WORM WIN32 SKYNET
wil84
Messages postés
8
Statut
Membre
-
wil84 Messages postés 8 Statut Membre -
wil84 Messages postés 8 Statut Membre -
Bonjour,
J ai eut un ecran bleu et j ai du restorer les fichier de base....
Depuis j ai un virus qui apparait (SKYNET) et j ai perdu mes connexions reseau.
Est ce que quelqu un aurait une idée avant que je reformate tout...
Le rapport HijackThis
Scan saved at 15:40:57, on 2010-01-03
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\winupdate86.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft LifeCam\MSCamSvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\mHotkey.exe
C:\WINDOWS\CNYHKey.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Documents and Settings\wil\Application Data\SystemProc\lsass.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\vVX3000.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\wil\Local Settings\Application Data\TheWeatherNetwork\WeatherEye\WeatherEye.exe
C:\Documents and Settings\wil\.COMMgr\complmgr.exe
C:\DOCUME~1\wil\LOCALS~1\Temp\hhkm3i.exe
C:\DOCUME~1\wil\LOCALS~1\Temp\lsass.exe
C:\Program Files\Thunderbird-Tray\TBTray.exe
C:\Program Files\Thunderbird-Tray\TBTray.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\DOCUME~1\wil\LOCALS~1\Temp\Répertoire temporaire 1 pour hijackthis_199.zip\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cicero.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.cicero.ca/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.cicero.ca/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\pdfforge Toolbar\SearchSettings.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\winlogon86.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\pdfforgeToolbarIE.dll
O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\pdfforge Toolbar\SearchSettings.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - (no file)
O3 - Toolbar: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\pdfforgeToolbarIE.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Fichiers communs\AOLSHARE\AOLDialReg.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [IS CfgWiz] C:\Program Files\Norton Internet Security\cfgwiz.exe /GUID {F073BDC9-0D67-4ff0-879E-27241C843828} /MODE CfgWiz /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] "C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\pdfforge Toolbar\SearchSettings.exe
O4 - HKLM\..\Run: [winupdate86.exe] C:\WINDOWS\system32\winupdate86.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [WeatherEye] C:\Documents and Settings\wil\Local Settings\Application Data\TheWeatherNetwork\WeatherEye\WeatherEye.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [COM+ Manager] "C:\Documents and Settings\wil\.COMMgr\complmgr.exe"
O4 - HKCU\..\Run: [ygua8e7yhuiesfha876yfauy8fe] C:\DOCUME~1\wil\LOCALS~1\Temp\hhkm3i.exe
O4 - HKCU\..\Run: [asg984jgkfmgasi8ug98jgkfgfb] C:\DOCUME~1\wil\LOCALS~1\Temp\lsass.exe
O4 - Startup: TB-Tray.lnk = C:\Program Files\Thunderbird-Tray\TBTray.exe
O4 - Global Startup: TB-Tray.lnk = C:\Program Files\Thunderbird-Tray\TBTray.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.cicero.ca/
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: Service Google Update (gupdate) (gupdate) - Unknown owner - C:\Program Files\Google\Update\GoogleUpdate.exe" /svc (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Program Files\RealVNC\VNC4\WinVNC4.exe" -service (file missing)
J ai eut un ecran bleu et j ai du restorer les fichier de base....
Depuis j ai un virus qui apparait (SKYNET) et j ai perdu mes connexions reseau.
Est ce que quelqu un aurait une idée avant que je reformate tout...
Le rapport HijackThis
Scan saved at 15:40:57, on 2010-01-03
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\winupdate86.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft LifeCam\MSCamSvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\mHotkey.exe
C:\WINDOWS\CNYHKey.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Documents and Settings\wil\Application Data\SystemProc\lsass.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\vVX3000.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\wil\Local Settings\Application Data\TheWeatherNetwork\WeatherEye\WeatherEye.exe
C:\Documents and Settings\wil\.COMMgr\complmgr.exe
C:\DOCUME~1\wil\LOCALS~1\Temp\hhkm3i.exe
C:\DOCUME~1\wil\LOCALS~1\Temp\lsass.exe
C:\Program Files\Thunderbird-Tray\TBTray.exe
C:\Program Files\Thunderbird-Tray\TBTray.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\DOCUME~1\wil\LOCALS~1\Temp\Répertoire temporaire 1 pour hijackthis_199.zip\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cicero.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.cicero.ca/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.cicero.ca/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\pdfforge Toolbar\SearchSettings.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\winlogon86.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\pdfforgeToolbarIE.dll
O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\pdfforge Toolbar\SearchSettings.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - (no file)
O3 - Toolbar: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\pdfforgeToolbarIE.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Fichiers communs\AOLSHARE\AOLDialReg.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [IS CfgWiz] C:\Program Files\Norton Internet Security\cfgwiz.exe /GUID {F073BDC9-0D67-4ff0-879E-27241C843828} /MODE CfgWiz /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] "C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\pdfforge Toolbar\SearchSettings.exe
O4 - HKLM\..\Run: [winupdate86.exe] C:\WINDOWS\system32\winupdate86.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [WeatherEye] C:\Documents and Settings\wil\Local Settings\Application Data\TheWeatherNetwork\WeatherEye\WeatherEye.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [COM+ Manager] "C:\Documents and Settings\wil\.COMMgr\complmgr.exe"
O4 - HKCU\..\Run: [ygua8e7yhuiesfha876yfauy8fe] C:\DOCUME~1\wil\LOCALS~1\Temp\hhkm3i.exe
O4 - HKCU\..\Run: [asg984jgkfmgasi8ug98jgkfgfb] C:\DOCUME~1\wil\LOCALS~1\Temp\lsass.exe
O4 - Startup: TB-Tray.lnk = C:\Program Files\Thunderbird-Tray\TBTray.exe
O4 - Global Startup: TB-Tray.lnk = C:\Program Files\Thunderbird-Tray\TBTray.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.cicero.ca/
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: Service Google Update (gupdate) (gupdate) - Unknown owner - C:\Program Files\Google\Update\GoogleUpdate.exe" /svc (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Program Files\RealVNC\VNC4\WinVNC4.exe" -service (file missing)
10 réponses
bonsoir
Skynet est une variante du rootkit TDSS
Attention, avant de commencer, lit attentivement la procédure, et imprime la
Télécharge ComboFix de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
/!\ Déconnecte-toi du net et DESACTIVES TOUTES LES DEFENSES, antivirus et antispyware y compris /!\
---> Double-clique sur ComboFix.exe
Un "pop-up" va apparaître qui dit que ComboFix est utilisé à vos risques et avec aucune garantie... Clique sur oui pour accepter
SURTOUT INSTALLES LA CONSOLE DE RECUPERATION
---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.
