Help PC Infecté (WORM_RONTOKBRO)
Résolu18 réponses
-
Contributeur sécuritéSalut
Un peu court comme description de problème...
Quel programme te dit que tu es infecté? As-tu un rapport?
@++ :) -
J'ai un rapport HijackThis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:39:29, on 27/06/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Canal+\CANAL+ CANALSAT A LA DEMANDE\VOD\CanalPlus.VOD.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe
C:\Program Files\ASUS\AI Suite\AiGear3\CpuPowerMonitor.exe
C:\Program Files\ASUS\AI Suite\EnergySaving\PwSave.exe
C:\Program Files\ASUS\AASP\1.00.59\aaCenter.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\vsnp2uvc.exe
C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe
C:\Program Files\Canal+\CANAL+ CANALSAT A LA DEMANDE\CANAL+ CANALSAT A LA DEMANDE.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe -
2ème partie :
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orange.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: Shell=Explorer.exe "C:\WINDOWS\eksplorasi.exe"
O1 - Hosts: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
O1 - Hosts: <html lang='en'>
O1 - Hosts: <head>
O1 - Hosts: <meta name="description" content="Yahoo! GeoCities offers you a free web site and all the tools you need to build a dynamic site. Features include easy-to-use site building tools, online help, web site statistics, secure and reliable hosting, and an intuitive control panel.">
O1 - Hosts: <title>Yahoo! GeoCities: Get a web site with easy-to-use site building tools.</title>
O1 - Hosts: <link rel="stylesheet" type="text/css" media="all" href="http://l.yimg.com/...">
O1 - Hosts: <link rel="stylesheet" type="text/css" media="all" href="http://us.i1.yimg.com/us.yimg.com/lib/smbiz/css/geocities_84954.css">
O1 - Hosts: <style>
O1 - Hosts: h1 { line-height:30px;height:30px; padding-left:15px; font-weight:bold;font-size:1.6em;color:#1f296a;}
O1 - Hosts: .services li { margin-left:1.0em; padding-left:0.5em; background:url("http://l.yimg.com/a/lib/smbiz/i/geo_bullet_3x3_1.gif") no-repeat 0 0.5em; margin-bottom:0.5em;margin-left:1.5em;margin-right:0.5em;width:6em}
O1 - Hosts: .services li {float:left; width:17em; font-size:116%;margin-top:0.8em}
O1 - Hosts: .services { font-size:116%; padding-bottom:20px }
O1 - Hosts: .learnmore a {color:#2882DE;font-size:16px}
O1 - Hosts: .image_web {float:right; margin:15px 0 0 15px}
O1 - Hosts: p {margin:20px;font-size:1em;}
O1 - Hosts: h2 {margin:20px 0 0 20px;color:#1F296;font-weight:bold;font-size:1.25em;color:#1f296a;}
O1 - Hosts: h3 {margin:20px;color:#1F296;font-weight:bold;font-size:1.15em;color:#1f296a;}
O1 - Hosts: li.rule {border-top:solid 1px #DBE1E6;}
O1 - Hosts: </style>
O1 - Hosts: </head>
O1 - Hosts: <body>
O1 - Hosts: <!-- following code added by server. PLEASE REMOVE -->
O1 - Hosts: <!-- preceding code added by server. PLEASE REMOVE -->
O1 - Hosts: <div class="ez-mw" style ="height:900px;width:905px">
O1 - Hosts: <div class="ez-wri ez-oh" style="width:900px">
O1 - Hosts: <div class="ez-box">
O1 - Hosts: <link type="text/css" rel="stylesheet" href="http://l.yimg.com/a/lib/uh/15/css/uh-1.0.28.css">
O1 - Hosts: <style type="text/css">
O1 - Hosts: div#headerblock div{font-family:arial;}
O1 - Hosts: </style>
O1 - Hosts: <div id="ygma"><div id="ygmaheader"><div class="bd sp"><div id="ymenu" class="ygmaclr"><div id="mepanel"><ul id="mepanel-nav"><li class="me1"><em>New User? <a class="ygmasignup" title="Sign Up" href="http://us.ard.yahoo.com/...*http://edit.yahoo.com/...">Sign Up</a></em></li><li class="me2"><a title="Sign In" href="http://us.ard.yahoo.com/...*http://login.yahoo.com/...">Sign In</a></li>
