sur le fichier Combofix.exe,j'ai fais un copier coller j'éspère qu'il s'agit de la bonne manip..? Voici le rapport: ComboFix 09-11-05.01 - vincent 06/11/2009 14:02.2.4 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.3327.2607 [GMT 1:00] Lancé depuis: c:\documents and settings\vincent\Mes documents\ComboFix.exe Commutateurs utilisés :: c:\documents and settings\vincent\Bureau\CFScript.txt AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7} AV: ZoneAlarm Security Suite Antivirus *On-access scanning disabled* (Updated) {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF} FW: COMODO Firewall Pro *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B} FW: ZoneAlarm Security Suite Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B} FILE :: "c:\program files\DAEMON Tools Toolbar" "c:\windows\system32\edacded0_x.dat" . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\edacded0_x.dat . ((((((((((((((((((((((((((((( Fichiers créés du 2009-10-06 au 2009-11-06 )))))))))))))))))))))))))))))))))))) . 2009-11-06 01:42 . 2009-11-06 01:42 -------- d-----w- c:\documents and settings\vincent\Local Settings\Application Data\F4 2009-11-05 19:38 . 2009-11-05 23:36 117760 ----a-w- c:\documents and settings\vincent\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL 2009-11-05 19:37 . 2009-11-05 19:37 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com 2009-11-05 19:37 . 2009-11-05 19:37 -------- d-----w- c:\documents and settings\vincent\Application Data\SUPERAntiSpyware.com 2009-11-05 19:37 . 2009-11-05 19:37 -------- d-----w- c:\program files\Fichiers communs\Wise Installation Wizard 2009-11-05 16:11 . 2009-11-05 14:23 102664 ----a-w- c:\windows\system32\drivers mcomm.sys 2009-11-05 14:23 . 2009-11-05 16:11 -------- d-----w- c:\documents and settings\vincent\.housecall6.6 2009-11-05 14:18 . 2009-11-05 14:18 -------- d-----w- c:\windows\Sun 2009-11-05 14:17 . 2009-11-05 14:17 -------- d-----w- c:\program files\Fichiers communs\Java 2009-11-05 14:09 . 2009-11-05 14:09 -------- d-----w- c:\documents and settings\All Users\Application Data\CA 2009-11-05 06:02 . 2009-11-05 17:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-11-04 15:44 . 2009-11-04 15:54 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP 2009-11-04 14:10 . 2009-11-04 14:10 -------- d-----w- c:\documents and settings\vincent\Application Data\SFR 2009-11-04 13:45 . 2009-05-18 13:17 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys 2009-11-04 13:45 . 2008-04-17 12:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll 2009-11-04 01:21 . 2009-11-04 01:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky SDK 2009-11-04 01:14 . 2009-11-04 01:14 4212 ---ha-w- c:\windows\system32\zllictbl.dat 2009-11-04 01:14 . 2009-10-17 00:39 72584 ----a-w- c:\windows\zllsputility.exe 2009-11-04 01:14 . 2009-10-12 17:15 128016 ----a-w- c:\windows\system32\drivers\kl1.sys 2009-11-04 01:13 . 2009-10-17 00:39 69000 ----a-w- c:\windows\system32\zlcomm.dll 2009-11-04 01:13 . 2009-10-17 00:39 103816 ----a-w- c:\windows\system32\zlcommdb.dll 2009-11-04 01:13 . 2009-11-05 16:19 -------- d-----w- c:\windows\system32\ZoneLabs 2009-11-04 01:13 . 2009-10-17 00:39 1238408 ----a-w- c:\windows\system32\zpeng25.dll 2009-11-04 01:12 . 2009-11-05 23:39 -------- d-----w- c:\windows\Internet Logs 2009-11-03 12:13 . 2009-11-03 12:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Electronic Arts 2009-11-03 12:13 . 2009-11-03 12:13 -------- d-----w- C:\ProgramData 2009-11-02 20:08 . 2009-11-02 20:08 -------- d-----w- c:\documents and settings\vincent\Application Data\Auslogics 2009-11-02 18:45 . 2009-11-05 19:20 -------- d-----w- c:\program files rend micro 2009-11-02 18:45 . 2009-11-02 18:45 -------- d-----w- C: sit 2009-11-02 17:14 . 2001-08-23 16:47 5632 ----a-w- c:\windows\system32\ptpusb.dll 2009-11-02 17:14 . 2004-08-03 21:58 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys 2009-11-02 17:14 . 2004-08-19 15:09 159232 ----a-w- c:\windows\system32\ptpusd.dll 2009-11-02 16:54 . 2009-11-06 01:33 -------- d-----w- c:\documents and settings\vincent\Tracing 2009-11-02 16:46 . 2009-11-02 16:46 -------- d-----w- c:\program files\Microsoft 2009-11-02 16:46 . 2009-11-02 16:46 -------- d-----w- c:\program files\Windows Live SkyDrive 2009-11-02 16:45 . 2009-11-02 16:46 -------- d-----w- c:\program files\Windows Live 2009-11-02 14:39 . 2009-11-02 14:39 -------- d-----w- c:\program files\iPod 2009-11-02 14:39 . 2009-11-02 14:39 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD} 2009-11-02 14:39 . 2009-11-02 14:39 -------- d-----w- c:\program files\Bonjour 2009-11-02 14:39 . 2009-11-02 14:39 -------- d-----w- c:\program files\Apple Software Update 2009-11-02 14:39 . 2009-08-28 18:42 40448 ----a-w- c:\windows\system32\drivers\usbaapl.sys 2009-11-02 14:39 . 2009-08-28 18:42 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll 2009-11-02 14:38 . 2009-11-02 15:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple 2009-11-02 14:38 . 2009-11-02 14:39 -------- d-----w- c:\program files\Fichiers communs\Apple 2009-11-02 00:28 . 2009-11-02 00:28 -------- d-----w- c:\documents and settings\vincent\Application Data\Malwarebytes 2009-11-02 00:27 . 2009-09-10 13:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-11-02 00:27 . 2009-11-02 00:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-11-02 00:27 . 2009-09-10 13:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-10-31 14:02 . 2009-11-05 17:38 -------- d-----w- c:\windows\BDOSCAN8 2009-10-31 13:26 . 2009-10-31 13:26 -------- d-----r- c:\documents and settings\NetworkService\Favoris 2009-10-30 15:46 . 2009-10-30 15:46 -------- d-----w- c:\documents and settings\vincent\Local Settings\Application Data\Fallout3 2009-10-30 15:35 . 2008-09-18 19:07 121064 ------r- c:\documents and settings\All Users\Application Data\Fallout3\setup.exe 2009-10-30 15:35 . 2009-10-30 15:35 -------- d-----w- c:\documents and settings\All Users\Application Data\Fallout3 2009-10-29 23:39 . 2009-11-02 19:51 -------- d-----w- c:\documents and settings\vincent\Local Settings\Application Data\VirtuaTennis2009 2009-10-29 23:37 . 2009-03-09 14:27 453456 ----a-w- c:\windows\system32\d3dx10_41.dll 2009-10-29 23:37 . 2009-03-09 14:27 1846632 ----a-w- c:\windows\system32\D3DCompiler_41.dll 2009-10-29 23:37 . 2009-03-16 13:18 69448 ----a-w- c:\windows\system32\XAPOFX1_3.dll 2009-10-29 23:37 . 2009-03-16 13:18 517448 ----a-w- c:\windows\system32\XAudio2_4.dll 2009-10-29 23:37 . 2009-03-16 13:18 235352 ----a-w- c:\windows\system32\xactengine3_4.dll 2009-10-29 23:37 . 2009-03-16 13:18 22360 ----a-w- c:\windows\system32\X3DAudio1_6.dll 2009-10-29 23:37 . 2009-03-09 14:27 4178264 ----a-w- c:\windows\system32\D3DX9_41.dll 2009-10-29 17:18 . 2009-10-29 17:18 -------- d-----w- c:\program files\SystemRequirementsLab 2009-10-28 19:58 . 2009-10-28 19:58 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe 2009-10-27 21:20 . 2009-10-27 21:20 -------- d-----w- c:\program files\Fichiers communs\Windows Live 2009-10-27 21:20 . 2009-10-27 21:20 -------- d-----w- c:\program files\Microsoft Silverlight 2009-10-27 19:58 . 2009-10-27 19:58 -------- d-----w- c:\windows\system32\CatRoot_bak 2009-10-27 15:52 . 2009-10-28 18:39 -------- d-----w- c:\documents and settings\All Users\Application Data\F4 2009-10-27 15:49 . 2009-10-27 15:49 -------- d-----w- c:\documents and settings\vincent\Application Data\F4 2009-10-27 13:41 . 2009-11-04 15:58 -------- d-----w- c:\documents and settings\vincent\Local Settings\Application Data\Unity 2009-10-27 13:40 . 2009-10-27 13:52 -------- d-----w- c:\windows\system32\Adobe 2009-10-27 02:00 . 2009-10-27 02:00 -------- d-----w- c:\windows\system32\KB905474 2009-10-27 02:00 . 2009-03-10 21:26 1438080 ----a-w- c:\windows\system32\KB905474\wganotifypackageinner.exe 2009-10-27 02:00 . 2009-03-10 21:18 454024 ----a-w- c:\windows\system32\KB905474\wgasetup.exe 2009-10-27 01:13 . 2009-08-06 18:23 274288 ----a-w- c:\windows\system32\mucltui.dll 2009-10-27 01:13 . 2009-08-06 18:23 215920 ----a-w- c:\windows\system32\muweb.dll 2009-10-26 20:07 . 2008-11-13 14:17 177664 ------w- c:\windows\system32\dllcache\wintrust.dll 2009-10-26 20:07 . 