Probleme runddl 32 et dwwin

mattdusud Messages postés 240 Date d'inscription   Statut Membre Dernière intervention   -  
mattdusud Messages postés 240 Date d'inscription   Statut Membre Dernière intervention   -
bonjour, depuis peu, j'ai un processus rundll32.exe dans le gestionnaire des taches, et lorsque j'essaie de le supprimer, un autre processus s'ouvre qui s'appelle dwwin. A partir de là, tout bug, firefox se ferme, explorer aussi me se relance et licone de mon antivirus disparait de la barre des taches. S'agit-il d'un virus?

13 réponses

  1.
    moment de grace Messages postés 29099 Date d'inscription   Statut Contributeur sécurité Dernière intervention   2 274
     
    bonjour

    Télécharge ZHPDiag ( de Nicolas coolman ).
    https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html

    (outil de diagnostic)

    Double clique sur le fichier d'installation, puis installe le avec les paramètres par défaut ( N'oublie pas de cocher " Créer une icône sur le bureau " )

    Lance ZHPDiag en double cliquant sur l'icône présente sur ton bureau (Clique droit -> Executer en tant qu'admin pour vista )

    Clique sur la loupe en haut à gauche, puis laisse l'outil scanner.

    Une fois le scan terminé, clique sur l'icône en forme de disquette et enregistre le fichier sur ton bureau.

    Rend toi sur Cjoint : http://www.cijoint.fr/

    Clique sur "Parcourir " dans la partie " Joindre un fichier[...] "

    Sélectionne le rapport ZHPdiag.txt qui se trouve sur ton bureau

    Clique ensuite sur "Cliquez ici pour déposer le fichier " et copie/colle le lien dans ton prochain message

    si soucis avec ci joint. fr => utiliser https://www.cjoint.com/
    0
  2. mattdusud Messages postés 240 Date d'inscription   Statut Membre Dernière intervention   27
     
    merci beaucoup. voila le lien: http://www.cijoint.fr/cjlink.php?file=cj201004/cijaqdWC7N.txt
    0
  3. moment de grace Messages postés 29099 Date d'inscription   Statut Contributeur sécurité Dernière intervention   2 274
     
    ok

    on commence par la méthode douce

    1)

    * Télécharge de AD-Remover sur ton Bureau. (Merci à C_XX)
    http://pagesperso-orange.fr/NosTools/C_XX/AD-R.exe

    Miroir:

    https://www.androidworld.fr/

    /!\ Déconnecte-toi d'internet et ferme toutes applications en cours /!\

    Désactive provisoirement et seulement le temps de l'utilisation de ADremover, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil.

    - Double-clique sur l'icône Ad-remover située sur ton Bureau.
    - Sur la page, clique sur le bouton « NETTOYER »
    - Confirme lancement du scan
    - Laisse travailler l'outil.
    - Poste le rapport qui apparaît à la fin.

    (Le rapport est sauvegardé aussi sous C:\Ad-report(Scan/clean).Txt)

    (CTRL+A pour tout sélectionner, CTRL+C pour copier et CTRL+V pour coller)

    .................................

    2)

    Télécharge Superantispyware (SAS)

    https://www.superantispyware.com/superantispywarefreevspro.html

    Choisis "enregistrer" et enregistre-le sur ton bureau.

    Double-clique sur l'icône d'installation qui vient de se créer et suis les instructions.

    Créé une icône sur le bureau.

    Double-clique sur l'icône de SAS (une tête dans un cercle rouge barré) pour le lancer.

    Si l'outil te demande de mettre à jour le programme ("update the program definitions", clique sur yes.

    Sous Configuration and Preferences, clique sur le bouton "Preferences"

    Clique sur l'onglet "Scanning Control "
    Dans "Scanner Options ", assure toi que la case devant lles lignes suivantes est cochée :

    * Close browsers before scanning
    * Scan for tracking cookies
    * Terminate memory threats before quarantining

    Laisse les autres lignes décochées.

    Clique sur le bouton "Close" pour quitter l'écran du centre de contrôle.

    Dans la fenêtre principale, clique, dans "Scan for Harmful Software", sur "Scan your computer".

    Dans la colonne de gauche, coche C:\Fixed Drive.

    Dans la colonne de droite, sous "Complete scan", clique sur "Perform Complete Scan"

    Clique sur "next" pour lancer le scan. Patiente pendant la durée du scan.

    A la fin du scan, une fenêtre de résultats s'ouvre . Clique sur OK.

    Assure toi que toutes les lignes de la fenêtre blanche sont cochées et clique sur "Next".

    Tout ce qui a été trouvé sera mis en quarantaine. S'il t'es demandé de redémarrer l'ordi ("reboot"), clique sur Yes.

    Pour recopier les informations sur le forum, fais ceci :

    - après le redémarrage de l'ordi, double-clique sur l'icône pour lancer SAS.
    - Clique sur "Preferences" puis sur l'onglet "Statistics/Logs ".
    - Dans "scanners logs", double-clique sur SUPERAntiSpyware Scan Log.

    - Le rapport va s'ouvrir dans ton éditeur de texte par défaut.

    - Copie son contenu dans ta réponse.

    tutoriel en image :

    https://www.malekal.com/?s=SUPERAntiSpyware

    ...................................

    3)

    Téléchargez MalwareByte's Anti-Malware (que tu pourras garder)

    http://www.malwarebytes.org/mbam/program/mbam-setup.exe

    . Enregistres le sur le bureau
    . Double cliques sur le fichier téléchargé pour lancer le processus d'installation.
    . Dans l'onglet "mise à jour", cliques sur le bouton Recherche de mise à jour
    . Si le pare-feu demande l'autorisation de se connecter pour malwarebytes, accepte
    . Une fois la mise à jour terminé
    . Rend-toi dans l'onglet, Recherche
    . Sélectionnes Exécuter un examen complet (examen assez long)
    . Cliques sur Rechercher
    . Le scan démarre.
    . A la fin de l'analyse, un message s'affiche : L'examen s'est terminé normalement. Cliquez sur 'Afficher les résultats' pour afficher tous les objets trouvés.
    . Cliques sur Ok pour poursuivre.
    . Si des malwares ont été détectés, clique sur Afficher les résultats
    . Sélectionnes tout (ou laisses cochés) et cliques sur Supprimer la sélection Malwarebytes va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.
    . Malwarebytes va ouvrir le bloc-notes et y copier le rapport d'analyse.
    . Rends toi dans l'onglet rapport/log
    . Tu cliques dessus pour l'afficher, une fois affiché
    . Tu cliques sur edition en haut du boc notes, et puis sur sélectionner tous
    . Tu recliques sur edition et puis sur copier et tu reviens sur le forum et dans ta réponse
    . tu cliques droit dans le cadre de la reponse et coller

    Si tu as besoin d'aide regarde ces tutoriels :
    Aide: https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
    http://www.infos-du-net.com/forum/278396-11-tuto-malwarebytes-anti-malware-mbam

    0
  4. mattdusud Messages postés 240 Date d'inscription   Statut Membre Dernière intervention   27
     
    .
    ======= RAPPORT D'AD-REMOVER 2.0.0.0,C | UNIQUEMENT XP/VISTA/7 =======
    .
    Mis à jour par C_XX le 27/04/10 à 22:00
    Contact: AdRemover.contact@gmail.com
    Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
    .
    Lancé à: 19:39:30 le 28/04/2010 | Mode normal | Option: CLEAN
    Exécuté de: C:\Ad-Remover\ADR.exe
    SE: Microsoft® Windows XP(TM) Service Pack 2 - X86
    Nom du PC: MATT
    Utilisateur actuel: matt'
    .
    ============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
    .
    .
    C:\Ask & Record Toolbar Setup Log.txt
    C:\Documents and Settings\All Users.WINDOWS\Application Data\Games-Attack
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Application Data\DesktopIcon
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Application Data\Mozilla\FireFox\Profiles\m0cv1q45.default\searchplugins\sweetim.xml
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Application Data\Mozilla\FireFox\Profiles\m0cv1q45.default\SweetIMToolbarData

