Bonjour,
ComboFix 10-05-12.03 - Compaq_Propriétaire 14/05/2010 15:19:53.3.1 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.1470.728 [GMT 2:00]
Lancé depuis: c:\documents and settings\Compaq_Propriétaire\Bureau\ComboFix.exe
AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\TEMP\logishrd\LVPrcInj01.dll
.
((((((((((((((((((((((((((((( Fichiers créés du 2010-04-14 au 2010-05-14 ))))))))))))))))))))))))))))))))))))
.
2010-05-13 21:14 . 2010-04-28 17:19 15880 ----a-w- c:\windows\system32\lsdelete.exe
2010-05-13 20:37 . 2010-05-13 20:40 -------- d-----w- c:\documents and settings\Administrateur
2010-05-13 09:08 . 2010-05-13 09:08 -------- d-----w- c:\program files\Sophos
2010-05-06 13:05 . 2009-03-30 08:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-05-06 13:05 . 2009-02-13 10:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2010-05-06 13:05 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2010-05-06 13:05 . 2010-05-06 13:05 -------- d-----w- c:\program files\Avira
2010-05-06 13:05 . 2010-05-06 13:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2010-04-20 16:03 . 2010-05-14 13:31 755200 ----a-w- c:\windows\system32\drivers\fbcgo.sys
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-14 13:25 . 2008-08-11 10:34 12 ----a-w- c:\windows\bthservsdp.dat
2010-05-09 19:43 . 2004-11-23 21:26 94518 ----a-w- c:\windows\system32\perfc00C.dat
2010-05-09 19:43 . 2004-11-23 21:26 534796 ----a-w- c:\windows\system32\perfh00C.dat
2010-05-07 12:38 . 2010-03-24 17:48 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-04-20 16:01 . 2010-04-20 16:01 8 ----a-w- c:\documents and settings\NetworkService\Application Data\kcmdte.dat
2010-04-04 17:17 . 2010-04-04 17:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Driver Whiz
2010-03-26 07:49 . 2008-08-06 13:13 -------- d-----w- c:\program files\Windows Desktop Search
2010-03-24 18:54 . 2010-03-24 18:52 -------- d-----w- c:\program files\Logitech
2010-03-24 18:54 . 2007-12-22 18:42 -------- d-----w- c:\program files\Fichiers communs\logishrd
2010-03-24 18:52 . 2007-12-22 18:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Logishrd
2010-03-24 18:13 . 2010-03-24 18:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-03-24 18:12 . 2010-03-24 18:12 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-03-24 18:06 . 2010-03-24 18:01 -------- d-----w- c:\program files\Lavasoft
2010-03-24 18:05 . 2010-03-24 18:05 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{52AC600B-5800-407E-99FF-83CD0669760B}
2010-03-21 11:22 . 2010-03-21 11:22 8 ----a-w- c:\documents and settings\NetworkService\Application Data\jasltw.dat
2010-03-21 08:19 . 2010-03-21 08:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-03-20 15:30 . 2010-03-20 15:30 -------- d-----w- c:\program files\Enigma Software Group
2010-03-20 09:16 . 2005-01-02 00:15 -------- d-----w- c:\program files\Java
2010-03-20 08:56 . 2007-12-21 18:50 -------- d-----w- c:\program files\Alwil Software
2010-03-20 08:56 . 2010-03-20 08:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-03-20 08:31 . 2010-03-20 08:31 8 ----a-w- c:\windows\system32\config\systemprofile\Application Data\jasltw.dat
2010-03-10 06:16 . 2004-08-05 18:00 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-02-25 06:17 . 2004-08-05 18:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-24 13:11 . 2004-08-05 18:00 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-17 12:07 . 2004-08-05 18:00 2192000 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-02-16 19:07 . 2004-08-05 18:00 2068864 ----a-w- c:\windows\system32\ntkrnlpa.exe
2004-10-01 14:00 . 2006-12-30 15:29 40960 ----a-w- c:\program files\Uninstall_CDS.exe
2005-12-30 10:29 . 2005-12-30 10:29 22 -csha-w- c:\windows\SMINST\HPCD.sys
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 204288]
"Logitech Vid"="c:\program files\Logitech\Logitech Vid\vid.exe" [2009-07-16 5458704]
"PowerBar"="c:\program files\CyberLink DVD Solution\Multimedia Launcher\PowerBar.exe" [2004-04-21 86016]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-06-08 344064]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2004-04-14 233472]
"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 57344]
"RemoteControl"="c:\program files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"OrderReminder"="c:\program files\Hewlett-Packard\OrderReminder\OrderReminder.exe" [2006-01-30 98304]
"ORAHSSStartup"="c:\program files\OrangeHSS\Launcher\Launcher.exe" [2007-01-04 462848]
"SystrayORAHSS"="c:\program files\OrangeHSS\Systray\SystrayApp.exe" [2007-01-04 90112]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-05-27 413696]
"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-07-30 289064]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"LogitechQuickCamRibbon"="c:\program files\Logitech\Logitech WebCam Software\LWS.exe" [2009-10-14 2793304]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
