Infection par un spam bot
Résolu
Wolf911
-
archet9 -
archet9 -
Bonjour,
Voilà, j'ai reçu un message de mon FAI disant que mon PC est infecté. Après vérification, il semblerait qu'un spam bot ait contaminé mon PC; d'après CurrPorts, plein de ports 25 sont ouverts et utilisés par "services.exe" et un processus qui lui est inconnu.
En regardant de plus près avec Wireshark, effectivement, plein de messages douteux sont envoyés depuis mon ordinateur. En quête de ce malware, j'ai fait quasiment tout ce qui était possible : parcours des services lancés, scannage de l'ordinateur par l'antivirus (McAfee), Spybot et A-Squared, recherche de processus suspects, mais rien trouvé, si ce n'est que c'est bien "services.exe" qui est en cause !
Que puis-je faire ? J'aimerais que le formatage soit fait en tout dernier recours...
PS: J'ai réussi à maintenir mon PC clean pendant 3 ans. Pas de formatage, pas d'infection durant tout ce temps-là. Et voilà, il fallait que ça arrive...
Voilà, j'ai reçu un message de mon FAI disant que mon PC est infecté. Après vérification, il semblerait qu'un spam bot ait contaminé mon PC; d'après CurrPorts, plein de ports 25 sont ouverts et utilisés par "services.exe" et un processus qui lui est inconnu.
En regardant de plus près avec Wireshark, effectivement, plein de messages douteux sont envoyés depuis mon ordinateur. En quête de ce malware, j'ai fait quasiment tout ce qui était possible : parcours des services lancés, scannage de l'ordinateur par l'antivirus (McAfee), Spybot et A-Squared, recherche de processus suspects, mais rien trouvé, si ce n'est que c'est bien "services.exe" qui est en cause !
Que puis-je faire ? J'aimerais que le formatage soit fait en tout dernier recours...
PS: J'ai réussi à maintenir mon PC clean pendant 3 ans. Pas de formatage, pas d'infection durant tout ce temps-là. Et voilà, il fallait que ça arrive...
Configuration: Windows XP SP3 / Opera 9.80
19 réponses
-
---> Clique sur Démarrer, Exécuter, tape notepad clique sur OK.
---> Copie le texte ci-dessous par sélection puis Ctrl+C :
Copie le texte ci-dessous :
KillAll::
File::
c:\windows\system32\GameMon.des -service
C:\WINDOWS\System32\drivers\ifqjwu.sys
Driver::
npggsvc
ifqjwu
Netsvc::
npggsvc
ifqjwu
---> Colle la sélection dans le bloc-notes
---> Enregistre ce fichier sur le bureau (Impératif)
---> Nom du fichier : CFScript
---> Type du fichier : tous les fichiers
---> Clique sur Enregistrer
---> Quitte le bloc-notes
2/
---> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :
http://img517.imageshack.us/img517/8662/cfscript10uc2.gif
[*] Une fenêtre bleue va apparaître : au message qui apparaît, tu acceptes.
[*] Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal !
Ne touche à rien tant que le scan n'est pas terminé.
[*] Une fois le scan achevé, un rapport va s'afficher : poste-le
[*] Si le fichier ne s'ouvre pas, il se trouve ici C:\ComboFix\Combofix.txt
a+
-
Bonsoir Wolf911,
Pour voir cela:
Télécharge RSIT (de random/random) sur le bureau :
- Double clique sur RSIT.exe qui est sur le bureau
- Clique sur "Continue" dans la fenêtre
- RSIT téléchargera HijackThis si il n’est pas présent où détecté, alors il faudra accepter la licence
- Poste le contenu de log.txt plus info.txt (réduit ds la barre de taches) à la fin de l’analyse .
Les rapports sont dans le dossier ici C:\rsit
a+
-
Logfile of random's system information tool 1.06 (written by random/random)
Run by Propriétaire at 2010-03-03 20:39:11
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 379 GB (62%) free of 610 GB
Total RAM: 3327 MB (77% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:39:13, on 03.03.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\ATKKBService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Powerware\LanSafe\Bin\PowerMonitor.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Powerware\LanSafe\Bin\LSTrayAgent.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe
C:\Program Files\TeamViewer\Version5\TeamViewer.exe
C:\Program Files\Powerware\LanSafe\bin\xyntservice.exe
C:\Program Files\Powerware\LanSafe\bin\httpserver.exe
C:\Program Files\Powerware\LanSafe\bin\status_glance.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\WINDOWS\Logi_MwX.Exe
C:\Program Files\Logitech Software\iTouch\iTouch.exe
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Opera\opera.exe
C:\Documents and Settings\Propriétaire\Bureau\autoruns.exe
C:\Documents and Settings\Propriétaire\Bureau\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Propriétaire.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ch/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [zBrowser Launcher] "C:\Program Files\Logitech Software\iTouch\iTouch.exe"
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe" /hide
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ASUS SmartDoctor] C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe /start
O4 - HKUS\S-1-5-21-2052111302-963894560-839522115-1009\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" (User 'Famille')
O4 - HKUS\S-1-5-21-2052111302-963894560-839522115-1009\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Famille')
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://simcity.ea.com/update/EARTPX.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-CH/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {C36661D7-3590-45B1-80B5-520839E94DAD} (MaxisSimCity4PatcherX Control) - http://simcity.ea.com/update/MaxisSimCity4PatcherX.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E89DD7A1-A7D5-407F-9DF8-EF243DEF5332}: NameServer = 195.186.4.110,198.186.4.162
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Dragon Age: Origins - Application de mise à jour (DAUpdaterSvc) - BioWare - C:\Program Files\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: Google Update Service (gupdate1c98637e024afd6) (gupdate1c98637e024afd6) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LanSafe Power Monitor (LanSafe PM) - Eaton Corporation - C:\Program Files\Powerware\LanSafe\Bin\PowerMonitor.exe
O23 - Service: LanSafe Process Manager - Powerware - C:\Program Files\Powerware\LanSafe\bin\xyntservice.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: Service Framework McAfee (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
O23 - Service: TeamViewer 5 (TeamViewer5) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe
O23 - Service: wampapache - Apache Software Foundation - C:\Program Files\wamp\bin\apache\apache2.2.11\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - C:\Program Files\wamp\bin\mysql\mysql5.1.36\bin\mysqld.exe
-
Peux tu me dire me dire à quoi correspond ceci :
C:\Documents and Settings\Propriétaire\Bureau\autoruns.exe
Ensuite :
• Télécharge USBFIX
http://pagesperso-orange.fr/NosTools/Chiquitine29/UsbFix.exe
(!) Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptibles d'avoir été infectés sans les ouvrir
• Double clic sur le raccourci UsbFix présent sur ton bureau .
• Au menu principal choisis l'option " F " pour français et tape sur [entrée] .
• Au second menu Choisis l'option " 2 " (suppression) et tape sur [entrée]
• Laisse travailler l'outil.
• Ensuite post le rapport UsbFix.txt qui apparaitra.
• Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque. ( C:\UsbFix.txt )
( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )
• Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.
a+ -
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question -
Autoruns.exe est l'outil Autoruns édité par Sysinternals, maintenant racheté par Microsoft. Rien de bien méchant, donc.
-
-
############################## | UsbFix V6.098 |
User : Propriétaire (Administrateurs) # K_VUILLEUMIER
Update on 03/03/2010 by El Desaparecido , C_XX & Chimay8
Start at: 21:02:13 | 03.03.2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com
Intel(R) Pentium(R) 4 CPU 3.40GHz
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
C:\ -> Disque fixe local # 596.17 Go (369.82 Go free) # NTFS
D:\ -> Disque fixe local # 149.05 Go (44.06 Go free) [Disque données] # NTFS
K:\ -> Disque CD-ROM
X:\ -> Disque CD-ROM
################## | Elements infectieux |
Supprimé ! C:\Recycler\S-1-5-21-2052111302-963894560-839522115-1003
Supprimé ! C:\Recycler\S-1-5-21-2052111302-963894560-839522115-1009
Supprimé ! D:\Recycler\S-1-5-21-2052111302-963894560-839522115-1003
Supprimé ! D:\Recycler\S-1-5-21-2052111302-963894560-839522115-1009
################## | Registre |
Supprimé ! [HKLM\SYSTEM\CurrentControlSet\Services\FileZilla Server]
Supprimé ! [HKLM\SYSTEM\ControlSet003\Services\FileZilla Server]
Supprimé ! [HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_FILEZILLA_SERVER]
Supprimé ! [HKLM\SYSTEM\ControlSet003\Enum\Root\LEGACY_FILEZILLA_SERVER]
################## | Mountpoints2 |
Supprimé ! HKCU\...\Explorer\MountPoints2\K\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{815da40c-fe81-11dc-9d2b-0016e6d2e2a2}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{99f79be7-ffea-11dc-9d2e-0016e6d2e2a2}\Shell\AutoRun\Command
################## | Listing des fichiers présent |
[20.07.2009 09:36|--a------|23] C:\.forward
[24.04.2007 14:46|--a------|0] C:\AUTOEXEC.BAT
[26.02.2010 13:09|--a------|2010] C:\balance.txt
[28.11.2009 15:18|---hs----|228] C:\boot.ini
[05.08.2004 13:00|-rahs----|4952] C:\Bootfont.bin
[18.10.2009 13:05|--a------|2711] C:\colorbox.log
[24.04.2007 14:46|--a------|0] C:\CONFIG.SYS
[27.11.2008 21:34|--a------|230] C:\config.xml
[13.04.2009 16:14|--a------|3532] C:\drmHeader.bin
[03.01.2010 13:32|--a------|2889] C:\findaudio.log
[?|?|?] C:\hiberfil.sys
[10.10.2008 12:10|--a------|100] C:\index.ini
[24.04.2007 14:46|-rahs----|0] C:\IO.SYS
[05.07.2009 14:27|--a------|0] C:\itouch_config_crash_info.txt
[25.04.2007 09:43|--ah-----|0] C:\itouch_crash_info.txt
[03.03.2010 21:01|--a------|24] C:\LS_TRAYAPP.ini
[24.04.2007 14:46|-rahs----|0] C:\MSDOS.SYS
[05.08.2004 13:00|-rahs----|47564] C:\NTDETECT.COM
[27.08.2008 18:58|-rahs----|252240] C:\ntldr
[?|?|?] C:\pagefile.sys
[07.08.2009 16:16|--a------|177] C:\setup.log
[20.07.2009 09:38|--a------|3183] C:\skin.inc
[14.03.2009 12:37|--a------|44239] C:\sound32.dll
[03.03.2010 21:11|--a------|2824] C:\UsbFix.txt
[26.02.2010 13:10|--a------|562358] C:\X73_DS.bmp
[14.11.2009 17:24|--ah-----|10441] C:\ZbThumbnail.info
################## | Vaccination |
# C:\autorun.inf -> Dossier créé par UsbFix (El Desaparecido).
# D:\autorun.inf -> Dossier créé par UsbFix (El Desaparecido).
################## | Upload |
Veuillez envoyer le fichier : C:\UsbFix_Upload_Me_K_VUILLEUMIER.zip : https://www.ionos.fr/?affiliate_id=77097
Merci pour votre contribution .
################## | ! Fin du rapport # UsbFix V6.098 ! | -
---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
/!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\
---> Double-clique sur Combofix.exe
Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
Accepte en cliquant sur "Oui"
---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.