    (!) -- Fichiers temporaires supprimés.
    .
    HKCU\Software\32 Vegas Casino
    HKCU\Software\AppDataLow\HavingFunOnline
    HKCU\Software\MediaHoldings
    HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}
    HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{19F2B849-4ADE-4d4b-85F9-C31C643DBDE9}
    HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{3F7889DB-8DF0-4D15-AB1B-B14CCD52EC9C}
    HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
    HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
    HKCU\Software\PlayMP3
    HKCU\Software\SweetIM
    HKLM\Software\32 Vegas Casino
    HKLM\Software\Classes\TypeLib\{4509D3CC-B642-4745-B030-645B79522C6D}
    HKLM\Software\Classes\urlsearchhook.toolbarurlsearchhook
    HKLM\Software\Classes\urlsearchhook.toolbarurlsearchhook.1
    HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{29137117-DEBC-4242-9FF2-3C3B287EB7EE}
    HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{3F7889DB-8DF0-4D15-AB1B-B14CCD52EC9C}
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{63A09EB8-8BFE-4641-B086-550000FE8B1D}
    HKLM\Software\SweetIM
    HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser|{D4027C7F-154A-4066-A1AD-4243D8127440}
    HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser|{EEE6C35B-6118-11DC-9C72-001320C79847}
    HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks|{EEE6C35D-6118-11DC-9C72-001320C79847}
    .
    (Orpheline) HKLM,Run - Win sytem - C:\WINDOWS\winsystem.exe (Fichier manquant)
    (Orpheline) BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} (CLSID manquant)
    (Orpheline) HKLM,Uninstall - Plugins Audacity - C:\Program Files\Audacity 1.3 Beta (Unicode)\Plug-Ins\Uninstal.exe (Fichier manquant)
    (Orpheline) HKLM,Uninstall - SMPlayer - M:\SMPlayer\uninst.exe (Fichier manquant)
    .
    ============== SCAN ADDITIONNEL ==============
    .
    * Mozilla FireFox Version 3.6.3 (fr) *
    .
    C:\Documents and Settings\matt'.UNICORNI-B997B1\..\m0cv1q45.default\prefs.js - browser.download.lastDir: C:\\Documents and Settings\\matt'.UNICORNI-B997B1\\Bureau\\expo anglais
    C:\Documents and Settings\matt'.UNICORNI-B997B1\..\m0cv1q45.default\prefs.js - browser.startup.homepage: www.google.fr
    C:\Documents and Settings\matt'.UNICORNI-B997B1\..\m0cv1q45.default\prefs.js - browser.startup.homepage_override.mstone: rv:1.9.2.3
    C:\Documents and Settings\matt'.UNICORNI-B997B1\..\m0cv1q45.default\prefs.js - keyword.URL: hxxp://redirecterror.sfr.fr/?q=
    C:\Documents and Settings\matt'.UNICORNI-B997B1\..\m0cv1q45.default\user.js - keyword.URL: hxxp://redirecterror.sfr.fr/?q=
    .
    .
    * Internet Explorer Version 8.0.6001.18702 *
    .
    [HKCU\Software\Microsoft\Internet Explorer\Main]
    .
    Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
    Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    Do404Search: 0x01000000
    Enable Browser Extensions: yes
    Local Page: C:\WINDOWS\system32\blank.htm
    Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
    Show_ToolBar: yes
    Start Page: hxxp://fr.msn.com/
    Use Custom Search URL: 1
    .
    [HKLM\Software\Microsoft\Internet Explorer\Main]
    .
    Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
    Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    Delete_Temp_Files_On_Exit: yes
    Local Page: C:\WINDOWS\system32\blank.htm
    Search bar: hxxp://search.msn.com/spbasic.htm
    Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    Start Page: hxxp://fr.msn.com/
    Use Custom Search URL: 1
    .
    [HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS]
    .
    Tabs: res://ieframe.dll/tabswelcome.htm
    Blank: res://mshtml.dll/blank.htm
    .
    ============== SUSPECT(S) ==============
    .
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Application Data\Azureus\torrents\CadSoft Eagle Professional v5.3.0+patch+key.gen.torrent
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Application Data\Azureus\torrents\[isoHunt] Rollercoaster Tycoon 3 Soaked Wild Patch.torrent
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Favoris\Internet Explorer 7 Crack Install IE7 Final bypassing WGA validation. IE7 Crack.URL
    .
    ========================================
    .
    C:\DOCUME~1\MATT'~1.UNI\LOCALS~1\Temp: 0 Fichier(s), 19 Dossier(s)
    C:\WINDOWS\temp: 0 Fichier(s), 2 Dossier(s)
    Temporary Internet Files: 2 Fichier(s), 10 Dossier(s)
    .
    C:\Ad-Remover\Quarantine: 2 Fichier(s)
    C:\Ad-Remover\Backup: 13 Fichier(s)
    .
    C:\Ad-Report-CLEAN[1].txt - 481 Octet(s)
    C:\Ad-Report-CLEAN[2].txt - 5540 Octet(s)
    .
    Fin à: 19:58:15, 28/04/2010
    .
    ============== E.O.F - CLEAN[2] ==============

    SAS:

    SUPERAntiSpyware Scan Log
    https://www.superantispyware.com/

    Generated 04/28/2010 at 09:51 PM

    Application Version : 4.35.1000

    Core Rules Database Version : 4863
    Trace Rules Database Version: 2675

    Scan type : Complete Scan
    Total Scan Time : 01:05:52

    Memory items scanned : 418
    Memory threats detected : 0
    Registry items scanned : 6549
    Registry threats detected : 11
    File items scanned : 23099
    File threats detected : 42

    Adware.Tracking Cookie
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Cookies\matt'@atdmt[6].txt
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Cookies\matt'@tradedoubler[1].txt
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Cookies\matt'@smartadserver[2].txt
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Cookies\matt'@serving-sys[1].txt
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Cookies\matt'@www.topdaofinder[1].txt
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Cookies\matt'@atdmt[5].txt
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Cookies\matt'@weborama[1].txt
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Cookies\matt'@oasn-en1.247realmedia[1].txt
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Cookies\matt'@mediaplex[1].txt
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Cookies\matt'@ad.zanox[1].txt
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Cookies\matt'@clickpayz6.1.blueseek[1].txt
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Cookies\matt'@azjmp[2].txt
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Cookies\matt'@bluestreak[2].txt
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Cookies\matt'@apmebf[1].txt
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Cookies\matt'@boursoramabanque.solution.weborama[2].txt
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Cookies\matt'@mediatraffic[1].txt
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Cookies\matt'@atdmt[3].txt
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Cookies\matt'@ad.yieldmanager[2].txt
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Cookies\matt'@content.yieldmanager[1].txt
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Cookies\matt'@bs.serving-sys[2].txt
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Cookies\matt'@server.iad.liveperson[2].txt
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Cookies\matt'@estat[1].txt
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Cookies\matt'@advertise[1].txt
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Cookies\matt'@atdmt[4].txt
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Cookies\matt'@doubleclick[3].txt
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Cookies\matt'@content.yieldmanager[5].txt
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Cookies\matt'@247realmedia[2].txt
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Cookies\matt'@bouyguestelecom.solution.weborama[2].txt
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Cookies\matt'@yadro[2].txt
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Cookies\matt'@clickpayz4.91485.blueseek[1].txt
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Cookies\matt'@clickpayz3.91423.blueseek[1].txt
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Cookies\matt'@doubleclick[1].txt
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Cookies\matt'@bs.serving-sys[1].txt
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Cookies\matt'@content.yieldmanager[3].txt
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Cookies\matt'@content.yieldmanager[4].txt
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Cookies\matt'@content.yieldmanager[2].txt
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Cookies\matt'@atdmt[2].txt
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Cookies\matt'@atdmt[1].txt
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Cookies\matt'@247realmedia[1].txt
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Cookies\matt'@serving-sys[2].txt
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Cookies\matt'@bluestreak[1].txt

    Trojan.Agent/Gen
    HKLM\SYSTEM\CurrentControlSet\Services\asc3550p
    HKLM\SYSTEM\CurrentControlSet\Services\asc3550p#ErrorControl
    HKLM\SYSTEM\CurrentControlSet\Services\asc3550p#Start
    HKLM\SYSTEM\CurrentControlSet\Services\asc3550p#Group
    HKLM\SYSTEM\CurrentControlSet\Services\asc3550p#Tag
    HKLM\SYSTEM\CurrentControlSet\Services\asc3550p#Type

    Browser Hijacker.Deskbar
    HKCR\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}
    HKCR\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}\ProxyStubClsid
    HKCR\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}\ProxyStubClsid32
    HKCR\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}\TypeLib
    HKCR\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}\TypeLib#Version

    Trojan.Agent/Gen-SSHNas[FakeAlert]
    C:\_OTM\MOVEDFILES\04112010_143346\C_WINDOWS\SYSTEM32\SSHNAS21.DLL

    je mettrai le rapport de MBAM après l'avoir fais demain.
    0
    1. moment de grace Messages postés 29099 Date d'inscription   Statut Contributeur sécurité Dernière intervention   2 274
       
      ok

      à demain alors...
      0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. mattdusud Messages postés 240 Date d'inscription   Statut Membre Dernière intervention   27
     
    merci encore
    ;)
    0
  7. mattdusud Messages postés 240 Date d'inscription   Statut Membre Dernière intervention   27
     
    voila, l'examen était un peu long:

    rapport MBAM:

    Malwarebytes' Anti-Malware 1.45
    www.malwarebytes.org

    Version de la base de données: 3976

    Windows 5.1.2600 Service Pack 2
    Internet Explorer 8.0.6001.18702

    30/04/2010 00:00:25
    mbam-log-2010-04-30 (00-00-25).txt

    Type d'examen: Examen complet (C:\|M:\|)
    Elément(s) analysé(s): 383547
    Temps écoulé: 4 heure(s), 25 minute(s), 10 seconde(s)

    Processus mémoire infecté(s): 0
    Module(s) mémoire infecté(s): 0
    Clé(s) du Registre infectée(s): 6
    Valeur(s) du Registre infectée(s): 0
    Elément(s) de données du Registre infecté(s): 0
    Dossier(s) infecté(s): 0
    Fichier(s) infecté(s): 2

    Processus mémoire infecté(s):
    (Aucun élément nuisible détecté)

    Module(s) mémoire infecté(s):
    (Aucun élément nuisible détecté)

    Clé(s) du Registre infectée(s):
    HKEY_CURRENT_USER\Software\YVIBBBHA8C (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\asc3550p (Rootkit.Agent) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\WEK9EMDHI9 (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{63a09eb9-8bfe-4641-b086-550000fe8b1d} (Trojan.BHO) -> Quarantined and deleted successfully.

    Valeur(s) du Registre infectée(s):
    (Aucun élément nuisible détecté)

    Elément(s) de données du Registre infecté(s):
    (Aucun élément nuisible détecté)

    Dossier(s) infecté(s):
    (Aucun élément nuisible détecté)

    Fichier(s) infecté(s):
    C:\Program Files\Fichiers communs\eBay\eBayLauncher.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
    C:\Documents and Settings\All Users.WINDOWS\Favoris\_favdata.dat (Malware.Trace) -> Quarantined and deleted successfully.

    le processus rundll32 est toujours là :s
    0
  8. moment de grace Messages postés 29099 Date d'inscription   Statut Contributeur sécurité Dernière intervention   2 274
     
    tu peux vider la quarantaine

    Desactive ton antivirus le temps de la manip ainsi que ton parefeu si présent(car il est detecté a tort comme infection)

    Télécharge et installe List&Kill'em et enregistre le sur ton bureau

    http://sd-1.archive-host.com/...

    double clique ( clic droit "executer en tant qu'administrateur" pour Vista/7 ) sur le raccourci sur ton bureau pour lancer l'installation

    coche la case "creer une icone sur le bureau"

    une fois terminée , clic sur "terminer" et le programme se lancer seul

    choisis la langue puis choisis l'option SEARCH

    laisse travailler l'outil

    à l'apparition de la fenetre blanche , c'est un peu long , c'est normal , le programme n'est pas bloqué.

    un rapport du nom de catchme apparait sur ton bureau , ignore-le,ne le poste pas , mais ne le supprime pas pour l instant, le scan n'est pas fini.

    Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'ecran "COMPLETED"

    tu peux supprimer le rapport catchme.log de ton bureau maintenant.

    0
  9. mattdusud Messages postés 240 Date d'inscription   Statut Membre Dernière intervention   27
     
    List'em by g3n-h@ckm@n 1.7.2.5

    User : matt' (Administrateurs)
    Update on 29/04/2010 by g3n-h@ckm@n ::::: 21.00
    Start at: 12:51:57 | 30/04/2010

    AMD Athlon(tm) XP 1800+
    Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
    Internet Explorer 8.0.6001.18702
    Windows Firewall Status : Enabled
    AV : AntiVir Desktop 9.0.1.32 [ Enabled | Updated ]

    A:\ -> Lecteur de disquettes 3 ½ pouces
    C:\ -> Disque fixe local | 64.49 Go (8.17 Go free) [HDD] | NTFS
    D:\ -> Disque CD-ROM | 401.83 Mo (0 Mo free) [COMBATFS] | CDFS
    E:\ -> Disque CD-ROM
    F:\ -> Disque CD-ROM
    G:\ -> Disque CD-ROM
    M:\ -> Disque fixe local | 10.04 Go (8.64 Go free) [SAVE] | NTFS

    Boot: Normal

    ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Avira\AntiVir Desktop\sched.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    C:\Program Files\RocketDock\RocketDock.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\List_Kill'em\List_Kill'em.exe
    C:\WINDOWS\system32\cmd.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe
    C:\Program Files\List_Kill'em\pv.exe

    ======================
    Keys "Run"
    ======================

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    RocketDock REG_SZ "C:\Program Files\RocketDock\RocketDock.exe"
    ctfmon.exe REG_SZ C:\WINDOWS\system32\ctfmon.exe
    SUPERAntiSpyware REG_SZ C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    avgnt REG_SZ "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
    nwiz REG_SZ nwiz.exe /install

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

    =====================
    Other Keys
    =====================

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
    dontdisplaylastusername REG_DWORD 0 (0x0)
    legalnoticecaption REG_SZ
    legalnoticetext REG_SZ
    shutdownwithoutlogon REG_DWORD 1 (0x1)
    undockwithoutlogon REG_DWORD 1 (0x1)
    EnableLUA REG_DWORD 0 (0x0)

    ===============

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
    NoDriveTypeAutoRun REG_DWORD 145 (0x91)

    ===============

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
    HonorAutoRunSetting REG_DWORD 1 (0x1)

    ===============

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

    ===============

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    AutoRestartShell REG_DWORD 1 (0x1)
    DefaultDomainName REG_SZ MATT
    DefaultUserName REG_SZ matt'
    LegalNoticeCaption REG_SZ
    LegalNoticeText REG_SZ
    PowerdownAfterShutdown REG_SZ 0
    ReportBootOk REG_SZ 1
    Shell REG_SZ explorer.exe
    ShutdownWithoutLogon REG_SZ 0
    System REG_SZ
    Userinit REG_SZ C:\WINDOWS\system32\userinit.exe,
    VmApplet REG_SZ rundll32 shell32,Control_RunDLL "sysdm.cpl"
    SfcQuota REG_DWORD -1 (0xffffffff)
    allocatecdroms REG_SZ 0
    allocatedasd REG_SZ 0
    allocatefloppies REG_SZ 0
    cachedlogonscount REG_SZ 10
    forceunlocklogon REG_DWORD 0 (0x0)
    passwordexpirywarning REG_DWORD 14 (0xe)
    scremoveoption REG_SZ 0
    AllowMultipleTSSessions REG_DWORD 1 (0x1)
    UIHost REG_EXPAND_SZ logonui.exe
    LogonType REG_DWORD 1 (0x1)
    Background REG_SZ 0 0 0
    DebugServerCommand REG_SZ no
    HibernationPreviouslyEnabled REG_DWORD 1 (0x1)
    SFCDisable REG_DWORD 0 (0x0)
    WinStationsDisabled REG_SZ 0
    ShowLogonOptions REG_DWORD 0 (0x0)
    AltDefaultUserName REG_SZ matt'
    AltDefaultDomainName REG_SZ MATT
    SfcScan REG_DWORD 0 (0x0)
    AutoAdminLogon REG_SZ 0

    ===============

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon]

    ===============

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    {AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ
    {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} REG_SZ

    ===============

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    C:\Program Files\TmNationsForever\TmForever.exe REG_SZ C:\Program Files\TmNationsForever\TmForever.exe:*:Enabled:TmForever
    C:\Program Files\Azureus\Azureus.exe REG_SZ C:\Program Files\Azureus\Azureus.exe:*:Enabled:Azureus
    C:\Program Files\BitTorrent\bittorrent.exe REG_SZ C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
    C:\Program Files\Electronic Arts\EADM\Core.exe REG_SZ C:\Program Files\Electronic Arts\EADM\Core.exe:*:Enabled:EA Download Manager
    C:\Program Files\eMule\emule.exe REG_SZ C:\Program Files\eMule\emule.exe:*:Enabled:eMule
    C:\Program Files\VideoLAN\VLC\vlc.exe REG_SZ C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player
    C:\Program Files\Mozilla Firefox\firefox.exe REG_SZ C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox
    C:\Program Files\Microsoft Games\Flight Simulator 9\fs9.exe REG_SZ C:\Program Files\Microsoft Games\Flight Simulator 9\fs9.exe:*:Enabled:Microsoft Flight Simulator
    C:\Program Files\Microsoft Games\Combat Flight Simulator\COMBATFS.EXE REG_SZ C:\Program Files\Microsoft Games\Combat Flight Simulator\COMBATFS.EXE:*:Enabled:Module Combat Simulator
    C:\WINDOWS\system32\dplaysvr.exe REG_SZ C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper
    C:\WINDOWS\system32\dpnsvr.exe REG_SZ C:\WINDOWS\system32\dpnsvr.exe:*:Enabled:Microsoft DirectPlay8 Server
    C:\Program Files\FrostWire\FrostWire.exe REG_SZ C:\Program Files\FrostWire\FrostWire.exe:*:Enabled:FrostWire
    C:\Program Files\RealVNC\VNC4\winvnc4.exe REG_SZ C:\Program Files\RealVNC\VNC4\winvnc4.exe:*:Enabled:VNC Server Enterprise Edition for Win32
    C:\Program Files\SFR\Media Center\httpd\httpd.exe REG_SZ C:\Program Files\SFR\Media Center\httpd\httpd.exe:172.16.255.0/255.255.255.0,192.168.1.0/255.255.255.0:Enabled:Serveur de partage Media Center (Player SFR)
    C:\Documents and Settings\matt'.UNICORNI-B997B1\Mes documents\Mes vidéos\nethostfs.exe REG_SZ C:\Documents and Settings\matt'.UNICORNI-B997B1\Mes documents\Mes vidéos\nethostfs.exe:*:Enabled:nethostfs

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    %windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
    %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
    C:\Program Files\Windows Live\Messenger\wlcsdk.exe REG_SZ C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger

    ===============
    ActivX controls
    ===============

    [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{30528230-99f7-4bb4-88d8-fa1d4f56a2ab}]
    [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{56762DEC-6B0D-4AB4-A8AD-989993B5D08B}]
    [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{5D6F45B3-9043-443D-A792-115447494D24}]
    [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{5D86DDB5-BDF9-441B-9E9E-D4730F4EE499}]
    [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}]
    [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{C3F79A2B-B9B4-4A66-B012-3EE46475B072}]
    [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}]
    [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}]
    [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{D27CDB6E-AE6D-11CF-96B8-444553540000}]

    ===============
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{CB58DED6-4AF3-4080-9DF1-DEE72075169F}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{0291E591-EA41-4c82-8106-3DC6CE7F7664}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{30528230-99F7-4BB4-88D8-FA1D4F56A2AB}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{347B0667-C7ED-429B-BDE3-CC8D3BACAA31}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3A08B3CA-9537-1A10-49EE-C6877BDF4477}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3F7924B9-D148-3141-87B1-68F36043A940}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{449D6C97-827E-A583-0D2E-889CF2CC21CC}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{73fa19d0-2d75-11d2-995d-00c04f98bbc9}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{ACC563BC-4266-43f0-B6ED-9D38C4202C7E}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B508B3F1-A24A-32C0-B310-85786919EF28}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}]
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F196AC50-7C95-42E1-9947-BDAB18BF3C8C}]

    ==============
    BHO :
    ======

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{0F6E720A-1A6B-40E1-A294-1D4D19F156C8}]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]

    ===
    DNS
    ===

    HKLM\SYSTEM\CCS\Services\Tcpip\..\{7D072EC8-D38C-489C-96D0-41C3EDF1D0EE}: DhcpNameServer=192.168.1.1
    HKLM\SYSTEM\CCS\Services\Tcpip\..\{DCA81DF9-6BD9-4953-850C-360AE8F3FC7C}: DhcpNameServer=192.168.30.1 0.0.0.0
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{7D072EC8-D38C-489C-96D0-41C3EDF1D0EE}: DhcpNameServer=192.168.1.1
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{DCA81DF9-6BD9-4953-850C-360AE8F3FC7C}: DhcpNameServer=192.168.30.1 0.0.0.0
    HKLM\SYSTEM\CS2\Services\Tcpip\..\{7D072EC8-D38C-489C-96D0-41C3EDF1D0EE}: DhcpNameServer=192.168.1.1
    HKLM\SYSTEM\CS2\Services\Tcpip\..\{DCA81DF9-6BD9-4953-850C-360AE8F3FC7C}: DhcpNameServer=192.168.30.1 0.0.0.0
    HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
    HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
    HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1

    ================
    Internet Explorer :
    ================

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
    Start Page REG_SZ https://www.msn.com/fr-fr
    Local Page REG_SZ C:\WINDOWS\system32\blank.htm
    Default_Search_URL REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    Default_Page_URL REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
    Search Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
    Start Page REG_SZ https://www.msn.com/fr-fr
    Local Page REG_SZ C:\WINDOWS\system32\blank.htm

    ========
    Services
    ========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]

    Ndisuio : 0x3 ( OK = 3 )
    SharedAccess : 0x2 ( OK = 2 )
    wuauserv : 0x2 ( OK = 2 )

    ========
    Safemode
    ========

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot : OK !!
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal : OK !!
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network : OK !!