2008-11-13 14:17 605696 ------w- c:\windows\system32\dllcache\crypt32.dll 2009-10-26 16:51 . 2009-10-26 16:51 -------- d-----w- c:\program files\Microsoft Games for Windows - LIVE 2009-10-26 16:51 . 2009-10-26 16:51 -------- d-----w- c:\windows\system32\xlive 2009-10-26 12:26 . 2009-10-26 12:26 -------- d-----w- c:\documents and settings\vincent\Local Settings\Application Data\Monte Cristo 2009-10-25 22:33 . 2009-10-25 22:33 -------- d-----w- c:\documents and settings\All Users\Application Data\ATI 2009-10-25 22:31 . 2009-09-25 15:35 593920 ------w- c:\windows\system32\ati2sgag.exe 2009-10-25 22:31 . 2009-10-25 22:32 -------- d-----w- c:\program files\ATI Technologies 2009-10-25 21:53 . 2009-10-25 21:54 63488 ----a-w- c:\windows\xobglu16.dll 2009-10-25 21:53 . 2009-10-25 21:54 38466 ----a-w- c:\windows\xobglu32.dll 2009-10-25 21:42 . 1996-10-14 00:24 131917 ----a-w- c:\windows\unstall.exe 2009-10-25 13:19 . 2009-10-25 13:19 -------- d-----w- c:\program files\Fichiers communs\DirectX 2009-10-25 13:15 . 2009-10-25 13:15 -------- d-----w- c:\windows\Logs 2009-10-24 00:46 . 2009-10-24 00:46 -------- d-----w- c:\documents and settings\All Users\Application Data\SimCity Societies 2009-10-23 19:45 . 2006-01-03 04:07 61440 ----a-w- c:\windows\system\cmsnxeye.exe 2009-10-23 19:45 . 2005-12-21 06:41 253952 ----a-w- c:\windows\system32\cmdrvrmu.exe 2009-10-23 19:45 . 2005-03-07 06:29 45056 ----a-w- c:\windows\system32\cmdrvrmu.dll 2009-10-23 19:45 . 2004-02-18 06:19 16384 ----a-w- c:\windows\system32\cmpropu.dll 2009-10-23 19:45 . 2004-02-13 07:39 98304 ----a-w- c:\windows\system32\cmudau.dll 2009-10-23 19:45 . 2002-04-29 07:04 917504 ----a-w- c:\windows\system\cmds3du.dll 2009-10-23 19:45 . 2001-11-23 04:08 712704 ----a-w- c:\windows\system32\a3dpropu.dll 2009-10-23 19:45 . 2009-10-23 19:45 -------- d-----w- c:\program files\Speed Link 2009-10-23 11:12 . 2006-03-24 03:30 1414528 ----a-w- c:\windows\system32\drivers\cmudaxu.sys 2009-10-22 18:41 . 2008-10-15 10:49 53618 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\CONFIG\AVWIN.INIaebb.dll 2009-10-22 17:15 . 2009-10-22 17:15 -------- d-----w- c:\windows\UbiSoft 2009-10-22 16:00 . 2009-10-22 16:00 -------- d-----w- c:\documents and settings\vincent\Application Data\DeepBurner 2009-10-21 18:58 . 2001-08-23 15:47 8704 ----a-w- c:\windows\system32\kbdjpn.dll 2009-10-21 18:58 . 2001-08-23 15:47 8192 ----a-w- c:\windows\system32\kbdkor.dll 2009-10-21 18:58 . 2001-08-17 20:55 6144 ----a-w- c:\windows\system32\kbd106.dll 2009-10-21 18:58 . 2001-08-17 20:55 6144 ----a-w- c:\windows\system32\kbd101c.dll 2009-10-21 18:58 . 2001-08-17 20:55 5632 ----a-w- c:\windows\system32\kbd103.dll 2009-10-21 18:58 . 2001-08-17 20:55 6144 ----a-w- c:\windows\system32\kbd101b.dll 2009-10-21 18:16 . 2009-10-02 22:15 483707 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aescript.dll 2009-10-21 18:16 . 2009-09-15 15:58 106867 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aevdf.dll 2009-10-21 18:16 . 2009-09-03 15:24 127346 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aescn.dll 2009-10-21 18:16 . 2009-10-07 21:27 2011511 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aeheur.dll 2009-10-21 18:16 . 2009-10-02 22:15 479604 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aerdl.dll 2009-10-21 18:16 . 2009-10-02 22:15 393587 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aeemu.dll 2009-10-21 18:16 . 2009-10-02 22:15 364916 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aegen.dll 2009-10-21 18:16 . 2009-09-15 15:58 422261 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aepack.dll 2009-10-21 18:16 . 2009-09-15 15:57 184693 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aecore.dll 2009-10-21 18:16 . 2009-09-03 15:24 237940 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aehelp.dll 2009-10-21 18:16 . 2009-06-17 14:32 196987 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aeoffice.dll 2009-10-21 18:16 . 2008-10-15 10:49 53618 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aebb.dll 2009-10-21 18:06 . 2009-10-21 18:06 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite 2009-10-21 18:06 . 2009-10-21 18:06 -------- d-----w- c:\program files\DAEMON Tools Toolbar 2009-10-21 18:02 . 2009-10-21 18:02 721904 ----a-w- c:\windows\system32\drivers\sptd.sys 2009-10-21 18:02 . 2009-10-21 18:11 -------- d-----w- c:\documents and settings\vincent\Application Data\DAEMON Tools Lite 2009-10-21 14:53 . 2009-10-21 14:53 -------- d-----w- c:\windows\system32\Lang 2009-10-21 13:41 . 2009-10-21 13:41 664 ----a-w- c:\windows\system32\d3d9caps.dat . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2009-11-05 17:26 . 2001-08-28 18:00 93408 ----a-w- c:\windows\system32\perfc00C.dat 2009-11-05 17:26 . 2001-08-28 18:00 532828 ----a-w- c:\windows\system32\perfh00C.dat 2009-11-05 15:00 . 2009-06-11 10:28 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-11-02 16:54 . 2009-06-11 17:35 12912 ----a-w- c:\documents and settings\vincent\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-10-28 19:04 . 2009-11-04 17:40 89600 ----a-w- c:\windows\system32\drivers\clipsrv.exe.vzr 2009-10-22 02:53 . 2009-06-11 14:20 -------- d-----w- c:\program files\Fichiers communs\Adobe 2009-10-21 13:27 . 2009-06-11 00:39 -------- d-----w- c:\program files\Fichiers communs\InstallShield 2009-09-23 22:59 . 2009-09-23 22:59 4481024 ----a-w- c:\windows\system32\drivers\ati2mtag.sys 2009-09-23 22:39 . 2009-09-23 22:39 446464 ----a-w- c:\windows\system32\ATIDEMGX.dll 2009-09-23 22:38 . 2009-09-23 22:38 299520 ----a-w- c:\windows\system32\ati2dvag.dll 2009-09-23 22:21 . 2009-09-23 22:21 204800 ----a-w- c:\windows\system32\atipdlxx.dll 2009-09-23 22:21 . 2009-09-23 22:21 155648 ----a-w- c:\windows\system32\Oemdspif.dll 2009-09-23 22:21 . 2009-09-23 22:21 26112 ----a-w- c:\windows\system32\Ati2mdxx.exe 2009-09-23 22:20 . 2009-09-23 22:20 43520 ----a-w- c:\windows\system32\ati2edxx.dll 2009-09-23 22:20 . 2009-09-23 22:20 155648 ----a-w- c:\windows\system32\ati2evxx.dll 2009-09-23 22:19 . 2009-09-23 22:19 602112 ----a-w- c:\windows\system32\ati2evxx.exe 2009-09-23 22:17 . 2009-09-23 22:17 53248 ----a-w- c:\windows\system32\ATIDDC.DLL 2009-09-23 22:11 . 2009-09-23 22:11 311296 ----a-w- c:\windows\system32\atiiiexx.dll 2009-09-23 22:09 . 2009-09-23 22:09 3506080 ----a-w- c:\windows\system32\ati3duag.dll 2009-09-23 21:58 . 2009-09-23 21:58 12644352 ----a-w- c:\windows\system32\atioglxx.dll 2009-09-23 21:53 . 2009-09-23 21:53 2096384 ----a-w- c:\windows\system32\ativvaxx.dll 2009-09-23 21:53 . 2009-09-23 21:53 887724 ----a-w- c:\windows\system32\ativva6x.dat 2009-09-23 21:53 . 2009-09-23 21:53 3 ----a-w- c:\windows\system32\ativva5x.dat 2009-09-23 21:36 . 2009-09-23 21:36 65024 ----a-w- c:\windows\system32\atimpc32.dll 2009-09-23 21:36 . 2009-09-23 21:36 65024 ----a-w- c:\windows\system32\amdpcom32.dll 2009-09-23 21:32 . 2009-09-23 21:32 561152 ----a-w- c:\windows\system32\atikvmag.dll 2009-09-23 21:31 . 2009-09-23 21:31 45056 ----a-w- c:\windows\system32\aticalrt.dll 2009-09-23 21:31 . 2009-09-23 21:31 45056 ----a-w- c:\windows\system32\aticalcl.dll 2009-09-23 21:30 . 2009-09-23 21:30 167936 ----a-w- c:\windows\system32\atiadlxx.dll 2009-09-23 21:29 . 2009-09-23 21:29 17408 ----a-w- c:\windows\system32\atitvo32.dll 2009-09-23 21:29 . 2009-09-23 21:29 3489792 ----a-w- c:\windows\system32\aticaldd.dll 2009-09-23 21:28 . 2009-09-23 21:28 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll 2009-09-23 21:27 . 2009-09-23 21:27 401408 ----a-w- c:\windows\system32\atiok3x2.dll 2009-09-23 21:23 . 2009-09-23 21:23 638976 ----a-w- c:\windows\system32\ati2cqag.dll 2009-09-16 16:23 . 2009-09-16 16:23 491192 ----a-w- c:\documents and settings\All Users\Application Data\F4\EoS-Launcher.exe 2009-09-11 14:12 . 2004-08-19 20:09 136192 ----a-w- c:\windows\system32\msv1_0.dll 2009-09-04 20:46 . 2004-08-19 20:09 58880 ----a-w- c:\windows\system32\msasn1.dll 2009-09-01 19:55 . 2009-09-01 19:55 195855 ----a-w- c:\windows\system32\atiicdxx.dat 2009-08-29 07:56 . 2007-04-18 14:32 916480 ------w- c:\windows\system32\wininet.dll 2009-08-26 13:04 . 2009-06-14 14:04 53248 ----a-w- c:\windows\system32\CSVer.dll 2009-08-26 08:15 . 