Virus Bagle
mikl76
-
Utilisateur anonyme -
Utilisateur anonyme -
Bonjour,
Voila j'ais un gros probleme ,j'ai chopé une saloperie qui a infecté avast et je n'ai plus de systeme de sécurité .
Je me suis rensigné sur les forum on dirait bien un virus de type "bagle".
Impossible de réinstaller d'autres AV,et d'analyser en ligne ni meme de redemarrer en mode sans echec.
Quelqun pourrait il m'aider SVP
Voila j'ais un gros probleme ,j'ai chopé une saloperie qui a infecté avast et je n'ai plus de systeme de sécurité .
Je me suis rensigné sur les forum on dirait bien un virus de type "bagle".
Impossible de réinstaller d'autres AV,et d'analyser en ligne ni meme de redemarrer en mode sans echec.
Quelqun pourrait il m'aider SVP
Configuration: Windows XP Internet Explorer 6.0
28 réponses
- 1
- 2
Suivant
Résumé de la discussion
Une infection de type Worm.Bagle sur Windows XP avec Avast inactif et impossibilité de démarrer en mode sans échec soulève l’inquiétude d’une infection virale bloquant les outils de sécurité. Des réponses suggèrent FindyKill pour analyser hors ligne et générer un rapport, puis des nettoyeurs comme HijackThis, ToolsCleaner2 et C Cleaner pour supprimer les éléments malveillants et nettoyer le système. En cas de contamination persistante, il est préconisé de désactiver puis réactiver la restauration système, mettre à jour Windows XP SP3 et envisager un diagnostic avec Malwarebytes pour confirmer la suppression et prévenir les restaurations.
-
bonjour,
Télécharge FindyKill de Chiquitine29 sur ton bureau :
http://pagesperso-orange.fr/NosTools/Chiquitine29/Setup.exe
Déconnecte toi et ferme toutes applications en cours
• Double clique sur Setup.exe pour lancer l'installation avec les paramètres par défaut
• Branche toutes tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...)
• Double-clique sur le raccourci FindyKill qui est sur ton bureau pour lancer l'outil .
• Sélectionne l'option F pour français, puis appuie sur la touche entrée
• Sélectionne l'option 1 (recherche), puis appuie sur la touche entrée
▶ Laisse travailler l'outil et ne touche à rien ...
--> Poste le rapport qui apparait à la fin , sur le forum ...
( le rapport est sauvegardé aussi sous C:\FindyKill.txt )
( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )
Aides en images : http://pagesperso-orange.fr/NosTools/findykill.html -
Bonsoir,
Est ce que quand tu essaye d'ouvrir un.exe il te mets ce n'est pas une application win 32 valide? -
Bonsoir et merci de prendre le temps de m'aider,
Ci dessous le raport effectué :
############################## | FindyKill V5.022 |
# User : mickael (Administrateurs) # MICO-325BBB3914
# Update on 24/12/2009 by Chiquitine29
# Start at: 23:33:52 | 27/12/2009
# Website : http://pagesperso-orange.fr/NosTools/index.html
# Contact : FindyKill.Contact@gmail.com
# Intel(R) Pentium(R) 4 CPU 3.06GHz
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 2
# Internet Explorer 6.0.2900.2180
# Windows Firewall Status : Enabled
# AV : avast! antivirus 4.8.1356 [VPS 091226-0] 4.8.1356 [ (!) Disabled | Updated ]
# C:\ # Disque fixe local # 232,88 Go (75,76 Go free) # NTFS
# D:\ # Disque amovible
# E:\ # Disque amovible
# F:\ # Disque amovible
# G:\ # Disque amovible
# H:\ # Disque amovible
# I:\ # Disque CD-ROM # 1,86 Go (0 Mo free) [Symantec_V_8_5] # CDFS
# J:\ # Disque amovible
# K:\ # Disque fixe local # 465,65 Go (316,52 Go free) [LaCie] # FAT32
############################## | Processus actifs |
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\TRENDnet\TEW-424UB\SiSWLSvc.exe
C:\Program Files\TRENDnet\TEW-424UB\Logon.tmp
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\mickael.MICO-325BBB3914\Application Data\drivers\winupgro.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\wintems.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
############################## | Processus infectieux stoppés |
"C:\Documents and Settings\mickael.MICO-325BBB3914\Application Data\drivers\winupgro.exe" (528)
"C:\WINDOWS\wintems.exe" (2340)
################## | C: |
Présent ! I:\autorun.inf
################## | C:\WINDOWS |
Présent ! C:\WINDOWS\ban_list.txt
Présent ! C:\WINDOWS\mdelk.exe
Présent ! C:\WINDOWS\wintems.exe
Présent ! C:\WINDOWS\Prefetch\101203.EXE-0430E8CB.pf
Présent ! C:\WINDOWS\Prefetch\104718.EXE-2355E75B.pf
Présent ! C:\WINDOWS\Prefetch\111890.EXE-16A74A9C.pf
Présent ! C:\WINDOWS\Prefetch\15778359.EXE-1B1D2FF4.pf
Présent ! C:\WINDOWS\Prefetch\15786343.EXE-3780AC6E.pf
Présent ! C:\WINDOWS\Prefetch\911250.EXE-267D7747.pf
Présent ! C:\WINDOWS\Prefetch\920609.EXE-29E80C93.pf
Présent ! C:\WINDOWS\Prefetch\95609.EXE-09DACB5E.pf
Présent ! C:\WINDOWS\Prefetch\MDELK.EXE-087EF2B4.pf
Présent ! C:\WINDOWS\Prefetch\WINTEMS.EXE-127B61D4.pf
################## | C:\WINDOWS\system32 |
Présent ! C:\WINDOWS\system32\srosa2.sys
Présent ! C:\WINDOWS\system32\wfsintwq.sys
################## | C:\WINDOWS\system32\drivers |
################## | C:\DOCUME~1\MICKAE~1.MIC\APPLIC~1 |
Présent ! C:\DOCUME~1\MICKAE~1.MIC\APPLIC~1\drivers
Présent ! C:\DOCUME~1\MICKAE~1.MIC\APPLIC~1\drivers\downld
Présent ! C:\DOCUME~1\MICKAE~1.MIC\APPLIC~1\drivers\winupgro.exe
################## | Temporary Internet Files |
################## | Registre / Clés infectieuses |
Présent ! [HKLM\SYSTEM\CurrentControlSet\Services\sK9Ou0s]
Présent ! [HKLM\SYSTEM\ControlSet001\Services\sK9Ou0s]
Présent ! [HKLM\SYSTEM\ControlSet002\Services\sK9Ou0s]
Présent ! [HKLM\SYSTEM\CurrentControlSet\Services\srosa]
Présent ! [HKLM\SYSTEM\ControlSet001\Services\srosa]
Présent ! [HKLM\SYSTEM\ControlSet002\Services\srosa]
Présent ! [HKLM\SYSTEM\ControlSet004\Services\srosa]
Présent ! [HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S]
Présent ! [HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S]
Présent ! [HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S]
Présent ! [HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA]
Présent ! [HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA]
Présent ! [HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA]
Présent ! [HKCU\Software\bisoft]
Présent ! [HKCU\Software\DateTime4]
Présent ! [HKCU\Software\WS35]
Présent ! [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "drvsyskit"
Présent ! [HKU\S-1-5-21-1085031214-1547161642-725345543-1005\Software\Microsoft\Windows\CurrentVersion\Run] "drvsyskit"
Présent ! [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "german.exe"
Présent ! [HKU\S-1-5-21-1085031214-1547161642-725345543-1005\Software\Microsoft\Windows\CurrentVersion\Run] "german.exe"
Présent ! [HKU\S-1-5-21-1085031214-1547161642-725345543-1005\Software\bisoft]
Présent ! [HKU\S-1-5-21-1085031214-1547161642-725345543-1005\Software\DateTime4]
Présent ! [HKCU\Software\Local AppWizard-Generated Applications\winupgro]
Présent ! [HKU\S-1-5-21-1085031214-1547161642-725345543-1005\Software\Local AppWizard-Generated Applications\winupgro]
################## | Etat / Services / Informations |
# Affichage des fichiers cachés : OK
Clé manquante : HKLM\...\SafeBoot | Mode sans echec non fonctionnel !