    =========
    Atapi.sys
    =========

    C:\WINDOWS\SDold\Download\7a1946fba2b8886ae6be37be6d51ae57\atapi.sys :
    MD5 :: [9f3a2f5aa6875c72bf062c712cfa2674]
    SHA256 :: [b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9]

    C:\WINDOWS\system32\drivers\atapi.sys :
    MD5 :: [cdfe4411a69c224bd1d11b2da92dac51]
    SHA256 :: [0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d]

    Référence :
    ==========

    Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe
    Win 2000_SP4 : 8c718aa8c77041b3285d55a0ce980867
    Win XP_32b : a64013e98426e1877cb653685c5c0009
    Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
    Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
    Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
    Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
    Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
    Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
    Windows 7_32b : 80C40F7FDFC376E4C5FEEC28B41C119E
    Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C
    Windows 7_32b_Ultimate : 338c86357871c167a96ab976519bf59e

    =======
    Drive :
    =======

    Défragmenteur de disque Windows
    Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc.

    Rapport d'analyse
    64.49 Go total, 8.17 Go libre (12%), 15% fragmenté (fragmentation du fichier 30%)

    Vous devriez défragmenter ce volume.

    ¤¤¤¤¤¤¤¤¤¤ Files/folders :

    Present !! : C:\Program Files\Internet Explorer\SET4C.tmp
    Present !! : C:\Program Files\Internet Explorer\SET4D.tmp
    Present !! : C:\Program Files\Internet Explorer\SET4F.tmp
    Present !! : C:\Program Files\Internet Explorer\SET62.tmp
    Present !! : C:\Program Files\Internet Explorer\SET63.tmp
    Present !! : C:\Program Files\Internet Explorer\SET65.tmp
    Present !! : C:\Program Files\Internet Explorer\SET8C.tmp
    Present !! : C:\Program Files\Internet Explorer\SET8D.tmp
    Present !! : C:\Program Files\Internet Explorer\SET8F.tmp
    Present !! : C:\WINDOWS\System32\404Fix.exe
    Present !! : C:\WINDOWS\System32\drivers\etc\hosts.msn
    Present !! : C:\WINDOWS\System32\dumphive.exe"
    Present !! : C:\WINDOWS\System32\IEDFix.exe
    Present !! : C:\WINDOWS\System32\MSWINSCK.OCX
    Present !! : C:\WINDOWS\System32\Process.exe
    Present !! : C:\WINDOWS\System32\SrchSTS.exe
    Present !! : C:\WINDOWS\System32\tmp.reg"
    Present !! : C:\WINDOWS\System32\VACFix.exe
    Present !! : C:\WINDOWS\System32\VCCLSID.exe
    Present !! : C:\WINDOWS\System32\WS2Fix.exe
    Present !! : C:\Documents and Settings\matt'.UNICORNI-B997B1\LOCAL Settings\Temp\SSUPDATE.EXE

    ¤¤¤¤¤¤¤¤¤¤ Keys :

    Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
    Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
    Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
    Present !! : HKCR\CLSID\{248dd896-bb45-11cf-9abc-0080c7e7b78d}
    Present !! : HKCR\CLSID\{248dd897-bb45-11cf-9abc-0080c7e7b78d}
    Present !! : HKCR\Interface\{248dd892-bb45-11cf-9abc-0080c7e7b78d}
    Present !! : HKCR\Interface\{248dd893-bb45-11cf-9abc-0080c7e7b78d}
    Present !! : HKCR\TypeLib\{248dd890-bb45-11cf-9abc-0080c7e7b78d}
    Present !! : HKLM\SYSTEM\ControlSet001\Enum\Root\Legacy_ASC3550P
    Present !! : HKLM\SYSTEM\ControlSet002\Enum\Root\Legacy_ASC3550P
    Present !! : HKLM\SYSTEM\CurrentControlSet\Enum\Root\Legacy_ASC3550P
    Present !! : HKLM\System\CurrentControlSet\Services\asc3550p

    ============

    catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-04-30 13:39:22
    Windows 5.1.2600 Service Pack 2 FAT NTAPI

    scanning hidden processes ...

    scanning hidden services ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden processes: 0
    hidden services: 0
    hidden files: 0

    Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

    device: opened successfully
    user: MBR read successfully
    called modules: ntoskrnl.exe >>UNKNOWN [0x81B3B205]<<
    kernel: MBR read successfully
    user & kernel MBR OK

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    FirstRunDisabled REG_DWORD 1 (0x1)
    AntiVirusDisableNotify REG_DWORD 0 (0x0)
    FirewallDisableNotify REG_DWORD 0 (0x0)
    UpdatesDisableNotify REG_DWORD 0 (0x0)
    AntiVirusOverride REG_DWORD 0 (0x0)
    FirewallOverride REG_DWORD 0 (0x0)

    ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

    End of scan : 13:39:23.78
    0
  10. moment de grace Messages postés 29099 Date d'inscription   Statut Contributeur sécurité Dernière intervention   2 274
     
    méthode moins douce..

    Attention, avant de commencer, lit attentivement la procédure, et imprime la

    Aide à l'utilisation
    https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

    Télécharge ComboFix de sUBs sur ton Bureau :

    http://download.bleepingcomputer.com/sUBs/ComboFix.exe

    /!\ Déconnecte-toi du net et DESACTIVES TOUTES LES DEFENSES, antivirus et antispyware y compris /!\

    ---> Double-clique sur ComboFix.exe
    Un "pop-up" va apparaître qui dit que ComboFix est utilisé à vos risques et avec aucune garantie... Clique sur oui pour accepter

    SURTOUT INSTALLES LA CONSOLE DE RECUPERATION
    (si il te propose de l'installer remets provisoirement internet)

    ---> Mets-le en langue française F
    Tape sur la touche 1 (Yes) pour démarrer le scan.

    Ne touche à rien(souris, clavier) tant que le scan n'est pas terminé, car tu risques de planter ton PC

    En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

    Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

    /!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

    Note : Le rapport se trouve également là : C:\ComboFix.txt

    0
  11. mattdusud Messages postés 240 Date d'inscription   Statut Membre Dernière intervention   27
     
    ComboFix 10-05-01.04 - matt' 02/05/2010 12:57:33.1.1 - x86
    Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.511.175 [GMT 2:00]
    Lancé depuis: c:\documents and settings\matt'.UNICORNI-B997B1\Mes documents\Téléchargements\ComboFix.exe
    AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

    AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
    .

    (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\program files\Internet Explorer\SET4C.tmp
    c:\program files\Internet Explorer\SET4D.tmp
    c:\program files\Internet Explorer\SET4F.tmp
    c:\program files\Internet Explorer\SET62.tmp
    c:\program files\Internet Explorer\SET63.tmp
    c:\program files\Internet Explorer\SET65.tmp
    c:\program files\Internet Explorer\SET8C.tmp
    c:\program files\Internet Explorer\SET8D.tmp
    c:\program files\Internet Explorer\SET8F.tmp
    c:\program files\WindowsUpdate
    C:\Thumbs.db
    c:\windows\system32\404Fix.exe
    c:\windows\system32\Agent.OMZ.Fix.exe
    c:\windows\system32\config\49496002.Evt
    c:\windows\system32\dumphive.exe
    c:\windows\system32\IEDFix.C.exe
    c:\windows\system32\IEDFix.exe
    c:\windows\system32\o4Patch.exe
    c:\windows\system32\Process.exe
    c:\windows\system32\SrchSTS.exe
    c:\windows\system32\tmp.reg
    c:\windows\system32\VACFix.exe
    c:\windows\system32\VCCLSID.exe
    c:\windows\system32\WS2Fix.exe
    c:\windows\WinSystem

    .
    ((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_ASC3550P
    -------\Service_asc3550p

    ((((((((((((((((((((((((((((( Fichiers créés du 2010-04-02 au 2010-05-02 ))))))))))))))))))))))))))))))))))))
    .