/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\
En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.
Une fois le scan achevé, un rapport va s'afficher : Poste son contenu
/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\
Note : Le rapport se trouve également là : C:\ComboFix.txt
a+
-
ComboFix 10-03-03.03 - Propriétaire 03.03.2010 22:21:39.2.2 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.41.1036.18.3327.2649 [GMT 1:00]
Lancé depuis: c:\documents and settings\Propriétaire\Bureau\ComboFix.exe
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\Temp\logishrd\LVPrcInj01.dll
.
---- Exécution préalable -------
.
c:\documents and settings\All Users\Application Data\mswintmp.dat
c:\windows\c.exe
c:\windows\system32\index.html
c:\windows\system32\VB40032.DLL
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_ASUS
((((((((((((((((((((((((((((( Fichiers créés du 2010-02-03 au 2010-03-03 ))))))))))))))))))))))))))))))))))))
.
2100-02-23 12:35 . 2001-02-22 07:54 768 ----a-w- c:\windows\x73_lut.dat
2010-03-03 20:11 . 2010-03-03 20:11 1630 ----a-w- C:\UsbFix_Upload_Me_K_VUILLEUMIER.zip
2010-03-03 19:54 . 2010-03-03 20:11 -------- d-----w- C:\UsbFix
2010-03-03 19:39 . 2010-03-03 19:39 -------- d-----w- C:\rsit
2010-03-02 14:29 . 2010-03-03 21:30 791552 ----a-w- c:\windows\system32\drivers\ifqjwu.sys
2010-02-26 19:56 . 2010-02-26 19:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Fallout3
2010-02-26 19:56 . 2010-02-26 19:56 -------- d-----w- c:\program files\Bethesda Softworks
2010-02-26 09:13 . 2010-02-26 09:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Ubisoft
2010-02-26 09:02 . 2010-02-26 09:02 -------- d-----w- c:\program files\Ubisoft
2010-02-21 08:26 . 2010-02-21 08:35 -------- d-----w- c:\program files\Mass Effect 2
2010-02-20 23:18 . 2010-02-20 23:18 -------- d-----w- c:\documents and settings\All Users\Application Data\TrackMania
2010-02-20 23:13 . 2010-02-20 23:17 -------- d-----w- c:\program files\TmUnitedForever
2010-02-20 09:02 . 2008-03-16 13:30 216064 --sh--r- c:\windows\system32\nbDX.dll
2010-02-20 09:02 . 2007-02-21 11:47 31232 --sh--r- c:\windows\system32\msfDX.dll
2010-02-20 09:02 . 2006-05-03 10:06 163328 --sh--r- c:\windows\system32\flvDX.dll
2010-02-20 09:01 . 2010-02-20 09:01 -------- d-----w- c:\program files\eRightSoft
2010-02-20 08:50 . 2010-02-20 08:51 -------- d-----w- c:\program files\MediaCoder
2010-02-17 20:57 . 2010-02-17 20:57 -------- d-----w- c:\program files\Smart Projects
2010-02-17 18:00 . 2009-09-04 16:44 515416 ----a-w- c:\windows\system32\XAudio2_5.dll
2010-02-17 18:00 . 2009-09-04 16:44 238936 ----a-w- c:\windows\system32\xactengine3_5.dll
2010-02-17 18:00 . 2009-09-04 16:29 1974616 ----a-w- c:\windows\system32\D3DCompiler_42.dll
2010-02-17 18:00 . 2009-09-04 16:29 235344 ----a-w- c:\windows\system32\d3dx11_42.dll
2010-02-17 18:00 . 2009-09-04 16:29 5501792 ----a-w- c:\windows\system32\d3dcsx_42.dll
2010-02-13 13:42 . 2010-02-13 13:42 501760 ----a-w- c:\windows\system32\Deutz Engine.scr
2010-02-13 13:42 . 2010-02-13 13:42 501760 ----a-w- c:\windows\system32\Deutz Engine.exe
2010-02-11 19:10 . 2010-02-11 19:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Divinity 2
2010-02-11 18:49 . 2010-02-11 19:11 -------- d-----w- c:\program files\Divinity II - Ego Draconis
2010-02-09 17:05 . 2010-02-09 17:05 -------- d-----w- c:\program files\cultix
2010-02-06 13:13 . 2010-02-06 13:13 -------- d-----w- c:\documents and settings\Famille\Local Settings\Application Data\Temp
2010-02-03 18:33 . 2010-02-03 18:33 -------- d-----w- c:\program files\iPod
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-03 21:28 . 2009-09-19 09:09 0 ----a-w- c:\windows\system32\drivers\lvuvc.hs
2010-03-03 21:28 . 2009-09-19 09:06 0 ----a-w- c:\windows\system32\drivers\logiflt.iad
2010-03-03 19:54 . 2007-10-08 10:00 -------- d-----w- c:\program files\a-squared Free
2010-03-03 19:53 . 2007-06-01 15:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-03-03 19:45 . 2008-03-11 12:32 -------- d-----w- c:\program files\Mozilla Thunderbird
2010-03-03 19:02 . 2008-02-10 11:00 -------- d-----w- c:\program files\Opera
2010-03-03 12:24 . 2009-08-28 19:48 -------- d-----w- c:\documents and settings\Famille\Application Data\Thunderbird
2010-03-02 08:19 . 2009-06-09 13:14 90920 ----a-w- c:\documents and settings\Famille\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-02-26 21:03 . 2007-04-29 07:20 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-02-26 20:29 . 2007-09-07 15:10 -------- d-----w- c:\program files\FRAPS
2010-02-26 19:56 . 2007-04-25 06:49 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-24 08:28 . 2008-09-22 09:22 -------- d-----w- c:\program files\uTorrent
2010-02-21 08:43 . 2009-10-31 10:45 -------- d-----w- c:\program files\Fichiers communs\BioWare
2010-02-21 07:46 . 2007-11-27 17:56 66872 ----a-w- c:\windows\system32\PnkBstrA.exe
2010-02-21 02:34 . 2009-09-18 17:27 -------- d-----w- c:\program files\Defraggler
2010-02-19 20:43 . 2009-11-07 22:02 -------- d-----w- c:\documents and settings\Famille\Application Data\vlc
2010-02-17 19:57 . 2009-07-25 15:23 -------- d-----w- c:\program files\Activision
2010-02-17 18:56 . 2007-11-27 17:57 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-02-17 18:56 . 2007-11-27 17:57 103736 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-02-14 20:19 . 2009-07-20 18:11 -------- d-----w- c:\program files\Microsoft Games
2010-02-14 17:23 . 2008-04-09 21:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-02-13 14:11 . 2009-07-16 13:36 -------- d-----w- c:\program files\Fichiers communs\Adobe AIR
2010-02-09 12:31 . 2009-09-27 16:53 -------- d-----w- c:\program files\Recuva
2010-02-04 15:02 . 2009-12-12 09:37 -------- d-----w- c:\program files\World of Warcraft
2010-02-03 19:23 . 2009-08-07 17:10 -------- d-----w- c:\program files\Capcom
2010-02-03 18:34 . 2009-06-18 08:15 -------- d-----w- c:\program files\iTunes
2010-02-03 18:33 . 2008-03-01 11:19 -------- d-----w- c:\program files\Fichiers communs\Apple
2010-02-03 18:29 . 2007-04-25 07:33 -------- d-----w- c:\program files\QuickTime
2010-01-31 11:49 . 2010-01-31 11:49 -------- d-----w- c:\program files\Unreal Tournament 3
2010-01-31 11:48 . 2007-11-25 18:02 -------- d-----w- c:\program files\Fichiers communs\Wise Installation Wizard
2010-01-25 17:29 . 2007-10-06 13:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Messenger Plus!
2010-01-25 17:28 . 2007-10-06 13:01 -------- d-----w- c:\program files\Messenger Plus! Live
2010-01-21 17:59 . 2008-06-27 12:48 -------- d-----w- c:\program files\Firefox
2010-01-21 11:02 . 2009-03-02 10:36 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-19 15:09 . 2010-01-19 15:09 -------- d-----w- c:\documents and settings\All Users\Application Data\BioWare
2010-01-19 14:57 . 2010-01-19 14:44 -------- d-----w- c:\program files\Dragon Age
2010-01-17 19:11 . 2007-11-25 18:21 -------- d-----w- c:\program files\AGEIA Technologies
2010-01-17 11:59 . 2007-04-25 07:31 -------- d-----w- c:\program files\Fichiers communs\Adobe
2010-01-17 11:59 . 2007-06-07 09:30 -------- d-----w- c:\program files\Adobe Reader 8.0
2010-01-16 10:13 . 2010-01-16 10:13 323584 ----a-w- c:\windows\system32\Binary Clock Screensaver.scr
2010-01-11 09:55 . 2004-08-05 12:00 84526 ----a-w- c:\windows\system32\perfc00C.dat
2010-01-11 09:55 . 2004-08-05 12:00 510324 ----a-w- c:\windows\system32\perfh00C.dat
2010-01-10 13:42 . 2009-12-01 15:04 -------- d-----w- c:\program files\FairUse Wizard 2
2010-01-05 21:28 . 2007-08-30 17:08 -------- d-----w- c:\program files\SpeedFan
2010-01-05 19:40 . 2010-01-05 19:40 1898264 ----a-w- c:\windows\system32\AutoPartNt.exe
2010-01-05 10:32 . 2010-01-05 10:31 -------- d-----w- c:\program files\Python31
2010-01-04 15:02 . 2010-01-04 15:02 -------- d-----w- c:\program files\Fichiers communs\Adobe Systems Shared
2010-01-04 12:42 . 2007-11-01 19:24 -------- d-----w- c:\program files\Sun
2010-01-03 18:34 . 2009-06-28 12:57 -------- d-----w- c:\program files\Photosynth
2010-01-03 18:32 . 2007-04-25 17:40 -------- d-----w- c:\program files\Google
2010-01-03 13:30 . 2009-09-19 09:05 -------- d-----w- c:\program files\Fichiers communs\LogiShrd
2010-01-03 12:57 . 2009-10-07 17:03 456480 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-01-03 12:11 . 2007-08-21 11:16 -------- d-----w- c:\program files\VirtualDub
2009-12-31 16:50 . 2004-08-05 12:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:07 . 2004-08-05 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2009-12-17 14:02 . 2009-12-17 14:02 133648 ----a-w- c:\windows\system32\VBoxNetFltNotify.dll
2009-12-17 14:02 . 2009-12-17 14:02 110096 ----a-w- c:\windows\system32\drivers\VBoxNetFlt.sys
2009-12-17 14:02 . 2009-04-13 09:20 99152 ----a-w- c:\windows\system32\drivers\VBoxNetAdp.sys
2009-12-17 14:02 . 2008-11-24 19:51 31824 ----a-w- c:\windows\system32\drivers\VBoxUSB.sys
2009-12-17 14:02 . 2008-04-04 09:51 41616 ----a-w- c:\windows\system32\drivers\VBoxUSBMon.sys
2009-12-17 14:02 . 2008-04-04 09:51 123280 ----a-w- c:\windows\system32\drivers\VBoxDrv.sys
2009-12-17 07:41 . 2007-04-24 13:42 347648 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:09 . 2004-08-05 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-09 10:08 . 2004-08-05 12:00 2147328 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-12-09 10:08 . 2004-08-04 00:49 2025984 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-12-06 14:02 . 2009-12-06 14:02 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-12-04 18:22 . 2004-08-05 12:00 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\opera\program\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\opera\program\plugins\ssldivx.dll
2006-05-03 10:06 . 2010-02-20 09:02 163328 --sh--r- c:\windows\system32\flvDX.dll
2007-02-21 11:47 . 2010-02-20 09:02 31232 --sh--r- c:\windows\system32\msfDX.dll
2008-03-16 13:30 . 2010-02-20 09:02 216064 --sh--r- c:\windows\system32\nbDX.dll