2007-07-16 14:27 247326 ----a-w- c:\windows\system32\strmdll.dll 2009-08-10 09:01 . 2009-08-10 09:01 21712 ----a-w- c:\documents and settings\All Users\Application Data\F4\IHelper.exe . ------- Sigcheck ------- [-] 2007-07-18 . FA7C7C2B461130A792ADF6A28F1D652B . 506368 . . [5.1.2600.2180] . . c:\windows\system32\winlogon.exe [-] 2004-11-28 18:36 . AB3D62010AF342203FFA60C2D94DBC68 . 8704 . . [1] . . c:\windows\system32\sfcfiles.dll . ((((((((((((((((((((((((((((( SnapShot@2009-11-05_19.49.37 ))))))))))))))))))))))))))))))))))))))))) . + 2009-11-05 23:25 . 2009-11-05 23:25 37558 c:\windows\system32\ZoneLabs\avsys emp\update ollback\bases\wmuf\wmuf0008.dat + 2009-11-05 23:25 . 2009-11-05 23:25 51228 c:\windows\system32\ZoneLabs\avsys emp\update ollback\bases\blst\bl0014.dat + 2009-11-05 23:25 . 2009-11-05 23:25 55015 c:\windows\system32\ZoneLabs\avsys emp\update ollback\bases\apu\apu0002.dat + 2009-11-04 01:25 . 2009-11-05 23:25 37714 c:\windows\system32\ZoneLabs\avsys emp emporaryFolder\bases\wmuf\wmuf0008.dat + 2009-11-04 01:22 . 2009-11-05 23:24 51225 c:\windows\system32\ZoneLabs\avsys emp emporaryFolder\bases\blst\bl0014.dat + 2009-11-04 01:22 . 2009-11-05 23:24 55360 c:\windows\system32\ZoneLabs\avsys emp emporaryFolder\bases\apu\apu0002.dat + 2009-11-04 01:25 . 2009-11-05 23:25 37714 c:\windows\system32\ZoneLabs\avsys\bases\wmuf0008.dat + 2009-11-04 01:25 . 2009-11-05 23:25 51225 c:\windows\system32\ZoneLabs\avsys\bases\bl0014.dat + 2009-11-04 01:13 . 2009-11-05 23:25 55360 c:\windows\system32\ZoneLabs\avsys\bases\apu0002.dat + 2009-11-05 23:25 . 2009-11-05 23:25 5505 c:\windows\system32\ZoneLabs\avsys emp\update ollback\bases\wmuf\wmuf0000.dat + 2009-11-05 23:25 . 2009-11-05 23:25 8624 c:\windows\system32\ZoneLabs\avsys emp\update ollback\bases\apu\apu0003.dat + 2009-11-04 01:25 . 2009-11-05 23:25 5513 c:\windows\system32\ZoneLabs\avsys emp emporaryFolder\bases\wmuf\wmuf0000.dat + 2009-11-04 01:22 . 2009-11-05 23:25 8020 c:\windows\system32\ZoneLabs\avsys emp emporaryFolder\bases\apu\apu0003.dat + 2009-11-04 01:13 . 2009-11-05 23:25 5513 c:\windows\system32\ZoneLabs\avsys\bases\wmuf0000.dat + 2009-11-04 01:13 . 2009-11-05 23:25 8020 c:\windows\system32\ZoneLabs\avsys\bases\apu0003.dat + 2009-10-22 02:53 . 2009-11-06 02:12 295606 c:\windows\Installer\{AC76BA86-7AD7-1036-7B44-A81300000003}\SC_Reader.exe - 2009-10-22 02:53 . 2009-10-30 16:13 295606 c:\windows\Installer\{AC76BA86-7AD7-1036-7B44-A81300000003}\SC_Reader.exe + 2009-11-06 02:12 . 2009-11-06 02:12 1711616 c:\windows\Installer\1e65cad.msp . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-16 39408] "SpybotSD TeaTimer"="d:\spybot - search & destroy\TeaTimer.exe" [2009-03-05 2260480] "SUPERAntiSpyware"="d:\super anti spy ware\SUPERAntiSpyware.exe" [2009-10-12 2000112] "LClock"="lclock.exe" - c:\windows\LClock.exe [2004-12-08 65536] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "Shockwave Updater"="c:\windows\system32\Adobe\Shockwave 11\SwHelper_1151601.exe" [2009-07-31 468408] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "QuickTime Task"="d:\quicktime\qttask.exe" [2009-09-04 417792] "avgnt"="d:\avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153] "RivaTunerStartupDaemon"="d: ivatuner v2.24 msi master overclocking arena 2009 edition\RivaTuner.exe" [2009-08-22 2781184] "Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-10-16 122880] "Adobe Reader Speed Launcher"="d:\adobe reader\Reader\Reader_sl.exe" [2008-10-14 39792] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-09-25 98304] "Malwarebytes Anti-Malware (reboot)"="d:\malwarebytes' anti-malware\mbam.exe" [2009-09-10 1312080] "iTunesHelper"="d:\i tunes\iTunesHelper.exe" [2009-10-28 141600] "ZoneAlarm Client"="d:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-10-17 1037192] "SunJavaUpdateSched"="d: rendmicro scan\bin\jusched.exe" [2005-04-13 36975] "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2008-07-03 16876032] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-19 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "LSD_III"="c:\windows\LSD\end.cmd" [2007-08-07 2336] "tscuninstall"="c:\windows\system32 scupgrd.exe" [2004-08-19 44544] "nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2009-03-08 128512] c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMBalloonTip"= 0 (0x0) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "d:\super anti spy ware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\!SASWinLogon] 2009-09-03 14:21 548352 ----a-w- d:\super anti spy ware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\Network Diagnostic\xpnetdiag.exe"= "%windir%\system32\sessmgr.exe"= "e:\COH\RelicCOH.exe"= "e:\COH\RelicDownloader\RelicDownloader.exe"= "e:\Empire of Sports\NetworkDiagnostic.exe"= "e:\Empire of Sports\EmpireOfSports.exe"= "c:\Program Files\Bonjour\mDNSResponder.exe"= "c:\Program Files\Windows Live\Messenger\wlcsdk.exe"= "c:\Program Files\Windows Live\Messenger\msnmsgr.exe"= "e:\mirrors\Binaries\MirrorsEdge.exe"= "c:\Documents and Settings\vincent\Local Settings\Application Data\F4\ClientUpdater\ClientUpdater.exe"= R0 mv61xx;mv61xx;c:\windows\system32\drivers\mv61xx.sys [20/03/2009 04:53 154664] R1 SASDIFSV;SASDIFSV;d:\super anti spy ware\sasdifsv.sys [12/10/2009 21:24 9968] R1 SASKUTIL;SASKUTIL;d:\super anti spy ware\SASKUTIL.SYS [12/10/2009 21:24 74480] R2 AntiVirSchedulerService;Avira AntiVir Planificateur;d:\avira\AntiVir Desktop\sched.exe [15/10/2009 22:18 108289] R3 L1e;Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1e51x86.sys [19/10/2009 14:21 39424] R3 SASENUM;SASENUM;d:\super anti spy ware\SASENUM.SYS [12/10/2009 21:24 7408] S3 cmudau32;C-Media USB UDA Sound Interface;c:\windows\system32\drivers\cmudaxu.sys [23/10/2009 12:12 1414528] S3 cpuz130;cpuz130;\??\c:\docume~1\vincent\LOCALS~1\Temp\cpuz130\cpuz_x32.sys --> c:\docume~1\vincent\LOCALS~1\Temp\cpuz130\cpuz_x32.sys [?] S3 EverestDriver;Lavalys EVEREST Kernel Driver;d:\everest ultimate edition\kerneld.wnt [15/10/2009 22:50 27248] S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [23/09/2009 13:50 238960] S3 PciCon;PciCon;\??\g:\pcicon.sys --> g:\PciCon.sys [?] --- Autres Services/Pilotes en mémoire --- *NewlyCreated* - MBR *NewlyCreated* - PROCEXP113 *NewlyCreated* - SASDIFSV *NewlyCreated* - SASENUM *NewlyCreated* - SASKUTIL *Deregistered* - cpuz132 *Deregistered* - mbr *Deregistered* - PROCEXP113 . Contenu du dossier 'Tâches planifiées' 2009-11-02 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] 2009-11-06 c:\windows\Tasks\User_Feed_Synchronization-{1F94FC4D-EFF2-436B-8DD2-2E15FEF24212}.job - c:\windows\system32\msfeedssync.exe [2006-10-17 02:31] 2009-11-02 c:\windows\Tasks\WGASetup.job - c:\windows\system32\KB905474\wgasetup.exe [2009-10-27 21:18] . . ------- Examen supplémentaire ------- . uInternet Settings,ProxyOverride = local uSearchURL,(Default) = hxxp://www.google.fr/keyword/%s IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_A54B7D6FB1DA63EA.dll/cmsidewiki.html DPF: {40F576AD-8680-4F9E-9490-99D069CD665F} - hxxp://srtest-cdn.systemrequirementslab.com.s3.amazonaws.com/bin/sysreqlabdetect.cab DPF: {E6BB2089-163F-466B-812A-748096614DFD} - hxxp://cainternetsecurity.net/scanner/cascanner.cab . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-11-06 14:05 Windows 5.1.2600 Service Pack 2 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully called modules: NTKRNLMP.EXE catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8AC311F8]<< kernel: MBR read successfully detected MBR rootkit hooks: \Driver\atapi -> 0x8ac311f8 Warning: possible MBR rootkit infection ! user & kernel MBR OK Use "Recovery Console" command "fixmbr" to clear infection ! ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver] "ImagePath"="\??\d:\everest ultimate edition\kerneld.wnt" . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'winlogon.exe'(804) c:\windows\system32\Ati2evxx.dll . Heure de fin: 2009-11-06 14:06 ComboFix-quarantined-files.txt 2009-11-06 13:06 ComboFix2.txt 2009-11-05 19:50 Avant-CF: 11 932 897 280 octets libres Après-CF: 12 124 667 904 octets libres - - End Of File - - 664F412CD48EE8F85F56CD76DE5064CB