    2010-05-02 08:11 . 2010-05-02 08:11 -------- d-----w- c:\program files\EAGLE-4.16
    2010-05-02 08:10 . 1997-04-08 18:08 299520 ----a-w- c:\windows\uninst.exe
    2010-04-30 10:51 . 2010-04-30 10:51 -------- d-----w- C:\Kill'em
    2010-04-30 10:50 . 2010-04-30 11:39 -------- d-----w- c:\program files\List_Kill'em
    2010-04-28 18:39 . 2010-04-28 18:39 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\SUPERAntiSpyware.com
    2010-04-28 18:39 . 2010-04-28 18:39 -------- d-----w- c:\program files\SUPERAntiSpyware
    2010-04-28 18:39 . 2010-04-28 18:39 -------- d-----w- c:\documents and settings\matt'.UNICORNI-B997B1\Application Data\SUPERAntiSpyware.com
    2010-04-28 18:39 . 2010-04-28 18:39 -------- d-----w- c:\program files\Fichiers communs\Wise Installation Wizard
    2010-04-28 16:37 . 2010-04-28 17:57 -------- d-----w- C:\Ad-Remover
    2010-04-28 10:45 . 2010-04-28 10:50 -------- d-----w- c:\program files\ZHPDiag
    2010-04-23 21:13 . 2010-04-23 21:13 -------- d-----w- c:\program files\FreeTime
    2010-04-23 11:26 . 2010-04-23 11:26 -------- d-----w- c:\documents and settings\matt'.UNICORNI-B997B1\Local Settings\Application Data\Cooliris
    2010-04-20 20:31 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
    2010-04-15 20:29 . 2010-04-15 20:34 -------- d-----w- c:\program files\mplayerc_homecinema_HD
    2010-04-15 20:29 . 2008-03-06 15:29 962560 ----a-w- c:\windows\system32\VSFilter.dll
    2010-04-15 20:29 . 2007-09-27 13:17 207720 ----a-w- c:\windows\system32\evrprop.dll
    2010-04-15 20:28 . 2010-04-15 20:28 -------- d-----w- c:\program files\Haali
    2010-04-15 20:28 . 2010-04-15 20:28 -------- d-----w- c:\program files\AC3Filter
    2010-04-15 20:28 . 2010-04-15 20:30 -------- d-----w- c:\program files\ReClock
    2010-04-15 20:01 . 2010-04-15 20:02 -------- d-----w- c:\program files\The KMPlayer FR
    2010-04-11 17:45 . 2010-04-11 17:45 -------- d-----w- c:\program files\VirginMega
    2010-04-11 12:33 . 2010-04-11 12:33 -------- d-----w- C:\_OTM
    2010-04-11 12:14 . 2010-04-11 12:14 -------- d-s---w- c:\documents and settings\LocalService.AUTORITE NT\Favoris
    2010-04-11 12:14 . 2010-04-11 12:14 -------- d-sh--w- c:\documents and settings\LocalService.AUTORITE NT\IETldCache
    2010-04-07 15:48 . 2010-04-07 15:48 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Adobe Systems
    2010-04-07 15:23 . 2010-04-07 15:23 -------- d-----w- c:\program files\Fichiers communs\Adobe Systems Shared
    2010-04-07 12:30 . 2010-04-09 17:02 -------- d-----w- c:\program files\Magic Karaoke Maker

    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-05-01 09:22 . 2010-02-09 14:20 -------- d-----w- c:\documents and settings\matt'.UNICORNI-B997B1\Application Data\vlc
    2010-04-29 22:00 . 2010-01-08 12:39 -------- d-----w- c:\program files\Fichiers communs\eBay
    2010-04-28 18:40 . 2010-04-28 18:40 52224 ----a-w- c:\documents and settings\matt'.UNICORNI-B997B1\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
    2010-04-28 18:40 . 2010-04-28 18:40 117760 ----a-w- c:\documents and settings\matt'.UNICORNI-B997B1\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
    2010-04-28 18:39 . 2010-04-28 18:39 65024 ----a-r- c:\documents and settings\matt'.UNICORNI-B997B1\Application Data\Microsoft\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF15.exe
    2010-04-28 18:39 . 2010-04-28 18:39 5120 ----a-r- c:\documents and settings\matt'.UNICORNI-B997B1\Application Data\Microsoft\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF16.exe
    2010-04-28 18:39 . 2010-04-28 18:39 18944 ----a-r- c:\documents and settings\matt'.UNICORNI-B997B1\Application Data\Microsoft\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF13.exe
    2010-04-28 17:10 . 2010-01-17 17:17 -------- d-----w- c:\program files\EAGLE-5.7.0
    2010-04-26 20:04 . 2008-12-15 12:44 -------- d-----w- c:\documents and settings\matt'.UNICORNI-B997B1\Application Data\gtk-2.0
    2010-04-20 21:01 . 2008-11-23 09:35 99344 ----a-w- c:\documents and settings\matt'.UNICORNI-B997B1\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2010-04-19 19:56 . 2008-11-23 10:43 -------- d-----w- c:\documents and settings\matt'.UNICORNI-B997B1\Application Data\Azureus
    2010-04-19 19:55 . 2010-04-19 19:55 8851392 ----a-w- c:\documents and settings\matt'.UNICORNI-B997B1\Application Data\Azureus\tmp\AZU534.tmp\Vuze_4.4.0.0a_win32.exe
    2010-04-19 16:26 . 2008-12-12 16:32 -------- d-----w- c:\program files\Guitar Pro 5
    2010-04-12 11:29 . 2008-12-10 16:18 -------- d-----w- c:\documents and settings\matt'.UNICORNI-B997B1\Application Data\dvdcss
    2010-04-11 17:43 . 2009-02-01 10:35 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Downloaded Installations
    2010-04-09 17:04 . 2010-02-16 22:32 -------- d-----w- c:\program files\Pcsx2
    2010-04-09 17:02 . 2009-02-14 16:08 -------- d-----w- c:\program files\eMule
    2010-04-08 10:18 . 2008-12-21 10:40 -------- d-----w- c:\program files\Fichiers communs\Adobe
    2010-04-07 13:05 . 2010-03-21 16:49 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\TrackMania
    2010-03-30 21:18 . 2009-07-13 12:14 -------- d-----w- c:\documents and settings\matt'.UNICORNI-B997B1\Application Data\FrostWire
    2010-03-29 22:46 . 2009-01-09 09:20 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-03-29 22:45 . 2009-01-09 09:20 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-03-28 20:40 . 2009-02-15 19:17 -------- d-----w- c:\program files\Google
    2010-03-28 10:33 . 2001-08-24 12:00 81386 ----a-w- c:\windows\system32\perfc00C.dat
    2010-03-28 10:33 . 2001-08-24 12:00 503238 ----a-w- c:\windows\system32\perfh00C.dat
    2010-03-23 18:11 . 2008-11-29 20:49 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft Help
    2010-03-21 16:49 . 2010-01-22 13:08 -------- d-----w- c:\program files\TmNationsForever
    2010-02-25 20:17 . 2010-02-25 20:17 29184 ----a-r- c:\documents and settings\matt'.UNICORNI-B997B1\Application Data\Microsoft\Installer\{52C8FAA0-68CA-4AF9-8A7A-92CF3174CC77}\IconTmpl5.26D6FF13_F77C_402E_8E96_9E49DFBBAF31.exe
    2010-02-20 14:59 . 2010-02-20 14:59 17408 ----a-w- C:\psapi.dll
    2010-02-20 14:38 . 2009-06-06 16:20 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
    2009-09-22 11:04 . 2009-09-22 11:04 61 --sh--w- c:\windows\cnerolf.dat
    .

    ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
    REGEDIT4

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0F6E720A-1A6B-40E1-A294-1D4D19F156C8}]
    2009-10-15 08:53 165184 ----a-w- c:\program files\SFR\Kit\SFRNavErrorHelper.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
    "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2010-03-29 2012912]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
    "nwiz"="nwiz.exe" [2008-05-03 1630208]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2009-09-03 13:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

    [HKLM\~\startupfolder\C:^Documents and Settings^matt'.UNICORNI-B997B1^Menu Démarrer^Programmes^Démarrage^MagicDisc.lnk]
    path=c:\documents and settings\matt'.UNICORNI-B997B1\Menu Démarrer\Programmes\Démarrage\MagicDisc.lnk
    backup=c:\windows\pss\MagicDisc.lnkStartup

    [HKLM\~\startupfolder\C:^Documents and Settings^matt'.UNICORNI-B997B1^Menu Démarrer^Programmes^Démarrage^RocketDock.lnk]
    path=c:\documents and settings\matt'.UNICORNI-B997B1\Menu Démarrer\Programmes\Démarrage\RocketDock.lnk
    backup=c:\windows\pss\RocketDock.lnkStartup

    [HKLM\~\startupfolder\C:^Documents and Settings^matt'.UNICORNI-B997B1^Menu Démarrer^Programmes^Démarrage^TransBar.lnk]
    path=c:\documents and settings\matt'.UNICORNI-B997B1\Menu Démarrer\Programmes\Démarrage\TransBar.lnk
    backup=c:\windows\pss\TransBar.lnkStartup