2009-03-30 19:51 . 2009-03-30 18:20 2215968 --sha-w- c:\windows\system32\drivers\fidbox.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ASUS SmartDoctor"="c:\program files\ASUS\SmartDoctor\SmartDoctor.exe" [2009-03-18 1171456]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ShStatEXE"="c:\program files\Network Associates\VirusScan\SHSTAT.EXE" [2003-09-29 81990]
"McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UpdaterUI.exe" [2003-09-10 135251]
"Logitech Utility"="Logi_MwX.Exe" [2003-06-30 19968]
"zBrowser Launcher"="c:\program files\Logitech Software\iTouch\iTouch.exe" [2004-03-18 892928]
"VirtualCloneDrive"="c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2009-05-26 85160]
"RTHDCPL"="RTHDCPL.EXE" [2009-06-12 17887232]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-11-20 12669544]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-11-20 110184]
"LogitechQuickCamRibbon"="c:\program files\Logitech\Logitech WebCam Software\LWS.exe" [2009-10-14 2793304]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-01-22 141608]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^iTouch.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\iTouch.lnk
backup=c:\windows\pss\iTouch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Propriétaire^Menu Démarrer^Programmes^Démarrage^Adobe Gamma.lnk]
path=c:\documents and settings\Propriétaire\Menu Démarrer\Programmes\Démarrage\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Propriétaire^Menu Démarrer^Programmes^Démarrage^Logitech . Enregistrement du produit.lnk]
path=c:\documents and settings\Propriétaire\Menu Démarrer\Programmes\Démarrage\Logitech . Enregistrement du produit.lnk
backup=c:\windows\pss\Logitech . Enregistrement du produit.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Propriétaire^Menu Démarrer^Programmes^Démarrage^SparkAngels.lnk]
path=c:\documents and settings\Propriétaire\Menu Démarrer\Programmes\Démarrage\SparkAngels.lnk
backup=c:\windows\pss\SparkAngels.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]
c:\windows\system32\dumprep 0 -u [X]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acronis Scheduler2 Service]
2009-06-15 08:55 136472 ----a-w- c:\program files\Fichiers communs\Acronis\Schedule2\schedhlp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AcronisTimounterMonitor]
2009-06-15 13:37 905360 ----a-w- c:\program files\Acronis\TrueImageHome\TimounterMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2009-12-11 14:57 948672 ----a-r- c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-12-18 07:58 40368 ----a-w- c:\program files\Adobe Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
2009-04-24 03:05 203416 ----a-w- c:\program files\Alcohol Soft\Alcohol 52\AxCmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUSGamerOSD]
2008-12-22 11:46 380928 ----a-w- c:\program files\ASUS\GamerOSD\GamerOSD.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2007-01-15 14:14 147456 ----a-w- c:\program files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\boincmgr]
2009-03-03 12:11 4289280 ----a-w- c:\program files\BOINC\boincmgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\boinctray]
2009-03-03 12:11 58112 ----a-w- c:\program files\BOINC\boinctray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FileZilla Server Interface]
2008-01-09 18:58 942080 ----a-w- c:\program files\FileZilla Server\FileZilla Server Interface.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FlashPlayerUpdate]
2010-01-27 01:07 256280 ----a-w- c:\windows\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GamerOSD]
2008-12-22 11:46 380928 ----a-w- c:\program files\ASUS\GamerOSD\GamerOSD.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark X73 Button Manager]
2001-06-11 09:37 53248 ----a-w- c:\progra~1\LEXMAR~1\AcBtnMgr_X73.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark X73 Button Monitor]
2001-10-08 14:21 53248 ----a-w- c:\progra~1\LEXMAR~1\ACMonitor_X73.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2006-01-12 13:40 155648 ----a-w- c:\program files\Fichiers communs\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2009-11-20 19:32 110184 ----a-w- c:\windows\system32\nvmctray.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PrinTray]
2001-10-12 05:42 36864 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\printray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-10 22:08 417792 ----a-w- c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2004-11-02 18:24 32768 ----a-w- c:\program files\CyberLink\PowerDVD\PDVDServ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-10-11 03:17 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrayServer]
2008-01-30 12:07 90112 ----a-w- c:\program files\MAGIX\Films_sur_DVD_7_TerraTec_Edition\Trayserver.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrueImageMonitor.exe]
2009-06-15 13:35 1348216 ----a-w- c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VX1000]
2009-06-26 15:21 757248 ----a-w- c:\windows\vVX1000.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"PnkBstrA"=2 (0x2)
"ReflectService"=2 (0x2)
"a2free"=2 (0x2)
"PnkBstrB"=2 (0x2)
"npggsvc"=3 (0x3)
"AcrSch2Svc"=2 (0x2)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Network Associates\\Common Framework\\FrameworkService.exe"=
"c:\\Program Files\\Opera\\Opera.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Zattoo\\zattood.exe"=
"c:\\Program Files\\Zattoo\\Zattoo2.exe"=
"c:\\Program Files\\Zattoo\\Zattoo.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=
"c:\\Documents and Settings\\Propriétaire\\Mes documents\\Visual Studio 2005\\Projects\\Secure LAN Messenger\\release\\Secure LAN Messenger.exe"=
"c:\\Documents and Settings\\Propriétaire\\Mes documents\\Visual Studio 2005\\Projects\\VChat\\release\\VChat.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\TmNationsForever\\TmForever.exe"=
"c:\\Program Files\\TeamViewer\\Version4\\TeamViewer.exe"=
"c:\\Program Files\\Synergy\\synergys.exe"=
"c:\\Program Files\\Electronic Arts\\Dead Space\\Dead Space.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Volition Inc\\Red Faction Guerrilla\\rfg.exe"=
"d:\\Partage\\Age of Empire 2\\age2_x1.exe"=
"d:\\Partage\\Warcraft 3\\war3.exe"=
"d:\\Partage\\Age of Empires III\\age3.exe"=
"d:\\Partage\\Warcraft 3\\Warcraft III.exe"=
"c:\\Program Files\\Mass Effect\\Binaries\\MassEffect.exe"=
"c:\\Program Files\\Mass Effect\\MassEffectLauncher.exe"=
"c:\\Program Files\\2K Games\\Gearbox Software\\Borderlands\\Binaries\\Borderlands.exe"=
"c:\\Program Files\\wamp\\bin\\apache\\Apache2.2.11\\bin\\httpd.exe"=
"c:\\Program Files\\TeamViewer\\Version5\\TeamViewer.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Cobian Backup 8\\Cobian.exe"=
"c:\\Program Files\\Cobian Backup 8\\cbInterface.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Dragon Age\\bin_ship\\daorigins.exe"=
"c:\\Program Files\\Dragon Age\\DAOriginsLauncher.exe"=
"c:\\Program Files\\Dragon Age\\bin_ship\\daupdatersvc.service.exe"=
"c:\\Program Files\\Unreal Tournament 3\\Binaries\\UT3.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\Microsoft Games\\Rise Of Legends\\legends.exe"=
"c:\\Program Files\\TmUnitedForever\\TmForever.exe"=
"c:\\Program Files\\Mass Effect 2\\Binaries\\MassEffect2.exe"=
"c:\\Program Files\\Mass Effect 2\\MassEffect2Launcher.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx9.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx10.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Launcher.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
R0 pssnap;Paramount Software Snapshot Filter;c:\windows\system32\drivers\pssnap.sys [20.05.2008 08:32 15328]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [06.12.2009 15:02 691696]
R1 VBoxDrv;VirtualBox Service;c:\windows\system32\drivers\VBoxDrv.sys [04.04.2008 10:51 123280]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\drivers\VBoxUSBMon.sys [04.04.2008 10:51 41616]
R2 io.sys;IO.DLL Driver;c:\windows\system32\drivers\io.sys [26.11.2008 19:37 5152]
R2 TeamViewer5;TeamViewer 5;c:\program files\TeamViewer\Version5\TeamViewer_Service.exe [11.02.2010 12:42 172328]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\drivers\VBoxNetAdp.sys [13.04.2009 10:20 99152]
R3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\drivers\VBoxNetFlt.sys [17.12.2009 15:02 110096]
S2 gupdate1c98637e024afd6;Google Update Service (gupdate1c98637e024afd6);c:\program files\Google\Update\GoogleUpdate.exe [03.02.2009 20:44 133104]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [28.06.2009 18:45 1684736]
S3 DAUpdaterSvc;Dragon Age: Origins - Application de mise à jour;c:\program files\Dragon Age\bin_ship\daupdatersvc.service.exe [19.01.2010 15:55 25832]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [28.12.2009 17:30 1527900]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [23.12.2008 16:35 50704]
S3 VBoxUSB;VirtualBox USB;c:\windows\system32\drivers\VBoxUSB.sys [24.11.2008 20:51 31824]
S4 a2free;a-squared Free Service;c:\program files\a-squared Free\a2service.exe [08.10.2007 11:00 1858144]
S4 cpuz130;cpuz130;\??\c:\windows\TEMP\cpuz130\cpuz_x32.sys --> c:\windows\TEMP\cpuz130\cpuz_x32.sys [?]
S4 fwadv07n;fwadv07n;\??\c:\windows\TEMP\fwadv07n.sys --> c:\windows\TEMP\fwadv07n.sys [?]
S4 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S4 ReflectService;Macrium Reflect Image Mounting Service;c:\program files\Macrium\Reflect\ReflectService.exe [25.08.2009 11:16 220128]
S4 TinaKey;TinaKey; [x]
--- Autres Services/Pilotes en mémoire ---
*Deregistered* - ifqjwu
.
Contenu du dossier 'Tâches planifiées'
2010-02-22 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 10:34]
2010-03-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-03 19:44]
2010-03-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-03 19:44]
2010-03-03 c:\windows\Tasks\User_Feed_Synchronization-{150D99EF-BD64-477B-A1BF-61842F273D19}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]
2010-03-03 c:\windows\Tasks\User_Feed_Synchronization-{B63CF8B1-9D0B-4421-B886-9EDBB677C731}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]
.
.
------- Examen supplémentaire -------
.