O1 - Hosts: <li class="me3"><a href="http://us.ard.yahoo.com/...*http://help.yahoo.com/l/us/yahoo/geocities/" target="_top" title="Yahoo! Help Central">Help</a></li>
O1 - Hosts: </ul></div><div id="ygmapromo"><a style="font-weight:bold;" id="ygmaie8" href="http://us.ard.yahoo.com/...*http://toolbar.yahoo.com/?.cpdl=ushdl" target="_top">Get Yahoo! Toolbar<abbr title="Yahoo! Toolbar"></abbr></a>
O1 - Hosts: <script language=javascript>
O1 - Hosts: if(window.yzq_d==null)window.yzq_d=new Object();
O1 - Hosts: window.yzq_d['0Qw4Atj8a20-']='&U=13hn349r9%2fN%3d0Qw4Atj8a20-%2fC%3d650008.13445975.13532322.12832737%2fD%3dHPRM2%2fB%3d5706923%2fV%3d1';
O1 - Hosts: </script>
O1 - Hosts: <noscript><img width=1 height=1 alt="" src="http://us.bc.yahoo.com/..."></noscript></div>
O1 - Hosts: <div id="pa"><div id="pa-wrapper"><ul id="pa2-nav" class="sp"><li class="pa1 sp"><a class="sp" href="http://us.ard.yahoo.com/...*http://yahoo.com/" title="Yahoo!" target="_top">Yahoo!</a></li><li class="pa2 sp"><a class="sp" href="http://us.ard.yahoo.com/...*http://mail.yahoo.com" title="Yahoo! Mail" target="_top">Mail</a></li></ul><div id="pa-left" class="sp"></div><ul id="pa-nav" class="sp"><li class="pa3 sp"><a class="sp" href="http://us.ard.yahoo.com/...
O1 - Hosts: <script language=javascript>
O1 - Hosts: if(window.yzq_d==null)window.yzq_d=new Object();
O1 - Hosts: window.yzq_d['zgw4Atj8a20-']='&U=13gmetml2%2fN%3dzgw4Atj8a20-%2fC%3d650008.13654021.13693393.13153902%2fD%3dHEAD%2fB%3d5836006%2fV%3d1';
O1 - Hosts: </script>
O1 - Hosts: </div>
O1 - Hosts: </div>
O1 - Hosts: <div class="ez-wr" style="width:898px;margin-top:1.5em">
O1 - Hosts: <Div class="ez-l2a" id="wrapper">
O1 - Hosts: <div class="ez-l2a-1 " style="width:898px">
O1 - Hosts: <div class="ez-box">
O1 - Hosts: <div class="ez-wr" >
O1 - Hosts: <div class="ez-box" style="width:898px">
O1 - Hosts: <h1>Sorry, the GeoCities web site you were trying to reach is no longer available.</h1>
O1 - Hosts: </div>
O1 - Hosts: </div>
O1 - Hosts: <div class="ez-wr">
O1 - Hosts: <div class="ez-box" id="boxyahoourls">
O1 - Hosts: <p> GeoCities has closed, but there's a lot more to explore on Yahoo!</p>
O1 - Hosts: <h2>Visit one of these popular Yahoo! sites:</h2>
O1 - Hosts: <ul class= "services">
O1 - Hosts: <li><a href="http://mail.yahoo.com">Yahoo! Mail</a></li>
O1 - Hosts: <li><a href="http://smallbusiness.yahoo.com/webhosting">Web Hosting</a></li>
O1 - Hosts: <li><a href="http://news.yahoo.com">News</a></li>
O1 - Hosts: <li><a href="http://games.yahoo.com">Games</a></li>
O1 - Hosts: <li><a href="http://sports.yahoo.com/">Sports</a> </li>
O1 - Hosts: <li><a href="http://movies.yahoo.com">Movies</a></li>
O1 - Hosts: <li><a href="http://finance.yahoo.com">Finance</a></li>
O1 - Hosts: <li><a href="http://maps.yahoo.com">Maps</a></li>
O1 - Hosts: </ul>
O1 - Hosts: </div>
O1 - Hosts: <li class="rule"><!----></li>
O1 - Hosts: <p>The GeoCities site you were looking for may have been preserved in the Internet Archive's Wayback Machine. To find out, <a href="http://www.archive.org/web/web.php" target="_blank">visit Archive.org</a> and enter the site's web address in the field provided.</p>
O1 - Hosts: <li class="rule"><!----></li>
O1 - Hosts: </div>
O1 - Hosts: </div>
O1 - Hosts: </div>
O1 - Hosts: </div>
O1 - Hosts: <div class="ez-wr">
O1 - Hosts: <div class="ez-box" style="text-align:center; margin-top:25px;">
O1 - Hosts: <font size="-2" face="verdana">Copyright © 2009 <a href="http://yahoo.com/">Yahoo!</a> Inc. All rights reserved.