# (!) Ndisuio -> Start = 4 ( Good = 3 | Bad = 4 )
# (!) Ip6Fw -> Start = 4 ( Good = 2 | Bad = 4 )
# SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 )
# (!) wuauserv -> Start = 4 ( Good = 2 | Bad = 4 )
# (!) wscsvc -> Start = 4 ( Good = 2 | Bad = 4 )
################## | Cracks / Keygens / Serials |
"C:\Documents and Settings\mickael.MICO-325BBB3914\Mes documents\Ciel Devis Factures 3.00 FR\Crack Ciel\Crack.exe"
03/10/2003 19:04 |Size 15427 |Crc32 d696d21a |Md5 bac501b39d31185c961a76626aa83d3a
################## | ! Fin du rapport # FindyKill V5.022 ! |
++-
belle infection bagle
"C:\Documents and Settings\mickael.MICO-325BBB3914\Mes documents\Ciel Devis Factures 3.00 FR\Crack Ciel\Crack.exe"
03/10/2003 19:04 |Size 15427 |Crc32 d696d21a |Md5 bac501b39d31185c961a76626aa83d3a
C'est ceci qui a infecté ton PC supprime le
lit ceci sur le danger des cracks en cliquant sur ce lien:
https://forum.malekal.com/viewtopic.php?t=893&start=
Déconnecte toi et ferme toutes application en cours, ainsi que le navigateur
• Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...)
• Relance FindyKill présent sur le bureau, tape sur F pour le français, puis appuie sur la touche entrée
• Sélectionne l'option 2 (suppression), puis appuie sur la touche entrée
• Le pc va redémarrer automatiquement ...
▶Laisse l'outil travailler, et ne touche à rien,ton bureau ne sera pas accessible c'est normal !
--> Poste le rapport qui apparait à la fin ( le rapport est sauvegardé aussi sous C:\FindyKill.txt )
Note:Si le Bureau ne réapparait pas, presse Ctrl + Alt + Suppr , aller dans Onglet "Processus",
cliquer sur "fichier", sélectionner "nouvelle tâche", taper explorer.exe, puis valider
Aides en images : http://pagesperso-orange.fr/NosTools/findykill.html
-
-
tu es arrivé avant moi mince, nathandre je te laisse la suite.
-
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question -
-
ci joint lien rapport 2
http://www.cijoint.fr/cjlink.php?file=cj200912/cijVazsJX7.txt
merci -
Tu as de la chance la plupart des fichiers corrompus on pu être réparé avec succès.
Mais d'autre non.
-
Oui c'est déja beaucoup mieux,
Le centre de sécurité est actif maintenant .
Que dois je faire de plus ... -
attendre nathandre pour qu'elle te donne la suite pour réparer les fichiers corrompus par bagle.
-
-
bonjour
C'est mieux déjà
Findykill a nettoyé pas mal de cochonneries
On va faire un bilan de l'état du PC, car bagle a fait pas mal de dégats
Pense à supprimer le crack
Télécharge Random's System Information Tool (RSIT) de random/random et enregistre l'exécutable sur ton Bureau.
- http://images.malwareremoval.com/random/RSIT.exe
! Déconnecte toi et ferme toutes tes applications en cours !
* Double-clique sur RSIT.exe pour le lancer .
* Une première fenêtre s'ouvre avec en titre : Disclaimer of warranty .
* Devant l'option List files/folders created ... , tu choisis 2 months
* Clique ensuite sur Continue pour lancer l'analyse ...
* Laisse faire le scan et ne touche pas au PC ...
* Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront (probablement avec le bloc-note).
* Héberge le contenu de log.txt (c'est celui qui apparait à l'écran), ainsi que de info.txt ici.
Clique sur parcourir
Une fois que tu as trouvé les rapports à héberger, clique sur ouvrir
Clique sur Cliquez ici pour déposer le fichier, puis donne le lien
qui apparait comme ceci http:/www.cijoint.fr/cjlink.php?file=cj200911/cijgAdC3Ch.txt
Note : les rapports seront en outre sauvegardés dans ce dossier C:\rsit
-
-
ok
ci joint lien rapport rsit
http://www.cijoint.fr/cjlink.php?file=cj200912/cijfzXrRWm.txt -
Ton antivirus fonctionne-t-il ?
Télécharge malwarebytes' anti-malware
https://www.commentcamarche.net/telecharger/securite/14361-malwarebytes-anti-malware/
Enregistre le sur le bureau
Double-clique sur l'icône Download_mbam-setup.exe pour lancer le processus d'installation
Si la pare-feu demande l'autorisation de se connecter pour malwarebytes, accepte
Il va se mettre à jour une fois faite
Va dans l'onglet recherche
Sélectionne exécuter un examen complet
Clique sur rechercher
Le scan démarre
A la fin de l'analyse, le message s'affiche: L'examen s'est terminé normalement.
Clique sur afficher les résultats pour afficher les objets trouvés
Clique sur OK pour pousuivre
Si des malwares ont été détectés, cliquer sur afficher les résultats
Sélectionne tout (ou laisser coché)
Clique sur supprimer la sélection
Malwarebytes va détruire les fichiers et les clés de registre et en mettre une
copie dans la quarantaine
Malewarebytes va ouvrir le bloc-note et y copier le rapport
Redémarre le PC
Une fois redémarré, double-clique sur Malewarebytes
Va dans l'onglet rapport/log
Clique dessus pour l'afficher une fois affiché, cliquer sur édition en haut du
bloc-note puis sur sélectionner tout
Revient sur édition, puis sur copier et revient sur le forum et dans ta réponse
Clic droit dans le cadre de la réponse et coller -
Salut
Et encore merci pour ton aide.
Oui mon AV foncionne(avast).Je l'ai désactivé pour faire l'analyse.
Ci dessous rapport ,par contre il n'a pas pus supprimer tout apparement..
Malwarebytes' Anti-Malware 1.42
Version de la base de données: 3443
Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180
28/12/2009 18:27:56
mbam-log-2009-12-28 (18-27-56).txt
Type de recherche: Examen complet (C:\|)
Eléments examinés: 247256
Temps écoulé: 3 hour(s), 12 minute(s), 30 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 6
Fichier(s) infecté(s): 127
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
C:\WINDOWS\system32\smimsgif32.dll (Trojan.Agent) -> Delete on reboot.
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
C:\Program Files\Gold VIP Club Casino (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\installed (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\temp (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\_patch (Adware.Casino) -> Quarantined and deleted successfully.
Fichier(s) infecté(s):
C:\System Volume Information\_restore{8F6DAD51-D658-40B2-94FA-BC34BF0FC08B}\RP9\A0003900.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{8F6DAD51-D658-40B2-94FA-BC34BF0FC08B}\RP9\A0003824.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{8F6DAD51-D658-40B2-94FA-BC34BF0FC08B}\RP9\A0004045.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{8F6DAD51-D658-40B2-94FA-BC34BF0FC08B}\RP9\A0004050.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{8F6DAD51-D658-40B2-94FA-BC34BF0FC08B}\RP9\A0004088.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{8F6DAD51-D658-40B2-94FA-BC34BF0FC08B}\RP9\A0004102.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{8F6DAD51-D658-40B2-94FA-BC34BF0FC08B}\RP9\A0004820.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{8F6DAD51-D658-40B2-94FA-BC34BF0FC08B}\RP9\A0004943.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{8F6DAD51-D658-40B2-94FA-BC34BF0FC08B}\RP9\A0005695.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\smimsgif32.dll (Trojan.Agent) -> Delete on reboot.