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xporter vers Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
TCP: {E89DD7A1-A7D5-407F-9DF8-EF243DEF5332} = 195.186.4.110,198.186.4.162
FF - ProfilePath - c:\documents and settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\nqdrr1w9.default\
FF - prefs.js: browser.search.selectedEngine - Wikipédia (fr)
FF - prefs.js: browser.startup.homepage - hxxp://www.google.ch/
FF - plugin: c:\program files\Adobe Reader 8.0\Reader\browser\nppdf32.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.17\npGoogleOneClick8.dll
FF - plugin: c:\program files\Opera\program\plugins\npdivx32.dll
FF - plugin: c:\program files\Photosynth\npPhotosynthMozilla.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- PARAMETRES FIREFOX ----
c:\program files\Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "https://www.mozilla.org/en-US/firefox/new/?redirect_source=firefox-com");
c:\program files\Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHELINS SUPPRIMES - - - -
AddRemove-DAO 3.5 - c:\program files\Your Company\DAO 3.5\Uninst.isu
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-03 22:29
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll sfsync02.sys atapi.sys spam.sys >>UNKNOWN [0x8B2F9938]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xb80fcf28
\Driver\ACPI -> ACPI.sys @ 0xb7e73cb8
\Driver\atapi -> sfsync02.sys @ 0xb80c98b4
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
NDIS: Realtek RTL8168B/8111B Family PCI-E GBE NIC -> SendCompleteHandler -> NDIS.sys @ 0xb7bf6bb0
PacketIndicateHandler -> NDIS.sys @ 0xb7c03a21
SendHandler -> NDIS.sys @ 0xb7be187b
user & kernel MBR OK
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ifqjwu]
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_USERS\S-1-5-21-2052111302-963894560-839522115-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
[HKEY_USERS\S-1-5-21-2052111302-963894560-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:7e,43,f5,88,74,ca,94,e1,d0,08,09,e7,7a,6e,6a,c8,c6,f7,74,0a,2b,a4,8e,
46,3c,1b,8c,f6,03,00,1e,eb,88,33,47,87,fe,35,d3,cf,2f,7c,e4,8b,49,d7,02,46,\
"??"=hex:c4,79,63,7a,e3,0b,18,56,9b,3e,af,3d,21,40,2f,6d
[HKEY_USERS\S-1-5-21-2052111302-963894560-839522115-1003\Software\SecuROM\License information*]
"datasecu"=hex:12,6d,e7,da,64,17,5e,bd,c4,df,b3,a0,d2,1d,77,83,59,84,99,7c,98,
d7,fc,c5,a5,b6,8d,af,bf,ec,f3,fb,b4,10,8a,cc,88,98,a3,f6,77,6c,6c,4f,1e,74,\
"rkeysecu"=hex:d6,91,ae,5e,65,7b,6a,fb,58,83,f0,cd,f9,98,06,cf
[HKEY_LOCAL_MACHINE\software\Microsoft\Environment*]
"Licence0"="04F0D21-79D8-7A25-D702-433F"
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'lsass.exe'(1404)
c:\windows\system32\relog_ap.dll
- - - - - - - > 'explorer.exe'(5020)
c:\windows\TEMP\logishrd\LVPrcInj01.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\msi.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.FRA
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\windows\system32\LEXBCES.EXE
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\ATKKBService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Powerware\LanSafe\Bin\PowerMonitor.exe
c:\program files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\program files\Network Associates\Common Framework\FrameworkService.exe
c:\program files\Network Associates\VirusScan\Mcshield.exe
c:\program files\Network Associates\VirusScan\VsTskMgr.exe
c:\progra~1\NETWOR~1\COMMON~1\naPrdMgr.exe
c:\program files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
c:\windows\Logi_MwX.Exe
c:\windows\RTHDCPL.EXE
c:\program files\Powerware\LanSafe\bin\xyntservice.exe
c:\program files\Powerware\LanSafe\bin\httpserver.exe
c:\program files\Powerware\LanSafe\bin\status_glance.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\WgaTray.exe
c:\windows\system32\wpabaln.exe
c:\program files\Opera\opera.exe
.
**************************************************************************
.
Heure de fin: 2010-03-03 22:41:13 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-03-03 21:41
Avant-CF: 397'088'047'104 octets libres
Après-CF: 396'996'349'952 octets libres
WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect /usepmtimer
- - End Of File - - 17E738A07CFD6040B306A6A530ACB680 -
Ok on avance bien...
Desactives ton antivirus le temps de la manip ainsi que ton parefeu si présent
Télécharges List&Kill'em et enregistre le sur ton bureau
http://sd-1.archive-host.com/membres/up/829108531491024/List_Killem_Install.exe
dezippes-le , (clic droit/ extraire.....)
Il ne necessite pas d'installation
double clic (clic droit "executer en tant qu'administrateur" pour Vista) pour lancer le scan
choisis la langue puis choisis l'option 1 = Mode Recherche
laisses travailler l'outil
colles le contenu dans ta prochaine réponse , un fois la fenetre refermée :
C:\List'em.txt
a+
-
Je tiens à dire que j'ai trouvé, en classant les fichiers par "modifié récemment", le fichier suspect appelé "ifqjwu.sys", situé dans C:\WINDOWS\System32\drivers et datant d'hier. D'ailleurs, il est mentionné dans le rapport ci-dessous...
List'em by g3n-h@ckm@n 1.2.8.5
User : Propriétaire (Administrateurs)
Update on 03/03/2010 by g3n-h@ckm@n ::::: 18.30
Start at: 23:01:13 | 03.03.2010
Contact : https://forums.commentcamarche.net/forum/virus-securite-7
Intel(R) Pentium(R) 4 CPU 3.40GHz
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
C:\ -> Disque fixe local | 596.17 Go (369.81 Go free) | NTFS
D:\ -> Disque fixe local | 149.05 Go (44.06 Go free) [Disque données] | NTFS
X:\ -> Disque CD-ROM
Boot: Normal
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\ATKKBService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Powerware\LanSafe\Bin\PowerMonitor.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe
C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\WINDOWS\Logi_MwX.Exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Powerware\LanSafe\bin\xyntservice.exe
C:\Program Files\Powerware\LanSafe\bin\httpserver.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe
C:\Program Files\Powerware\LanSafe\bin\status_glance.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\wpabaln.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\List_Kill'em\List_Kill'em.scr
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\ntvdm.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\Temp\3F.tmp\pv.exe
======================
Keys "Run"
======================
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ASUS SmartDoctor REG_SZ C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe /start
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ShStatEXE REG_SZ "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
McAfeeUpdaterUI REG_SZ "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
Logitech Utility REG_SZ Logi_MwX.Exe
zBrowser Launcher REG_SZ "C:\Program Files\Logitech Software\iTouch\iTouch.exe"
VirtualCloneDrive REG_SZ "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
RTHDCPL REG_SZ RTHDCPL.EXE
NvCplDaemon REG_SZ RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
NvMediaCenter REG_SZ RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
LogitechQuickCamRibbon REG_SZ "C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe" /hide
iTunesHelper REG_SZ "C:\Program Files\iTunes\iTunesHelper.exe"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
=====================
Other Keys
=====================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
dontdisplaylastusername REG_DWORD 0 (0x0)
legalnoticecaption REG_SZ
legalnoticetext REG_SZ
shutdownwithoutlogon REG_DWORD 1 (0x1)
undockwithoutlogon REG_DWORD 1 (0x1)
DisableRegistryTools REG_DWORD 0 (0x0)
===============
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
NoDriveTypeAutoRun REG_DWORD 323 (0x143)
NoDriveAutoRun REG_DWORD 67108863 (0x3ffffff)
HonorAutoRunSetting REG_DWORD 0 (0x0)
NoDrives REG_DWORD 0 (0x0)
===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
HonorAutoRunSetting REG_DWORD 0 (0x0)
NoDriveAutoRun REG_DWORD 67108863 (0x3ffffff)
NoDriveTypeAutoRun REG_DWORD 323 (0x143)
NoDrives REG_DWORD 0 (0x0)
===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
AutoRestartShell REG_DWORD 1 (0x1)
DefaultDomainName REG_SZ K_VUILLEUMIER
DefaultUserName REG_SZ Propriétaire
LegalNoticeCaption REG_SZ
LegalNoticeText REG_SZ
PowerdownAfterShutdown REG_SZ 0
ReportBootOk REG_SZ 1
Shell REG_SZ Explorer.exe
ShutdownWithoutLogon REG_SZ 0
System REG_SZ
Userinit REG_SZ C:\WINDOWS\system32\userinit.exe,
VmApplet REG_SZ rundll32 shell32,Control_RunDLL "sysdm.cpl"
SfcQuota REG_DWORD -1 (0xffffffff)
allocatecdroms REG_SZ 0
allocatedasd REG_SZ 0
allocatefloppies REG_SZ 0
cachedlogonscount REG_SZ 10
forceunlocklogon REG_DWORD 0 (0x0)
passwordexpirywarning REG_DWORD 14 (0xe)
scremoveoption REG_SZ 0
AllowMultipleTSSessions REG_DWORD 1 (0x1)
UIHost REG_EXPAND_SZ logonui.exe
LogonType REG_DWORD 1 (0x1)
Background REG_SZ 0 0 0
DebugServerCommand REG_SZ no
SFCDisable REG_DWORD 0 (0x0)
WinStationsDisabled REG_SZ 0
HibernationPreviouslyEnabled REG_DWORD 1 (0x1)
ShowLogonOptions REG_DWORD 0 (0x0)
AltDefaultUserName REG_SZ Propriétaire
AltDefaultDomainName REG_SZ K_VUILLEUMIER
ChangePasswordUseKerberos REG_DWORD 1 (0x1)
===============
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon]
===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ
===============
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe REG_SZ C:\Program Files\Network Associates\Common Framework\FrameworkService.exe:*:Enabled:Framework Service
C:\Program Files\Opera\Opera.exe REG_SZ C:\Program Files\Opera\Opera.exe:*:Enabled:Opera Internet Browser
C:\WINDOWS\system32\sessmgr.exe REG_SZ C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019
C:\WINDOWS\Network Diagnostic\xpnetdiag.exe REG_SZ C:\WINDOWS\Network Diagnostic\xpnetdiag.exe:*:Disabled:@xpsp3res.dll,-20000
C:\Program Files\Zattoo\zattood.exe REG_SZ C:\Program Files\Zattoo\zattood.exe:*:Enabled:zattood
C:\Program Files\Zattoo\Zattoo2.exe REG_SZ C:\Program Files\Zattoo\Zattoo2.exe:*:Enabled:
C:\Program Files\Zattoo\Zattoo.exe REG_SZ C:\Program Files\Zattoo\Zattoo.exe:*:Enabled:
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
C:\Program Files\uTorrent\uTorrent.exe REG_SZ C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent
C:\Program Files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe REG_SZ C:\Program Files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe:*:Disabled:Logitech Harmony Remote Software 7
C:\Documents and Settings\Propriétaire\Mes documents\Visual Studio 2005\Projects\Secure LAN Messenger\release\Secure LAN Messenger.exe REG_SZ C:\Documents and Settings\Propriétaire\Mes documents\Visual Studio 2005\Projects\Secure LAN Messenger\release\Secure LAN Messenger.exe:*:Disabled:Secure LAN Messenger
C:\Documents and Settings\Propriétaire\Mes documents\Visual Studio 2005\Projects\VChat\release\VChat.exe REG_SZ C:\Documents and Settings\Propriétaire\Mes documents\Visual Studio 2005\Projects\VChat\release\VChat.exe:*:Disabled:VChat
C:\Program Files\Windows Live\Messenger\wlcsdk.exe REG_SZ C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
C:\Program Files\TmNationsForever\TmForever.exe REG_SZ C:\Program Files\TmNationsForever\TmForever.exe:*:Enabled:TmForever
C:\Program Files\TeamViewer\Version4\TeamViewer.exe REG_SZ C:\Program Files\TeamViewer\Version4\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application
C:\Program Files\Synergy\synergys.exe REG_SZ C:\Program Files\Synergy\synergys.exe:*:Enabled:synergys
C:\Program Files\Electronic Arts\Dead Space\Dead Space.exe REG_SZ C:\Program Files\Electronic Arts\Dead Space\Dead Space.exe:*:Disabled:Dead Space ™