O1 - Hosts: <ul>
O1 - Hosts: <li style="display:inline;"><a target="_top" href="http://privacy.yahoo.com/privacy/us/geo/">Privacy Policy</a></li> -
O1 - Hosts: <li style="display:inline;"><a target="_top" href="http://docs.yahoo.com/info/copyright/copyright.html">Copyright Policy</a></li> -
O1 - Hosts: <li style="display:inline;"><a target="_top" href="http://docs.yahoo.com/info/guidelines/community.html">Guidelines</a
O1 - Hosts: ></li> -
O1 - Hosts: <li style="display:inline;"><a target="_top" href="http://smallbusiness.yahoo.com/tos/tos.php">Terms of Service
O1 - Hosts: </a></li> -
O1 - Hosts: <li style="display:inline;"><a target="_top" href="http://help.yahoo.com/help/us/geo/">Help</a></li>
O1 - Hosts: </ul>
O1 - Hosts: </font>
O1 - Hosts: </div>
O1 - Hosts: </div>
O1 - Hosts: </div>
O1 - Hosts: </body>
O1 - Hosts: </html>
O1 - Hosts: <!-- text below generated by server. PLEASE REMOVE --></object></layer></div></span></style></noscript></table></script></applet>
O1 - Hosts: <IMG SRC="http://geo.yahoo.com/serv?s=19190039&t=1277668447&f=us-w3" ALT=1 WIDTH=1 HEIGHT=1> -
3ème partie :
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Ai Nap] "C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe"
O4 - HKLM\..\Run: [CPU Power Monitor] "C:\Program Files\ASUS\AI Suite\AiGear3\CpuPowerMonitor.exe"
O4 - HKLM\..\Run: [Cpu Level Up help] C:\Program Files\ASUS\AI Suite\CpuLevelUpHelp.exe
O4 - HKLM\..\Run: [ASUS Energy Saving] "C:\Program Files\ASUS\AI Suite\EnergySaving\PwSave.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [snp2uvc] C:\WINDOWS\vsnp2uvc.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [CANAL+ CANALSAT A LA DEMANDE] "C:\Program Files\Canal+\CANAL+ CANALSAT A LA DEMANDE\Launcher.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Bron-Spizaetus] "C:\WINDOWS\ShellNew\bronstab.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [CUCore Agent] "C:\Documents and Settings\Arnovero\Local Settings\Application Data\Radvision\Conference Client\7.11.3.317\ConfAgent.exe" /minimize
O4 - HKCU\..\Run: [Tok-Cirrhatus] "C:\Documents and Settings\Arnovero\Local Settings\Application Data\smss.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: ajouter cette page à vos favoris Orange - C:\Documents and Settings\Arnovero\Application Data\Orange\MessengerByOrange\addfavorites.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: envoyer le texte sélectionné par sms - C:\Documents and Settings\Arnovero\Application Data\Orange\MessengerByOrange\sendsmsselectedtext.html
O8 - Extra context menu item: envoyer par sms - C:\Documents and Settings\Arnovero\Application Data\Orange\MessengerByOrange\sendsms.html
O8 - Extra context menu item: envoyer un mail - C:\Documents and Settings\Arnovero\Application Data\Orange\MessengerByOrange\sendmail.html
O8 - Extra context menu item: orange.fr - C:\Documents and Settings\Arnovero\Application Data\Orange\MessengerByOrange\orange.html
O8 - Extra context menu item: rechercher le texte sélectionné - C:\Documents and Settings\Arnovero\Application Data\Orange\MessengerByOrange\selectedsearch.html
O8 - Extra context menu item: traduire la page - C:\Documents and Settings\Arnovero\Application Data\Orange\MessengerByOrange\translate.html