    [HKLM\~\startupfolder\C:^Documents and Settings^matt'.UNICORNI-B997B1^Menu Démarrer^Programmes^Démarrage^ubisoft register.lnk]
    path=c:\documents and settings\matt'.UNICORNI-B997B1\Menu Démarrer\Programmes\Démarrage\ubisoft register.lnk
    backup=c:\windows\pss\ubisoft register.lnkStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DeleteDir[CD8] Fast Browser Search]
    RD [X]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DeleteDir[CD8] SGPSA]
    RD [X]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
    2009-02-27 16:10 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
    2009-11-15 09:42 33120 ----a-w- c:\program files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Connexion SFR 9props.exe]
    2009-10-15 08:53 959808 ----a-w- c:\program files\SFR\Kit\9props.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
    2004-08-03 22:54 15360 ----a-w- c:\windows\system32\ctfmon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
    2008-04-01 09:39 486856 ----a-w- c:\program files\DAEMON Tools Lite\daemon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
    2008-06-24 15:06 1840424 ----a-w- c:\program files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechSoftwareUpdate]
    2005-06-08 13:44 196608 ----a-w- c:\program files\Logitech\Video\ManifestEngine.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair]
    2005-06-08 14:24 458752 ----a-w- c:\program files\Logitech\Video\ISStart.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray]
    2005-06-08 14:14 217088 ----a-w- c:\program files\Logitech\Video\LogiTray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMSX]
    2005-07-19 16:32 221184 ----a-w- c:\windows\system32\LVCOMSX.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
    2008-06-08 08:31 2221352 ----a-w- c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Neuf Media Center]
    2008-10-10 18:24 726336 ----a-w- c:\program files\SFR\Media Center\MediaCenter.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
    2008-05-03 04:46 13529088 ----a-w- c:\windows\system32\nvcpl.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
    2008-05-03 04:46 86016 ----a-w- c:\windows\system32\nvmctray.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
    2008-05-03 04:46 1630208 ----a-w- c:\windows\system32\nwiz.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    2008-09-06 14:09 413696 ----a-w- c:\program files\QuickTime\QTTask.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "TOSHIBA Bluetooth Service"=2 (0x2)
    "StarWindServiceAE"=2 (0x2)
    "Nero BackItUp Scheduler 3"=2 (0x2)
    "gupdate1c98fa21b0f3d20"=2 (0x2)
    "Spooler"=2 (0x2)
    "WMPNetworkSvc"=3 (0x3)
    "PLFlash DeviceIoControl Service"=2 (0x2)
    "ose"=3 (0x3)
    "odserv"=3 (0x3)
    "NVSvc"=2 (0x2)
    "npggsvc"=3 (0x3)
    "NMIndexingService"=3 (0x3)
    "JavaQuickStarterService"=2 (0x2)
    "idsvc"=3 (0x3)
    "IDriverT"=3 (0x3)
    "WinVNC4"=2 (0x2)
    "FirebirdServerMAGIXInstance"=3 (0x3)
    "dmadmin"=3 (0x3)
    "gusvc"=3 (0x3)
    "Adobe LM Service"=3 (0x3)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "c:\\Program Files\\TmNationsForever\\TmForever.exe"=
    "c:\\Program Files\\Azureus\\Azureus.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
    "c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
    "c:\\Program Files\\Microsoft Games\\Flight Simulator 9\\fs9.exe"=
    "c:\\Program Files\\Microsoft Games\\Combat Flight Simulator\\COMBATFS.EXE"=
    "c:\\WINDOWS\\system32\\dplaysvr.exe"=
    "c:\\WINDOWS\\system32\\dpnsvr.exe"=
    "c:\\Program Files\\FrostWire\\FrostWire.exe"=
    "c:\\Program Files\\RealVNC\\VNC4\\winvnc4.exe"=
    "c:\program files\SFR\Media Center\httpd\httpd.exe"= c:\program files\SFR\Media Center\httpd\httpd.exe:172.16.255.0/255.255.255.0,192.168.1.0/255.255.255.0:Enabled:Serveur de partage Media Center (Player SFR)
    "c:\\Documents and Settings\\matt'.UNICORNI-B997B1\\Mes documents\\Mes vidéos\\nethostfs.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
    "13000:TCP"= 13000:TCP:pspwebcam
    "13300:UDP"= 13300:UDP:pspwebcam
    "26180:UDP"= 26180:UDP:neuf
    "26180:TCP"= 26180:TCP:neuf

    R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [17/02/2010 11:25 12872]
    R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [17/02/2010 11:15 66632]
    R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [21/09/2009 13:16 108289]
    R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\drivers\ManyCam.sys [14/01/2008 12:06 21632]
    R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [17/02/2010 11:15 12872]
    S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [03/07/2009 16:35 13224]
    S3 libusb0;LibUsb-Win32 - Kernel Driver 03/20/2007, 0.1.12.1;c:\windows\system32\drivers\libusb0.sys [06/12/2008 19:11 28672]
    S3 pspdisp;pspdisp;c:\windows\system32\drivers\pspdisp.sys [25/12/2008 16:24 3072]
    S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [06/04/2009 14:19 23064]
    S3 WsAudioDevice_383;WsAudioDevice_383;c:\windows\system32\drivers\WsAudioDevice_383.sys [05/07/2009 12:13 16640]
    S4 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [25/11/2008 20:16 1527900]
    S4 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
    S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [06/06/2009 18:20 691696]
    .
    Contenu du dossier 'Tâches planifiées'

    2010-05-02 c:\windows\Tasks\User_Feed_Synchronization-{6B204DDC-D86C-4930-A4A2-25D989337D77}.job
    - c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
    .
    .
    ------- Examen supplémentaire -------
    .
    uInternet Connection Wizard,ShellNext = iexplore
    uInternet Settings,ProxyOverride = local
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
    FF - ProfilePath - c:\documents and settings\matt'.UNICORNI-B997B1\Application Data\Mozilla\Firefox\Profiles\m0cv1q45.default\
    FF - prefs.js: browser.startup.homepage - www.google.fr
    FF - prefs.js: keyword.URL - hxxp://redirecterror.sfr.fr/?q=
    FF - component: c:\documents and settings\matt'.UNICORNI-B997B1\Application Data\Mozilla\Firefox\Profiles\m0cv1q45.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
    FF - plugin: c:\documents and settings\matt'.UNICORNI-B997B1\Application Data\Mozilla\Firefox\Profiles\m0cv1q45.default\extensions\piclens@cooliris.com\plugins\npcoolirisplugin.dll
    FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll
    FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

    ---- PARAMETRES FIREFOX ----
    FF - user.js: keyword.URL - hxxp://redirecterror.sfr.fr/?q=
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
    c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
    c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
    c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
    c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
    c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "https://www.mozilla.org/en-US/firefox/new/?redirect_source=firefox-com");
    c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
    .
    - - - - ORPHELINS SUPPRIMES - - - -

    Toolbar-{63A09EB8-8BFE-4641-B086-550000FE8B1D} - (no file)
    WebBrowser-{63A09EB8-8BFE-4641-B086-550000FE8B1D} - (no file)
    MSConfigStartUp-MSMSGS - c:\program files\Messenger\msmsgs.exe
    MSConfigStartUp-YVIBBBHA8C - c:\docume~1\MATT'~1.UNI\LOCALS~1\Temp\Nnu.exe
    ActiveSetup-{3A08B3CA-9537-1A10-49EE-C6877BDF4477} - c:\windows\winsystem.exe

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-05-02 13:12
    Windows 5.1.2600 Service Pack 2 NTFS

    Recherche de processus cachés ...

    Recherche d'éléments en démarrage automatique cachés ...

    Recherche de fichiers cachés ...

    Scan terminé avec succès
    Fichiers cachés: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
    "ImagePath"="c:\windows\system32\GameMon.des -service"
    .
    --------------------- CLES DE REGISTRE BLOQUEES ---------------------

    [HKEY_USERS\S-1-5-21-682003330-746137067-1343024091-1003\Software\SecuROM\License information*]
    @Allowed: (Read) (RestrictedCode)
    @Allowed: (Read) (RestrictedCode)
    "datasecu"=hex:b2,7d,3e,8d,1e,7e,c6,52,6b,7b,16,0d,85,dd,52,58,48,4c,8b,3a,ab,
    b5,3e,75,8f,de,1e,28,63,b6,13,89,c7,b2,fb,fd,44,7a,86,d2,62,d9,b1,84,6c,7b,\
    "rkeysecu"=hex:6d,ec,7c,95,1e,75,4c,24,b6,23,22,42,bb,32,d9,ac

    [HKEY_USERS\S-1-5-21-682003330-746137067-1343024091-1003\Software\Sony Creative Software\M*e*d*i*a* *M*a*n*a*g*e*r* *f*o*r* *P*S*P*"!\3.0]
    "FRT"="RxNxxztDnQncmoyVhwysxpw33dT7XMqMx9tIcI7xrt7MuWUHzeZ1Wg=="
    "PLCK"="TKfAs7qqqBgUVHS5yR9KGYFBV4n87Kse"
    "Percents"="0.0006 0.5085 0.716 0.7488 0.7622 0.959 0.9785 0.983 "
    "Increment"=".000341"

    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\ð*€|ÿÿÿÿ.*€|ù*9~*]
    "AB141C35E9F4BF344B9FC010BB17F68A"=""
    .
    --------------------- DLLs chargées dans les processus actifs ---------------------

    - - - - - - - > 'winlogon.exe'(740)
    c:\program files\SUPERAntiSpyware\SASWINLO.dll

    - - - - - - - > 'explorer.exe'(2392)
    c:\windows\system32\SHDOCVW.dll
    c:\program files\RocketDock\RocketDock.dll
    c:\windows\system32\nview.dll
    c:\windows\system32\NVWRSFR.DLL
    c:\program files\Windows Media Player\wmpband.dll
    c:\windows\system32\ntshrui.dll
    c:\windows\system32\NETSHELL.dll
    c:\windows\system32\credui.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Autres processus actifs ------------------------
    .
    c:\program files\Avira\AntiVir Desktop\avguard.exe
    c:\windows\system32\rundll32.exe
    .
    **************************************************************************
    .
    Heure de fin: 2010-05-02 13:24:10 - La machine a redémarré
    ComboFix-quarantined-files.txt 2010-05-02 11:24

    Avant-CF: 8 086 450 176 octets libres
    Après-CF: 7 958 478 848 octets libres

    - - End Of File - - 790A8C616BA2078106EB6BF6F6E62BEB
    0
  12. moment de grace Messages postés 29099 Date d'inscription   Statut Contributeur sécurité Dernière intervention   2 274
     
    la console n'a pas été installée !

    supprimes combofix et retélécharges le

    http://download.bleepingcomputer.com/sUBs/ComboFix.exe

    cette fois acceptes l'installation de cette console et laisses internet pour cela
    0
  13. mattdusud Messages postés 240 Date d'inscription   Statut Membre Dernière intervention   27
     
    ComboFix 10-05-02.01 - matt' 02/05/2010 21:07:08.2.1 - x86
    Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.511.123 [GMT 2:00]
    Lancé depuis: c:\documents and settings\matt'.UNICORNI-B997B1\Mes documents\Téléchargements\ComboFix.exe
    AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
    .