C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
C:\Program Files\Volition Inc\Red Faction Guerrilla\rfg.exe REG_SZ C:\Program Files\Volition Inc\Red Faction Guerrilla\rfg.exe:*:Enabled:Red Faction: Guerrilla
D:\Partage\Age of Empire 2\age2_x1.exe REG_SZ D:\Partage\Age of Empire 2\age2_x1.exe:*:Enabled:Age of Empires II Expansion
D:\Partage\Warcraft 3\war3.exe REG_SZ D:\Partage\Warcraft 3\war3.exe:*:Enabled:Warcraft III
D:\Partage\Age of Empires III\age3.exe REG_SZ D:\Partage\Age of Empires III\age3.exe:*:Enabled:Age of Empires 3
D:\Partage\Warcraft 3\Warcraft III.exe REG_SZ D:\Partage\Warcraft 3\Warcraft III.exe:*:Enabled:Warcraft III
C:\Program Files\Mass Effect\Binaries\MassEffect.exe REG_SZ C:\Program Files\Mass Effect\Binaries\MassEffect.exe:*:Enabled:Mass Effect Game
C:\Program Files\Mass Effect\MassEffectLauncher.exe REG_SZ C:\Program Files\Mass Effect\MassEffectLauncher.exe:*:Enabled:Mass Effect Launcher
C:\Program Files\2K Games\Gearbox Software\Borderlands\Binaries\Borderlands.exe REG_SZ C:\Program Files\2K Games\Gearbox Software\Borderlands\Binaries\Borderlands.exe:*:Enabled:Borderlands
C:\Program Files\wamp\bin\apache\Apache2.2.11\bin\httpd.exe REG_SZ C:\Program Files\wamp\bin\apache\Apache2.2.11\bin\httpd.exe:*:Enabled:Apache HTTP Server
C:\Program Files\TeamViewer\Version5\TeamViewer.exe REG_SZ C:\Program Files\TeamViewer\Version5\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application
C:\Program Files\Bonjour\mDNSResponder.exe REG_SZ C:\Program Files\Bonjour\mDNSResponder.exe:*:Disabled:Bonjour
C:\Program Files\Cobian Backup 8\Cobian.exe REG_SZ C:\Program Files\Cobian Backup 8\Cobian.exe:*:Disabled:Cobian Backup Black Moon Application
C:\Program Files\Cobian Backup 8\cbInterface.exe REG_SZ C:\Program Files\Cobian Backup 8\cbInterface.exe:*:Disabled:Cobian Backup Black Moon Interface
C:\WINDOWS\system32\dplaysvr.exe REG_SZ C:\WINDOWS\system32\dplaysvr.exe:*:Disabled:Microsoft DirectPlay Helper
C:\Program Files\Java\jre6\bin\java.exe REG_SZ C:\Program Files\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary
C:\Program Files\Dragon Age\bin_ship\daorigins.exe REG_SZ C:\Program Files\Dragon Age\bin_ship\daorigins.exe:*:Enabled:Dragon Age Origins Jeu
C:\Program Files\Dragon Age\DAOriginsLauncher.exe REG_SZ C:\Program Files\Dragon Age\DAOriginsLauncher.exe:*:Enabled:Dragon Age Origins Lanceur
C:\Program Files\Dragon Age\bin_ship\daupdatersvc.service.exe REG_SZ C:\Program Files\Dragon Age\bin_ship\daupdatersvc.service.exe:*:Enabled:Dragon Age Origins Application de mise à jour
C:\Program Files\Unreal Tournament 3\Binaries\UT3.exe REG_SZ C:\Program Files\Unreal Tournament 3\Binaries\UT3.exe:*:Enabled:Unreal Tournament 3
C:\Program Files\iTunes\iTunes.exe REG_SZ C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes
C:\WINDOWS\system32\PnkBstrA.exe REG_SZ C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA
C:\WINDOWS\system32\PnkBstrB.exe REG_SZ C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB
C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe REG_SZ C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM)
C:\Program Files\Microsoft Games\Rise Of Legends\legends.exe REG_SZ C:\Program Files\Microsoft Games\Rise Of Legends\legends.exe:*:Enabled:Rise Of Legends
C:\Program Files\TmUnitedForever\TmForever.exe REG_SZ C:\Program Files\TmUnitedForever\TmForever.exe:*:Enabled:TmForever
C:\Program Files\Mass Effect 2\Binaries\MassEffect2.exe REG_SZ C:\Program Files\Mass Effect 2\Binaries\MassEffect2.exe:*:Enabled:Mass Effect 2 Jeu
C:\Program Files\Mass Effect 2\MassEffect2Launcher.exe REG_SZ C:\Program Files\Mass Effect 2\MassEffect2Launcher.exe:*:Enabled:Mass Effect 2 Lanceur
C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe REG_SZ C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe:*:Enabled:Assassin's Creed Dx9
C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe REG_SZ C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe:*:Enabled:Assassin's Creed Dx10
C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe REG_SZ C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe:*:Enabled:Assassin's Creed Update
C:\Program Files\Skype\Phone\Skype.exe REG_SZ C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\Program Files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe REG_SZ C:\Program Files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7
C:\Program Files\Windows Live\Messenger\wlcsdk.exe REG_SZ C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
===============
ActivX controls
===============
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{17492023-C23A-453E-A040-C7C580BBF700}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{33564D57-0000-0010-8000-00AA00389B71}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{54B52E52-8000-4413-BD67-FC7FE24B59F2}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{5D6F45B3-9043-443D-A792-115447494D24}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{5D86DDB5-BDF9-441B-9E9E-D4730F4EE499}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{6414512B-B978-451D-A0D8-FCFDF33E833C}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{6E32070A-766D-4EE6-879C-DC1FA91D2FC3}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{C36661D7-3590-45B1-80B5-520839E94DAD}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{C3F79A2B-B9B4-4A66-B012-3EE46475B072}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{D27CDB6E-AE6D-11CF-96B8-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{F5A7706B-B9C0-4C89-A715-7A0C6B05DD48}
===============
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\Microsoft Base Smart Card Crypto Provider Package
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{411EDCF7-755D-414E-A74B-3DCD6583F589}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5056b317-8d4c-43ee-8543-b9d1e234b8f4}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{72AD53CC-CCC0-3757-8480-9EE176866A7C}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{73fa19d0-2d75-11d2-995d-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9A394342-4A68-4EBA-85A6-55B559F4E700}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9BB5DD65-D02F-43FC-94AF-E8932A4EFB73}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B508B3F1-A24A-32C0-B310-85786919EF28}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{BECB938C-6BC2-48C6-A0A6-4B61E85F584C}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{EF289A85-8E57-408d-BE47-73B55609861A}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F196AC50-7C95-42E1-9947-BDAB18BF3C8C}
==============
BHO :
======
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
===
DNS
===
HKLM\SYSTEM\CCS\Services\Tcpip\..\{E89DD7A1-A7D5-407F-9DF8-EF243DEF5332}: NameServer=195.186.4.110,198.186.4.162
HKLM\SYSTEM\CS1\Services\Tcpip\..\{E89DD7A1-A7D5-407F-9DF8-EF243DEF5332}: NameServer=195.186.4.110,198.186.4.162
HKLM\SYSTEM\CS2\Services\Tcpip\..\{E89DD7A1-A7D5-407F-9DF8-EF243DEF5332}: NameServer=195.186.4.110,198.186.4.162
HKLM\SYSTEM\CS3\Services\Tcpip\..\{E89DD7A1-A7D5-407F-9DF8-EF243DEF5332}: NameServer=195.186.4.110,198.186.4.162
================
Internet Explorer :
================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.msn.com/fr-fr
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
========
Services
========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]
Ndisuio : 0x3 ( OK = 3 )
EapHost : 0x3 ( OK = 2 )
SharedAccess : 0x2 ( OK = 2 )
wuauserv : 0x2 ( OK = 2 )
=========
Atapi.sys
=========
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\WINDOWS\Temp\3F.tmp
## C:\> hashdeep.exe C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
##
95360,cdfe4411a69c224bd1d11b2da92dac51,0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d,C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\WINDOWS\Temp\3F.tmp
## C:\> hashdeep.exe C:\WINDOWS\ERDNT\cache\atapi.sys
##
96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,C:\WINDOWS\ERDNT\cache\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\WINDOWS\Temp\3F.tmp
## C:\> hashdeep.exe C:\WINDOWS\ServicePackFiles\i386\atapi.sys
##
96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,C:\WINDOWS\ServicePackFiles\i386\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\WINDOWS\Temp\3F.tmp
## C:\> hashdeep.exe C:\WINDOWS\system32\dllcache\atapi.sys
##
96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,C:\WINDOWS\system32\dllcache\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\WINDOWS\Temp\3F.tmp
## C:\> hashdeep.exe C:\WINDOWS\system32\drivers\atapi.sys
##
96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,C:\WINDOWS\system32\drivers\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\WINDOWS\Temp\3F.tmp
## C:\> hashdeep.exe C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\atapi.sys
##
95360,cdfe4411a69c224bd1d11b2da92dac51,0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d,C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\atapi.sys
Référence :
==========
Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe
Win XP_32b : a64013e98426e1877cb653685c5c0009
Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
Windows 7_32b : 80C40F7FDFC376E4C5FEEC28B41C119E
Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C
=======
Drive :
=======
Défragmenteur de disque Windows
Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc.
Rapport d'analyse
596 Go total, 370 Go libre (62%), 9% fragmenté (fragmentation du fichier 18%)
Il ne vous est pas nécessaire de défragmenter ce volume.
¤¤¤¤¤¤¤¤¤¤ Files/folders :
Present !! : C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
Present !! : C:\Program Files\WinPCap
Present !! : C:\WINDOWS\003042_.tmp
Present !! : C:\WINDOWS\SET3.tmp
Present !! : C:\WINDOWS\SET4.tmp
Present !! : C:\WINDOWS\SET8.tmp
Present !! : C:\WINDOWS\iun6002.exe
Present !! : C:\WINDOWS\System32\drivers\etc\hosts.msn
Present !! : C:\WINDOWS\System32\drivers\npf.sys
Present !! : C:\WINDOWS\System32\Packet.dll
Present !! : C:\WINDOWS\System32\pthreadVC.dll
Present !! : C:\WINDOWS\System32\wpcap.dll
Present !! : C:\WINDOWS\unins000.dat
Present !! : C:\WINDOWS\unins000.exe
Present !! : C:\Documents and Settings\Propriétaire\Application Data\pcouffin.inf
Present !! : C:\Documents and Settings\Propriétaire\Application Data\SYZBUFRW.inf
Present !! : C:\Documents and Settings\Propriétaire\Application Data\inst.exe
¤¤¤¤¤¤¤¤¤¤ Keys :
Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
Present !! : HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives
Present !! : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
Present !! : HKCR\CLSID\{248dd896-bb45-11cf-9abc-0080c7e7b78d}
Present !! : HKCR\CLSID\{248dd897-bb45-11cf-9abc-0080c7e7b78d}
Present !! : HKCR\Interface\{248dd892-bb45-11cf-9abc-0080c7e7b78d}
Present !! : HKCR\Interface\{248dd893-bb45-11cf-9abc-0080c7e7b78d}
Present !! : HKCR\TypeLib\{248dd890-bb45-11cf-9abc-0080c7e7b78d}
Present !! : HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_NPF
Present !! : HKLM\SYSTEM\ControlSet001\Services\npf
Present !! : HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_NPF
Present !! : HKLM\SYSTEM\ControlSet002\Services\npf
Present !! : HKLM\SYSTEM\ControlSet003\Enum\Root\LEGACY_NPF
Present !! : HKLM\SYSTEM\ControlSet003\Services\npf
Present !! : HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NPF
Present !! : HKLM\SYSTEM\CurrentControlSet\Services\npf
============
catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-03 23:09:01
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden services & system hive ...