O8 - Extra context menu item: traduire le texte sélectionné - C:\Documents and Settings\Arnovero\Application Data\Orange\MessengerByOrange\translateSelectedText.html
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.canalplay.com
O15 - Trusted Zone: *.canalplusactive.com
O15 - Trusted Zone: *.canalplay.com (HKLM)
O15 - Trusted Zone: *.canalplusactive.com (HKLM)
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://mis06.ipsen.com/iNotes6W.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/MessengerGamesContent/GameContent/fr/uno1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft - C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: CanalPlus.VOD - Canal+ Active - C:\Program Files\Canal+\CANAL+ CANALSAT A LA DEMANDE\VOD\CanalPlus.VOD.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Orange Contrôle Parental (OPTENET_FILTER) - Unknown owner - C:\Program Files\Controle Parental\bin\optproxy.exe (file missing)
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Service CANALPLAY - Canal+ Distribution - C:\Program Files\Lecteur CANALPLAY\CanalPlayService.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Check Point SecuRemote Service (SR_Service) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
O23 - Service: Check Point SecuRemote WatchDog (SR_WatchDog) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
-
Contributeur sécuritéSalut tipain62
Télécharge combofix.exe (de sUBs) sur le bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://www.geekstogo.com/forum/files/file/197-combofix-by-subs/
Important Désactive ton Antivirus, antispyware et Pare feu avant le scan avec Combofix :
https://forum.pcastuces.com/default.asp
https://www.bleepingcomputer.com/forums/t/114351/how-to-temporarily-disable-your-anti-virus-firewall-and-anti-malware-programs/
==> Sauvegarde ton travail et ferme toutes les fenêtres actives, il peut y avoir un redémarrage du PC. Ne lance aucun programme tant que Combofix n'est pas fini. <==
Double clique sur combofix.exe, clique sur OUI et valide par Entrée
Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.
NOTE : Le rapport se trouve également ici : C:\Combofix.txt
Combofix est détecté par certains antivirus comme une infection, ne pas en tenir compte, il s'agit d'un faux positif, continue la procédure
@++ :) -
Rapport Combofix :
ComboFix 10-06-27.03 - Arnovero 27/06/2010 23:44:14.1.4 - x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.3327.2405 [GMT 2:00]
Lancé depuis: c:\documents and settings\Arnovero\Bureau\ComboFix.exe
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Arnovero\Local Settings\Application Data\Bron.tok-10-27
c:\documents and settings\Arnovero\Local Settings\Application Data\Bron.tok.A10.em.bin
c:\documents and settings\Arnovero\Local Settings\Application Data\Kosong.Bron.Tok.txt
c:\documents and settings\Arnovero\Local Settings\Application Data\ListHost10.txt
c:\documents and settings\Arnovero\Local Settings\Application Data\lsass.exe
c:\documents and settings\Arnovero\Local Settings\Application Data\services.exe
c:\documents and settings\Arnovero\Local Settings\Application Data\Update.10.Bron.Tok.bin
c:\documents and settings\Arnovero\Local Settings\Application Data\winlogon.exe
.
((((((((((((((((((((((((((((( Fichiers créés du 2010-05-27 au 2010-06-27 ))))))))))))))))))))))))))))))))))))
.