    ((((((((((((((((((((((((((((( Fichiers créés du 2010-04-02 au 2010-05-02 ))))))))))))))))))))))))))))))))))))
    .

    2010-05-02 08:11 . 2010-05-02 08:11 -------- d-----w- c:\program files\EAGLE-4.16
    2010-05-02 08:10 . 1997-04-08 18:08 299520 ----a-w- c:\windows\uninst.exe
    2010-04-30 10:51 . 2010-04-30 10:51 -------- d-----w- C:\Kill'em
    2010-04-30 10:50 . 2010-04-30 11:39 -------- d-----w- c:\program files\List_Kill'em
    2010-04-28 18:39 . 2010-04-28 18:39 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\SUPERAntiSpyware.com
    2010-04-28 18:39 . 2010-04-28 18:39 -------- d-----w- c:\program files\SUPERAntiSpyware
    2010-04-28 18:39 . 2010-04-28 18:39 -------- d-----w- c:\documents and settings\matt'.UNICORNI-B997B1\Application Data\SUPERAntiSpyware.com
    2010-04-28 18:39 . 2010-04-28 18:39 -------- d-----w- c:\program files\Fichiers communs\Wise Installation Wizard
    2010-04-28 16:37 . 2010-04-28 17:57 -------- d-----w- C:\Ad-Remover
    2010-04-28 10:45 . 2010-04-28 10:50 -------- d-----w- c:\program files\ZHPDiag
    2010-04-23 21:13 . 2010-04-23 21:13 -------- d-----w- c:\program files\FreeTime
    2010-04-23 11:26 . 2010-04-23 11:26 -------- d-----w- c:\documents and settings\matt'.UNICORNI-B997B1\Local Settings\Application Data\Cooliris
    2010-04-20 20:31 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
    2010-04-15 20:29 . 2010-04-15 20:34 -------- d-----w- c:\program files\mplayerc_homecinema_HD
    2010-04-15 20:29 . 2008-03-06 15:29 962560 ----a-w- c:\windows\system32\VSFilter.dll
    2010-04-15 20:29 . 2007-09-27 13:17 207720 ----a-w- c:\windows\system32\evrprop.dll
    2010-04-15 20:28 . 2010-04-15 20:28 -------- d-----w- c:\program files\Haali
    2010-04-15 20:28 . 2010-04-15 20:28 -------- d-----w- c:\program files\AC3Filter
    2010-04-15 20:28 . 2010-04-15 20:30 -------- d-----w- c:\program files\ReClock
    2010-04-15 20:01 . 2010-04-15 20:02 -------- d-----w- c:\program files\The KMPlayer FR
    2010-04-11 17:45 . 2010-04-11 17:45 -------- d-----w- c:\program files\VirginMega
    2010-04-11 12:33 . 2010-04-11 12:33 -------- d-----w- C:\_OTM
    2010-04-11 12:14 . 2010-04-11 12:14 -------- d-s---w- c:\documents and settings\LocalService.AUTORITE NT\Favoris
    2010-04-11 12:14 . 2010-04-11 12:14 -------- d-sh--w- c:\documents and settings\LocalService.AUTORITE NT\IETldCache
    2010-04-07 15:48 . 2010-04-07 15:48 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Adobe Systems
    2010-04-07 15:23 . 2010-04-07 15:23 -------- d-----w- c:\program files\Fichiers communs\Adobe Systems Shared
    2010-04-07 12:30 . 2010-04-09 17:02 -------- d-----w- c:\program files\Magic Karaoke Maker

    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-05-01 09:22 . 2010-02-09 14:20 -------- d-----w- c:\documents and settings\matt'.UNICORNI-B997B1\Application Data\vlc
    2010-04-29 22:00 . 2010-01-08 12:39 -------- d-----w- c:\program files\Fichiers communs\eBay
    2010-04-28 18:40 . 2010-04-28 18:40 52224 ----a-w- c:\documents and settings\matt'.UNICORNI-B997B1\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
    2010-04-28 18:40 . 2010-04-28 18:40 117760 ----a-w- c:\documents and settings\matt'.UNICORNI-B997B1\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
    2010-04-28 18:39 . 2010-04-28 18:39 65024 ----a-r- c:\documents and settings\matt'.UNICORNI-B997B1\Application Data\Microsoft\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF15.exe
    2010-04-28 18:39 . 2010-04-28 18:39 5120 ----a-r- c:\documents and settings\matt'.UNICORNI-B997B1\Application Data\Microsoft\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF16.exe
    2010-04-28 18:39 . 2010-04-28 18:39 18944 ----a-r- c:\documents and settings\matt'.UNICORNI-B997B1\Application Data\Microsoft\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF13.exe
    2010-04-28 17:10 . 2010-01-17 17:17 -------- d-----w- c:\program files\EAGLE-5.7.0
    2010-04-26 20:04 . 2008-12-15 12:44 -------- d-----w- c:\documents and settings\matt'.UNICORNI-B997B1\Application Data\gtk-2.0
    2010-04-20 21:01 . 2008-11-23 09:35 99344 ----a-w- c:\documents and settings\matt'.UNICORNI-B997B1\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2010-04-19 19:56 . 2008-11-23 10:43 -------- d-----w- c:\documents and settings\matt'.UNICORNI-B997B1\Application Data\Azureus
    2010-04-19 19:55 . 2010-04-19 19:55 8851392 ----a-w- c:\documents and settings\matt'.UNICORNI-B997B1\Application Data\Azureus\tmp\AZU534.tmp\Vuze_4.4.0.0a_win32.exe
    2010-04-19 16:26 . 2008-12-12 16:32 -------- d-----w- c:\program files\Guitar Pro 5
    2010-04-12 11:29 . 2008-12-10 16:18 -------- d-----w- c:\documents and settings\matt'.UNICORNI-B997B1\Application Data\dvdcss
    2010-04-11 17:43 . 2009-02-01 10:35 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Downloaded Installations
    2010-04-09 17:04 . 2010-02-16 22:32 -------- d-----w- c:\program files\Pcsx2
    2010-04-09 17:02 . 2009-02-14 16:08 -------- d-----w- c:\program files\eMule
    2010-04-08 10:18 . 2008-12-21 10:40 -------- d-----w- c:\program files\Fichiers communs\Adobe
    2010-04-07 13:05 . 2010-03-21 16:49 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\TrackMania
    2010-03-30 21:18 . 2009-07-13 12:14 -------- d-----w- c:\documents and settings\matt'.UNICORNI-B997B1\Application Data\FrostWire
    2010-03-29 22:46 . 2009-01-09 09:20 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-03-29 22:45 . 2009-01-09 09:20 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-03-28 20:40 . 2009-02-15 19:17 -------- d-----w- c:\program files\Google
    2010-03-28 10:33 . 2001-08-24 12:00 81386 ----a-w- c:\windows\system32\perfc00C.dat
    2010-03-28 10:33 . 2001-08-24 12:00 503238 ----a-w- c:\windows\system32\perfh00C.dat
    2010-03-23 18:11 . 2008-11-29 20:49 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft Help
    2010-03-21 16:49 . 2010-01-22 13:08 -------- d-----w- c:\program files\TmNationsForever
    2010-02-25 20:17 . 2010-02-25 20:17 29184 ----a-r- c:\documents and settings\matt'.UNICORNI-B997B1\Application Data\Microsoft\Installer\{52C8FAA0-68CA-4AF9-8A7A-92CF3174CC77}\IconTmpl5.26D6FF13_F77C_402E_8E96_9E49DFBBAF31.exe
    2010-02-20 14:59 . 2010-02-20 14:59 17408 ----a-w- C:\psapi.dll
    2010-02-20 14:38 . 2009-06-06 16:20 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
    2009-09-22 11:04 . 2009-09-22 11:04 61 --sh--w- c:\windows\cnerolf.dat
    .

    ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
    REGEDIT4

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0F6E720A-1A6B-40E1-A294-1D4D19F156C8}]
    2009-10-15 08:53 165184 ----a-w- c:\program files\SFR\Kit\SFRNavErrorHelper.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2009-09-03 13:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

    [HKLM\~\startupfolder\C:^Documents and Settings^matt'.UNICORNI-B997B1^Menu Démarrer^Programmes^Démarrage^MagicDisc.lnk]
    path=c:\documents and settings\matt'.UNICORNI-B997B1\Menu Démarrer\Programmes\Démarrage\MagicDisc.lnk
    backup=c:\windows\pss\MagicDisc.lnkStartup

    [HKLM\~\startupfolder\C:^Documents and Settings^matt'.UNICORNI-B997B1^Menu Démarrer^Programmes^Démarrage^RocketDock.lnk]
    path=c:\documents and settings\matt'.UNICORNI-B997B1\Menu Démarrer\Programmes\Démarrage\RocketDock.lnk
    backup=c:\windows\pss\RocketDock.lnkStartup

    [HKLM\~\startupfolder\C:^Documents and Settings^matt'.UNICORNI-B997B1^Menu Démarrer^Programmes^Démarrage^TransBar.lnk]
    path=c:\documents and settings\matt'.UNICORNI-B997B1\Menu Démarrer\Programmes\Démarrage\TransBar.lnk
    backup=c:\windows\pss\TransBar.lnkStartup