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ifqjwu]
"Type"=dword:00000001
"Start"=dword:00000000
"ErrorControl"=dword:00000000
"Group"="Boot Bus Extender"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 52\"
"h0"=dword:00000000
"ujdew"=hex:95,5d,bc,2f,d1,f0,d3,c9,d9,8d,f3,61,5f,8a,44,02,2e,23,69,c6,5d,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\ifqjwu]
"Type"=dword:00000001
"Start"=dword:00000000
"ErrorControl"=dword:00000000
"Group"="Boot Bus Extender"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 52\"
"h0"=dword:00000000
"ujdew"=hex:95,5d,bc,2f,d1,f0,d3,c9,d9,8d,f3,61,5f,8a,44,02,2e,23,69,c6,5d,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ifqjwu]
"Type"=dword:00000001
"Start"=dword:00000000
"ErrorControl"=dword:00000000
"Group"="Boot Bus Extender"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 52\"
"h0"=dword:00000000
"ujdew"=hex:95,5d,bc,2f,d1,f0,d3,c9,d9,8d,f3,61,5f,8a,44,02,2e,23,69,c6,5d,..
scanning hidden registry entries ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll sfsync02.sys atapi.sys spam.sys >>UNKNOWN [0x8B2F9938]<<
kernel: MBR read successfully
user & kernel MBR OK
¤¤¤¤¤¤¤¤¤¤ Cracks | Keygens | Serials
C:\Documents and Settings\Propriétaire\Mes documents\Programmation\Programmes, codes téléchargés\C, CPP\Serial.zip
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
End of scan : 23:18:18.78 -
REDEMARRE EN MODE SANS ECHEC
Relance List&Kill'em ,
mais cette fois-ci :
choisis l'option 2 = Mode Destruction
laisse travailler l'outil
apres les verifications , un rapport va s'ouvrir.
ferme-le.
un deuxieme rapport va s'ouvrir ,
colle son contenu dans ta reponse apres avoir redemarré en mode normal
a+ -
Bon, par contre, lorsque j'ai redémarré, il y a eu un jolie écran bleu de la mort. J'ai du alors remettre la dernière bonne configuration connue... C'est pas la première fois depuis que je fais tous ces scans :(
En plus, le spam bot est toujours là :(
Kill'em by g3n-h@ckm@n 1.2.8.5
User : Administrateur ()
Update on 03/03/2010 by g3n-h@ckm@n ::::: 18.30
Start at: 23:48:30 | 03.03.2010
Contact : https://forums.commentcamarche.net/forum/virus-securite-7
Intel(R) Pentium(R) 4 CPU 3.40GHz
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
C:\ -> Disque fixe local | 596.17 Go (373.92 Go free) | NTFS
D:\ -> Disque fixe local | 149.05 Go (44.06 Go free) [Disque données] | NTFS
X:\ -> Disque CD-ROM
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\List_Kill'em\List_Kill'em.scr
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\ntvdm.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\Temp\1.tmp\ERUNT.EXE
C:\WINDOWS\Temp\1.tmp\pv.exe
Detections :
==========
¤¤¤¤¤¤¤¤¤¤ Files/folders :
Quarantined & Deleted !! : C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
Quarantined & Deleted !! : C:\Program Files\WinPCap
Quarantined & Deleted !! : C:\WINDOWS\003042_.tmp
Quarantined & Deleted !! : C:\WINDOWS\SET3.tmp
Quarantined & Deleted !! : C:\WINDOWS\SET4.tmp
Quarantined & Deleted !! : C:\WINDOWS\SET8.tmp
Quarantined & Deleted !! : C:\WINDOWS\iun6002.exe
Quarantined & Deleted !! : C:\WINDOWS\System32\drivers\etc\hosts.msn
Quarantined & Deleted !! : C:\WINDOWS\System32\drivers\lvuvc.hs
Quarantined & Deleted !! : C:\WINDOWS\System32\drivers\npf.sys
Quarantined & Deleted !! : C:\WINDOWS\System32\Packet.dll
Quarantined & Deleted !! : C:\WINDOWS\System32\pthreadVC.dll
Quarantined & Deleted !! : C:\WINDOWS\System32\wpcap.dll
Quarantined & Deleted !! : C:\WINDOWS\unins000.dat
Quarantined & Deleted !! : C:\WINDOWS\unins000.exe
==============
host file OK !
==============
========
Registry
========
Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
Deleted : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe" -
Fais ceci stp :
---> Télécharge OTM (OldTimer) sur ton Bureau :
http: http://www.geekstogo.com/forum/files/file/402-otm-oldtimers-move-it/
---> Double-clique sur OTMoveIt3.exe afin de le lancer.
---> Copie (Ctrl+C) le texte suivant en gras ci-dessous :
:files
C:\WINDOWS\System32\drivers\etc\hosts.msn
C:\Documents and Settings\Propriétaire\Application Data\inst.exe
:commands
[purity]
[emptytemp]
---> Colle (Ctrl+V) le texte précédemment copié dans le cadre:
Paste Instructions for Items to be Moved.
---> Clique maintenant sur le bouton MoveIt!
Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
Accepte en cliquant sur YES.
---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
Le nom du rapport correspond au moment de sa création : date_heure.log
==> A demain....
........ -
All processes killed
========== FILES ==========
File/Folder C:\WINDOWS\System32\drivers\etc\hosts.msn not found.
File/Folder C:\Documents and Settings\Propriétaire\Application Data\inst.exe not found.
========== COMMANDS ==========
[EMPTYTEMP]
User: Administrateur
->Temporary Internet Files folder emptied: 57257 bytes
->Flash cache emptied: 41661 bytes
User: All Users
User: Default user
->Temporary Internet Files folder emptied: 57257 bytes
->Flash cache emptied: 41661 bytes
User: Famille
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 5570965 bytes
->Java cache emptied: 278259 bytes
->FireFox cache emptied: 55041899 bytes
->Flash cache emptied: 22958 bytes
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 275666 bytes
->Flash cache emptied: 405 bytes
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
User: Propritaire
User: Propriétaire
->Flash cache emptied: 1850800 bytes
User: Propriétaire
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 5873236 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 83650063 bytes
->Flash cache emptied: 47774 bytes
User: PropriÚtaire
->Temporary Internet Files folder emptied: 33170 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 30778687 bytes
%systemroot%\System32 .tmp files removed: 3072 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 56996905 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 230.00 mb
OTM by OldTimer - Version 3.1.10.0 log created on 03042010_172346
Files moved on Reboot...
Registry entries deleted on Reboot... -
Je me demande si il ne faudrait tout simplement pas supprimer le fameux fichier "C:\WINDOWS\System32\drivers\ifqjwu.sys" qui paraît dater du début de l'infection et qui est inaccessible et insupprimable, même en mode sans-échecs.
-
ComboFix 10-03-03.03 - Propriétaire 04.03.2010 20:26:11.3.2 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.41.1036.18.3327.2773 [GMT 1:00]
Lancé depuis: c:\documents and settings\Propriétaire\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\Propriétaire\Bureau\CFScript
FILE ::
"c:\windows\system32\drivers\ifqjwu.sys"
"c:\windows\system32\GameMon.des -service"
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\drivers\ifqjwu.sys
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_IFQJWU
-------\Legacy_NPF
-------\Legacy_NPGGSVC
-------\Service_ifqjwu
-------\Service_NPF
-------\Service_npggsvc
((((((((((((((((((((((((((((( Fichiers créés du 2010-02-04 au 2010-03-04 ))))))))))))))))))))))))))))))))))))
.