Ne touche à rien(souris, clavier) tant que le scan n'est pas terminé, car tu risques de planter ton PC
En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.
Une fois le scan achevé, un rapport va s'afficher : Poste son contenu
/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\
Note : Le rapport se trouve également là : C:\ComboFix.txt
Skynet est une variante du rootkit TDSS
Attention, avant de commencer, lit attentivement la procédure, et imprime la
Télécharge ComboFix de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
/!\ Déconnecte-toi du net et DESACTIVES TOUTES LES DEFENSES, antivirus et antispyware y compris /!\
---> Double-clique sur ComboFix.exe
Un "pop-up" va apparaître qui dit que ComboFix est utilisé à vos risques et avec aucune garantie... Clique sur oui pour accepter
SURTOUT INSTALLES LA CONSOLE DE RECUPERATION
---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.
Ne touche à rien(souris, clavier) tant que le scan n'est pas terminé, car tu risques de planter ton PC
En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.
Une fois le scan achevé, un rapport va s'afficher : Poste son contenu
/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\
Note : Le rapport se trouve également là : C:\ComboFix.txt
Salut Nathandre,
Tout d'abord merci de t'occuper de mon soucis...
Le PC ne détecte plus la connexion internet (via routeur normalement même sans rien installé il la trouve)
Donc pour le point de restauration système il n'a pas trouvé les composants windows nécessaires donc j ai pas pu le faire...
Ensuite le PC a redémarré a effectuer le scan et a redemarré le PC à nouveau.
Voici le rapport du scan...
Si tu sais pourquoi la connexion réseau ne marche plus je suis preneur ...
Merci déjà
ComboFix 10-01-03.01 - wil 2010-01-03 17:30:48.1.2 - x86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.2.1036.18.1023.664 [GMT -4:00]
Lancé depuis: c:\documents and settings\wil\Bureau\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 091230-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: Norton Internet Security 2006 *On-access scanning enabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security 2006 *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\docume~1\wil\LOCALS~1\Temp\lsass.exe
c:\documents and settings\wil\Application Data\SystemProc
c:\documents and settings\wil\Application Data\SystemProc\lsass.exe
c:\program files\Fichiers communs\Real\WeatherBug\MiniBugTransporter.dll
c:\program files\Mozilla Firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}
c:\program files\Mozilla Firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}\chrome\content\timer.xul
c:\program files\Mozilla Firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}\install.rdf
c:\program files\pdfforge Toolbar\SearchSettings.dll
C:\s
c:\windows\kb913800.exe
c:\windows\system32\18467.exe
c:\windows\system32\19169.exe
c:\windows\system32\26500.exe
c:\windows\system32\41.exe
c:\windows\system32\6334.exe
c:\windows\system32\AVR10.exe
c:\windows\system32\flags.ini
c:\windows\system32\kbdsock.dll
c:\windows\system32\mshlps.dll
c:\windows\system32\sshnas.dll
c:\windows\system32\Thumbs.db
c:\windows\system32\uses32.dat
c:\windows\system32\winhelper86.dll
c:\windows\system32\winlogon86.exe
c:\windows\system32\winupdate86.exe
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_SSHNAS
-------\Service_SSHNAS
((((((((((((((((((((((((((((( Fichiers créés du 2009-12-03 au 2010-01-03 ))))))))))))))))))))))))))))))))))))
.
2010-01-03 18:41 . 2009-11-24 23:48 23120 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-01-03 18:41 . 2009-11-24 23:49 48560 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-01-03 18:41 . 2009-11-24 23:47 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-01-03 18:41 . 2009-11-24 23:51 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-01-03 18:41 . 2009-11-24 23:50 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-01-03 18:41 . 2009-11-24 23:50 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-01-03 18:41 . 2009-11-24 23:50 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-01-03 18:41 . 2009-11-24 23:47 97480 ----a-w- c:\windows\system32\AvastSS.scr
2010-01-03 18:41 . 2009-11-24 23:54 1280480 ----a-w- c:\windows\system32\aswBoot.exe
2010-01-03 18:41 . 2010-01-03 18:41 -------- d-----w- c:\program files\Alwil Software
2010-01-03 15:35 . 2010-01-03 15:35 767488 ----a-w- c:\windows\system32\drivers\cvzwx.sys
2010-01-03 15:34 . 2010-01-03 15:34 -------- d-sh--w- c:\documents and settings\wil\.COMMgr
2010-01-03 15:34 . 2010-01-03 15:34 22016 ----a-w- C:\sbjolvsw.exe
2010-01-03 15:34 . 2010-01-03 15:34 25088 ----a-w- C:\ydbkaxo.exe
2010-01-01 13:00 . 2010-01-01 13:00 1956072 ----a-w- c:\documents and settings\wil\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
2009-12-29 14:40 . 2009-12-29 14:40 -------- d-----w- c:\documents and settings\wil\Local Settings\Application Data\TheWeatherNetwork
2009-12-28 15:28 . 2009-12-28 15:28 -------- d-----w- c:\program files\MSN BackUp
2009-12-05 05:42 . 2009-12-05 05:42 -------- d-----w- c:\windows\Sun
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-03 21:34 . 2009-12-03 03:46 -------- d-----w- c:\program files\pdfforge Toolbar
2010-01-03 21:24 . 2005-08-26 12:04 17408 ----a-w- c:\windows\system32\drivers\USBCRFT.SYS
2010-01-03 20:09 . 2009-11-23 06:12 -------- d-----w- c:\program files\Mozilla Thunderbird
2010-01-03 18:18 . 2005-08-26 20:17 83516 ----a-w- c:\windows\system32\perfc00C.dat
2010-01-03 18:18 . 2005-08-26 20:17 506906 ----a-w- c:\windows\system32\perfh00C.dat
2010-01-03 15:14 . 2009-11-25 07:23 -------- d-----w- c:\documents and settings\wil\Application Data\Skype
2010-01-01 12:05 . 2009-11-25 07:49 -------- d-----w- c:\documents and settings\wil\Application Data\skypePM