2010-06-27 20:39 . 2010-06-27 20:39 -------- d-----w- c:\program files\Trend Micro
2010-06-27 20:16 . 2010-06-27 20:16 -------- d-sh--w- c:\documents and settings\LocalService\PrivacIE
2010-06-27 20:16 . 2010-06-27 20:16 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-06-27 20:16 . 2010-06-27 20:16 -------- d-----r- c:\documents and settings\LocalService\Favoris
2010-06-27 20:16 . 2010-06-27 20:16 -------- d--h--w- c:\windows\PIF
2010-06-27 20:12 . 2005-09-16 22:20 87768 ----a-w- c:\windows\system32\S32EVNT1.DLL
2010-06-27 20:12 . 2005-09-16 22:20 108168 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2010-06-27 20:12 . 2010-06-27 20:27 -------- d-----w- c:\program files\Symantec
2010-06-27 20:12 . 2010-06-27 20:20 -------- d-----w- c:\program files\Fichiers communs\Symantec Shared
2010-06-27 20:03 . 2010-06-27 20:15 -------- d-----w- c:\documents and settings\Arnovero\Local Settings\Application Data\Loc.Mail.Bron.Tok
2010-06-27 20:03 . 2010-06-27 20:03 -------- d-----w- c:\documents and settings\Arnovero\Local Settings\Application Data\Ok-SendMail-Bron-tok
2010-06-19 07:13 . 2010-06-19 07:13 -------- d-----w- c:\documents and settings\Arnovero\Application Data\Skypad
2010-06-19 07:13 . 2007-09-25 17:12 2453504 ---ha-w- c:\documents and settings\Arnovero\Application Data\Skypad\tmp\SkypadMain.exe
2010-06-19 07:13 . 2007-09-25 17:12 2453504 ---ha-w- c:\documents and settings\Arnovero\Application Data\Skypad\SkypadMain.exe
2010-06-19 07:13 . 2007-05-16 21:13 143360 ---ha-w- c:\documents and settings\Arnovero\Application Data\Skypad\tmp\TaskKeyHook.dll
2010-06-19 07:13 . 2007-05-16 21:13 143360 ------w- c:\documents and settings\Arnovero\Application Data\Skypad\TaskKeyHook.dll
2010-06-19 07:13 . 2005-05-31 16:13 249856 ---ha-w- c:\documents and settings\Arnovero\Application Data\Skypad\tmp\IMailDll.dll
2010-06-19 07:13 . 2005-05-31 16:13 249856 ------w- c:\documents and settings\Arnovero\Application Data\Skypad\IMailDll.dll
2010-06-19 07:13 . 2002-08-19 11:19 397856 ---ha-w- c:\documents and settings\Arnovero\Application Data\Skypad\XceedZip.dll
2010-06-19 07:13 . 2002-08-19 11:19 397856 ---ha-w- c:\documents and settings\Arnovero\Application Data\Skypad\tmp\XceedZip.dll
2010-06-09 16:29 . 2010-06-09 16:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Danware Data
2010-06-09 16:09 . 2010-05-06 10:33 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2010-06-09 15:10 . 2010-06-09 15:10 -------- d-----w- c:\documents and settings\Arnovero\Local Settings\Application Data\Conference Client
2010-06-09 15:09 . 2010-06-09 15:10 -------- d-----w- c:\documents and settings\Arnovero\Local Settings\Application Data\Radvision
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-27 21:41 . 2008-10-21 13:46 -------- d-----w- c:\program files\Symantec AntiVirus
2010-06-27 20:12 . 2008-10-21 13:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec
2010-06-27 20:09 . 2010-03-24 20:49 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-06-27 20:01 . 2010-03-24 20:49 2568656 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player.exe
2010-06-26 17:07 . 2004-08-05 12:00 77998 ----a-w- c:\windows\system32\perfc00C.dat
2010-06-26 17:07 . 2004-08-05 12:00 494382 ----a-w- c:\windows\system32\perfh00C.dat
2010-06-23 16:28 . 2008-10-22 18:39 -------- d-----w- c:\documents and settings\Arnovero\Application Data\Canon
2010-06-16 12:16 . 2009-05-30 16:26 21840 ----atw- c:\windows\system32\SIntfNT.dll
2010-06-16 12:16 . 2009-05-30 16:26 17212 ----atw- c:\windows\system32\SIntf32.dll
2010-06-16 12:16 . 2009-05-30 16:26 12067 ----atw- c:\windows\system32\SIntf16.dll
2010-06-05 11:49 . 2010-05-24 10:19 -------- d-----w- c:\program files\Microsoft Silverlight
2010-05-30 16:16 . 2009-11-08 15:11 -------- d-----w- c:\program files\Messenger Plus! Live
2010-05-23 15:50 . 2010-05-27 17:23 73216 ----a-w- c:\documents and settings\Arnovero\Application Data\Mozilla\Firefox\Profiles\mdfxs4ib.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc_fireftp.dll
2010-05-16 06:47 . 2010-05-16 06:47 -------- d-----w- c:\program files\Fichiers communs\Java
2010-05-16 06:47 . 2010-05-16 06:47 503808 ----a-w- c:\documents and settings\Arnovero\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-66decc0d-n\msvcp71.dll