2100-02-23 12:35 . 2001-02-22 07:54 768 ----a-w- c:\windows\x73_lut.dat
2010-03-04 16:13 . 2010-03-04 16:13 -------- d-----w- C:\_OTM
2010-03-03 22:48 . 2010-03-03 22:48 -------- d-----w- C:\Kill'em
2010-03-03 22:35 . 2010-03-03 22:37 -------- d-----w- c:\documents and settings\Administrateur
2010-03-03 22:00 . 2010-03-03 22:00 -------- d-----w- c:\program files\List_Kill'em
2010-03-03 20:11 . 2010-03-03 20:11 1630 ----a-w- C:\UsbFix_Upload_Me_K_VUILLEUMIER.zip
2010-03-03 19:54 . 2010-03-03 20:11 -------- d-----w- C:\UsbFix
2010-03-03 19:39 . 2010-03-03 19:39 -------- d-----w- C:\rsit
2010-02-26 19:56 . 2010-02-26 19:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Fallout3
2010-02-26 19:56 . 2010-02-26 19:56 -------- d-----w- c:\program files\Bethesda Softworks
2010-02-26 09:13 . 2010-02-26 09:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Ubisoft
2010-02-26 09:02 . 2010-02-26 09:02 -------- d-----w- c:\program files\Ubisoft
2010-02-21 08:26 . 2010-02-21 08:35 -------- d-----w- c:\program files\Mass Effect 2
2010-02-20 23:18 . 2010-02-20 23:18 -------- d-----w- c:\documents and settings\All Users\Application Data\TrackMania
2010-02-20 23:13 . 2010-02-20 23:17 -------- d-----w- c:\program files\TmUnitedForever
2010-02-20 09:02 . 2008-03-16 13:30 216064 --sh--r- c:\windows\system32\nbDX.dll
2010-02-20 09:02 . 2007-02-21 11:47 31232 --sh--r- c:\windows\system32\msfDX.dll
2010-02-20 09:02 . 2006-05-03 10:06 163328 --sh--r- c:\windows\system32\flvDX.dll
2010-02-20 09:01 . 2010-02-20 09:01 -------- d-----w- c:\program files\eRightSoft
2010-02-20 08:50 . 2010-02-20 08:51 -------- d-----w- c:\program files\MediaCoder
2010-02-17 20:57 . 2010-02-17 20:57 -------- d-----w- c:\program files\Smart Projects
2010-02-17 18:00 . 2009-09-04 16:44 515416 ----a-w- c:\windows\system32\XAudio2_5.dll
2010-02-17 18:00 . 2009-09-04 16:44 238936 ----a-w- c:\windows\system32\xactengine3_5.dll
2010-02-17 18:00 . 2009-09-04 16:29 1974616 ----a-w- c:\windows\system32\D3DCompiler_42.dll
2010-02-17 18:00 . 2009-09-04 16:29 235344 ----a-w- c:\windows\system32\d3dx11_42.dll
2010-02-17 18:00 . 2009-09-04 16:29 5501792 ----a-w- c:\windows\system32\d3dcsx_42.dll
2010-02-13 13:42 . 2010-02-13 13:42 501760 ----a-w- c:\windows\system32\Deutz Engine.scr
2010-02-13 13:42 . 2010-02-13 13:42 501760 ----a-w- c:\windows\system32\Deutz Engine.exe
2010-02-11 19:10 . 2010-02-11 19:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Divinity 2
2010-02-11 18:49 . 2010-02-11 19:11 -------- d-----w- c:\program files\Divinity II - Ego Draconis
2010-02-09 17:05 . 2010-02-09 17:05 -------- d-----w- c:\program files\cultix
2010-02-06 13:13 . 2010-02-06 13:13 -------- d-----w- c:\documents and settings\Famille\Local Settings\Application Data\Temp
2010-02-03 18:33 . 2010-02-03 18:33 -------- d-----w- c:\program files\iPod
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-04 19:39 . 2010-03-03 23:09 0 ----a-w- c:\windows\system32\drivers\lvuvc.hs
2010-03-04 16:33 . 2008-03-11 12:32 -------- d-----w- c:\program files\Mozilla Thunderbird
2010-03-04 11:04 . 2009-12-12 09:37 -------- d-----w- c:\program files\World of Warcraft
2010-03-03 19:54 . 2007-10-08 10:00 -------- d-----w- c:\program files\a-squared Free
2010-03-03 19:53 . 2007-06-01 15:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-03-03 19:02 . 2008-02-10 11:00 -------- d-----w- c:\program files\Opera
2010-03-03 12:24 . 2009-08-28 19:48 -------- d-----w- c:\documents and settings\Famille\Application Data\Thunderbird
2010-03-02 08:19 . 2009-06-09 13:14 90920 ----a-w- c:\documents and settings\Famille\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-02-26 21:03 . 2007-04-29 07:20 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-02-26 20:29 . 2007-09-07 15:10 -------- d-----w- c:\program files\FRAPS
2010-02-26 19:56 . 2007-04-25 06:49 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-24 08:28 . 2008-09-22 09:22 -------- d-----w- c:\program files\uTorrent
2010-02-21 08:43 . 2009-10-31 10:45 -------- d-----w- c:\program files\Fichiers communs\BioWare
2010-02-21 07:46 . 2007-11-27 17:56 66872 ----a-w- c:\windows\system32\PnkBstrA.exe
2010-02-21 02:34 . 2009-09-18 17:27 -------- d-----w- c:\program files\Defraggler
2010-02-19 20:43 . 2009-11-07 22:02 -------- d-----w- c:\documents and settings\Famille\Application Data\vlc
2010-02-17 19:57 . 2009-07-25 15:23 -------- d-----w- c:\program files\Activision
2010-02-17 18:56 . 2007-11-27 17:57 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-02-17 18:56 . 2007-11-27 17:57 103736 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-02-14 20:19 . 2009-07-20 18:11 -------- d-----w- c:\program files\Microsoft Games
2010-02-14 17:23 . 2008-04-09 21:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-02-13 14:11 . 2009-07-16 13:36 -------- d-----w- c:\program files\Fichiers communs\Adobe AIR
2010-02-09 12:31 . 2009-09-27 16:53 -------- d-----w- c:\program files\Recuva
2010-02-03 19:23 . 2009-08-07 17:10 -------- d-----w- c:\program files\Capcom
2010-02-03 18:34 . 2009-06-18 08:15 -------- d-----w- c:\program files\iTunes
2010-02-03 18:33 . 2008-03-01 11:19 -------- d-----w- c:\program files\Fichiers communs\Apple
2010-02-03 18:29 . 2007-04-25 07:33 -------- d-----w- c:\program files\QuickTime
2010-01-31 11:49 . 2010-01-31 11:49 -------- d-----w- c:\program files\Unreal Tournament 3
2010-01-31 11:48 . 2007-11-25 18:02 -------- d-----w- c:\program files\Fichiers communs\Wise Installation Wizard
2010-01-25 17:29 . 2007-10-06 13:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Messenger Plus!
2010-01-25 17:28 . 2007-10-06 13:01 -------- d-----w- c:\program files\Messenger Plus! Live
2010-01-21 17:59 . 2008-06-27 12:48 -------- d-----w- c:\program files\Firefox
2010-01-21 11:02 . 2009-03-02 10:36 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-19 15:09 . 2010-01-19 15:09 -------- d-----w- c:\documents and settings\All Users\Application Data\BioWare
2010-01-19 14:57 . 2010-01-19 14:44 -------- d-----w- c:\program files\Dragon Age
2010-01-17 19:11 . 2007-11-25 18:21 -------- d-----w- c:\program files\AGEIA Technologies
2010-01-17 11:59 . 2007-04-25 07:31 -------- d-----w- c:\program files\Fichiers communs\Adobe
2010-01-17 11:59 . 2007-06-07 09:30 -------- d-----w- c:\program files\Adobe Reader 8.0
2010-01-16 10:13 . 2010-01-16 10:13 323584 ----a-w- c:\windows\system32\Binary Clock Screensaver.scr
2010-01-11 09:55 . 2004-08-05 12:00 84526 ----a-w- c:\windows\system32\perfc00C.dat
2010-01-11 09:55 . 2004-08-05 12:00 510324 ----a-w- c:\windows\system32\perfh00C.dat
2010-01-10 13:42 . 2009-12-01 15:04 -------- d-----w- c:\program files\FairUse Wizard 2
2010-01-05 21:28 . 2007-08-30 17:08 -------- d-----w- c:\program files\SpeedFan
2010-01-05 19:40 . 2010-01-05 19:40 1898264 ----a-w- c:\windows\system32\AutoPartNt.exe
2010-01-05 10:32 . 2010-01-05 10:31 -------- d-----w- c:\program files\Python31
2010-01-04 15:02 . 2010-01-04 15:02 -------- d-----w- c:\program files\Fichiers communs\Adobe Systems Shared
2010-01-04 12:42 . 2007-11-01 19:24 -------- d-----w- c:\program files\Sun
2010-01-03 12:57 . 2009-10-07 17:03 456480 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-12-31 16:50 . 2004-08-05 12:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:07 . 2004-08-05 12:00 916480 ------w- c:\windows\system32\wininet.dll
2009-12-17 14:02 . 2009-12-17 14:02 133648 ----a-w- c:\windows\system32\VBoxNetFltNotify.dll
2009-12-17 14:02 . 2009-12-17 14:02 110096 ----a-w- c:\windows\system32\drivers\VBoxNetFlt.sys
2009-12-17 14:02 . 2009-04-13 09:20 99152 ----a-w- c:\windows\system32\drivers\VBoxNetAdp.sys
2009-12-17 14:02 . 2008-11-24 19:51 31824 ----a-w- c:\windows\system32\drivers\VBoxUSB.sys
2009-12-17 14:02 . 2008-04-04 09:51 41616 ----a-w- c:\windows\system32\drivers\VBoxUSBMon.sys
2009-12-17 14:02 . 2008-04-04 09:51 123280 ----a-w- c:\windows\system32\drivers\VBoxDrv.sys
2009-12-17 07:41 . 2007-04-24 13:42 347648 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:09 . 2004-08-05 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-09 10:08 . 2004-08-05 12:00 2147328 ------w- c:\windows\system32\ntoskrnl.exe
2009-12-09 10:08 . 2004-08-04 00:49 2025984 ------w- c:\windows\system32\ntkrnlpa.exe
2009-12-06 14:02 . 2009-12-06 14:02 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\opera\program\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\opera\program\plugins\ssldivx.dll
2006-05-03 10:06 . 2010-02-20 09:02 163328 --sh--r- c:\windows\system32\flvDX.dll
2007-02-21 11:47 . 2010-02-20 09:02 31232 --sh--r- c:\windows\system32\msfDX.dll
2008-03-16 13:30 . 2010-02-20 09:02 216064 --sh--r- c:\windows\system32\nbDX.dll
2009-03-30 19:51 . 2009-03-30 18:20 2215968 --sha-w- c:\windows\system32\drivers\fidbox.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ASUS SmartDoctor"="c:\program files\ASUS\SmartDoctor\SmartDoctor.exe" [2009-03-18 1171456]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ShStatEXE"="c:\program files\Network Associates\VirusScan\SHSTAT.EXE" [2003-09-29 81990]
"McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UpdaterUI.exe" [2003-09-10 135251]
"Logitech Utility"="Logi_MwX.Exe" [2003-06-30 19968]
"zBrowser Launcher"="c:\program files\Logitech Software\iTouch\iTouch.exe" [2004-03-18 892928]
"VirtualCloneDrive"="c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2009-05-26 85160]
"RTHDCPL"="RTHDCPL.EXE" [2009-06-12 17887232]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-11-20 12669544]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-11-20 110184]
"LogitechQuickCamRibbon"="c:\program files\Logitech\Logitech WebCam Software\LWS.exe" [2009-10-14 2793304]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-01-22 141608]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^iTouch.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\iTouch.lnk
backup=c:\windows\pss\iTouch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Propriétaire^Menu Démarrer^Programmes^Démarrage^Adobe Gamma.lnk]
path=c:\documents and settings\Propriétaire\Menu Démarrer\Programmes\Démarrage\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Propriétaire^Menu Démarrer^Programmes^Démarrage^Logitech . Enregistrement du produit.lnk]
path=c:\documents and settings\Propriétaire\Menu Démarrer\Programmes\Démarrage\Logitech . Enregistrement du produit.lnk
backup=c:\windows\pss\Logitech . Enregistrement du produit.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Propriétaire^Menu Démarrer^Programmes^Démarrage^SparkAngels.lnk]
path=c:\documents and settings\Propriétaire\Menu Démarrer\Programmes\Démarrage\SparkAngels.lnk
backup=c:\windows\pss\SparkAngels.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]
c:\windows\system32\dumprep 0 -u [X]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acronis Scheduler2 Service]
2009-06-15 08:55 136472 ----a-w- c:\program files\Fichiers communs\Acronis\Schedule2\schedhlp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AcronisTimounterMonitor]
2009-06-15 13:37 905360 ----a-w- c:\program files\Acronis\TrueImageHome\TimounterMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2009-12-11 14:57 948672 ----a-r- c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-12-18 07:58 40368 ----a-w- c:\program files\Adobe Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
2009-04-24 03:05 203416 ----a-w- c:\program files\Alcohol Soft\Alcohol 52\AxCmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUSGamerOSD]
2008-12-22 11:46 380928 ----a-w- c:\program files\ASUS\GamerOSD\GamerOSD.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2007-01-15 14:14 147456 ----a-w- c:\program files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\boincmgr]