2009-12-23 23:43 . 2005-08-26 21:18 -------- d-----w- c:\program files\Google
2009-12-23 11:23 . 2009-11-23 07:13 72592 ----a-w- c:\documents and settings\wil\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-11 19:27 . 2009-12-03 02:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-12-11 19:23 . 2005-08-29 09:04 -------- d-----w- c:\program files\Microsoft Works
2009-12-03 03:49 . 2009-12-03 03:49 -------- d-----w- c:\documents and settings\wil\Application Data\Search Settings
2009-12-03 03:49 . 2009-12-03 03:49 -------- d-----w- c:\documents and settings\wil\Application Data\pdfforge
2009-12-03 03:47 . 2009-12-03 03:44 -------- d-----w- c:\program files\PDFCreator
2009-12-03 03:44 . 2009-11-23 05:52 126 ----a-w- c:\documents and settings\wil\Local Settings\Application Data\fusioncache.dat
2009-12-03 03:02 . 2009-11-24 17:56 -------- d-----w- c:\program files\MSBuild
2009-12-03 03:01 . 2009-12-03 03:01 -------- d-----w- c:\program files\Microsoft.NET
2009-12-03 02:59 . 2009-12-03 02:59 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2009-12-03 02:55 . 2009-12-03 02:55 -------- d-----w- c:\program files\DAEMON Tools Lite
2009-12-03 02:52 . 2009-12-03 02:52 717296 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-12-03 02:52 . 2009-12-03 02:52 -------- d-----w- c:\documents and settings\wil\Application Data\DAEMON Tools
2009-11-26 17:14 . 2009-11-23 05:52 -------- d-----w- c:\documents and settings\wil\Application Data\Apple Computer
2009-11-26 16:30 . 2009-11-26 16:30 -------- d-----w- c:\documents and settings\wil\Application Data\AdobeUM
2009-11-26 15:42 . 2009-11-26 15:42 -------- d-----w- c:\program files\TheWeatherNetwork
2009-11-25 07:49 . 2009-11-25 07:49 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-11-25 07:29 . 2009-11-25 07:29 -------- d-----r- c:\program files\Skype
2009-11-25 07:29 . 2009-11-25 07:29 -------- d-----w- c:\program files\Fichiers communs\Skype
2009-11-25 07:29 . 2009-11-25 07:22 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2009-11-24 17:56 . 2009-11-24 17:56 -------- d-----w- c:\program files\Reference Assemblies
2009-11-24 17:53 . 2009-11-24 17:53 -------- d-----w- c:\program files\MSXML 6.0
2009-11-24 15:46 . 2009-11-24 15:46 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2
2009-11-24 15:41 . 2009-11-24 15:41 -------- d-----w- c:\program files\MSXML 4.0
2009-11-23 09:20 . 2009-11-23 08:36 -------- d-----w- c:\documents and settings\wil\Application Data\MessengerDiscovery 2
2009-11-23 08:36 . 2009-11-23 08:36 -------- d-----w- c:\documents and settings\All Users\Application Data\MessengerDiscovery 2
2009-11-23 08:36 . 2009-11-23 08:36 -------- d-----w- c:\program files\MessengerDiscovery 2
2009-11-23 08:29 . 2009-11-23 08:28 -------- d-----w- c:\program files\Microsoft LifeCam
2009-11-23 08:28 . 2009-11-23 08:28 -------- d-----w- c:\program files\Microsoft
2009-11-23 08:27 . 2009-11-23 08:27 -------- d-----w- c:\program files\Windows Live
2009-11-23 08:27 . 2009-11-23 08:27 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-11-23 08:22 . 2009-11-23 08:22 -------- d-----w- c:\program files\Fichiers communs\Windows Live
2009-11-23 07:28 . 2009-11-23 07:28 -------- d-----w- c:\program files\RealVNC
2009-11-23 06:38 . 2009-11-23 06:33 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-11-23 06:36 . 2009-11-23 06:35 -------- d-----w- c:\program files\iTunes
2009-11-23 06:36 . 2009-11-23 06:35 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-11-23 06:36 . 2009-11-23 06:36 -------- d-----w- c:\program files\iPod
2009-11-23 06:36 . 2009-11-23 06:16 -------- d-----w- c:\program files\Fichiers communs\Apple
2009-11-23 06:34 . 2009-11-23 06:34 -------- d-----w- c:\program files\Bonjour
2009-11-23 06:34 . 2009-11-23 06:34 -------- d-----w- c:\program files\QuickTime
2009-11-23 06:33 . 2009-11-23 06:33 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee Security Scan
2009-11-23 06:26 . 2009-11-23 06:26 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2009-11-23 06:26 . 2009-11-23 06:26 -------- d-----w- c:\program files\Thunderbird-Tray
2009-11-23 06:18 . 2005-09-12 19:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-11-23 06:17 . 2009-11-23 06:17 -------- d-----w- c:\program files\Apple Software Update
2009-11-23 06:16 . 2009-11-23 06:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2009-11-23 06:12 . 2009-11-23 06:12 -------- d-----w- c:\documents and settings\wil\Application Data\Thunderbird
2009-11-23 06:12 . 2009-11-23 06:12 -------- d-----w- c:\program files\MozBackup
2009-11-06 13:20 . 2009-11-23 06:33 34112 ----a-w- c:\documents and settings\wil\Application Data\Mozilla\Firefox\Profiles\7rw1txl9.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content\getPlusPlus_Adobe_reg_bootstrap.exe
2009-11-06 13:20 . 2009-11-23 06:33 32448 ----a-w- c:\documents and settings\wil\Application Data\Mozilla\Firefox\Profiles\7rw1txl9.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
2009-11-06 13:20 . 2009-11-23 06:33 22352 ----a-w- c:\documents and settings\wil\Application Data\Mozilla\Firefox\Profiles\7rw1txl9.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content\getPlusPlus_Adobe_reg.exe
2009-10-29 05:46 . 2005-08-26 20:17 666112 ----a-w- c:\windows\system32\wininet.dll
2009-10-21 06:03 . 2005-08-26 20:17 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 06:03 . 2005-08-26 20:17 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-13 10:52 . 2005-08-26 20:17 267776 ----a-w- c:\windows\system32\oakley.dll
2009-10-12 13:52 . 2005-08-26 20:17 69632 ----a-w- c:\windows\system32\raschap.dll
2009-10-12 13:52 . 2005-08-26 20:17 113152 ----a-w- c:\windows\system32\rastls.dll
2005-09-12 16:57 . 2005-08-26 21:18 56 --sh--r- c:\windows\system32\3154A52CE7.sys