2010-04-03 11:20 . 2010-04-03 11:20 1025992 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\SecurityScan_Release.exe
2010-03-30 22:16 . 2010-03-30 22:16 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2010-03-30 22:10 . 2010-03-30 22:10 295264 ----a-w- c:\windows\system32\PresentationHost.exe
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OSDOverLayIcon]
@="{8129812F-4AF8-4A47-85A5-D995B505880C}"
[HKEY_CLASSES_ROOT\CLSID\{8129812F-4AF8-4A47-85A5-D995B505880C}]
2009-04-16 14:32 53248 ----a-w- c:\program files\mes données\OSDExtension.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-12-20 16860672]
"Ai Nap"="c:\program files\ASUS\AI Suite\AiNap\AiNap.exe" [2007-12-10 1412608]
"CPU Power Monitor"="c:\program files\ASUS\AI Suite\AiGear3\CpuPowerMonitor.exe" [2008-01-09 627200]
"Cpu Level Up help"="c:\program files\ASUS\AI Suite\CpuLevelUpHelp.exe" [2007-11-30 881152]
"ASUS Energy Saving"="c:\program files\ASUS\AI Suite\EnergySaving\PwSave.exe" [2008-01-24 1352192]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-03-11 13520896]
"nwiz"="nwiz.exe" [2008-03-11 1626112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-03-11 86016]
"PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2003-12-04 406016]
"snp2uvc"="c:\windows\vsnp2uvc.exe" [2007-03-12 569344]
"SunJavaUpdateSched"="c:\program files\Fichiers communs\Java\Java Update\jusched.exe" [2010-02-18 248040]
"CANAL+ CANALSAT A LA DEMANDE"="c:\program files\Canal+\CANAL+ CANALSAT A LA DEMANDE\Launcher.exe" [2010-01-12 163928]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-17 421888]
"ccApp"="c:\program files\Fichiers communs\Symantec Shared\ccApp.exe" [2005-12-21 48800]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2006-05-27 85744]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ckpNotify]
2006-04-09 18:59 24674 ----a-w- c:\windows\system32\ckpNotify.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-06-12 00:38 34672 ----a-w- c:\program files\Adobe\Reader\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcSoft Connection Service]
2007-10-11 06:45 31232 ----a-w- c:\program files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Easy-PrintToolBox]
2004-01-14 01:10 409600 ----a-w- c:\program files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2009-07-26 15:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-03-17 19:53 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_SERVICE.EXE"=
"c:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_GUI.EXE"=
"c:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SCC.EXE"=
"c:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_SDS.EXE"=
"c:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_DIAGNOSTICS.EXE"=
"c:\\Program Files\\Hercules\\DualPix Exchange\\Station2.exe"=
"c:\\WINDOWS\\system32\\ftp.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\helpctr.exe"=
"c:\\WINDOWS\\system32\\rtcshare.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"d:\\Softwares\\NETOP\\Teacher\\ntchw32.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundTimestampRequest"= 1 (0x1)
"AllowInboundMaskRequest"= 1 (0x1)
"AllowInboundRouterRequest"= 1 (0x1)
"AllowOutboundDestinationUnreachable"= 1 (0x1)
"AllowOutboundTimeExceeded"= 1 (0x1)
R1 CbFs;CbFs;c:\windows\system32\drivers\cbfs32.sys [01/06/2009 23:48 137384]
R2 CanalPlus.VOD;CanalPlus.VOD;c:\program files\Canal+\CANAL+ CANALSAT A LA DEMANDE\VOD\CanalPlus.VOD.exe [28/04/2009 17:33 188416]
R2 CP_OMDRV;Check Point Office Mode Module;c:\windows\system32\drivers\omdrv.sys [21/10/2008 16:18 36400]
R2 VNASC;Check Point Virtual Network Adapter - SecureClient;c:\windows\system32\drivers\vnasc.sys [21/10/2008 16:19 109072]
R2 VPN-1;VPN-1 Module;c:\windows\system32\drivers\vpn.sys [21/10/2008 16:18 671472]
R3 BENDER;Pinnacle DV/AV Capture;c:\windows\system32\drivers\bender.sys [21/10/2008 19:45 180480]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Fichiers communs\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [27/06/2010 22:15 102448]
R3 FW1;SecuRemote Miniport;c:\windows\system32\drivers\fw.sys [21/10/2008 16:19 2234320]
S3 camfilt2;camfilt2;c:\windows\system32\drivers\camfilt2.sys [21/10/2008 20:43 94208]
S3 OPTENET_FILTER;Orange Contrôle Parental;c:\program files\Controle Parental\bin\optproxy.exe --> c:\program files\Controle Parental\bin\optproxy.exe [?]