virus44 · Answer

J'ai l'impression de ne plus etre vérolé,j'ai passer un scan avec malwarebyte et superantispyware et ils ne trouve rien.
Peut ont faire confiance a ces logiciels?

Je passe actuellement un scan avec a-squared anti-Malware,je te tiens au courant...

virus44 · Answer

Bon apres trois scan (Malwarebytes,a-squared,Avira) plus aucune trace de trojan ou autres misères..

Je pense ne plus etre vérolé,en esperant qu'il ne sont pas "endormie" et quils ne réaparaissent pas plus tard..

Qu'en penses tu Nanard?

Utilisateur anonyme · Answer

fait ce qui suit.

/!\ ATTENTION /!\ Le script qui suit a été écrit spécialement pour virus44, il n'est pas transposable sur un autre ordinateur ! 
• Télécharge ce dossier virus44
• Fais un clic-droit dessus --> Extraire tout --> choisis le Bureau comme destination 
• Un autre dossier va apparaitre, prends le fichier CFScript.txt qui se trouve à l'intérieur et place le sur le Bureau et pas ailleurs.
• Désactive tes logiciels de protection 
• Fais un glisser/déposer de ce fichier CFScript.txt sur le fichier Combofix.exe 
comme ceci :http://img155.imageshack.us/img155/4837/cfscriptop0.gif 
• Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal ! Ne touche à rien tant que le scan n'est pas terminé. 
• Une fois le scan achevé, un rapport va s'afficher: poste son contenu. 
• Si le fichier ne s'ouvre pas, il se trouve ici &#8594; C:\ComboFix.txt 
*********************************************************************
Tu peux me poster les rapports malawaresbytes et a squared