2005-09-12 19:51 . 2005-09-12 19:29 56 --sh--r- c:\windows\system32\7CE60FCB2F.sys
2005-09-12 19:51 . 2005-08-26 21:18 5018 --sha-w- c:\windows\system32\KGyGaAvL.sys
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B922D405-6D13-4A2B-AE89-08A030DA4402}]
2009-07-31 06:00 698880 ----a-w- c:\program files\pdfforge Toolbar\pdfforgeToolbarIE.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{B922D405-6D13-4A2B-AE89-08A030DA4402}"= "c:\program files\pdfforge Toolbar\pdfforgeToolbarIE.dll" [2009-07-31 698880]
[HKEY_CLASSES_ROOT\clsid\{b922d405-6d13-4a2b-ae89-08a030da4402}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-10-09 25623336]
"WeatherEye"="c:\documents and settings\wil\Local Settings\Application Data\TheWeatherNetwork\WeatherEye\WeatherEye.exe" [2009-10-27 718232]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856]
"COM+ Manager"="c:\documents and settings\wil\.COMMgr\complmgr.exe" [2010-01-03 369152]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"Dit"="Dit.exe" [2004-07-20 90112]
"CHotkey"="mHotkey.exe" [2004-02-24 508416]
"ledpointer"="CNYHKey.exe" [2004-02-03 5794816]
"AOLDialer"="c:\program files\Fichiers communs\AOLSHARE\AOLDialReg.exe" [2004-08-19 119625]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-10-11 7286784]
"nwiz"="nwiz.exe" [2005-10-11 1519616]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"IS CfgWiz"="c:\program files\Norton Internet Security\cfgwiz.exe" [2005-09-30 120464]
"URLLSTCK.exe"="c:\program files\Norton Internet Security\UrlLstCk.exe" [2005-10-23 23168]
"SSC_UserPrompt"="c:\program files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe" [2004-11-10 218240]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-11 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2006-06-29 269104]
"VX3000"="c:\windows\vVX3000.exe" [2006-06-29 707376]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"SearchSettings"="c:\program files\pdfforge Toolbar\SearchSettings.exe" [2009-07-29 1024512]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-10 15360]
c:\documents and settings\wil\Menu D‚marrer\Programmes\D‚marrage\
TB-Tray.lnk - c:\program files\Thunderbird-Tray\TBTray.exe [2005-11-8 38912]
c:\documents and settings\wil\Menu D‚marrer\Programmes\D‚marrage\
TB-Tray.lnk - c:\program files\Thunderbird-Tray\TBTray.exe [2005-11-8 38912]
c:\documents and settings\wil\Menu D‚marrer\Programmes\D‚marrage\
TB-Tray.lnk - c:\program files\Thunderbird-Tray\TBTray.exe [2005-11-8 38912]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
TB-Tray.lnk - c:\program files\Thunderbird-Tray\TBTray.exe [2005-11-8 38912]
c:\documents and settings\wil\Menu D‚marrer\Programmes\D‚marrage\
TB-Tray.lnk - c:\program files\Thunderbird-Tray\TBTray.exe [2005-11-8 38912]
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\AOL 8.0\\AOL.exe"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\RealVNC\\VNC4\\winvnc4.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\MSN BackUp\\MSNBackup.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2009-12-02 717296]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2010-01-03 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-01-03 20560]
R2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2009-12-02 135664]
R3 UKBFLT;UKBFLT;c:\windows\system32\drivers\UKBFLT.sys [2009-11-23 11672]
S3 CardReaderFilter;Card Reader Filter;c:\windows\system32\drivers\USBCRFT.SYS [2005-08-26 17408]
--- Autres Services/Pilotes en mémoire ---
*NewlyCreated* - COMHOST
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contenu du dossier 'Tâches planifiées'
2009-12-28 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]
2010-01-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-02 14:35]
2010-01-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-02 14:35]
2005-12-16 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2005-12-16 00:21]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.cicero.ca/
uInternet Connection Wizard,ShellNext = hxxp://www.cicero.ca/
uInternet Settings,ProxyOverride = *.local
IE: &Google Search - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Pages liées - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Pages similaires - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Version de la page actuelle disponible dans le cache Google - c:\program files\Google\GoogleToolbar1.dll/cmcache.html
FF - ProfilePath - c:\documents and settings\wil\Application Data\Mozilla\Firefox\Profiles\7rw1txl9.default\
FF - prefs.js: browser.startup.homepage - wwwgoogle.com/ig
FF - prefs.js: network.proxy.type - 4
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B922D405-6D13-4A2B-AE89-08A030DA4402}\components\pdfforgeToolbarFF.dll
FF - component: c:\program files\Mozilla Firefox\extensions\search@searchsettings.com\components\SearchSettingsFF.dll
FF - plugin: c:\documents and settings\wil\Application Data\Mozilla\Firefox\Profiles\7rw1txl9.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJPI150_06.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPOJI610.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHELINS SUPPRIMES - - - -
URLSearchHooks-{E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)
HKLM-Run-Cmaudio - cmicnfg.cpl
HKLM-Explorer_Run-RTHDBPL - c:\documents and settings\wil\Application Data\SystemProc\lsass.exe
AddRemove-HijackThis - c:\docume~1\wil\LOCALS~1\Temp\Répertoire temporaire 1 pour hijackthis_199.zip\HijackThis.exe
AddRemove-{FAF88B432344413595BB2DED98385684} - c:\program files\DivX\DivXUserGuideUninstall
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-03 17:37
Windows 5.1.2600 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
RTHDBPL = c:\documents and settings\wil\Application Data\SystemProc\lsass.exe?#???????????????????????????????????????????????????????????