C:\Program Files\Gold VIP Club Casino\menu.txt (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\installed\Blackjack - Common (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\installed\Blackjack - Standard (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\installed\Extgame (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\installed\Fonts - Latin (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\installed\Lobby (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\installed\packages (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\installed\SmartDownload (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\action_button.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\bj.en.st.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\blackjack32.en.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\card.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\cards32.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino.bd1.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino.chf.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino.cny.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino.en.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino.en.st.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino.eur.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino.gbp.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino.myr.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino.pen.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino.php.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino.pln.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino.rub.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino.usd.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino.zar.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino32.en.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino32.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips.bd1.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips.chf.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips.cny.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips.eur.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips.gbp.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips.myr.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips.pen.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips.php.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips.pln.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips.rub.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips.usd.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips.zar.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips32.chf.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips32.cny.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips32.eur.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips32.myr.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips32.pen.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips32.php.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips32.pln.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips32.rub.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips32.usd.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips32.zar.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\downloaddlg.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\exit.en.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\extgame.en.st.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\history.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\lobby.en.st.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\lobby.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\logos.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\options_new.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\rings.en.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\table.en.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\table.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\tables32.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\tbslot.en.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\Blackjack.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\Bust.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\cmn000.wav (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\cmn001.wav (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\cmn002.wav (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\cmn003.wav (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\cmn004.wav (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\cmn005.wav (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\cmn007.wav (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_00.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_01.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_02.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_03.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_04.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_05.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_06.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_07.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_08.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_09.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_10.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_11.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_12.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_13.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_14.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_15.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_16.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_17.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_18.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_19.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_20.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_21.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_22.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_23.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_24.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_25.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_26.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_27.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_28.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_29.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_30.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_31.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_32.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_33.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_34.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_35.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_36.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\Insurance.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\PlayerWins.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\Push.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\ShoeCardSound.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\Win.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\temp\loading.html (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\_patch\package_list.ini.crc (Adware.Casino) -> Quarantined and deleted successfully. -
Ok c'est fait.
Si c'est terminé je te remerci vraiment beaucoup de ton aide.
Bonne continuation.
MS -
Bonjour,
CI dessous rapport RSTI
Logfile of random's system information tool 1.06 (written by random/random)
Run by mickael at 2009-12-29 04:43:24
Microsoft Windows XP Édition familiale Service Pack 2
System drive C: has 76 GB (32%) free of 238 GB
Total RAM: 1023 MB (60% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 04:43:31, on 29/12/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\TRENDnet\TEW-424UB\TRENDnet.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\TRENDnet\TEW-424UB\SiSWLSvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\eMule\emule.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\mickael.MICO-325BBB3914\Bureau\RSIT.exe
C:\Program Files\trend micro\HijackThis\mickael.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://webmail.aliceadsl.fr//
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://portail.free.fr/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll (file missing)
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [OPSE reminder] "C:\Program Files\ScanSoft\OmniPageSE2.0\EregFre\Ereg.exe" -r "C:\Program Files\ScanSoft\OmniPageSE2.0\EregFre\ereg.ini"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: IDETool.lnk = C:\Program Files\IDETOOL\IDETOOL.EXE