virus44 · Answer

Voici les rapports Combofix,Malwarebytes et a squared (sa prend de la place..) stp peut tu me dire si mon pc est toujours vérolé et si c'est le cas quelle fichiers sont atteints.Merci ComboFix 09-11-05.01 - vincent 07/11/2009 3:28.4.4 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.3327.2708 [GMT 1:00] Lancé depuis: c:\documents and settings\vincent\Mes documents\ComboFix.exe Commutateurs utilisés :: c:\documents and settings\vincent\Bureau\CFScript.txt AV: a-squared Anti-Malware *On-access scanning enabled* (Updated) {0F8591BB-342B-4493-91C3-4E948ED21255} AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7} AV: ZoneAlarm Security Suite Antivirus *On-access scanning disabled* (Updated) {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF} FW: COMODO Firewall Pro *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B} FW: ZoneAlarm Security Suite Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B} * Un nouveau point de restauration a été créé . ((((((((((((((((((((((((((((( Fichiers créés du 2009-10-07 au 2009-11-07 )))))))))))))))))))))))))))))))))))) . 2009-11-06 01:42 . 2009-11-06 01:42 -------- d-----w- c:\documents and settings\vincent\Local Settings\Application Data\F4 2009-11-05 19:38 . 2009-11-06 16:04 117760 ----a-w- c:\documents and settings\vincent\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL 2009-11-05 19:37 . 2009-11-05 19:37 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com 2009-11-05 19:37 . 2009-11-05 19:37 -------- d-----w- c:\documents and settings\vincent\Application Data\SUPERAntiSpyware.com 2009-11-05 19:37 . 2009-11-05 19:37 -------- d-----w- c:\program files\Fichiers communs\Wise Installation Wizard 2009-11-05 16:11 . 2009-11-05 14:23 102664 ----a-w- c:\windows\system32\drivers mcomm.sys 2009-11-05 14:23 . 2009-11-05 16:11 -------- d-----w- c:\documents and settings\vincent\.housecall6.6 2009-11-05 14:18 . 2009-11-05 14:18 -------- d-----w- c:\windows\Sun 2009-11-05 14:17 . 2009-11-05 14:17 -------- d-----w- c:\program files\Fichiers communs\Java 2009-11-05 14:09 . 2009-11-05 14:09 -------- d-----w- c:\documents and settings\All Users\Application Data\CA 2009-11-05 06:02 . 2009-11-05 17:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-11-04 15:44 . 2009-11-04 15:54 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP 2009-11-04 14:10 . 2009-11-04 14:10 -------- d-----w- c:\documents and settings\vincent\Application Data\SFR 2009-11-04 13:45 . 2009-05-18 13:17 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys 2009-11-04 13:45 . 2008-04-17 12:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll 2009-11-04 01:21 . 2009-11-04 01:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky SDK 2009-11-04 01:14 . 2009-11-04 01:14 4212 ---ha-w- c:\windows\system32\zllictbl.dat 2009-11-04 01:14 . 2009-10-17 00:39 72584 ----a-w- c:\windows\zllsputility.exe 2009-11-04 01:14 . 2009-10-12 17:15 128016 ----a-w- c:\windows\system32\drivers\kl1.sys 2009-11-04 01:13 . 2009-10-17 00:39 69000 ----a-w- c:\windows\system32\zlcomm.dll 2009-11-04 01:13 . 2009-10-17 00:39 103816 ----a-w- c:\windows\system32\zlcommdb.dll 2009-11-04 01:13 . 2009-11-05 16:19 -------- d-----w- c:\windows\system32\ZoneLabs 2009-11-04 01:13 . 2009-10-17 00:39 1238408 ----a-w- c:\windows\system32\zpeng25.dll 2009-11-04 01:12 . 2009-11-07 02:13 -------- d-----w- c:\windows\Internet Logs 2009-11-03 12:13 . 2009-11-03 12:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Electronic Arts 2009-11-03 12:13 . 2009-11-03 12:13 -------- d-----w- C:\ProgramData 2009-11-02 20:08 . 2009-11-02 20:08 -------- d-----w- c:\documents and settings\vincent\Application Data\Auslogics 2009-11-02 18:45 . 2009-11-05 19:20 -------- d-----w- c:\program files rend micro 2009-11-02 18:45 . 2009-11-02 18:45 -------- d-----w- C: sit 2009-11-02 17:14 . 2001-08-23 16:47 5632 ----a-w- c:\windows\system32\ptpusb.dll 2009-11-02 17:14 . 2004-08-03 21:58 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys 2009-11-02 17:14 . 2004-08-19 15:09 159232 ----a-w- c:\windows\system32\ptpusd.dll 2009-11-02 16:54 . 2009-11-07 01:35 -------- d-----w- c:\documents and settings\vincent\Tracing 2009-11-02 16:46 . 2009-11-02 16:46 -------- d-----w- c:\program files\Microsoft 2009-11-02 16:46 . 2009-11-02 16:46 -------- d-----w- c:\program files\Windows Live SkyDrive 2009-11-02 16:45 . 2009-11-02 16:46 -------- d-----w- c:\program files\Windows Live 2009-11-02 14:39 . 2009-11-02 14:39 -------- d-----w- c:\program files\iPod 2009-11-02 14:39 . 2009-11-02 14:39 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD} 2009-11-02 14:39 . 2009-11-02 14:39 -------- d-----w- c:\program files\Bonjour 2009-11-02 14:39 . 2009-11-02 14:39 -------- d-----w- c:\program files\Apple Software Update 2009-11-02 14:39 . 2009-08-28 18:42 40448 ----a-w- c:\windows\system32\drivers\usbaapl.sys 2009-11-02 14:39 . 2009-08-28 18:42 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll 2009-11-02 14:38 . 2009-11-02 15:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple 2009-11-02 14:38 . 2009-11-02 14:39 -------- d-----w- c:\program files\Fichiers communs\Apple 2009-11-02 00:28 . 2009-11-02 00:28 -------- d-----w- c:\documents and settings\vincent\Application Data\Malwarebytes 2009-11-02 00:27 . 2009-09-10 13:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-11-02 00:27 . 2009-11-02 00:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-11-02 00:27 . 2009-09-10 13:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-10-31 14:02 . 2009-11-05 17:38 -------- d-----w- c:\windows\BDOSCAN8 2009-10-31 13:26 . 2009-10-31 13:26 -------- d-----r- c:\documents and settings\NetworkService\Favoris 2009-10-30 15:46 . 2009-10-30 15:46 -------- d-----w- c:\documents and settings\vincent\Local Settings\Application Data\Fallout3 2009-10-30 15:35 . 2008-09-18 19:07 121064 ------r- c:\documents and settings\All Users\Application Data\Fallout3\setup.exe 2009-10-30 15:35 . 2009-10-30 15:35 -------- d-----w- c:\documents and settings\All Users\Application Data\Fallout3 2009-10-29 23:39 . 2009-11-02 19:51 -------- d-----w- c:\documents and settings\vincent\Local Settings\Application Data\VirtuaTennis2009 2009-10-29 23:37 . 2009-03-09 14:27 453456 ----a-w- c:\windows\system32\d3dx10_41.dll 2009-10-29 23:37 . 2009-03-09 14:27 1846632 ----a-w- c:\windows\system32\D3DCompiler_41.dll 2009-10-29 23:37 . 2009-03-16 13:18 69448 ----a-w- c:\windows\system32\XAPOFX1_3.dll 2009-10-29 23:37 . 2009-03-16 13:18 517448 ----a-w- c:\windows\system32\XAudio2_4.dll 2009-10-29 23:37 . 2009-03-16 13:18 235352 ----a-w- c:\windows\system32\xactengine3_4.dll 2009-10-29 23:37 . 2009-03-16 13:18 22360 ----a-w- c:\windows\system32\X3DAudio1_6.dll 2009-10-29 23:37 . 2009-03-09 14:27 4178264 ----a-w- c:\windows\system32\D3DX9_41.dll 2009-10-29 17:18 . 2009-10-29 17:18 -------- d-----w- c:\program files\SystemRequirementsLab 2009-10-28 19:58 . 2009-10-28 19:58 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe 2009-10-27 21:20 . 2009-10-27 21:20 -------- d-----w- c:\program files\Fichiers communs\Windows Live 2009-10-27 21:20 . 2009-10-27 21:20 -------- d-----w- c:\program files\Microsoft Silverlight 2009-10-27 19:58 . 2009-10-27 19:58 -------- d-----w- c:\windows\system32\CatRoot_bak 2009-10-27 15:52 . 2009-10-28 18:39 -------- d-----w- c:\documents and settings\All Users\Application Data\F4 2009-10-27 15:49 . 2009-10-27 15:49 -------- d-----w- c:\documents and settings\vincent\Application Data\F4 2009-10-27 13:41 . 2009-11-04 15:58 -------- d-----w- c:\documents and settings\vincent\Local Settings\Application Data\Unity 2009-10-27 13:40 . 2009-10-27 13:52 -------- d-----w- c:\windows\system32\Adobe 2009-10-27 02:00 . 2009-10-27 02:00 -------- d-----w- c:\windows\system32\KB905474 2009-10-27 02:00 . 2009-03-10 21:26 1438080 ----a-w- c:\windows\system32\KB905474\wganotifypackageinner.exe 2009-10-27 02:00 . 2009-03-10 21:18 454024 ----a-w- c:\windows\system32\KB905474\wgasetup.exe 2009-10-27 01:13 . 2009-08-06 18:23 274288 ----a-w- c:\windows\system32\mucltui.dll 2009-10-27 01:13 . 2009-08-06 18:23 215920 ----a-w- c:\windows\system32\muweb.dll 2009-10-26 20:07 . 2008-11-13 14:17 177664 ------w- c:\windows\system32\dllcache\wintrust.dll 2009-10-26 20:07 . 2008-11-13 14:17 605696 ------w- c:\windows\system32\dllcache\crypt32.dll 2009-10-26 16:51 . 2009-10-26 16:51 -------- d-----w- c:\program files\Microsoft Games for Windows - LIVE 2009-10-26 16:51 . 2009-10-26 16:51 -------- d-----w- c:\windows\system32\xlive 2009-10-26 12:26 . 2009-10-26 12:26 -------- d-----w- c:\documents and settings\vincent\Local Settings\Application Data\Monte Cristo 2009-10-25 22:33 . 2009-10-25 22:33 -------- d-----w- c:\documents and settings\All Users\Application Data\ATI 2009-10-25 22:31 . 2009-09-25 15:35 593920 ------w- c:\windows\system32\ati2sgag.exe 2009-10-25 22:31 . 2009-10-25 22:32 -------- d-----w- c:\program files\ATI Technologies 2009-10-25 21:53 . 2009-10-25 21:54 63488 ----a-w- c:\windows\xobglu16.dll 2009-10-25 21:53 . 2009-10-25 21:54 38466 ----a-w- c:\windows\xobglu32.dll 2009-10-25 21:42 . 1996-10-14 00:24 131917 ----a-w- c:\windows\unstall.exe 2009-10-25 13:19 . 2009-10-25 13:19 -------- d-----w- c:\program files\Fichiers communs\DirectX 2009-10-25 13:15 . 