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
COM+ Manager = "c:\documents and settings\wil\.COMMgr\complmgr.exe"?
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x865671F8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf7640fc3
\Driver\ACPI -> ACPI.sys @ 0xf739acb8
\Driver\atapi -> 0x865671f8
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x8058241c
ParseProcedure -> ntkrnlpa.exe @ 0x8058155c
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x8058241c
ParseProcedure -> ntkrnlpa.exe @ 0x8058155c
NDIS: NVIDIA nForce Networking Controller -> SendCompleteHandler -> NDIS.sys @ 0xf724bba0
PacketIndicateHandler -> NDIS.sys @ 0xf7258b21
SendHandler -> NDIS.sys @ 0xf723687b
Warning: possible MBR rootkit infection !
user & kernel MBR OK
PE file found in sector at 0x029EB29C1 !
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'Explorer.EXE'(1052)
c:\windows\system32\msi.dll
c:\windows\HKCYDLL.dll
c:\docume~1\wil\LOCALS~1\Temp\catchme.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Fichiers communs\Symantec Shared\ccSetMgr.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\program files\Fichiers communs\LightScribe\LSSrvc.exe
c:\program files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Microsoft LifeCam\MSCamSvc.exe
c:\windows\system32\nvsvc32.exe
c:\windows\wanmpsvc.exe
c:\program files\RealVNC\VNC4\WinVNC4.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\windows\system32\dllhost.exe
c:\windows\Dit.exe
c:\windows\mHotkey.exe
c:\windows\CNYHKey.exe
c:\windows\system32\RunDll32.exe
c:\windows\eHome\ehmsas.exe
c:\program files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Heure de fin: 2010-01-03 17:39:03 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-01-03 21:38
Avant-CF: 335 564 140 544 octets libres
Après-CF: 335 583 047 680 octets libres
- - End Of File - - DD06E1C9A0DC25051D2FAA3E4DE2C0EA
Tout d'abord merci de t'occuper de mon soucis...
Le PC ne détecte plus la connexion internet (via routeur normalement même sans rien installé il la trouve)
Donc pour le point de restauration système il n'a pas trouvé les composants windows nécessaires donc j ai pas pu le faire...
Ensuite le PC a redémarré a effectuer le scan et a redemarré le PC à nouveau.
Voici le rapport du scan...
Si tu sais pourquoi la connexion réseau ne marche plus je suis preneur ...
Merci déjà
ComboFix 10-01-03.01 - wil 2010-01-03 17:30:48.1.2 - x86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.2.1036.18.1023.664 [GMT -4:00]
Lancé depuis: c:\documents and settings\wil\Bureau\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 091230-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: Norton Internet Security 2006 *On-access scanning enabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security 2006 *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\docume~1\wil\LOCALS~1\Temp\lsass.exe
c:\documents and settings\wil\Application Data\SystemProc
c:\documents and settings\wil\Application Data\SystemProc\lsass.exe
c:\program files\Fichiers communs\Real\WeatherBug\MiniBugTransporter.dll
c:\program files\Mozilla Firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}
c:\program files\Mozilla Firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}\chrome\content\timer.xul
c:\program files\Mozilla Firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}\install.rdf
c:\program files\pdfforge Toolbar\SearchSettings.dll
C:\s
c:\windows\kb913800.exe
c:\windows\system32\18467.exe
c:\windows\system32\19169.exe
c:\windows\system32\26500.exe
c:\windows\system32\41.exe
c:\windows\system32\6334.exe
c:\windows\system32\AVR10.exe
c:\windows\system32\flags.ini
c:\windows\system32\kbdsock.dll
c:\windows\system32\mshlps.dll
c:\windows\system32\sshnas.dll
c:\windows\system32\Thumbs.db
c:\windows\system32\uses32.dat
c:\windows\system32\winhelper86.dll
c:\windows\system32\winlogon86.exe
c:\windows\system32\winupdate86.exe
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_SSHNAS
-------\Service_SSHNAS
((((((((((((((((((((((((((((( Fichiers créés du 2009-12-03 au 2010-01-03 ))))))))))))))))))))))))))))))))))))
.