O4 - Global Startup: Wireless Configuration Utility HW.32.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_5F1A57F0B9B89E2E.dll/cmsidewiki.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Lucky Emperor Casino - 5350BDE3-CED8-46D8-816C-BE4E2AC0AAD9 - C:\Microgaming\Casino\LuckyEmperor\Casinogame.exe (HKCU)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/fr/scan8/oscan8.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - https://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://fichiers.touslesdrivers.com/maconfig/MaConfig_3_5_2_1.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: SiS WirelessLan Service (SiSWLSvc) - Unknown owner - C:\Program Files\TRENDnet\TEW-424UB\SiSWLSvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
-
Rapport C:\WINDOWS\system32\vfwwdm32.dll :
File size: 54784 bytes
MD5 : e55975fa0bc5934d5604b1a17eb81c4c
SHA1 : f96b14a39dafe2db63cd25359c4dd4ff9196716b
SHA256: 2c849b5b8dc4f36023f9fdb9d6b4017d4b5297203d15cddc7d7ee7589ce7b5d2
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x4B1F
timedatestamp.....: 0x41109623 (Wed Aug 4 09:54:11 2004)
machinetype.......: 0x14C (Intel I386)
( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x999D 0x9A00 6.43 a0c0f2de40768cdb614f3c1ec462cb16
.data 0xB000 0x624 0x600 2.38 bbac1cf162c1ab256474a8ebf59ab438
.rsrc 0xC000 0x2910 0x2A00 3.83 98808e67c661872f1695260736686a98
.reloc 0xF000 0x648 0x800 4.63 353fa6eaa43e6620c96f74b0ff60d449
( 9 imports )
> advapi32.dll: RegQueryValueExA, RegSetValueExA, RegCloseKey, RegCreateKeyExA
> comctl32.dll: PropertySheetA, -, CreatePropertySheetPageA
> kernel32.dll: FreeLibrary, InterlockedDecrement, InterlockedIncrement, WideCharToMultiByte, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, GetSystemTimeAsFileTime, GetCurrentProcessId, GetCurrentThreadId, GetTickCount, QueryPerformanceCounter, CreateThread, SetThreadPriority, ResumeThread, ExitThread, WaitForMultipleObjectsEx, SetEvent, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSection, OutputDebugStringA, LoadLibraryA, GetProcAddress, GetModuleHandleA, VirtualAlloc, CreateEventA, GetLastError, VirtualFree, CloseHandle, GetOverlappedResult, CancelIo, WaitForSingleObject, DeviceIoControl
> ksuser.dll: KsCreatePin
> msvcrt.dll: strtol, __2@YAPAXI@Z, _purecall, __3@YAXPAX@Z, _except_handler3, wcscmp
> ole32.dll: CoUninitialize, CoInitialize, CoCreateInstance, CoTaskMemFree
> oleaut32.dll: -, -
> user32.dll: SetForegroundWindow, LoadCursorA, RegisterClassA, CreateWindowExA, GetWindowRect, GetClientRect, DefWindowProcA, PostQuitMessage, GetMessageA, DispatchMessageA, GetClassInfoA, UnregisterClassA, GetWindowLongA, WinHelpA, SetWindowLongA, GetParent, IsWindowEnabled, EnableWindow, wsprintfA, SetWindowTextA, ShowWindow, LoadStringA, MessageBoxA, FindWindowA, GetDlgItem, SendMessageA
> winmm.dll: timeGetTime, DefDriverProc, DriverCallback
( 1 exports )
> DllMain, DriverProc, VfwWdm
TrID : File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
ssdeep: 1536:EdXnUid2Jk80sFwOpIy3Xja+8/HJpcSws:qnUbBwOdLippcSws
PEiD : -
RDS : NSRL Reference Data Set
( Microsoft )
MSDN Disc 2439.6: vfwwdm32.dllMSDN Disc 2439.7: vfwwdm32.dllMSDN Disc 2439.8: vfwwdm32.dll -
Et rapport C:\WINDOWS\IsUn040c.exe :
a-squared 4.5.0.43 2009.12.29 -
AhnLab-V3 5.0.0.2 2009.12.29 -
AntiVir 7.9.1.122 2009.12.29 -
Antiy-AVL 2.0.3.7 2009.12.29 -
Authentium 5.2.0.5 2009.12.29 -
Avast 4.8.1351.0 2009.12.29 -
AVG 8.5.0.430 2009.12.29 -
BitDefender 7.2 2009.12.29 -
CAT-QuickHeal 10.00 2009.12.29 -
ClamAV 0.94.1 2009.12.29 -
Comodo 3404 2009.12.29 -
DrWeb 5.0.1.12222 2009.12.29 -
eSafe 7.0.17.0 2009.12.28 -
eTrust-Vet 35.1.7203 2009.12.29 -
F-Prot 4.5.1.85 2009.12.28 -
F-Secure 9.0.15370.0 2009.12.29 -
Fortinet 4.0.14.0 2009.12.29 -
GData 19 2009.12.29 -
Ikarus T3.1.1.79.0 2009.12.29 -
Jiangmin 13.0.900 2009.12.29 -
K7AntiVirus 7.10.932 2009.12.28 -
Kaspersky 7.0.0.125 2009.12.29 -
McAfee 5845 2009.12.28 -
McAfee+Artemis 5845 2009.12.28 -
McAfee-GW-Edition 6.8.5 2009.12.29 Heuristic.BehavesLike.Win32.Virus.I
Microsoft 1.5302 2009.12.29 -
NOD32 4725 2009.12.29 -
Norman 6.04.03 2009.12.29 -
nProtect 2009.1.8.0 2009.12.29 -
Panda 10.0.2.2 2009.12.15 -
PCTools 7.0.3.5 2009.12.29 -
Prevx 3.0 2009.12.29 -
Rising 22.28.01.03 2009.12.29 -
Sophos 4.49.0 2009.12.29 -
Sunbelt 3.2.1858.2 2009.12.29 -
Symantec 1.4.4.12 2009.12.29 -
TheHacker 6.5.0.3.117 2009.12.29 -
TrendMicro 9.120.0.1004 2009.12.29 -
VBA32 3.12.12.1 2009.12.28 -
ViRobot 2009.12.29.2114 2009.12.29 -
VirusBuster 5.0.21.0 2009.12.28 -
Information additionnelle
File size: 308224 bytes
MD5...: e40c1867d16dd880e7a6c8156d06d27e
SHA1..: 02682854f0124997099e785624f8b88af7ac4b21
SHA256: e0f833d101bb27cbc60ca56f3532fb75a79895942a5e56f277daa83cca7a4a17
ssdeep: 6144:QPDRrOpaOzOziasZ6wMaWJ5JEMItbsdVeFkCA:2DkZdFvMao5KrxsdE+CA
PEiD..: -
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x1c330
timedatestamp.....: 0x3638e561 (Thu Oct 29 22:00:01 1998)
machinetype.......: 0x14c (I386)
( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x1f315 0x1f400 6.24 fd4f4cbddcd33f76b523739b629cc3b3
.rdata 0x21000 0x1c0c 0x1e00 5.39 01668df29e4d91578a2309cc44649fc8
.data 0x23000 0x4a7c 0x3800 2.51 8383ed0cfd9809552c7023805b5c9170
.rsrc 0x28000 0x27000 0x26600 6.04 208474b19d2ae8af3c23c54e43dea29e
( 7 imports )
> KERNEL32.dll: DosDateTimeToFileTime, GetPrivateProfileStringA, GetCurrentProcess, LocalFileTimeToFileTime, SetFileTime, MoveFileExA, SetFilePointer, WriteFile, MoveFileA, GetFileAttributesA, lstrcmpA, SetEndOfFile, lstrcpynA, GetLocalTime, SetCurrentDirectoryA, GetDriveTypeA, GetDiskFreeSpaceA, CreateDirectoryA, GetLastError, GetCurrentThread, GetCurrentDirectoryA, GlobalReAlloc, FileTimeToLocalFileTime, GetFileTime, FileTimeToDosDateTime, GetPrivateProfileSectionA, SetFileAttributesA, DeleteFileA, FindNextFileA, FindClose, WinExec, Sleep, GetModuleFileNameA, GetSystemDefaultLCID, MulDiv, GetWindowsDirectoryA, GetTickCount, lstrcatA, lstrcmpiA, lstrlenA, lstrcpyA, CreateFileA, GetFileSize, GlobalAlloc, CloseHandle, GlobalLock, ReadFile, GlobalUnlock, GetModuleHandleA, GetSystemInfo, FindResourceA, LoadResource, SizeofResource, FreeResource, LockResource, OpenFile, _hwrite, _lclose, GetVersion, IsDBCSLeadByte, GetSystemDirectoryA, WriteProfileSectionA, WritePrivateProfileSectionA, WritePrivateProfileStringA, GlobalCompact, WriteProfileStringA, GetFileType, LCMapStringA, GetProfileSectionA, GlobalHandle, SetErrorMode, GlobalFree, LoadLibraryA, GetProcAddress, FreeLibrary, FindFirstFileA, RemoveDirectoryA, RtlUnwind, GetStdHandle, SetHandleCount, GetOEMCP, GetACP, GetCPInfo, WideCharToMultiByte, GetEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsW, MultiByteToWideChar, FreeEnvironmentStringsA, UnhandledExceptionFilter, TerminateProcess, VirtualAlloc, VirtualFree, HeapCreate, HeapDestroy, GetSystemTime, GetTimeZoneInformation, ExitProcess, GetCommandLineA, GetStartupInfoA, HeapFree, HeapAlloc, LCMapStringW, GetStringTypeA, GetStringTypeW, CompareStringA, CompareStringW, SetEnvironmentVariableA, HeapReAlloc
> USER32.dll: SetDlgItemTextA, LoadStringA, MessageBoxA, EndDialog, DialogBoxParamA, wsprintfA, PeekMessageA, SendDlgItemMessageA, BeginPaint, EndPaint, DefWindowProcA, LoadCursorA, GetClassInfoA, OemToCharA, KillTimer, PostQuitMessage, RegisterClassA, GetSysColor, IsDialogMessageA, CharLowerA, CreateWindowExA, EnableWindow, GetWindow, GetClassNameA, CharUpperA, GetWindowTextA, GetDlgItem, SendMessageA, PostMessageA, SetWindowTextA, GetSystemMetrics, SetWindowPos, ShowWindow, UpdateWindow, SetFocus, IsWindow, RegisterWindowMessageA, GetDC, ReleaseDC, ScreenToClient, SetTimer, LoadIconA, DestroyWindow, LoadBitmapA, CreateDialogParamA, InvalidateRect, IsWindowVisible, CharNextA, InflateRect, CharPrevA, CharToOemA, DdeGetData, DdeFreeDataHandle, DdeConnect, DdeClientTransaction, DdeGetLastError, DdeDisconnect, DdeFreeStringHandle, DdeUninitialize, DdeInitializeA, DdeCreateStringHandleA, ExitWindowsEx, FindWindowA, GetClientRect, FillRect, SetRect, SetRectEmpty, GetWindowLongA, GetWindowRect, DispatchMessageA, TranslateMessage, MessageBeep
> GDI32.dll: CreateDIBitmap, SelectPalette, GetDeviceCaps, CreatePalette, GetSystemPaletteEntries, LineTo, MoveToEx, DeleteObject, CreatePen, CreateFontIndirectA, GetObjectA, DeleteDC, BitBlt, CreateCompatibleDC, RestoreDC, Rectangle, GetStockObject, CreateSolidBrush, IntersectClipRect, SaveDC, CreateCompatibleBitmap, SetBkColor, CreateBitmap, SetPixel, GetTextExtentPointA, SelectObject, RealizePalette