2009-10-25 13:15 -------- d-----w- c:\windows\Logs 2009-10-24 00:46 . 2009-10-24 00:46 -------- d-----w- c:\documents and settings\All Users\Application Data\SimCity Societies 2009-10-23 19:45 . 2006-01-03 04:07 61440 ----a-w- c:\windows\system\cmsnxeye.exe 2009-10-23 19:45 . 2005-12-21 06:41 253952 ----a-w- c:\windows\system32\cmdrvrmu.exe 2009-10-23 19:45 . 2005-03-07 06:29 45056 ----a-w- c:\windows\system32\cmdrvrmu.dll 2009-10-23 19:45 . 2004-02-18 06:19 16384 ----a-w- c:\windows\system32\cmpropu.dll 2009-10-23 19:45 . 2004-02-13 07:39 98304 ----a-w- c:\windows\system32\cmudau.dll 2009-10-23 19:45 . 2002-04-29 07:04 917504 ----a-w- c:\windows\system\cmds3du.dll 2009-10-23 19:45 . 2001-11-23 04:08 712704 ----a-w- c:\windows\system32\a3dpropu.dll 2009-10-23 19:45 . 2009-10-23 19:45 -------- d-----w- c:\program files\Speed Link 2009-10-23 11:12 . 2006-03-24 03:30 1414528 ----a-w- c:\windows\system32\drivers\cmudaxu.sys 2009-10-22 18:41 . 2008-10-15 10:49 53618 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\CONFIG\AVWIN.INIaebb.dll 2009-10-22 17:15 . 2009-10-22 17:15 -------- d-----w- c:\windows\UbiSoft 2009-10-22 16:00 . 2009-10-22 16:00 -------- d-----w- c:\documents and settings\vincent\Application Data\DeepBurner 2009-10-21 18:58 . 2001-08-23 15:47 8704 ----a-w- c:\windows\system32\kbdjpn.dll 2009-10-21 18:58 . 2001-08-23 15:47 8192 ----a-w- c:\windows\system32\kbdkor.dll 2009-10-21 18:58 . 2001-08-17 20:55 6144 ----a-w- c:\windows\system32\kbd106.dll 2009-10-21 18:58 . 2001-08-17 20:55 6144 ----a-w- c:\windows\system32\kbd101c.dll 2009-10-21 18:58 . 2001-08-17 20:55 5632 ----a-w- c:\windows\system32\kbd103.dll 2009-10-21 18:58 . 2001-08-17 20:55 6144 ----a-w- c:\windows\system32\kbd101b.dll 2009-10-21 18:16 . 2009-10-02 22:15 483707 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aescript.dll 2009-10-21 18:16 . 2009-09-15 15:58 106867 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aevdf.dll 2009-10-21 18:16 . 2009-09-03 15:24 127346 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aescn.dll 2009-10-21 18:16 . 2009-10-07 21:27 2011511 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aeheur.dll 2009-10-21 18:16 . 2009-10-02 22:15 479604 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aerdl.dll 2009-10-21 18:16 . 2009-10-02 22:15 393587 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aeemu.dll 2009-10-21 18:16 . 2009-10-02 22:15 364916 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aegen.dll 2009-10-21 18:16 . 2009-09-15 15:58 422261 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aepack.dll 2009-10-21 18:16 . 2009-09-15 15:57 184693 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aecore.dll 2009-10-21 18:16 . 2009-09-03 15:24 237940 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aehelp.dll 2009-10-21 18:16 . 2009-06-17 14:32 196987 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aeoffice.dll 2009-10-21 18:16 . 2008-10-15 10:49 53618 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aebb.dll 2009-10-21 18:06 . 2009-10-21 18:06 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite 2009-10-21 18:06 . 2009-10-21 18:06 -------- d-----w- c:\program files\DAEMON Tools Toolbar 2009-10-21 18:02 . 2009-10-21 18:02 721904 ----a-w- c:\windows\system32\drivers\sptd.sys 2009-10-21 18:02 . 2009-10-21 18:11 -------- d-----w- c:\documents and settings\vincent\Application Data\DAEMON Tools Lite 2009-10-21 14:53 . 2009-10-21 14:53 -------- d-----w- c:\windows\system32\Lang 2009-10-21 13:41 . 2009-10-21 13:41 664 ----a-w- c:\windows\system32\d3d9caps.dat . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2009-11-07 01:00 . 2001-08-28 18:00 93408 ----a-w- c:\windows\system32\perfc00C.dat 2009-11-07 01:00 . 2001-08-28 18:00 532828 ----a-w- c:\windows\system32\perfh00C.dat 2009-11-05 15:00 . 2009-06-11 10:28 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-11-02 16:54 . 2009-06-11 17:35 12912 ----a-w- c:\documents and settings\vincent\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-10-28 19:04 . 2009-11-04 17:40 89600 ----a-w- c:\windows\system32\drivers\clipsrv.exe.vzr 2009-10-22 02:53 . 2009-06-11 14:20 -------- d-----w- c:\program files\Fichiers communs\Adobe 2009-10-21 13:27 . 2009-06-11 00:39 -------- d-----w- c:\program files\Fichiers communs\InstallShield 2009-09-23 22:59 . 2009-09-23 22:59 4481024 ----a-w- c:\windows\system32\drivers\ati2mtag.sys 2009-09-23 22:39 . 2009-09-23 22:39 446464 ----a-w- c:\windows\system32\ATIDEMGX.dll 2009-09-23 22:38 . 2009-09-23 22:38 299520 ----a-w- c:\windows\system32\ati2dvag.dll 2009-09-23 22:21 . 2009-09-23 22:21 204800 ----a-w- c:\windows\system32\atipdlxx.dll 2009-09-23 22:21 . 2009-09-23 22:21 155648 ----a-w- c:\windows\system32\Oemdspif.dll 2009-09-23 22:21 . 2009-09-23 22:21 26112 ----a-w- c:\windows\system32\Ati2mdxx.exe 2009-09-23 22:20 . 2009-09-23 22:20 43520 ----a-w- c:\windows\system32\ati2edxx.dll 2009-09-23 22:20 . 2009-09-23 22:20 155648 ----a-w- c:\windows\system32\ati2evxx.dll 2009-09-23 22:19 . 2009-09-23 22:19 602112 ----a-w- c:\windows\system32\ati2evxx.exe 2009-09-23 22:17 . 2009-09-23 22:17 53248 ----a-w- c:\windows\system32\ATIDDC.DLL 2009-09-23 22:11 . 2009-09-23 22:11 311296 ----a-w- c:\windows\system32\atiiiexx.dll 2009-09-23 22:09 . 2009-09-23 22:09 3506080 ----a-w- c:\windows\system32\ati3duag.dll 2009-09-23 21:58 . 2009-09-23 21:58 12644352 ----a-w- c:\windows\system32\atioglxx.dll 2009-09-23 21:53 . 2009-09-23 21:53 2096384 ----a-w- c:\windows\system32\ativvaxx.dll 2009-09-23 21:53 . 2009-09-23 21:53 887724 ----a-w- c:\windows\system32\ativva6x.dat 2009-09-23 21:53 . 2009-09-23 21:53 3 ----a-w- c:\windows\system32\ativva5x.dat 2009-09-23 21:36 . 2009-09-23 21:36 65024 ----a-w- c:\windows\system32\atimpc32.dll 2009-09-23 21:36 . 2009-09-23 21:36 65024 ----a-w- c:\windows\system32\amdpcom32.dll 2009-09-23 21:32 . 2009-09-23 21:32 561152 ----a-w- c:\windows\system32\atikvmag.dll 2009-09-23 21:31 . 2009-09-23 21:31 45056 ----a-w- c:\windows\system32\aticalrt.dll 2009-09-23 21:31 . 2009-09-23 21:31 45056 ----a-w- c:\windows\system32\aticalcl.dll 2009-09-23 21:30 . 2009-09-23 21:30 167936 ----a-w- c:\windows\system32\atiadlxx.dll 2009-09-23 21:29 . 2009-09-23 21:29 17408 ----a-w- c:\windows\system32\atitvo32.dll 2009-09-23 21:29 . 2009-09-23 21:29 3489792 ----a-w- c:\windows\system32\aticaldd.dll 2009-09-23 21:28 . 2009-09-23 21:28 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll 2009-09-23 21:27 . 2009-09-23 21:27 401408 ----a-w- c:\windows\system32\atiok3x2.dll 2009-09-23 21:23 . 2009-09-23 21:23 638976 ----a-w- c:\windows\system32\ati2cqag.dll 2009-09-16 16:23 . 2009-09-16 16:23 491192 ----a-w- c:\documents and settings\All Users\Application Data\F4\EoS-Launcher.exe 2009-09-11 14:12 . 2004-08-19 20:09 136192 ----a-w- c:\windows\system32\msv1_0.dll 2009-09-04 20:46 . 2004-08-19 20:09 58880 ----a-w- c:\windows\system32\msasn1.dll 2009-09-01 19:55 . 2009-09-01 19:55 195855 ----a-w- c:\windows\system32\atiicdxx.dat 2009-08-29 07:56 . 2007-04-18 14:32 916480 ------w- c:\windows\system32\wininet.dll 2009-08-26 13:04 . 2009-06-14 14:04 53248 ----a-w- c:\windows\system32\CSVer.dll 2009-08-26 08:15 . 2007-07-16 14:27 247326 ----a-w- c:\windows\system32\strmdll.dll 2009-08-10 09:01 . 2009-08-10 09:01 21712 ----a-w- c:\documents and settings\All Users\Application Data\F4\IHelper.exe . ------- Sigcheck ------- [-] 2007-07-18 . FA7C7C2B461130A792ADF6A28F1D652B . 506368 . . [5.1.2600.2180] . . c:\windows\system32\winlogon.exe [-] 2004-11-28 18:36 . AB3D62010AF342203FFA60C2D94DBC68 . 8704 . . [1] . . c:\windows\system32\sfcfiles.dll . ((((((((((((((((((((((((((((( SnapShot@2009-11-05_19.49.37 ))))))))))))))))))))))))))))))))))))))))) . + 2009-11-07 01:01 . 2009-11-07 01:01 38926 c:\windows\system32\ZoneLabs\avsys emp\update ollback\bases\wmuf\wmuf0008.dat + 2009-11-07 01:01 . 2009-11-07 01:01 54852 c:\windows\system32\ZoneLabs\avsys emp\update ollback\bases\apu\apu0002.dat + 2009-11-07 01:01 . 2009-11-07 01:01 42008 c:\windows\system32\ZoneLabs\avsys emp\update ollback\bases\apu\apu0001.dat + 2009-11-04 01:25 . 2009-11-07 01:01 39444 c:\windows\system32\ZoneLabs\avsys emp emporaryFolder\bases\wmuf\wmuf0008.dat + 2009-11-04 01:22 . 2009-11-05 23:24 51225 c:\windows\system32\ZoneLabs\avsys emp emporaryFolder\bases\blst\bl0014.dat + 2009-11-04 01:22 . 2009-11-07 01:01 55436 c:\windows\system32\ZoneLabs\avsys emp emporaryFolder\bases\apu\apu0002.dat - 2009-11-04 01:22 . 2009-11-04 16:28 42008 c:\windows\system32\ZoneLabs\avsys emp emporaryFolder\bases\apu\apu0001.dat + 2009-11-04 01:22 . 2009-11-07 01:01 42008 c:\windows\system32\ZoneLabs\avsys emp emporaryFolder\bases\apu\apu0001.dat + 2009-11-04 01:25 . 2009-11-07 01:01 39444 c:\windows\system32\ZoneLabs\avsys\bases\wmuf0008.dat + 2009-11-04 01:25 . 2009-11-05 23:25 51225 c:\windows\system32\ZoneLabs\avsys\bases\bl0014.dat + 2009-11-04 01:13 . 2009-11-07 01:01 55436 c:\windows\system32\ZoneLabs\avsys\bases\apu0002.dat + 2009-11-04 01:13 . 2009-11-07 01:01 42008 c:\windows\system32\ZoneLabs\avsys\bases\apu0001.dat - 2009-11-04 01:13 . 2009-11-04 16:28 42008 c:\windows\system32\ZoneLabs\avsys\bases\apu0001.dat + 2001-08-28 18:00 . 2009-11-07 01:00 71060 c:\windows\system32\perfc009.dat - 2001-08-28 18:00 . 