2010-01-03 18:41 . 2009-11-24 23:48 23120 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-01-03 18:41 . 2009-11-24 23:49 48560 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-01-03 18:41 . 2009-11-24 23:47 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-01-03 18:41 . 2009-11-24 23:51 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-01-03 18:41 . 2009-11-24 23:50 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-01-03 18:41 . 2009-11-24 23:50 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-01-03 18:41 . 2009-11-24 23:50 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-01-03 18:41 . 2009-11-24 23:47 97480 ----a-w- c:\windows\system32\AvastSS.scr
2010-01-03 18:41 . 2009-11-24 23:54 1280480 ----a-w- c:\windows\system32\aswBoot.exe
2010-01-03 18:41 . 2010-01-03 18:41 -------- d-----w- c:\program files\Alwil Software
2010-01-03 15:35 . 2010-01-03 15:35 767488 ----a-w- c:\windows\system32\drivers\cvzwx.sys
2010-01-03 15:34 . 2010-01-03 15:34 -------- d-sh--w- c:\documents and settings\wil\.COMMgr
2010-01-03 15:34 . 2010-01-03 15:34 22016 ----a-w- C:\sbjolvsw.exe
2010-01-03 15:34 . 2010-01-03 15:34 25088 ----a-w- C:\ydbkaxo.exe
2010-01-01 13:00 . 2010-01-01 13:00 1956072 ----a-w- c:\documents and settings\wil\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
2009-12-29 14:40 . 2009-12-29 14:40 -------- d-----w- c:\documents and settings\wil\Local Settings\Application Data\TheWeatherNetwork
2009-12-28 15:28 . 2009-12-28 15:28 -------- d-----w- c:\program files\MSN BackUp
2009-12-05 05:42 . 2009-12-05 05:42 -------- d-----w- c:\windows\Sun
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-03 21:34 . 2009-12-03 03:46 -------- d-----w- c:\program files\pdfforge Toolbar
2010-01-03 21:24 . 2005-08-26 12:04 17408 ----a-w- c:\windows\system32\drivers\USBCRFT.SYS
2010-01-03 20:09 . 2009-11-23 06:12 -------- d-----w- c:\program files\Mozilla Thunderbird
2010-01-03 18:18 . 2005-08-26 20:17 83516 ----a-w- c:\windows\system32\perfc00C.dat
2010-01-03 18:18 . 2005-08-26 20:17 506906 ----a-w- c:\windows\system32\perfh00C.dat
2010-01-03 15:14 . 2009-11-25 07:23 -------- d-----w- c:\documents and settings\wil\Application Data\Skype
2010-01-01 12:05 . 2009-11-25 07:49 -------- d-----w- c:\documents and settings\wil\Application Data\skypePM
2009-12-23 23:43 . 2005-08-26 21:18 -------- d-----w- c:\program files\Google
2009-12-23 11:23 . 2009-11-23 07:13 72592 ----a-w- c:\documents and settings\wil\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-11 19:27 . 2009-12-03 02:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-12-11 19:23 . 2005-08-29 09:04 -------- d-----w- c:\program files\Microsoft Works
2009-12-03 03:49 . 2009-12-03 03:49 -------- d-----w- c:\documents and settings\wil\Application Data\Search Settings
2009-12-03 03:49 . 2009-12-03 03:49 -------- d-----w- c:\documents and settings\wil\Application Data\pdfforge
2009-12-03 03:47 . 2009-12-03 03:44 -------- d-----w- c:\program files\PDFCreator
2009-12-03 03:44 . 2009-11-23 05:52 126 ----a-w- c:\documents and settings\wil\Local Settings\Application Data\fusioncache.dat
2009-12-03 03:02 . 2009-11-24 17:56 -------- d-----w- c:\program files\MSBuild
2009-12-03 03:01 . 2009-12-03 03:01 -------- d-----w- c:\program files\Microsoft.NET
2009-12-03 02:59 . 2009-12-03 02:59 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2009-12-03 02:55 . 2009-12-03 02:55 -------- d-----w- c:\program files\DAEMON Tools Lite
2009-12-03 02:52 . 2009-12-03 02:52 717296 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-12-03 02:52 . 2009-12-03 02:52 -------- d-----w- c:\documents and settings\wil\Application Data\DAEMON Tools
2009-11-26 17:14 . 2009-11-23 05:52 -------- d-----w- c:\documents and settings\wil\Application Data\Apple Computer
2009-11-26 16:30 . 2009-11-26 16:30 -------- d-----w- c:\documents and settings\wil\Application Data\AdobeUM
2009-11-26 15:42 . 2009-11-26 15:42 -------- d-----w- c:\program files\TheWeatherNetwork
2009-11-25 07:49 . 2009-11-25 07:49 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-11-25 07:29 . 2009-11-25 07:29 -------- d-----r- c:\program files\Skype
2009-11-25 07:29 . 2009-11-25 07:29 -------- d-----w- c:\program files\Fichiers communs\Skype
2009-11-25 07:29 . 2009-11-25 07:22 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2009-11-24 17:56 . 2009-11-24 17:56 -------- d-----w- c:\program files\Reference Assemblies
2009-11-24 17:53 . 2009-11-24 17:53 -------- d-----w- c:\program files\MSXML 6.0
2009-11-24 15:46 . 2009-11-24 15:46 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2
2009-11-24 15:41 . 2009-11-24 15:41 -------- d-----w- c:\program files\MSXML 4.0
2009-11-23 09:20 . 2009-11-23 08:36 -------- d-----w- c:\documents and settings\wil\Application Data\MessengerDiscovery 2
2009-11-23 08:36 . 2009-11-23 08:36 -------- d-----w- c:\documents and settings\All Users\Application Data\MessengerDiscovery 2
2009-11-23 08:36 . 2009-11-23 08:36 -------- d-----w- c:\program files\MessengerDiscovery 2
2009-11-23 08:29 . 2009-11-23 08:28 -------- d-----w- c:\program files\Microsoft LifeCam
2009-11-23 08:28 . 2009-11-23 08:28 -------- d-----w- c:\program files\Microsoft
2009-11-23 08:27 . 2009-11-23 08:27 -------- d-----w- c:\program files\Windows Live
2009-11-23 08:27 . 2009-11-23 08:27 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-11-23 08:22 . 2009-11-23 08:22 -------- d-----w- c:\program files\Fichiers communs\Windows Live
2009-11-23 07:28 . 2009-11-23 07:28 -------- d-----w- c:\program files\RealVNC
2009-11-23 06:38 . 2009-11-23 06:33 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-11-23 06:36 . 2009-11-23 06:35 -------- d-----w- c:\program files\iTunes
2009-11-23 06:36 . 2009-11-23 06:35 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-11-23 06:36 . 2009-11-23 06:36 -------- d-----w- c:\program files\iPod
2009-11-23 06:36 . 2009-11-23 06:16 -------- d-----w- c:\program files\Fichiers communs\Apple
2009-11-23 06:34 . 2009-11-23 06:34 -------- d-----w- c:\program files\Bonjour
2009-11-23 06:34 . 2009-11-23 06:34 -------- d-----w- c:\program files\QuickTime
2009-11-23 06:33 . 2009-11-23 06:33 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee Security Scan
2009-11-23 06:26 . 2009-11-23 06:26 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2009-11-23 06:26 . 2009-11-23 06:26 -------- d-----w- c:\program files\Thunderbird-Tray
2009-11-23 06:18 . 2005-09-12 19:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-11-23 06:17 . 2009-11-23 06:17 -------- d-----w- c:\program files\Apple Software Update
2009-11-23 06:16 . 2009-11-23 06:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2009-11-23 06:12 . 2009-11-23 06:12 -------- d-----w- c:\documents and settings\wil\Application Data\Thunderbird
2009-11-23 06:12 . 2009-11-23 06:12 -------- d-----w- c:\program files\MozBackup