> comdlg32.dll: GetOpenFileNameA, GetSaveFileNameA
> ADVAPI32.dll: AllocateAndInitializeSid, RegCloseKey, RegConnectRegistryA, AdjustTokenPrivileges, LookupPrivilegeValueA, OpenProcessToken, CloseServiceHandle, OpenSCManagerA, FreeSid, RegCreateKeyExA, SetSecurityDescriptorOwner, InitializeSecurityDescriptor, RegOpenKeyA, RegDeleteKeyA, RegEnumKeyA, RegSetValueExA, RegQueryValueExA, RegDeleteValueA, RegEnumValueA, EqualSid, GetTokenInformation, OpenThreadToken
> SHELL32.dll: SHGetSpecialFolderLocation, SHGetPathFromIDListA
> VERSION.dll: GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA
( 0 exports )
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
sigcheck:
publisher....: InstallShield Software Corporation
copyright....: Copyright(c) 1990-1998 InstallShield Software Corporation Phone : (847) 240-9111
product......: InstallShield_ unInstaller
description..: InstallShield_ unInstaller
original name: n/a
internal name: n/a
file version.: 5, 51, 138, 0
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
. -
Excuse j'avais pas vu,
voila
Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.43 2009.12.29 -
AhnLab-V3 5.0.0.2 2009.12.29 -
AntiVir 7.9.1.122 2009.12.29 -
Antiy-AVL 2.0.3.7 2009.12.29 -
Authentium 5.2.0.5 2009.12.29 -
Avast 4.8.1351.0 2009.12.29 -
AVG 8.5.0.430 2009.12.29 -
BitDefender 7.2 2009.12.29 -
CAT-QuickHeal 10.00 2009.12.29 -
ClamAV 0.94.1 2009.12.29 -
Comodo 3403 2009.12.29 -
DrWeb 5.0.1.12222 2009.12.29 -
eSafe 7.0.17.0 2009.12.28 -
eTrust-Vet None 2009.12.29 -
F-Prot 4.5.1.85 2009.12.28 -
F-Secure 9.0.15370.0 2009.12.29 -
Fortinet 4.0.14.0 2009.12.29 -
GData 19 2009.12.29 -
Ikarus T3.1.1.79.0 2009.12.29 -
Jiangmin 13.0.900 2009.12.29 -
K7AntiVirus 7.10.932 2009.12.28 -
Kaspersky 7.0.0.125 2009.12.29 -
McAfee 5845 2009.12.28 -
McAfee+Artemis 5845 2009.12.28 -
McAfee-GW-Edition 6.8.5 2009.12.29 -
Microsoft 1.5302 2009.12.29 -
NOD32 4725 2009.12.29 -
Norman 6.04.03 2009.12.29 -
nProtect 2009.1.8.0 2009.12.29 -
Panda 10.0.2.2 2009.12.15 -
PCTools 7.0.3.5 2009.12.29 -
Prevx 3.0 2009.12.29 -
Rising 22.28.01.03 2009.12.29 -
Sophos 4.49.0 2009.12.29 -
Sunbelt 3.2.1858.2 2009.12.29 -
Symantec 1.4.4.12 2009.12.29 -
TheHacker 6.5.0.3.117 2009.12.29 -
TrendMicro 9.120.0.1004 2009.12.29 -
VBA32 3.12.12.1 2009.12.28 -
ViRobot 2009.12.29.2114 2009.12.29 -
VirusBuster 5.0.21.0 2009.12.28 -
Information additionnelle
File size: 54784 bytes
MD5 : e55975fa0bc5934d5604b1a17eb81c4c
SHA1 : f96b14a39dafe2db63cd25359c4dd4ff9196716b
SHA256: 2c849b5b8dc4f36023f9fdb9d6b4017d4b5297203d15cddc7d7ee7589ce7b5d2
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x4B1F
timedatestamp.....: 0x41109623 (Wed Aug 4 09:54:11 2004)
machinetype.......: 0x14C (Intel I386)
( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x999D 0x9A00 6.43 a0c0f2de40768cdb614f3c1ec462cb16
.data 0xB000 0x624 0x600 2.38 bbac1cf162c1ab256474a8ebf59ab438
.rsrc 0xC000 0x2910 0x2A00 3.83 98808e67c661872f1695260736686a98
.reloc 0xF000 0x648 0x800 4.63 353fa6eaa43e6620c96f74b0ff60d449
( 9 imports )
> advapi32.dll: RegQueryValueExA, RegSetValueExA, RegCloseKey, RegCreateKeyExA
> comctl32.dll: PropertySheetA, -, CreatePropertySheetPageA
> kernel32.dll: FreeLibrary, InterlockedDecrement, InterlockedIncrement, WideCharToMultiByte, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, GetSystemTimeAsFileTime, GetCurrentProcessId, GetCurrentThreadId, GetTickCount, QueryPerformanceCounter, CreateThread, SetThreadPriority, ResumeThread, ExitThread, WaitForMultipleObjectsEx, SetEvent, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSection, OutputDebugStringA, LoadLibraryA, GetProcAddress, GetModuleHandleA, VirtualAlloc, CreateEventA, GetLastError, VirtualFree, CloseHandle, GetOverlappedResult, CancelIo, WaitForSingleObject, DeviceIoControl
> ksuser.dll: KsCreatePin
> msvcrt.dll: strtol, __2@YAPAXI@Z, _purecall, __3@YAXPAX@Z, _except_handler3, wcscmp
> ole32.dll: CoUninitialize, CoInitialize, CoCreateInstance, CoTaskMemFree
> oleaut32.dll: -, -
> user32.dll: SetForegroundWindow, LoadCursorA, RegisterClassA, CreateWindowExA, GetWindowRect, GetClientRect, DefWindowProcA, PostQuitMessage, GetMessageA, DispatchMessageA, GetClassInfoA, UnregisterClassA, GetWindowLongA, WinHelpA, SetWindowLongA, GetParent, IsWindowEnabled, EnableWindow, wsprintfA, SetWindowTextA, ShowWindow, LoadStringA, MessageBoxA, FindWindowA, GetDlgItem, SendMessageA
> winmm.dll: timeGetTime, DefDriverProc, DriverCallback
( 1 exports )
> DllMain, DriverProc, VfwWdm
TrID : File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
ssdeep: 1536:EdXnUid2Jk80sFwOpIy3Xja+8/HJpcSws:qnUbBwOdLippcSws
PEiD : -
RDS : NSRL Reference Data Set
( Microsoft )
MSDN Disc 2439.6: vfwwdm32.dllMSDN Disc 2439.7: vfwwdm32.dllMSDN Disc 2439.8: vfwwdm32.dll
ATTENTION: VirusTotal est un service gratuit offert par Hispasec Sistemas. Il n'y a aucune garantie quant à la disponibilité et la continuité de ce service. Bien que le taux de détection permis par l'utilisation de multiples moteurs antivirus soit bien supérieur à celui offert par seulement un produit, ces résultats NE garantissent PAS qu'un fichier est sans danger. Il n'y a actuellement aucune solution qui offre un taux d'efficacité de 100% pour la détection des virus et malwares.-
2009-12-26 11:56:03 ----RA---- C:\WINDOWS\SETC9.tmp
2009-12-26 11:56:03 ----RA---- C:\WINDOWS\SETC7.tmp
2009-12-26 11:56:02 ----RA---- C:\WINDOWS\SETC6.tmp
2009-12-26 11:56:02 ----RA---- C:\WINDOWS\SETC4.tmp
2009-12-26 11:56:02 ----RA---- C:\WINDOWS\SETC3.tmp
2009-12-26 11:55:56 ----RA---- C:\WINDOWS\SET90.tmp
2009-12-26 11:55:53 ----RA---- C:\WINDOWS\SET7F.tmp
2009-12-26 11:55:51 ----RA---- C:\WINDOWS\SET7C.tmp
2009-12-25 08:24:04 ----RA---- C:\WINDOWS\SET88.tmp
2009-12-25 08:24:04 ----RA---- C:\WINDOWS\SET87.tmp
2009-12-25 08:24:04 ----RA---- C:\WINDOWS\SET86.tmp
2009-12-25 08:24:04 ----RA---- C:\WINDOWS\SET85.tmp
2009-12-25 08:24:04 ----RA---- C:\WINDOWS\SET84.tmp
2009-12-25 08:24:01 ----RA---- C:\WINDOWS\SET51.tmp
2009-12-25 08:23:58 ----RA---- C:\WINDOWS\SET45.tmp
2009-12-25 08:23:56 ----RA---- C:\WINDOWS\SET42.tmp
2009-12-25 00:33:31 ----RA---- C:\WINDOWS\SETCB.tmp
2009-12-25 00:32:50 ----RA---- C:\WINDOWS\SETC8.tmp
2009-12-25 00:31:55 ----RA---- C:\WINDOWS\SETC5.tmp
2009-12-25 00:31:25 ----RA---- C:\WINDOWS\SETC2.tmp
2009-12-25 00:30:34 ----RA---- C:\WINDOWS\SETBF.tmp
2009-12-24 23:02:09 ----RA---- C:\WINDOWS\SET8C.tmp
2009-12-24 22:40:36 ----RA---- C:\WINDOWS\SET80.tmp
2009-12-24 22:31:13 ----RA---- C:\WINDOWS\SET7D.tmp
pourrai tu supprimer tout ces fichiers en mode sans échec, puis vide la corbeille
-
-
Ca y est par contre impossible de demarrer en mode sans echec
Quand redemarre ,F8 ,une fenetre bleu demande de choisir,je fais entrer et il se ralume normalement sur le bureau sans demander l'option sans echec-
laisse tomber pour le mode sans échec
Attention, avant de commencer, lit attentivement la procédure, et imprime la
Télécharge ComboFix de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
/!\ Déconnecte-toi du net et DESACTIVES TOUTES LES DEFENSES, antivirus et antispyware y compris /!\
---> Double-clique sur ComboFix.exe
Un "pop-up" va apparaître qui dit que ComboFix est utilisé à vos risques et avec aucune garantie... Clique sur oui pour accepter
SURTOUT INSTALLES LA CONSOLE DE RECUPERATION
---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.
Ne touche à rien(souris, clavier) tant que le scan n'est pas terminé, car tu risques de planter ton PC
En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.
Une fois le scan achevé, un rapport va s'afficher : Poste son contenu
/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\
Note : Le rapport se trouve également là : C:\ComboFix.txt
-
-
Ci joint rapport combofix pas pus installer console resto ,demande acces internet alors que tout désactivé
ComboFix 09-12-28.06 - mickael 29/12/2009 17:47:59.1.2 - x86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.33.1036.18.1023.585 [GMT 1:00]
Lancé depuis: c:\documents and settings\mickael.MICO-325BBB3914\Bureau\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 091229-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\LOG.TXT
c:\windows\a3kebook.ini
c:\windows\akebook.ini
c:\windows\ANS2000.INI
c:\windows\system32\1348e038.dll
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-11-28 au 2009-12-29 ))))))))))))))))))))))))))))))))))))
.