2009-11-05 17:26 71060 c:\windows\system32\perfc009.dat + 2009-11-07 01:01 . 2009-11-07 01:01 7186 c:\windows\system32\ZoneLabs\avsys emp\update ollback\bases\apu\apu0003.dat + 2009-11-04 01:25 . 2009-11-06 16:07 5631 c:\windows\system32\ZoneLabs\avsys emp emporaryFolder\bases\wmuf\wmuf0000.dat + 2009-11-04 01:22 . 2009-11-07 01:01 6938 c:\windows\system32\ZoneLabs\avsys emp emporaryFolder\bases\apu\apu0003.dat + 2009-11-04 01:13 . 2009-11-06 16:07 5631 c:\windows\system32\ZoneLabs\avsys\bases\wmuf0000.dat + 2009-11-04 01:13 . 2009-11-07 01:01 6938 c:\windows\system32\ZoneLabs\avsys\bases\apu0003.dat + 2001-08-28 18:00 . 2009-11-07 01:00 441124 c:\windows\system32\perfh009.dat - 2001-08-28 18:00 . 2009-11-05 17:26 441124 c:\windows\system32\perfh009.dat + 2009-10-22 02:53 . 2009-11-06 02:12 295606 c:\windows\Installer\{AC76BA86-7AD7-1036-7B44-A81300000003}\SC_Reader.exe - 2009-10-22 02:53 . 2009-10-30 16:13 295606 c:\windows\Installer\{AC76BA86-7AD7-1036-7B44-A81300000003}\SC_Reader.exe + 2009-11-06 02:12 . 2009-11-06 02:12 1711616 c:\windows\Installer\1e65cad.msp . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-16 39408] "SpybotSD TeaTimer"="d:\spybot - search & destroy\TeaTimer.exe" [2009-03-05 2260480] "SUPERAntiSpyware"="d:\super anti spy ware\SUPERAntiSpyware.exe" [2009-10-12 2000112] "LClock"="lclock.exe" - c:\windows\LClock.exe [2004-12-08 65536] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "Shockwave Updater"="c:\windows\system32\Adobe\Shockwave 11\SwHelper_1151601.exe" [2009-07-31 468408] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "QuickTime Task"="d:\quicktime\qttask.exe" [2009-09-04 417792] "avgnt"="d:\avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153] "RivaTunerStartupDaemon"="d: ivatuner v2.24 msi master overclocking arena 2009 edition\RivaTuner.exe" [2009-08-22 2781184] "Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-10-16 122880] "Adobe Reader Speed Launcher"="d:\adobe reader\Reader\Reader_sl.exe" [2008-10-14 39792] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-09-25 98304] "Malwarebytes Anti-Malware (reboot)"="d:\malwarebytes' anti-malware\mbam.exe" [2009-09-10 1312080] "iTunesHelper"="d:\i tunes\iTunesHelper.exe" [2009-10-28 141600] "ZoneAlarm Client"="d:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-10-17 1037192] "SunJavaUpdateSched"="d: rendmicro scan\bin\jusched.exe" [2005-04-13 36975] "a-squared"="d:\a-squared anti-malware 2\a2guard.exe" [2009-11-05 3279192] "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2008-07-03 16876032] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-19 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "LSD_III"="c:\windows\LSD\end.cmd" [2007-08-07 2336] "tscuninstall"="c:\windows\system32 scupgrd.exe" [2004-08-19 44544] "nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2009-03-08 128512] c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMBalloonTip"= 0 (0x0) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "d:\super anti spy ware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\!SASWinLogon] 2009-09-03 14:21 548352 ----a-w- d:\super anti spy ware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\Network Diagnostic\xpnetdiag.exe"= "%windir%\system32\sessmgr.exe"= "e:\COH\RelicCOH.exe"= "e:\COH\RelicDownloader\RelicDownloader.exe"= "e:\Empire of Sports\NetworkDiagnostic.exe"= "e:\Empire of Sports\EmpireOfSports.exe"= "c:\Program Files\Bonjour\mDNSResponder.exe"= "c:\Program Files\Windows Live\Messenger\wlcsdk.exe"= "c:\Program Files\Windows Live\Messenger\msnmsgr.exe"= "e:\mirrors\Binaries\MirrorsEdge.exe"= "c:\Documents and Settings\vincent\Local Settings\Application Data\F4\ClientUpdater\ClientUpdater.exe"= "d:\eMule\emule.exe"= R0 mv61xx;mv61xx;c:\windows\system32\drivers\mv61xx.sys [20/03/2009 04:53 154664] R1 SASDIFSV;SASDIFSV;d:\super anti spy ware\sasdifsv.sys [12/10/2009 21:24 9968] R1 SASKUTIL;SASKUTIL;d:\super anti spy ware\SASKUTIL.SYS [12/10/2009 21:24 74480] R2 AntiVirSchedulerService;Avira AntiVir Planificateur;d:\avira\AntiVir Desktop\sched.exe [15/10/2009 22:18 108289] R3 L1e;Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1e51x86.sys [19/10/2009 14:21 39424] R3 SASENUM;SASENUM;d:\super anti spy ware\SASENUM.SYS [12/10/2009 21:24 7408] S3 cmudau32;C-Media USB UDA Sound Interface;c:\windows\system32\drivers\cmudaxu.sys [23/10/2009 12:12 1414528] S3 cpuz130;cpuz130;\??\c:\docume~1\vincent\LOCALS~1\Temp\cpuz130\cpuz_x32.sys --> c:\docume~1\vincent\LOCALS~1\Temp\cpuz130\cpuz_x32.sys [?] S3 EverestDriver;Lavalys EVEREST Kernel Driver;d:\everest ultimate edition\kerneld.wnt [15/10/2009 22:50 27248] S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [23/09/2009 13:50 238960] S3 PciCon;PciCon;\??\g:\pcicon.sys --> g:\PciCon.sys [?] --- Autres Services/Pilotes en mémoire --- *Deregistered* - mbr *Deregistered* - PROCEXP113 . Contenu du dossier 'Tâches planifiées' 2009-11-02 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] 2009-11-06 c:\windows\Tasks\User_Feed_Synchronization-{1F94FC4D-EFF2-436B-8DD2-2E15FEF24212}.job - c:\windows\system32\msfeedssync.exe [2006-10-17 02:31] 2009-11-02 c:\windows\Tasks\WGASetup.job - c:\windows\system32\KB905474\wgasetup.exe [2009-10-27 21:18] . . ------- Examen supplémentaire ------- . uInternet Settings,ProxyOverride = local uSearchURL,(Default) = hxxp://www.google.fr/keyword/%s IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_A54B7D6FB1DA63EA.dll/cmsidewiki.html DPF: {40F576AD-8680-4F9E-9490-99D069CD665F} - hxxp://srtest-cdn.systemrequirementslab.com.s3.amazonaws.com/bin/sysreqlabdetect.cab DPF: {E6BB2089-163F-466B-812A-748096614DFD} - hxxp://cainternetsecurity.net/scanner/cascanner.cab . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-11-07 03:30 Windows 5.1.2600 Service Pack 2 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully called modules: NTKRNLMP.EXE catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8AC311F8]<< kernel: MBR read successfully detected MBR rootkit hooks: \Driver\atapi -> 0x8ac311f8 Warning: possible MBR rootkit infection ! user & kernel MBR OK Use "Recovery Console" command "fixmbr" to clear infection ! ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver] "ImagePath"="\??\d:\everest ultimate edition\kerneld.wnt" . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'winlogon.exe'(800) d:\super anti spy ware\SASWINLO.dll c:\windows\system32\Ati2evxx.dll - - - - - - - > 'explorer.exe'(524) c:\windows\system32 tshrui.dll c:\program files\Google\Quick Search Box\bin\1.2.1150.162\qsb.dll c:\windows\system32\NETSHELL.dll c:\windows\system32\credui.dll c:\windows\LC.dll c:\windows\system32\webcheck.dll c:\windows\system32\stobject.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . Heure de fin: 2009-11-07 3:31 ComboFix-quarantined-files.txt 2009-11-07 02:31 ComboFix2.txt 2009-11-06 14:15 ComboFix3.txt 2009-11-06 13:06 ComboFix4.txt 2009-11-05 19:50 Avant-CF: 12 050 530 304 octets libres Après-CF: 12 016 574 464 octets libres - - End Of File - - 04F95D992121F5E7CD97B887B89D7422 Version - a-squared Anti-Malware 4.5 Dernière mise à jour : 07/11/2009 03:40:14 Paramètres des balayages : Type de balayage : Scan en Détail Objets : Mémoire, Traces, Cookies, C:\, D:\, E:\, F:\ Balayage dans les archives : Marche Analyse heuristique : Arrêt Balayage dans les ADS : Marche Début du balayage : 07/11/2009 03:40:31 C:\Documents and Settings\vincent\Cookies\vincent@247realmedia[2].txt Objets détectés : Trace.TrackingCookie.247realmedia!A2 C:\Documents and Settings\vincent\Cookies\vincent@2o7[2].txt Objets détectés : Trace.TrackingCookie.2o7!A2 C:\Documents and Settings\vincent\Cookies\vincent@atdmt[2].txt Objets détectés : Trace.TrackingCookie.atdmt!A2 C:\Documents and Settings\vincent\Cookies\vincent@bs.serving-sys[2].txt Objets détectés : Trace.TrackingCookie.bs.serving-sys!A2 C:\Documents and Settings\vincent\Cookies\vincent@serving-sys[2].txt Objets détectés : Trace.TrackingCookie.serving-sys!A2 C:\Documents and Settings\vincent\Cookies\vincent@weborama[1].txt Objets détectés : Trace.TrackingCookie.weborama!A2 Analysé Fichiers : 158781 Traces : 686351 Cookies : 117 Processus : 40 Objets trouvés Fichiers : 0 Traces : 0 Cookies : 6 Processus : 0 Clés de Registre : 0 Fin du balayage : 07/11/2009 04:19:55 Temps du balayage : 0:39:24 Malwarebytes' Anti-Malware 1.41 Version de la base de données: 3113 Windows 5.1.2600 Service Pack 2 07/11/2009 03:09:02 mbam-log-2009-11-07 (03-09-02).txt Type de recherche: Examen complet (A:\|C:\|D:\|E:\|F:\|G:\|H:\|) Eléments examinés: 219535 Temps écoulé: 24 minute(s), 24 second(s) Processus mémoire infecté(s): 0 Module(s) mémoire infecté(s): 0 Clé(s) du Registre infectée(s): 0 Valeur(s) du Registre infectée(s): 0 Elément(s) de données du Registre infecté(s): 0 Dossier(s) infecté(s): 0 Fichier(s) infecté(s): 0 Processus mémoire infecté(s): (Aucun élément nuisible détecté) Module(s) mémoire infecté(s): (Aucun élément nuisible détecté) Clé(s) du Registre infectée(s): (Aucun élément nuisible détecté) Valeur(s) du Registre infectée(s): (Aucun élément nuisible détecté) Elément(s) de données du Registre infecté(s): (Aucun élément nuisible détecté) Dossier(s) infecté(s): (Aucun élément nuisible détecté) Fichier(s) infecté(s): (Aucun élément nuisible détecté) Merci pour ton aide