    [HKLM\~\startupfolder\C:^Documents and Settings^matt'.UNICORNI-B997B1^Menu Démarrer^Programmes^Démarrage^ubisoft register.lnk]
    path=c:\documents and settings\matt'.UNICORNI-B997B1\Menu Démarrer\Programmes\Démarrage\ubisoft register.lnk
    backup=c:\windows\pss\ubisoft register.lnkStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DeleteDir[CD8] Fast Browser Search]
    RD [X]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DeleteDir[CD8] SGPSA]
    RD [X]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
    2009-02-27 16:10 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
    2009-11-15 09:42 33120 ----a-w- c:\program files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Connexion SFR 9props.exe]
    2009-10-15 08:53 959808 ----a-w- c:\program files\SFR\Kit\9props.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
    2004-08-03 22:54 15360 ----a-w- c:\windows\system32\ctfmon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
    2008-04-01 09:39 486856 ----a-w- c:\program files\DAEMON Tools Lite\daemon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
    2008-06-24 15:06 1840424 ----a-w- c:\program files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechSoftwareUpdate]
    2005-06-08 13:44 196608 ----a-w- c:\program files\Logitech\Video\ManifestEngine.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair]
    2005-06-08 14:24 458752 ----a-w- c:\program files\Logitech\Video\ISStart.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray]
    2005-06-08 14:14 217088 ----a-w- c:\program files\Logitech\Video\LogiTray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMSX]
    2005-07-19 16:32 221184 ----a-w- c:\windows\system32\LVCOMSX.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
    2008-06-08 08:31 2221352 ----a-w- c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Neuf Media Center]
    2008-10-10 18:24 726336 ----a-w- c:\program files\SFR\Media Center\MediaCenter.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
    2008-05-03 04:46 13529088 ----a-w- c:\windows\system32\nvcpl.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
    2008-05-03 04:46 86016 ----a-w- c:\windows\system32\nvmctray.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
    2008-05-03 04:46 1630208 ----a-w- c:\windows\system32\nwiz.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    2008-09-06 14:09 413696 ----a-w- c:\program files\QuickTime\QTTask.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
    2010-03-29 06:29 2012912 ----a-w- c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "TOSHIBA Bluetooth Service"=2 (0x2)
    "StarWindServiceAE"=2 (0x2)
    "Nero BackItUp Scheduler 3"=2 (0x2)
    "gupdate1c98fa21b0f3d20"=2 (0x2)
    "Spooler"=2 (0x2)
    "WMPNetworkSvc"=3 (0x3)
    "PLFlash DeviceIoControl Service"=2 (0x2)
    "ose"=3 (0x3)
    "odserv"=3 (0x3)
    "NVSvc"=2 (0x2)
    "npggsvc"=3 (0x3)
    "NMIndexingService"=3 (0x3)
    "JavaQuickStarterService"=2 (0x2)
    "idsvc"=3 (0x3)
    "IDriverT"=3 (0x3)
    "WinVNC4"=2 (0x2)
    "FirebirdServerMAGIXInstance"=3 (0x3)
    "dmadmin"=3 (0x3)
    "gusvc"=3 (0x3)
    "Adobe LM Service"=3 (0x3)
    0
  14. mattdusud Messages postés 240 Date d'inscription   Statut Membre Dernière intervention   27
     
    et la suite:

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "c:\\Program Files\\TmNationsForever\\TmForever.exe"=
    "c:\\Program Files\\Azureus\\Azureus.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
    "c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
    "c:\\Program Files\\Microsoft Games\\Flight Simulator 9\\fs9.exe"=
    "c:\\Program Files\\Microsoft Games\\Combat Flight Simulator\\COMBATFS.EXE"=
    "c:\\WINDOWS\\system32\\dplaysvr.exe"=
    "c:\\WINDOWS\\system32\\dpnsvr.exe"=
    "c:\\Program Files\\FrostWire\\FrostWire.exe"=
    "c:\\Program Files\\RealVNC\\VNC4\\winvnc4.exe"=
    "c:\program files\SFR\Media Center\httpd\httpd.exe"= c:\program files\SFR\Media Center\httpd\httpd.exe:172.16.255.0/255.255.255.0,192.168.1.0/255.255.255.0:Enabled:Serveur de partage Media Center (Player SFR)
    "c:\\Documents and Settings\\matt'.UNICORNI-B997B1\\Mes documents\\Mes vidéos\\nethostfs.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
    "13000:TCP"= 13000:TCP:pspwebcam
    "13300:UDP"= 13300:UDP:pspwebcam
    "26180:UDP"= 26180:UDP:neuf
    "26180:TCP"= 26180:TCP:neuf

    R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [17/02/2010 11:25 12872]
    R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [17/02/2010 11:15 66632]
    R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [21/09/2009 13:16 108289]
    R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\drivers\ManyCam.sys [14/01/2008 12:06 21632]
    R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [17/02/2010 11:15 12872]
    S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [03/07/2009 16:35 13224]
    S3 libusb0;LibUsb-Win32 - Kernel Driver 03/20/2007, 0.1.12.1;c:\windows\system32\drivers\libusb0.sys [06/12/2008 19:11 28672]
    S3 pspdisp;pspdisp;c:\windows\system32\drivers\pspdisp.sys [25/12/2008 16:24 3072]
    S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [06/04/2009 14:19 23064]
    S3 WsAudioDevice_383;WsAudioDevice_383;c:\windows\system32\drivers\WsAudioDevice_383.sys [05/07/2009 12:13 16640]
    S4 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [25/11/2008 20:16 1527900]
    S4 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
    S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [06/06/2009 18:20 691696]
    .
    Contenu du dossier 'Tâches planifiées'

    2010-05-02 c:\windows\Tasks\User_Feed_Synchronization-{6B204DDC-D86C-4930-A4A2-25D989337D77}.job
    - c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
    .
    .
    ------- Examen supplémentaire -------
    .
    uInternet Connection Wizard,ShellNext = iexplore
    uInternet Settings,ProxyOverride = local
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
    FF - ProfilePath - c:\documents and settings\matt'.UNICORNI-B997B1\Application Data\Mozilla\Firefox\Profiles\m0cv1q45.default\
    FF - prefs.js: browser.startup.homepage - www.google.fr
    FF - prefs.js: keyword.URL - hxxp://redirecterror.sfr.fr/?q=
    FF - component: c:\documents and settings\matt'.UNICORNI-B997B1\Application Data\Mozilla\Firefox\Profiles\m0cv1q45.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
    FF - plugin: c:\documents and settings\matt'.UNICORNI-B997B1\Application Data\Mozilla\Firefox\Profiles\m0cv1q45.default\extensions\piclens@cooliris.com\plugins\npcoolirisplugin.dll
    FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll
    FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

    ---- PARAMETRES FIREFOX ----
    FF - user.js: keyword.URL - hxxp://redirecterror.sfr.fr/?q=
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
    c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
    c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
    c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
    c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
    c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "https://www.mozilla.org/en-US/firefox/new/?redirect_source=firefox-com");
    c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-05-02 21:18
    Windows 5.1.2600 Service Pack 2 NTFS

    Recherche de processus cachés ...

    Recherche d'éléments en démarrage automatique cachés ...

    Recherche de fichiers cachés ...

    Scan terminé avec succès
    Fichiers cachés: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
    "ImagePath"="c:\windows\system32\GameMon.des -service"
    .
    --------------------- CLES DE REGISTRE BLOQUEES ---------------------

    [HKEY_USERS\S-1-5-21-682003330-746137067-1343024091-1003\Software\SecuROM\License information*]
    @Allowed: (Read) (RestrictedCode)
    @Allowed: (Read) (RestrictedCode)
    "datasecu"=hex:b2,7d,3e,8d,1e,7e,c6,52,6b,7b,16,0d,85,dd,52,58,48,4c,8b,3a,ab,
    b5,3e,75,8f,de,1e,28,63,b6,13,89,c7,b2,fb,fd,44,7a,86,d2,62,d9,b1,84,6c,7b,\
    "rkeysecu"=hex:6d,ec,7c,95,1e,75,4c,24,b6,23,22,42,bb,32,d9,ac

    [HKEY_USERS\S-1-5-21-682003330-746137067-1343024091-1003\Software\Sony Creative Software\M*e*d*i*a* *M*a*n*a*g*e*r* *f*o*r* *P*S*P*"!\3.0]
    "FRT"="RxNxxztDnQncmoyVhwysxpw33dT7XMqMx9tIcI7xrt7MuWUHzeZ1Wg=="
    "PLCK"="TKfAs7qqqBgUVHS5yR9KGYFBV4n87Kse"
    "Percents"="0.0006 0.5085 0.716 0.7488 0.7622 0.959 0.9785 0.983 "
    "Increment"=".000341"

    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\ð*€|ÿÿÿÿ.*€|ù*9~*]
    "AB141C35E9F4BF344B9FC010BB17F68A"=""
    .
    --------------------- DLLs chargées dans les processus actifs ---------------------

    - - - - - - - > 'winlogon.exe'(740)
    c:\program files\SUPERAntiSpyware\SASWINLO.dll

    - - - - - - - > 'explorer.exe'(952)
    c:\windows\system32\SHDOCVW.dll
    c:\windows\system32\nview.dll
    c:\windows\system32\NVWRSFR.DLL
    c:\program files\Windows Media Player\wmpband.dll
    c:\windows\system32\ntshrui.dll
    c:\windows\system32\NETSHELL.dll
    c:\windows\system32\credui.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    Heure de fin: 2010-05-02 21:26:03
    ComboFix-quarantined-files.txt 2010-05-02 19:26
    ComboFix2.txt 2010-05-02 11:24

    Avant-CF: 7 940 714 496 octets libres
    Après-CF: 7 893 823 488 octets libres

    WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect

    - - End Of File - - 8E070B2399F6A572DBFE292F64C2C97F
    0

Discussions similaires

svp 32Gb est il egal a 32Go??
William Fernand -
nemrod18 -

3 réponses
À quoi correspond 32x32 US en taille française pour un jean ?
Alison1958 -
Thordendall -

1 réponse
Quelle est la différence entre les GO et GB ?
badour -
MarceloFilippo -

37 réponses
32 GO, est-ce suffisant ?
Alexia14 -
Alexia14 -

2 réponses
Bonjour j aimerais savoir +32 465 c est quelle fourniseur
Coralie -
brucine -

2 réponses