2009-12-28 17:32 . 2007-07-19 00:40 264576 ----a-r- c:\windows\system32\drivers\RTL8187B.sys
2009-12-28 14:11 . 2009-12-28 14:11 -------- d-----w- c:\documents and settings\mickael.MICO-325BBB3914\Application Data\Malwarebytes
2009-12-28 14:11 . 2009-12-03 15:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-28 14:11 . 2009-12-28 14:11 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-12-28 14:11 . 2009-12-28 14:11 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
2009-12-28 14:11 . 2009-12-03 15:13 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-28 14:00 . 2008-10-20 10:22 41216 ----a-w- c:\windows\system32\drivers\Capt905c.sys
2009-12-28 14:00 . 2008-10-20 10:22 26496 ----a-w- c:\windows\system32\drivers\Camd905c.sys
2009-12-28 14:00 . 2009-12-28 14:07 -------- d-----w- c:\program files\MyDSC2
2009-12-28 14:00 . 2009-12-28 14:00 -------- d-----w- c:\documents and settings\mickael.MICO-325BBB3914\Application Data\InstallShield
2009-12-28 13:42 . 2009-12-28 13:42 -------- d-----w- c:\program files\PhoTags Express
2009-12-28 09:24 . 2008-06-14 17:59 272768 -c----w- c:\windows\system32\dllcache\bthport.sys
2009-12-28 09:16 . 2008-10-24 11:10 453632 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2009-12-28 09:15 . 2009-08-04 17:05 2059776 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe
2009-12-28 09:15 . 2009-08-04 17:05 2138112 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2009-12-28 09:15 . 2009-08-04 17:05 2017792 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2009-12-27 23:41 . 2009-11-24 23:49 48560 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-12-27 23:41 . 2009-11-24 23:48 23120 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-12-27 23:41 . 2009-11-24 23:47 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-12-27 23:41 . 2009-11-24 23:50 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-12-27 23:41 . 2009-11-24 23:50 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-12-27 23:41 . 2009-11-24 23:50 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-12-27 23:41 . 2009-12-27 23:41 -------- d-----w- c:\program files\Alwil Software
2009-12-27 22:33 . 2009-12-27 23:20 -------- d-----w- C:\FindyKill
2009-12-27 16:34 . 2009-12-27 17:11 -------- d-----w- C:\UsbFix
2009-12-27 15:42 . 2009-12-27 15:42 -------- d-----w- c:\documents and settings\mickael.MICO-325BBB3914\Application Data\Yahoo!
2009-12-27 15:42 . 2009-12-27 15:42 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Yahoo! Companion
2009-12-27 15:42 . 2009-12-27 15:42 -------- d-----w- c:\program files\Yahoo!
2009-12-27 15:11 . 2009-12-28 10:54 -------- d-----w- c:\program files\trend micro
2009-12-27 15:11 . 2009-12-27 15:11 -------- d-----w- C:\rsit
2009-12-27 14:53 . 2009-12-27 14:59 -------- d-----w- c:\program files\ZHPDiag
2009-12-27 12:31 . 2009-12-27 16:21 -------- d-----w- c:\windows\BDOSCAN8
2009-12-27 10:37 . 2009-12-27 10:37 -------- d-----w- c:\program files\Fichiers communs\Symantec Shared
2009-12-26 11:10 . 2004-08-05 12:00 41600 -c--a-w- c:\windows\system32\dllcache\weitekp9.dll
2009-12-26 11:10 . 2004-08-05 12:00 31360 -c--a-w- c:\windows\system32\dllcache\weitekp9.sys
2009-12-26 11:10 . 2004-08-05 12:00 48256 -c--a-w- c:\windows\system32\dllcache\w32.dll
2009-12-26 11:10 . 2004-08-05 12:00 14336 -c--a-w- c:\windows\system32\dllcache\tsprof.exe
2009-12-26 11:08 . 2004-08-05 12:00 36864 -c--a-w- c:\windows\system32\dllcache\iprip.dll
2009-12-26 11:07 . 2003-03-24 14:52 20540 -c--a-w- c:\windows\system32\dllcache\admin.dll
2009-12-26 10:56 . 2004-08-05 12:00 24661 -c--a-w- c:\windows\system32\dllcache\spxcoins.dll
2009-12-26 10:56 . 2004-08-05 12:00 24661 ----a-w- c:\windows\system32\spxcoins.dll
2009-12-26 10:56 . 2004-08-05 12:00 13312 -c--a-w- c:\windows\system32\dllcache\irclass.dll
2009-12-26 10:56 . 2004-08-05 12:00 13312 ----a-w- c:\windows\system32\irclass.dll
2009-12-25 11:47 . 2009-08-04 17:05 2182400 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe
2009-12-25 08:43 . 2009-12-26 11:28 -------- d-----w- c:\program files\QuickTime
2009-12-25 08:40 . 2009-12-25 08:40 -------- d-----w- c:\documents and settings\mickael.MICO-325BBB3914\Local Settings\Application Data\Apple
2009-12-25 08:39 . 2009-12-25 08:39 -------- d-----w- c:\documents and settings\mickael.MICO-325BBB3914\Local Settings\Application Data\Apple Computer
2009-12-25 08:25 . 2009-12-25 08:25 1956072 ----a-w- c:\documents and settings\mickael.MICO-325BBB3914\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
2009-12-25 07:34 . 2004-08-05 12:00 16384 -c--a-w- c:\windows\system32\dllcache\isignup.exe
2009-12-24 09:47 . 2009-12-24 09:47 -------- d-----w- c:\windows\system32\wbem\Repository
2009-12-24 09:46 . 2009-12-24 09:46 -------- d-----w- c:\program files\Roulette Raper v2.5 Trial Version
2009-12-23 10:53 . 2009-12-24 09:45 -------- d-----w- c:\program files\StatistiquesRoulette
2009-12-23 08:55 . 2009-12-23 08:55 -------- d-----w- c:\program files\UX Software
2009-12-21 08:47 . 2009-12-21 08:47 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Azureus
2009-12-21 08:47 . 2009-12-24 09:46 -------- d-----w- c:\documents and settings\mickael.MICO-325BBB3914\Application Data\Azureus
2009-12-21 08:46 . 2009-12-24 09:46 -------- d-----w- c:\program files\Fichiers communs\i4j_jres(2)
2009-12-21 08:46 . 2009-12-24 09:46 -------- d-----w- c:\program files\Vuze(2)
2009-12-20 05:56 . 2009-12-20 05:56 -------- d-----w- C:\5f54b6d673a1dfe1c61fbed224cf4412
2009-12-20 05:55 . 2009-12-26 11:31 -------- d-----w- c:\windows\SxsCaPendDel
2009-12-20 05:49 . 2009-12-20 05:49 146 ----a-w- c:\documents and settings\mickael.MICO-325BBB3914\Local Settings\Application Data\fusioncache.dat
2009-12-20 05:49 . 2009-12-20 05:50 -------- d-----w- c:\documents and settings\mickael.MICO-325BBB3914\Local Settings\Application Data\ApplicationHistory
2009-12-19 23:16 . 2009-12-21 16:08 -------- d-----w- c:\documents and settings\mickael.MICO-325BBB3914\Local Settings\Application Data\Deployment
2009-12-19 23:12 . 2008-07-06 12:06 89088 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2009-12-19 23:12 . 2006-06-29 12:07 14048 ----a-w- c:\windows\system32\spmsg2.dll
2009-12-19 23:10 . 1997-01-16 00:00 71680 ----a-w- c:\windows\ST5UNST.EXE
2009-12-18 02:01 . 2009-12-18 02:01 -------- d-----w- c:\program files\MSXML 4.0
2009-12-17 08:28 . 2009-12-17 08:31 -------- d-----w- c:\documents and settings\mickael.MICO-325BBB3914\Application Data\Canon
2009-12-17 08:14 . 2009-12-17 08:14 -------- d-----w- c:\documents and settings\mickael.MICO-325BBB3914\Application Data\ScanSoft