Utilisateur anonyme · Answer

Il rest un dossier qui ne veux pas partir 

•	Télécharge:https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cpVobGk5bHnxrhQ4yaoEUDJvOYNnEGyYjgqHZz5GqZLfutR3fMFPlsC3-CGIilfupPAguYATNyua3csodN_frdMK8sSzUpit10Yac-QJCOkMqJKkbdKcP6ySs8trWPgoNVIq4TGGWCe6o0txXQv-ZueJF9vZzw3RXsGwFYIqN2lvF2LPdQzS8mE1d5kWOVOz6EMzQuE5-lClSJM869uq3oc7-t7yg%3D%3D&attredirects=3
•	!! Déconnectes toi et fermes toute tes applications en cours le temps de la manipe !!
•	Double-cliques sur l'.exe pour lancer l'installe et laisses toi guider
•	Une fois fait, cliques sur le raccourci créé sur ton bureau pour lancer l'outil .
•	Choisis l'option2 et tapes "entrée" .
•	Une fois le scan finit , un rapport va apparaître, copie/colles l'intégralité de son contenu dans ta prochaine réponse ...
•	( le rapport est en outre sauvegardé ici -> C:\TB.txt )
•	Tuto :[ https://sites.google.com/site/toolbarsd/aideenimages toolbarSD]

virus44 · Answer

Bonjour nanard

Désolé pour le retard..

voici le rapport,quen penses tu?


   -----------\  ToolBar S&D 1.2.9   XP/Vista

   Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
   X86-based PC ( Multiprocessor Free : Processeur Intel Pentium III Xeon )
   BIOS : BIOS Date: 04/07/09 15:26:13 Ver: 08.00.14
   USER : vincent ( Administrator )
   BOOT : Normal boot
   Antivirus : a-squared Anti-Malware 4 (Not Activated)
   Firewall  : COMODO Firewall Pro 3.0 (Activated)
   A:\ (USB)
   C:\ (Local Disk) - NTFS - Total:19 Go (Free:10 Go)
   D:\ (Local Disk) - NTFS - Total:244 Go (Free:126 Go)
   E:\ (Local Disk) - NTFS - Total:244 Go (Free:165 Go)
   F:\ (Local Disk) - NTFS - Total:88 Go (Free:88 Go)
   G:\ (CD or DVD) - UDF - Total:3 Go (Free:0 Go)
   H:\ (CD or DVD)

   "C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
   Option : [2] ( 09/11/2009|15:31 )

   -----------\ SUPPRESSION

   Supprime! - C:\Program Files\DAEMON Tools Toolbar

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Start Page"="https://www.msn.com/fr-fr"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
   "Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
   "Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Start Page"="https://www.msn.com/fr-fr/"


   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\vincent\Mes documents\Crack
   C:\DOCUME~1\vincent\Mes documents\Crack\Crack
   C:\DOCUME~1\vincent\Mes documents\Crack\MEMENTO.exe
   C:\DOCUME~1\vincent\Mes documents\Crack\Mirrors.Edge.Update.1.01-RELOADED
   C:\DOCUME~1\vincent\Mes documents\Crack\MirrorsEdge.exe
   C:\DOCUME~1\vincent\Mes documents\Crack\SimCitySocieties.exe
   C:\DOCUME~1\vincent\Mes documents\Crack\Crack\MEMENTO.exe
   C:\DOCUME~1\vincent\Mes documents\Crack\Mirrors.Edge.Update.1.01-RELOADED\Crack
   C:\DOCUME~1\vincent\Mes documents\Crack\Mirrors.Edge.Update.1.01-RELOADED\Update
   C:\DOCUME~1\vincent\Mes documents\Crack\Mirrors.Edge.Update.1.01-RELOADED\Crack\MirrorsEdge.exe
   C:\DOCUME~1\vincent\Mes documents\Crack\Mirrors.Edge.Update.1.01-RELOADED\Update\mirrors_edge_patch_101.exe



   1 - "C:\ToolBar SD\TB_1.txt" - 09/11/2009|15:31 - Option : [2]

   -----------\  Fin du rapport a 15:31:59,09

Utilisateur anonyme · Answer

Post un nouveau rapport rsit

virus44 · Answer

Je télécharge actuellement avec la mule,j'éspère que cela na va pas fausser le rapport..?!


Logfile of random's system information tool 1.06 (written by random/random)
Run by vincent at 2009-11-09 20:26:17
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 11 GB (56%) free of 20 GB
Total RAM: 3327 MB (70% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:26:24, on 09/11/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
D:\Avira\AntiVir Desktop\sched.exe
D:\a-squared Anti-Malware 2\a2service.exe
D:\a-squared Free\a2service.exe
D:\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
D:\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
D:\i tunes\iTunesHelper.exe
D:\TrendMicro Scan\bin\jusched.exe
C:\WINDOWS\lclock.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
D:\eMule\emule.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\SearchFilterHost.exe
C:\Documents and Settings\vincent\Mes documents\RSIT.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Documents and Settings\vincent\Mes documents\vincent.exe
C:\WINDOWS\system32\SearchProtocolHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/keyword/%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Favoris
R3 - Default URLSearchHook is missing
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O4 - HKLM\..\Run: [QuickTime Task] "D:\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avgnt] "D:\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "D:\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner.exe" /S
O4 - HKLM\..\Run: [Google Quick Search Box] "C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe"  /autorun
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Adobe Reader\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "D:\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [iTunesHelper] "D:\i tunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\TrendMicro Scan\bin\jusched.exe
O4 - HKLM\..\Run: [a-squared] "D:\a-squared Anti-Malware 2\a2guard.exe"
O4 - HKCU\..\Run: [LClock] lclock.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] D:\super anti spy ware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\Shockwave 11\SwHelper_1151601.exe -Update -1151601 -"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB6.3; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" -"http://saison7.fighting-club.com/salle3d.asp?num=11"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'Default user')
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_A54B7D6FB1DA63EA.dll/cmsidewiki.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\TrendMicro Scan\bin
pjpi150_03.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\TrendMicro Scan\bin
pjpi150_03.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {40F576AD-8680-4F9E-9490-99D069CD665F} (System Requirements Lab Class) - http://srtest-cdn.systemrequirementslab.com.s3.amazonaws.com/bin/sysreqlabdetect.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos-beta/OnlineScanner.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - http://javadl-esd.sun.com/update/1.5.0/jinstall-1_5_0_03-windows-i586.cab
O16 - DPF: {E6BB2089-163F-466B-812A-748096614DFD} (CAScanner Control) - http://cainternetsecurity.net/scanner/cascanner.cab
O20 - Winlogon Notify: !SASWinLogon - D:\super anti spy ware\SASWINLO.dll
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - D:\a-squared Anti-Malware 2\a2service.exe
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - D:\a-squared Free\a2service.exe
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - D:\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - D:\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Utilisateur anonyme · Answer

Rien sur le dernier rapport .Toujours des soucis ?

virus44 · Answer

Non plus de problème!

Merci Nanard pour ton aide,mon pc tourne a nouveau impecablement.

Je met ce sujet en résolu!

Supprimer cheval de troie TR/Dropper Gen

16 réponses

Discussions similaires