2009-11-06 13:20 . 2009-11-23 06:33 34112 ----a-w- c:\documents and settings\wil\Application Data\Mozilla\Firefox\Profiles\7rw1txl9.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content\getPlusPlus_Adobe_reg_bootstrap.exe
2009-11-06 13:20 . 2009-11-23 06:33 32448 ----a-w- c:\documents and settings\wil\Application Data\Mozilla\Firefox\Profiles\7rw1txl9.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
2009-11-06 13:20 . 2009-11-23 06:33 22352 ----a-w- c:\documents and settings\wil\Application Data\Mozilla\Firefox\Profiles\7rw1txl9.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content\getPlusPlus_Adobe_reg.exe
2009-10-29 05:46 . 2005-08-26 20:17 666112 ----a-w- c:\windows\system32\wininet.dll
2009-10-21 06:03 . 2005-08-26 20:17 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 06:03 . 2005-08-26 20:17 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-13 10:52 . 2005-08-26 20:17 267776 ----a-w- c:\windows\system32\oakley.dll
2009-10-12 13:52 . 2005-08-26 20:17 69632 ----a-w- c:\windows\system32\raschap.dll
2009-10-12 13:52 . 2005-08-26 20:17 113152 ----a-w- c:\windows\system32\rastls.dll
2005-09-12 16:57 . 2005-08-26 21:18 56 --sh--r- c:\windows\system32\3154A52CE7.sys
2005-09-12 19:51 . 2005-09-12 19:29 56 --sh--r- c:\windows\system32\7CE60FCB2F.sys
2005-09-12 19:51 . 2005-08-26 21:18 5018 --sha-w- c:\windows\system32\KGyGaAvL.sys
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B922D405-6D13-4A2B-AE89-08A030DA4402}]
2009-07-31 06:00 698880 ----a-w- c:\program files\pdfforge Toolbar\pdfforgeToolbarIE.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{B922D405-6D13-4A2B-AE89-08A030DA4402}"= "c:\program files\pdfforge Toolbar\pdfforgeToolbarIE.dll" [2009-07-31 698880]
[HKEY_CLASSES_ROOT\clsid\{b922d405-6d13-4a2b-ae89-08a030da4402}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-10-09 25623336]
"WeatherEye"="c:\documents and settings\wil\Local Settings\Application Data\TheWeatherNetwork\WeatherEye\WeatherEye.exe" [2009-10-27 718232]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856]
"COM+ Manager"="c:\documents and settings\wil\.COMMgr\complmgr.exe" [2010-01-03 369152]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"Dit"="Dit.exe" [2004-07-20 90112]
"CHotkey"="mHotkey.exe" [2004-02-24 508416]
"ledpointer"="CNYHKey.exe" [2004-02-03 5794816]
"AOLDialer"="c:\program files\Fichiers communs\AOLSHARE\AOLDialReg.exe" [2004-08-19 119625]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-10-11 7286784]
"nwiz"="nwiz.exe" [2005-10-11 1519616]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"IS CfgWiz"="c:\program files\Norton Internet Security\cfgwiz.exe" [2005-09-30 120464]
"URLLSTCK.exe"="c:\program files\Norton Internet Security\UrlLstCk.exe" [2005-10-23 23168]
"SSC_UserPrompt"="c:\program files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe" [2004-11-10 218240]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-11 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2006-06-29 269104]
"VX3000"="c:\windows\vVX3000.exe" [2006-06-29 707376]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"SearchSettings"="c:\program files\pdfforge Toolbar\SearchSettings.exe" [2009-07-29 1024512]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-10 15360]
c:\documents and settings\wil\Menu D‚marrer\Programmes\D‚marrage\
TB-Tray.lnk - c:\program files\Thunderbird-Tray\TBTray.exe [2005-11-8 38912]
c:\documents and settings\wil\Menu D‚marrer\Programmes\D‚marrage\
TB-Tray.lnk - c:\program files\Thunderbird-Tray\TBTray.exe [2005-11-8 38912]
c:\documents and settings\wil\Menu D‚marrer\Programmes\D‚marrage\
TB-Tray.lnk - c:\program files\Thunderbird-Tray\TBTray.exe [2005-11-8 38912]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
TB-Tray.lnk - c:\program files\Thunderbird-Tray\TBTray.exe [2005-11-8 38912]
c:\documents and settings\wil\Menu D‚marrer\Programmes\D‚marrage\
TB-Tray.lnk - c:\program files\Thunderbird-Tray\TBTray.exe [2005-11-8 38912]
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\AOL 8.0\\AOL.exe"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\RealVNC\\VNC4\\winvnc4.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\MSN BackUp\\MSNBackup.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2009-12-02 717296]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2010-01-03 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-01-03 20560]
R2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2009-12-02 135664]
R3 UKBFLT;UKBFLT;c:\windows\system32\drivers\UKBFLT.sys [2009-11-23 11672]
S3 CardReaderFilter;Card Reader Filter;c:\windows\system32\drivers\USBCRFT.SYS [2005-08-26 17408]
--- Autres Services/Pilotes en mémoire ---
*NewlyCreated* - COMHOST
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contenu du dossier 'Tâches planifiées'
2009-12-28 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]
2010-01-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-02 14:35]
2010-01-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-02 14:35]
2005-12-16 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2005-12-16 00:21]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.cicero.ca/
uInternet Connection Wizard,ShellNext = hxxp://www.cicero.ca/
uInternet Settings,ProxyOverride = *.local
IE: &Google Search - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Pages liées - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Pages similaires - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Version de la page actuelle disponible dans le cache Google - c:\program files\Google\GoogleToolbar1.dll/cmcache.html
FF - ProfilePath - c:\documents and settings\wil\Application Data\Mozilla\Firefox\Profiles\7rw1txl9.default\
FF - prefs.js: browser.startup.homepage - wwwgoogle.com/ig
FF - prefs.js: network.proxy.type - 4
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B922D405-6D13-4A2B-AE89-08A030DA4402}\components\pdfforgeToolbarFF.dll
FF - component: c:\program files\Mozilla Firefox\extensions\search@searchsettings.com\components\SearchSettingsFF.dll
FF - plugin: c:\documents and settings\wil\Application Data\Mozilla\Firefox\Profiles\7rw1txl9.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJPI150_06.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPOJI610.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHELINS SUPPRIMES - - - -
URLSearchHooks-{E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)
HKLM-Run-Cmaudio - cmicnfg.cpl
HKLM-Explorer_Run-RTHDBPL - c:\documents and settings\wil\Application Data\SystemProc\lsass.exe
AddRemove-HijackThis - c:\docume~1\wil\LOCALS~1\Temp\Répertoire temporaire 1 pour hijackthis_199.zip\HijackThis.exe
AddRemove-{FAF88B432344413595BB2DED98385684} - c:\program files\DivX\DivXUserGuideUninstall
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-03 17:37
Windows 5.1.2600 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
RTHDBPL = c:\documents and settings\wil\Application Data\SystemProc\lsass.exe?#???????????????????????????????????????????????????????????