2009-12-17 08:14 . 2009-12-17 08:14 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\SSScanWizard
2009-12-17 08:14 . 2009-12-17 08:14 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\SSScanAppDataDir
2009-12-17 08:08 . 1995-08-01 03:44 212480 ----a-w- c:\windows\PCDLIB32.DLL
2009-12-17 08:07 . 1998-11-13 12:16 308224 ----a-w- c:\windows\IsUn040c.exe
2009-12-17 08:07 . 2009-12-17 08:07 -------- d-----w- c:\windows\StartHtmico
2009-12-17 08:06 . 2009-12-17 08:06 -------- d--h--w- c:\windows\system32\CanonMP Uninstaller Information
2009-12-17 08:04 . 2004-08-03 21:58 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2009-12-16 22:28 . 2009-12-16 22:28 -------- d-----w- c:\documents and settings\NetworkService.AUTORITE NT\Local Settings\Application Data\Google
2009-12-16 22:23 . 2009-12-16 22:23 -------- d-----w- c:\documents and settings\LocalService.AUTORITE NT\Local Settings\Application Data\Google
2009-12-16 13:11 . 2009-12-23 11:12 -------- d-----w- c:\program files\RouletteSniper
2009-12-15 22:24 . 2009-12-15 22:24 -------- d-----r- c:\documents and settings\LocalService.AUTORITE NT\Favoris
2009-12-15 14:09 . 2004-08-03 22:01 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2009-12-15 13:57 . 2009-12-15 13:57 -------- d-----w- c:\program files\Fichiers communs\Nero
2009-12-15 13:54 . 2009-12-15 13:55 -------- d-----w- c:\windows\LastGood(2).Tmp
2009-12-11 08:01 . 2009-12-11 08:01 -------- d-----w- c:\program files\Crazy Hermit
2009-12-08 21:51 . 2009-12-20 10:18 -------- d-----w- c:\program files\WinRouletteBot V4.0 DEMO
2009-12-08 06:51 . 2009-12-29 12:36 -------- d-----w- C:\Casino
2009-12-02 10:32 . 2009-12-02 10:32 -------- d-----w- c:\program files\Micro Application
2009-12-02 10:28 . 2009-12-15 13:53 -------- d-----w- c:\program files\DAEMON Tools Toolbar
2009-12-02 10:27 . 2009-12-15 13:53 -------- d-----w- c:\documents and settings\mickael.MICO-325BBB3914\Application Data\DAEMON Tools Lite
2009-12-02 10:27 . 2009-12-02 10:28 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\DAEMON Tools Lite
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-29 08:58 . 2009-09-21 11:16 -------- d-----w- c:\documents and settings\mickael.MICO-325BBB3914\Application Data\vlc
2009-12-29 02:30 . 2004-08-05 12:00 649636 ----a-w- c:\windows\system32\perfh00C.dat
2009-12-29 02:30 . 2004-08-05 12:00 134508 ----a-w- c:\windows\system32\perfc00C.dat
2009-12-28 14:00 . 2009-09-20 08:13 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-12-27 22:23 . 2009-09-21 16:29 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft Help
2009-12-27 09:48 . 2009-09-20 08:19 -------- d-----w- c:\program files\Alice
2009-12-26 11:19 . 2009-09-22 10:39 71152 ----a-w- c:\documents and settings\mickael.MICO-325BBB3914\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-26 11:05 . 2009-09-21 10:41 23704 -c--a-w- c:\windows\system32\emptyregdb.dat
2009-12-24 09:46 . 2009-09-21 11:16 -------- d-----w- c:\documents and settings\mickael.MICO-325BBB3914\Application Data\dvdcss
2009-12-17 08:14 . 2009-11-04 14:02 -------- d-----w- c:\program files\Fichiers communs\ScanSoft Shared
2009-12-17 08:07 . 2009-11-04 13:55 -------- d-----w- c:\program files\Canon
2009-12-16 22:23 . 2009-09-20 09:33 -------- d-----w- c:\program files\Google
2009-12-15 16:11 . 2009-11-03 09:50 -------- d-----w- c:\program files\aMSN
2009-12-15 16:11 . 2009-11-04 13:49 -------- d-----w- c:\program files\ImgBurn
2009-12-15 16:11 . 2009-09-20 11:22 -------- d-----w- c:\program files\ma-config.com
2009-12-15 13:57 . 2009-11-20 13:55 -------- d-----w- c:\program files\Pochette Express 2(2)
2009-12-15 13:57 . 2009-10-04 07:00 -------- d-----w- c:\program files\Ahead
2009-12-15 13:57 . 2009-10-04 07:00 -------- d-----w- c:\program files\Fichiers communs\Ahead
2009-12-15 13:57 . 2009-11-23 18:45 -------- d-----w- c:\program files\Fichiers communs\Nero(2)
2009-12-15 13:57 . 2009-11-23 18:45 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Nero
2009-12-15 13:55 . 2009-09-25 13:51 -------- d-----w- c:\program files\Fichiers communs\Adobe
2009-12-15 13:55 . 2009-11-23 22:58 -------- d-----w- c:\program files\Adobe(2)
2009-12-14 16:49 . 2009-09-22 10:13 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\ma-config.com
2009-12-11 08:24 . 2009-11-04 14:00 -------- d-----w- c:\program files\ArcSoft
2009-11-24 23:54 . 2009-09-21 11:17 1280480 ----a-w- c:\windows\system32\aswBoot.exe
2009-11-24 23:51 . 2009-09-21 11:17 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-11-24 23:47 . 2009-09-21 11:17 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-11-23 18:50 . 2009-11-23 18:50 -------- d-----w- c:\documents and settings\mickael.MICO-325BBB3914\Application Data\Nero
2009-11-23 18:45 . 2009-11-23 18:45 -------- d-----w- c:\program files\Nero
2009-11-22 12:03 . 2009-10-26 07:55 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\MGS
2009-11-18 10:13 . 2009-11-18 10:13 112651 ----a-w- c:\windows\hpoins07.dat
2009-11-18 10:13 . 2009-11-18 10:13 -------- d-----w- c:\documents and settings\mickael.MICO-325BBB3914\Application Data\HP
2009-11-12 08:26 . 2009-11-12 08:26 -------- d-----w- c:\documents and settings\mickael.MICO-325BBB3914\Application Data\Sony
2009-11-12 08:26 . 2009-11-12 08:26 -------- d-----w- c:\program files\Sony
2009-11-12 08:25 . 2009-11-12 08:25 -------- d-----w- c:\program files\Sony Setup
2009-11-08 02:05 . 2009-09-21 19:00 -------- d-----w- c:\program files\MSBuild
2009-11-08 02:04 . 2009-11-08 02:04 -------- d-----w- c:\program files\Reference Assemblies
2009-11-08 02:01 . 2009-11-08 02:01 -------- d-----w- c:\program files\MSXML 6.0
2009-11-05 08:05 . 2009-11-05 08:05 -------- d-----w- c:\program files\denouvel
2009-11-04 14:02 . 2009-11-04 14:02 -------- d-----w- c:\program files\ScanSoft
2009-11-04 13:50 . 2009-11-04 13:50 -------- d-----w- c:\documents and settings\mickael.MICO-325BBB3914\Application Data\ImgBurn
2009-11-04 13:45 . 2009-09-27 10:41 456 ----a-w- c:\documents and settings\mickael.MICO-325BBB3914\Application Data\wklnhst.dat
2009-11-04 13:39 . 2009-11-04 13:39 -------- d--h--w- c:\documents and settings\All Users.WINDOWS\Application Data\CanonBJ
2009-10-29 05:46 . 2004-09-29 18:49 666112 ----a-w- c:\windows\system32\wininet.dll
2009-10-29 05:46 . 2004-09-29 18:49 666112 ----a-w- c:\windows\system32\wininet(2)(2)(2).dll
2009-10-29 05:46 . 2004-09-29 18:49 626688 ----a-w- c:\windows\system32\urlmon(2)(2)(2).dll
2009-10-29 05:46 . 2004-09-29 18:49 1506816 ----a-w- c:\windows\system32\shdocvw(2)(2)(2).dll