S3 RTL8187B;NETGEAR WG111v3 Wireless-G USB Adapter Vista Driver;c:\windows\system32\drivers\wg111v3.sys [31/07/2009 08:12 341504]
S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [27/05/2006 05:51 169200]
S3 Service CANALPLAY;Service CANALPLAY;c:\program files\Lecteur CANALPLAY\CanalPlayService.exe [27/12/2008 19:15 436096]
S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\drivers\VBoxNetAdp.sys [12/02/2010 21:34 99152]
S3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys --> c:\windows\system32\DRIVERS\VBoxNetFlt.sys [?]
.
Contenu du dossier 'Tâches planifiées'
2010-06-18 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
2010-06-27 c:\windows\Tasks\User_Feed_Synchronization-{05C5DBA7-4CB1-4553-8689-A72CE15A2233}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.orange.fr/
uInternet Connection Wizard,ShellNext = iexplore
IE: ajouter cette page à vos favoris Orange - c:\documents and settings\Arnovero\Application Data\Orange\MessengerByOrange\addfavorites.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Easy-WebPrint Ajouter à la liste d'impressions - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint Impression rapide - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Imprimer - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: Easy-WebPrint Prévisualiser - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: envoyer le texte sélectionné par sms - c:\documents and settings\Arnovero\Application Data\Orange\MessengerByOrange\sendsmsselectedtext.html
IE: envoyer par sms - c:\documents and settings\Arnovero\Application Data\Orange\MessengerByOrange\sendsms.html
IE: envoyer un mail - c:\documents and settings\Arnovero\Application Data\Orange\MessengerByOrange\sendmail.html
IE: orange.fr - c:\documents and settings\Arnovero\Application Data\Orange\MessengerByOrange\orange.html
IE: rechercher le texte sélectionné - c:\documents and settings\Arnovero\Application Data\Orange\MessengerByOrange\selectedsearch.html
IE: traduire la page - c:\documents and settings\Arnovero\Application Data\Orange\MessengerByOrange\translate.html
IE: traduire le texte sélectionné - c:\documents and settings\Arnovero\Application Data\Orange\MessengerByOrange\translateSelectedText.html
Trusted Zone: canalplay.com
Trusted Zone: canalplusactive.com
Trusted Zone: canalplay.com
Trusted Zone: canalplusactive.com
FF - ProfilePath - c:\documents and settings\Arnovero\Application Data\Mozilla\Firefox\Profiles\mdfxs4ib.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr
FF - prefs.js: keyword.URL - hxxp://rws.search.ke.voila.fr/RW/S/opensearch_orange?rdata=
FF - component: c:\documents and settings\Arnovero\Application Data\Mozilla\Firefox\Profiles\mdfxs4ib.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc_fireftp.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\Adobe\Reader\Reader\browser\nppdf32.dll
FF - plugin: c:\program files\Canal+\CANAL+ CANALSAT A LA DEMANDE\VOD\npCpVod.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - ORPHELINS SUPPRIMES - - - -
HKCU-Run-CUCore Agent - c:\documents and settings\Arnovero\Local Settings\Application Data\Radvision\Conference Client\7.11.3.317\ConfAgent.exe
HKLM-Run-EoEngine - (no file)
MSConfigStartUp-ASUS SmartDoctor - c:\program files\ASUS\SmartDoctor\SmartDoctor.exe
MSConfigStartUp-Omnipage - c:\program files\ScanSoft\OmniPageSE\opware32.exe
MSConfigStartUp-SoftwareHelper - c:\documents and settings\Arnovero\Application Data\eoRezo\SoftwareUpdate\SoftwareUpdateHP.exe
AddRemove-Macromedia Shockwave Player - c:\windows\system32\Macromed\SHOCKW~1\UNWISE.EXE
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-27 23:46
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
Heure de fin: 2010-06-27 23:47:45
ComboFix-quarantined-files.txt 2010-06-27 21:47
Avant-CF: 51 517 112 320 octets libres
Après-CF: 51 972 902 912 octets libres
WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect
- - End Of File - - 3653F7D908FC39F3B0DACDC05E085E5A -
Contributeur sécuritéSalut tipain62
- Clique sur le menu démarrer/Exécuter, tape notepad à l'invite de commande et OK.