2009-03-03 12:11 4289280 ----a-w- c:\program files\BOINC\boincmgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\boinctray]
2009-03-03 12:11 58112 ----a-w- c:\program files\BOINC\boinctray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FileZilla Server Interface]
2008-01-09 18:58 942080 ----a-w- c:\program files\FileZilla Server\FileZilla Server Interface.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FlashPlayerUpdate]
2010-01-27 01:07 256280 ----a-w- c:\windows\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GamerOSD]
2008-12-22 11:46 380928 ----a-w- c:\program files\ASUS\GamerOSD\GamerOSD.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark X73 Button Manager]
2001-06-11 09:37 53248 ----a-w- c:\progra~1\LEXMAR~1\AcBtnMgr_X73.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark X73 Button Monitor]
2001-10-08 14:21 53248 ----a-w- c:\progra~1\LEXMAR~1\ACMonitor_X73.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2006-01-12 13:40 155648 ----a-w- c:\program files\Fichiers communs\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2009-11-20 19:32 110184 ----a-w- c:\windows\system32\nvmctray.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PrinTray]
2001-10-12 05:42 36864 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\printray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-10 22:08 417792 ----a-w- c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2004-11-02 18:24 32768 ----a-w- c:\program files\CyberLink\PowerDVD\PDVDServ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-10-11 03:17 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrayServer]
2008-01-30 12:07 90112 ----a-w- c:\program files\MAGIX\Films_sur_DVD_7_TerraTec_Edition\Trayserver.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrueImageMonitor.exe]
2009-06-15 13:35 1348216 ----a-w- c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VX1000]
2009-06-26 15:21 757248 ----a-w- c:\windows\vVX1000.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"PnkBstrA"=2 (0x2)
"ReflectService"=2 (0x2)
"a2free"=2 (0x2)
"PnkBstrB"=2 (0x2)
"npggsvc"=3 (0x3)
"AcrSch2Svc"=2 (0x2)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Network Associates\\Common Framework\\FrameworkService.exe"=
"c:\\Program Files\\Opera\\Opera.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Zattoo\\zattood.exe"=
"c:\\Program Files\\Zattoo\\Zattoo2.exe"=
"c:\\Program Files\\Zattoo\\Zattoo.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=
"c:\\Documents and Settings\\Propriétaire\\Mes documents\\Visual Studio 2005\\Projects\\Secure LAN Messenger\\release\\Secure LAN Messenger.exe"=
"c:\\Documents and Settings\\Propriétaire\\Mes documents\\Visual Studio 2005\\Projects\\VChat\\release\\VChat.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\TmNationsForever\\TmForever.exe"=
"c:\\Program Files\\TeamViewer\\Version4\\TeamViewer.exe"=
"c:\\Program Files\\Synergy\\synergys.exe"=
"c:\\Program Files\\Electronic Arts\\Dead Space\\Dead Space.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Volition Inc\\Red Faction Guerrilla\\rfg.exe"=
"d:\\Partage\\Age of Empire 2\\age2_x1.exe"=
"d:\\Partage\\Warcraft 3\\war3.exe"=
"d:\\Partage\\Age of Empires III\\age3.exe"=
"d:\\Partage\\Warcraft 3\\Warcraft III.exe"=
"c:\\Program Files\\Mass Effect\\Binaries\\MassEffect.exe"=
"c:\\Program Files\\Mass Effect\\MassEffectLauncher.exe"=
"c:\\Program Files\\2K Games\\Gearbox Software\\Borderlands\\Binaries\\Borderlands.exe"=
"c:\\Program Files\\wamp\\bin\\apache\\Apache2.2.11\\bin\\httpd.exe"=
"c:\\Program Files\\TeamViewer\\Version5\\TeamViewer.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Cobian Backup 8\\Cobian.exe"=
"c:\\Program Files\\Cobian Backup 8\\cbInterface.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Dragon Age\\bin_ship\\daorigins.exe"=
"c:\\Program Files\\Dragon Age\\DAOriginsLauncher.exe"=
"c:\\Program Files\\Dragon Age\\bin_ship\\daupdatersvc.service.exe"=
"c:\\Program Files\\Unreal Tournament 3\\Binaries\\UT3.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\Microsoft Games\\Rise Of Legends\\legends.exe"=
"c:\\Program Files\\TmUnitedForever\\TmForever.exe"=
"c:\\Program Files\\Mass Effect 2\\Binaries\\MassEffect2.exe"=
"c:\\Program Files\\Mass Effect 2\\MassEffect2Launcher.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx9.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx10.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Launcher.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
R0 pssnap;Paramount Software Snapshot Filter;c:\windows\system32\drivers\pssnap.sys [20.05.2008 08:32 15328]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [06.12.2009 15:02 691696]
R1 VBoxDrv;VirtualBox Service;c:\windows\system32\drivers\VBoxDrv.sys [04.04.2008 10:51 123280]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\drivers\VBoxUSBMon.sys [04.04.2008 10:51 41616]
R2 io.sys;IO.DLL Driver;c:\windows\system32\drivers\io.sys [26.11.2008 19:37 5152]
R2 TeamViewer5;TeamViewer 5;c:\program files\TeamViewer\Version5\TeamViewer_Service.exe [11.02.2010 12:42 172328]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\drivers\VBoxNetAdp.sys [13.04.2009 10:20 99152]
R3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\drivers\VBoxNetFlt.sys [17.12.2009 15:02 110096]
S2 gupdate1c98637e024afd6;Google Update Service (gupdate1c98637e024afd6);c:\program files\Google\Update\GoogleUpdate.exe [03.02.2009 20:44 133104]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [28.06.2009 18:45 1684736]
S3 DAUpdaterSvc;Dragon Age: Origins - Application de mise à jour;c:\program files\Dragon Age\bin_ship\daupdatersvc.service.exe [19.01.2010 15:55 25832]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [28.12.2009 17:30 1527900]
S3 VBoxUSB;VirtualBox USB;c:\windows\system32\drivers\VBoxUSB.sys [24.11.2008 20:51 31824]
S4 a2free;a-squared Free Service;c:\program files\a-squared Free\a2service.exe [08.10.2007 11:00 1858144]
S4 cpuz130;cpuz130;\??\c:\windows\TEMP\cpuz130\cpuz_x32.sys --> c:\windows\TEMP\cpuz130\cpuz_x32.sys [?]
S4 fwadv07n;fwadv07n;\??\c:\windows\TEMP\fwadv07n.sys --> c:\windows\TEMP\fwadv07n.sys [?]
S4 ReflectService;Macrium Reflect Image Mounting Service;c:\program files\Macrium\Reflect\ReflectService.exe [25.08.2009 11:16 220128]
S4 TinaKey;TinaKey; [x]
.
Contenu du dossier 'Tâches planifiées'
2010-02-22 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 10:34]
2010-03-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-03 19:44]
2010-03-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-03 19:44]
2010-03-04 c:\windows\Tasks\User_Feed_Synchronization-{150D99EF-BD64-477B-A1BF-61842F273D19}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]
2010-03-04 c:\windows\Tasks\User_Feed_Synchronization-{B63CF8B1-9D0B-4421-B886-9EDBB677C731}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]
.
.
------- Examen supplémentaire -------
.
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xporter vers Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
TCP: {E89DD7A1-A7D5-407F-9DF8-EF243DEF5332} = 195.186.4.110,198.186.4.162
FF - ProfilePath - c:\documents and settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\nqdrr1w9.default\
FF - prefs.js: browser.search.selectedEngine - Wikipédia (fr)
FF - prefs.js: browser.startup.homepage - hxxp://www.google.ch/
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- PARAMETRES FIREFOX ----
c:\program files\Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "https://www.mozilla.org/en-US/firefox/new/?redirect_source=firefox-com");
c:\program files\Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHELINS SUPPRIMES - - - -
AddRemove-Spybot - Search & Destroy_is1 - c:\windows\unins000.exe
AddRemove-WinPcapInst - c:\program files\WinPcap\uninstall.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-04 20:39
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll sfsync02.sys atapi.sys spxu.sys >>UNKNOWN [0x8B490938]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xb80fcf28
\Driver\ACPI -> ACPI.sys @ 0xb7e73cb8
\Driver\atapi -> sfsync02.sys @ 0xb80c98b4
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
NDIS: -> SendCompleteHandler -> 0x0
PacketIndicateHandler -> 0x0
SendHandler -> 0x0
user & kernel MBR OK
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_USERS\S-1-5-21-2052111302-963894560-839522115-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
[HKEY_USERS\S-1-5-21-2052111302-963894560-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:7e,43,f5,88,74,ca,94,e1,d0,08,09,e7,7a,6e,6a,c8,c6,f7,74,0a,2b,a4,8e,
46,3c,1b,8c,f6,03,00,1e,eb,88,33,47,87,fe,35,d3,cf,2f,7c,e4,8b,49,d7,02,46,\
"??"=hex:c4,79,63,7a,e3,0b,18,56,9b,3e,af,3d,21,40,2f,6d
[HKEY_USERS\S-1-5-21-2052111302-963894560-839522115-1003\Software\SecuROM\License information*]
"datasecu"=hex:12,6d,e7,da,64,17,5e,bd,c4,df,b3,a0,d2,1d,77,83,59,84,99,7c,98,
d7,fc,c5,a5,b6,8d,af,bf,ec,f3,fb,b4,10,8a,cc,88,98,a3,f6,77,6c,6c,4f,1e,74,\
"rkeysecu"=hex:d6,91,ae,5e,65,7b,6a,fb,58,83,f0,cd,f9,98,06,cf
[HKEY_LOCAL_MACHINE\software\Microsoft\Environment*]
"Licence0"="04F0D21-79D8-7A25-D702-433F"
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'lsass.exe'(1024)
c:\windows\system32\relog_ap.dll
- - - - - - - > 'explorer.exe'(4932)
c:\windows\TEMP\logishrd\LVPrcInj01.dll
c:\program files\Logitech Software\iTouch\iTchHk.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\program files\Fichiers communs\Logitech\Scrolling\LgMsgHk.dll
c:\windows\system32\msi.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\windows\system32\LEXBCES.EXE
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\ATKKBService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Powerware\LanSafe\Bin\PowerMonitor.exe
c:\program files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\program files\Network Associates\Common Framework\FrameworkService.exe
c:\program files\Network Associates\VirusScan\Mcshield.exe
c:\program files\Network Associates\VirusScan\VsTskMgr.exe
c:\program files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
c:\progra~1\NETWOR~1\COMMON~1\naPrdMgr.exe
c:\program files\TeamViewer\Version5\TeamViewer.exe
c:\program files\Powerware\LanSafe\bin\xyntservice.exe
c:\program files\Powerware\LanSafe\bin\httpserver.exe
c:\program files\Powerware\LanSafe\bin\status_glance.exe
c:\windows\system32\WgaTray.exe
c:\windows\Logi_MwX.Exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\RUNDLL32.EXE
c:\program files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
c:\windows\system32\wpabaln.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Heure de fin: 2010-03-04 20:50:46 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-03-04 19:50
ComboFix2.txt 2010-03-03 21:41
Avant-CF: 397'077'291'008 octets libres
Après-CF: 397'018'456'064 octets libres
Current=4 Default=4 Failed=2 LastKnownGood=5 Sets=1,2,3,4,5
- - End Of File - - A8283BC9975801025C7DB23025B71FFF -
Ahhhhh ça a l'air d'être tout bon ! Plus de spams ne sont émis de ma machine, c'était effectivement bien ce fichier qui posait problème.
Merci pour tout en tout cas, c'est du super boulot, un grand bravo pour votre aide et votre patience ;) -
Ok ...Impec !!!
Pour vérif:
Fais un scan avec cet antispyware :
Malwarebytes + tutoriel
Tu l´installes; mets le a jour...(onglet mise a jour)
Click maintenant sur l´onglet recherche et coche la case :
"Executer un examen rapide".
Puis click sur "rechercher".
Laisses le scanner le pc...
A la fin du scan, clique sur Afficher les résultats
Si des elements on ete trouvés :
> click sur supprimer la selection.
si il t´es demandé de redemarrer > click sur "oui".
A la fin un rapport va s´ouvrir;
sauvegarde le de maniere a le retrouver en vue de le poster sur le forum.
Copies et colles le rapport stp.
a+