2009-10-13 16:53 . 2009-10-13 16:53 40960 ----a-r- c:\documents and settings\mickael.MICO-325BBB3914\Application Data\Microsoft\Installer\{86399190-A8D6-4158-86C8-24080024A1F3}\NewShortcut2_86399190A8D6415886C824080024A1F3.exe
2009-10-13 16:53 . 2009-10-13 16:53 40960 ----a-r- c:\documents and settings\mickael.MICO-325BBB3914\Application Data\Microsoft\Installer\{86399190-A8D6-4158-86C8-24080024A1F3}\NewShortcut1_86399190A8D6415886C824080024A1F3.exe
2009-10-13 16:53 . 2009-10-13 16:53 40960 ----a-r- c:\documents and settings\mickael.MICO-325BBB3914\Application Data\Microsoft\Installer\{86399190-A8D6-4158-86C8-24080024A1F3}\ARPPRODUCTICON.exe
2009-10-13 16:53 . 2009-10-13 16:53 2232 ----a-w- c:\windows\java\Packages\Data\R7RJL33B.DAT
2009-10-13 16:53 . 2009-10-13 16:53 155995 ----a-w- c:\windows\java\Packages\1JPN9ZB1.ZIP
2009-10-13 16:53 . 2009-10-13 16:53 2678 ----a-w- c:\windows\java\Packages\Data\QGBZDZVN.DAT
2009-10-13 16:53 . 2009-10-13 16:53 2678 ----a-w- c:\windows\java\Packages\Data\XJP3RXRJ.DAT
2009-10-13 16:53 . 2009-10-13 16:53 2678 ----a-w- c:\windows\java\Packages\Data\B73B3FT3.DAT
2009-10-13 16:53 . 2009-10-13 16:53 2678 ----a-w- c:\windows\java\Packages\Data\2NNTJVNF.DAT
2009-10-13 16:53 . 2009-10-13 16:53 2678 ----a-w- c:\windows\java\Packages\Data\313F1RNN.DAT
2009-10-13 10:52 . 2004-08-05 12:00 267776 ----a-w- c:\windows\system32\oakley.dll
2009-10-12 13:52 . 2004-08-05 12:00 69632 ----a-w- c:\windows\system32\raschap.dll
2009-10-12 13:52 . 2004-08-05 12:00 69632 ----a-w- c:\windows\system32\raschap(2)(2)(2)(2)(2).dll
2009-10-12 13:52 . 2004-08-05 12:00 113152 ----a-w- c:\windows\system32\rastls.dll
2009-10-12 13:52 . 2004-08-05 12:00 113152 ----a-w- c:\windows\system32\rastls(2)(2)(2)(2)(2).dll
2009-10-12 07:24 . 2009-10-12 07:24 826856 ----a-w- c:\documents and settings\mickael.MICO-325BBB3914\Application Data\MSNInstaller\msnauins.exe
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-04 1667584]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-21 61440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"OpwareSE2"="c:\program files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 49152]
"OPSE reminder"="c:\program files\ScanSoft\OmniPageSE2.0\EregFre\Ereg.exe" [2003-07-07 729088]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-05 15360]
c:\documents and settings\All Users.WINDOWS\Menu D‚marrer\Programmes\D‚marrage\
IDETool.lnk - c:\program files\IDETOOL\IDETOOL.EXE [2009-9-21 352256]
Wireless Configuration Utility HW.32.lnk - c:\windows\Installer\{BDC88E5A-F47B-4314-AB38-994592E32C95}\NewShortcut1_BDC88E5AF47B4314AB38994592E32C95.exe [2009-12-26 40960]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0sprestrt
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"25:TCP"= 25:TCP:File and Printer Sharing
"9232:TCP"= 9232:TCP:omiw
"3842:TCP"= 3842:TCP:omiw
"6125:TCP"= 6125:TCP:omiw
"1886:TCP"= 1886:TCP:omiw
"8543:TCP"= 8543:TCP:omiw
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [28/12/2009 00:41 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [28/12/2009 00:41 20560]
S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [16/12/2009 23:23 135664]
S2 smimsgif32;WMI SNMP MIB Compiler Fatal Error Messages;c:\windows\system32\rundll32.exe smimsgif32.dll,omiw --> c:\windows\system32\rundll32.exe smimsgif32.dll,omiw [?]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [11/12/2009 15:43 234864]
S3 RTL8187B;TRENDnet TEW-424UB 54M USB Dongle;c:\windows\system32\drivers\RTL8187B.sys [28/12/2009 18:32 264576]
S3 SIS163u;SiS163 USB Wireless LAN Adapter Driver;c:\windows\system32\drivers\sis163u.sys [15/02/2006 18:25 215552]
S3 USB_RNDIS_51;Broadcom USB Remote NDIS Device Driver;c:\windows\system32\drivers\usb8023.sys [05/08/2004 13:00 12672]
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://webmail.aliceadsl.fr/
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Easy-WebPrint Ajouter à la liste d'impressions - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint Impression rapide - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Imprimer - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: Easy-WebPrint Prévisualiser - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_5F1A57F0B9B89E2E.dll/cmsidewiki.html
TCP: {52005BAF-2120-4B76-8739-0DABF23FB046} = 192.168.1.1
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\mickael.MICO-325BBB3914\Application Data\Mozilla\Firefox\Profiles\5d2tzabq.default\
FF - prefs.js: browser.search.selectedEngine - DAEMON Search
FF - prefs.js: browser.startup.homepage - hxxp://www.daemon-search.com/startpage
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll
.
- - - - ORPHELINS SUPPRIMES - - - -
HKCU-Run-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
AddRemove-HijackThis - c:\program files\Trend Micro\HijackThis\HijackThis.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-29 17:58
Windows 5.1.2600 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(704)
c:\windows\system32\Ati2evxx.dll
.
Heure de fin: 2009-12-29 18:00:04
ComboFix-quarantined-files.txt 2009-12-29 17:00
Avant-CF: 79 873 728 512 octets libres
Après-CF: 80 419 401 728 octets libres
- - End Of File - - 93D6ABD974BC231AC230F58D2EA7FAF1-
2009-12-26 11:56:03 ----RA---- C:\WINDOWS\SETC9.tmp
2009-12-26 11:56:03 ----RA---- C:\WINDOWS\SETC7.tmp
2009-12-26 11:56:02 ----RA---- C:\WINDOWS\SETC6.tmp
2009-12-26 11:56:02 ----RA---- C:\WINDOWS\SETC4.tmp
2009-12-26 11:56:02 ----RA---- C:\WINDOWS\SETC3.tmp
2009-12-26 11:55:56 ----RA---- C:\WINDOWS\SET90.tmp
2009-12-26 11:55:53 ----RA---- C:\WINDOWS\SET7F.tmp
2009-12-26 11:55:51 ----RA---- C:\WINDOWS\SET7C.tmp
2009-12-25 08:24:04 ----RA---- C:\WINDOWS\SET88.tmp
2009-12-25 08:24:04 ----RA---- C:\WINDOWS\SET87.tmp
2009-12-25 08:24:04 ----RA---- C:\WINDOWS\SET86.tmp
2009-12-25 08:24:04 ----RA---- C:\WINDOWS\SET85.tmp
2009-12-25 08:24:04 ----RA---- C:\WINDOWS\SET84.tmp
2009-12-25 08:24:01 ----RA---- C:\WINDOWS\SET51.tmp
2009-12-25 08:23:58 ----RA---- C:\WINDOWS\SET45.tmp
2009-12-25 08:23:56 ----RA---- C:\WINDOWS\SET42.tmp
2009-12-25 00:33:31 ----RA---- C:\WINDOWS\SETCB.tmp
2009-12-25 00:32:50 ----RA---- C:\WINDOWS\SETC8.tmp
2009-12-25 00:31:55 ----RA---- C:\WINDOWS\SETC5.tmp
2009-12-25 00:31:25 ----RA---- C:\WINDOWS\SETC2.tmp
2009-12-25 00:30:34 ----RA---- C:\WINDOWS\SETBF.tmp
2009-12-24 23:02:09 ----RA---- C:\WINDOWS\SET8C.tmp
2009-12-24 22:40:36 ----RA---- C:\WINDOWS\SET80.tmp
2009-12-24 22:31:13 ----RA---- C:\WINDOWS\SET7D.tmp
essaye de supprimer ces fichiers
-
- 1
- 2
Suivant