c:\documents and settings\Compaq_Propri'taire\Menu D'marrer\Programmes\D'marrage\
Microsoft Recherche acc'l'r'e.lnk - c:\program files\Microsoft Office\Office\FINDFAST.EXE [1996-12-17 111376]
c:\documents and settings\Compaq_Propri'taire\Menu D'marrer\Programmes\D'marrage\
Microsoft Recherche acc'l'r'e.lnk - c:\program files\Microsoft Office\Office\FINDFAST.EXE [1996-12-17 111376]
c:\documents and settings\Compaq_Propri'taire\Menu D'marrer\Programmes\D'marrage\
Microsoft Recherche acc'l'r'e.lnk - c:\program files\Microsoft Office\Office\FINDFAST.EXE [1996-12-17 111376]
c:\documents and settings\All Users\Menu D'marrer\Programmes\D'marrage\
BlueSoleil.lnk - c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2006-7-16 626176]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
c:\documents and settings\Compaq_Propri'taire\Menu D'marrer\Programmes\D'marrage\
Microsoft Recherche acc'l'r'e.lnk - c:\program files\Microsoft Office\Office\FINDFAST.EXE [1996-12-17 111376]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\OrangeHSS\\Connectivity\\ConnectivityManager.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Logitech\\Logitech Vid\\Vid.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"17445:TCP"= 17445:TCP:NortonAV
"14721:TCP"= 14721:TCP:NortonAV
"16424:TCP"= 16424:TCP:NortonAV
"15059:TCP"= 15059:TCP:NortonAV
"12924:TCP"= 12924:TCP:NortonAV
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [24/03/2010 20:13 64288]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [06/05/2010 15:05 108289]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [05/02/2010 11:03 1291544]
S3 MEMSWEEP2;MEMSWEEP2;c:\windows\system32\5E.tmp [13/05/2010 22:40 6144]
--- Autres Services/Pilotes en mémoire ---
*Deregistered* - fbcgo
.
Contenu du dossier 'Tâches planifiées'
2010-05-14 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-02-05 17:16]
2010-05-14 c:\windows\Tasks\User_Feed_Synchronization-{CD104BC0-62F6-44E3-AC3C-66163B38852D}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 03:31]
.
.
------- Examen supplémentaire -------
.
uStart Page = www.google.fr/
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan8/oscan8.cab
DPF: {DFB5BCF1-06AE-4ABB-BFA8-1E228F41C50A} - hxxp://bobtv.fr/download/cfweb_www.bobtv.fr-download_instmodule.exe
FF - ProfilePath - c:\documents and settings\Compaq_Propriétaire\Application Data\Mozilla\Firefox\Profiles\vpr9uzcx.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.lemonde.fr/
FF - component: c:\documents and settings\Compaq_Propriétaire\Application Data\Mozilla\Firefox\Profiles\vpr9uzcx.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- PARAMETRES FIREFOX ----
FF - user.js: yahoo.homepage.dontask - true.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2010-05-14 15:27
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\5E.tmp"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\fbcgo]
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(792)
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'explorer.exe'(5280)
c:\windows\TEMP\logishrd\LVPrcInj01.dll
c:\program files\Windows Desktop Search\deskbar.dll
c:\program files\Windows Desktop Search\fr-fr\dbres.dll.mui
c:\program files\Windows Desktop Search\dbres.dll
c:\program files\Windows Desktop Search\wordwheel.dll
c:\program files\Windows Desktop Search\fr-fr\msnlExtRes.dll.mui
c:\program files\Windows Desktop Search\msnlExtRes.dll
c:\program files\OrangeHSS\Launcher\Inactivity.Dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\eappprxy.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\IVT Corporation\BlueSoleil\BTNtService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\progra~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\windows\system32\SearchIndexer.exe
c:\windows\ALCXMNTR.EXE
c:\windows\system32\rundll32.exe
c:\program files\Windows Media Player\WMPNetwk.exe
c:\program files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
c:\program files\OrangeHSS\Deskboard\deskboard.exe
c:\program files\OrangeHSS\connectivity\connectivitymanager.exe
c:\progra~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
c:\program files\OrangeHSS\connectivity\CoreCom\CoreCom.exe
c:\program files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe
c:\progra~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
c:\program files\Java\jre6\bin\jucheck.exe
c:\program files\Lavasoft\Ad-Aware\AAWTray.exe
.
**************************************************************************
.
Heure de fin: 2010-05-14 15:37:05 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-05-14 13:37
ComboFix2.txt 2010-05-13 18:17
ComboFix3.txt 2010-05-13 07:53
Avant-CF: 111 866 318 848 octets libres
Après-CF: 111 836 905 472 octets libres
- - End Of File - - 4D8A4DDAADAEC09DD9E0F76A42020841
Afficher la suite