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
COM+ Manager = "c:\documents and settings\wil\.COMMgr\complmgr.exe"?
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x865671F8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf7640fc3
\Driver\ACPI -> ACPI.sys @ 0xf739acb8
\Driver\atapi -> 0x865671f8
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x8058241c
ParseProcedure -> ntkrnlpa.exe @ 0x8058155c
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x8058241c
ParseProcedure -> ntkrnlpa.exe @ 0x8058155c
NDIS: NVIDIA nForce Networking Controller -> SendCompleteHandler -> NDIS.sys @ 0xf724bba0
PacketIndicateHandler -> NDIS.sys @ 0xf7258b21
SendHandler -> NDIS.sys @ 0xf723687b
Warning: possible MBR rootkit infection !
user & kernel MBR OK
PE file found in sector at 0x029EB29C1 !
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'Explorer.EXE'(1052)
c:\windows\system32\msi.dll
c:\windows\HKCYDLL.dll
c:\docume~1\wil\LOCALS~1\Temp\catchme.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Fichiers communs\Symantec Shared\ccSetMgr.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\program files\Fichiers communs\LightScribe\LSSrvc.exe
c:\program files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Microsoft LifeCam\MSCamSvc.exe
c:\windows\system32\nvsvc32.exe
c:\windows\wanmpsvc.exe
c:\program files\RealVNC\VNC4\WinVNC4.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\windows\system32\dllhost.exe
c:\windows\Dit.exe
c:\windows\mHotkey.exe
c:\windows\CNYHKey.exe
c:\windows\system32\RunDll32.exe
c:\windows\eHome\ehmsas.exe
c:\program files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Heure de fin: 2010-01-03 17:39:03 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-01-03 21:38
Avant-CF: 335 564 140 544 octets libres
Après-CF: 335 583 047 680 octets libres
- - End Of File - - DD06E1C9A0DC25051D2FAA3E4DE2C0EA
Je suis en train de faire un back up de mes données donc si tu penses que c est vraiment compliqué, je pense que je vais reformater en esperant retrouver ma connexion internet .....
J 'attends de tes news
J 'attends de tes news
Télécharge le programme mbr à cette adresse : http://www2.gmer.net/mbr/mbr.exe
Place le fichier sur ton bureau
- Désactive tous les programmes de protection (antivirus, antispyware etc.)
- Double-clique sur mbr.exe.. une fenêtre de l'invité de commande va s'ouvrir et se refermer,
- Un rapport sera généré ; mbr.log.
Pour supprimer le rootkit :
- Menu Démarrer --> Exécuter... et tape la commande : "%userprofile%\Bureau\mbr" -f
(ne pas omettre les guillemets)
- dans le rapport mbr.log, la ligne suivante s'est ajoutée original MBR restored successfully !
- Supprimer le fichier mbr.log
- Relancez mbr.exe et revisualiser mbr.log, si tu n'es plus infecté, tu dois avoir
un rapport disant qu'aucune infection n'a été détectée.
Place le fichier sur ton bureau
- Désactive tous les programmes de protection (antivirus, antispyware etc.)
- Double-clique sur mbr.exe.. une fenêtre de l'invité de commande va s'ouvrir et se refermer,
- Un rapport sera généré ; mbr.log.
Pour supprimer le rootkit :
- Menu Démarrer --> Exécuter... et tape la commande : "%userprofile%\Bureau\mbr" -f
(ne pas omettre les guillemets)
- dans le rapport mbr.log, la ligne suivante s'est ajoutée original MBR restored successfully !
- Supprimer le fichier mbr.log
- Relancez mbr.exe et revisualiser mbr.log, si tu n'es plus infecté, tu dois avoir
un rapport disant qu'aucune infection n'a été détectée.
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
Voici ce que dit le rapport,
Je sais pas si ça a marché :-/
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device : opened successfully
user : MBR read successfully
kernel : MBR read successfully
user & kernel MBR OK
PE file found in sector at 0x029EB29C1!
Je sais pas si ça a marché :-/
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device : opened successfully
user : MBR read successfully
kernel : MBR read successfully
user & kernel MBR OK
PE file found in sector at 0x029EB29C1!
oui j ai bien fait et ca ouvre tres rapidement une fenetre (capture ecran pour voir ce que c etait) où il y a marqué la même chose.
Dans le rapport ca a rien modifié comme tu peux le voir
Dans le rapport ca a rien modifié comme tu peux le voir