- Copie/colle ce qui est en gras ci-dessous dans le Bloc-Notes :
KillAll::
Folder::
c:\documents and settings\Arnovero\Local Settings\Application Data\Loc.Mail.Bron.Tok
c:\documents and settings\Arnovero\Local Settings\Application Data\Ok-SendMail-Bron-tok
- Enregistre ce fichier sur le bureau (Impératif)
-Nom du fichier : CFScript.txt
-Type du fichier : tous les fichiers
- Clique sur Enregistrer et quitte le Bloc Notes
Important Désactive ton Antivirus et antispyware avant de faire le glisser/déposer
- Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe sur le bureau, comme sur cette capture (l'icône est un lion) :
http://free0.hiboox.com/images/2409/9126d3b136f7db9ab6242ad715b44296.gif
* Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
* Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
* Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt
@++ :) -
Bonjour,
Rapport Part 1
ComboFix 10-06-27.03 - Arnovero 28/06/2010 7:38.2.4 - x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.3327.2648 [GMT 2:00]
Lancé depuis: c:\documents and settings\Arnovero\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\Arnovero\Bureau\CFScript.txt
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Arnovero\Local Settings\Application Data\Loc.Mail.Bron.Tok
c:\documents and settings\Arnovero\Local Settings\Application Data\Loc.Mail.Bron.Tok\xxxxxxxxx@hotmail.fr.ini
c:\documents and settings\Arnovero\Local Settings\Application Data\Loc.Mail.Bron.Tok\xxxxx@hotmail.fr.ini
c:\documents and settings\Arnovero\Local Settings\Application Data\Loc.Mail.Bron.Tok\xxxxxxx@hotmail.fr.ini
c:\documents and settings\Arnovero\Local Settings\Application Data\Loc.Mail.Bron.Tok\xxxxxxxxx@orange.fr.ini
c:\documents and settings\Arnovero\Local Settings\Application Data\Loc.Mail.Bron.Tok\xxxxxx@live.fr.ini
c:\documents and settings\Arnovero\Local Settings\Application Data\Loc.Mail.Bron.Tok\xxxxxxxxx@orange.fr.ini
c:\documents and settings\Arnovero\Local Settings\Application Data\Loc.Mail.Bron.Tok\xxxxxxx@live.fr.ini
c:\documents and settings\Arnovero\Local Settings\Application Data\Loc.Mail.Bron.Tok\jxxxxxxxxxxxx@live.fr.ini
c:\documents and settings\Arnovero\Local Settings\Application Data\Loc.Mail.Bron.Tok\xxxxxxxx@hotmail.fr.ini
c:\documents and settings\Arnovero\Local Settings\Application Data\Loc.Mail.Bron.Tok\xxxxxxxxxx@hotmail.fr.ini
c:\documents and settings\Arnovero\Local Settings\Application Data\Loc.Mail.Bron.Tok\xxxxxx@live.fr.ini
c:\documents and settings\Arnovero\Local Settings\Application Data\Loc.Mail.Bron.Tok\xxxxxx@hotmail.fr.ini
c:\documents and settings\Arnovero\Local Settings\Application Data\Loc.Mail.Bron.Tok\xxxxxxxxx@hotmail.fr.ini
c:\documents and settings\Arnovero\Local Settings\Application Data\Loc.Mail.Bron.Tok\xxxxxxxxxxx@hotmail.fr.ini
c:\documents and settings\Arnovero\Local Settings\Application Data\Loc.Mail.Bron.Tok\xxxxxxxxxxx@hotmail.fr.ini
c:\documents and settings\Arnovero\Local Settings\Application Data\Loc.Mail.Bron.Tok\xxxxxxxxxx@hotmail.fr.ini
c:\documents and settings\Arnovero\Local Settings\Application Data\Loc.Mail.Bron.Tok\xxxxxxxxx@hotmail.fr.ini
c:\documents and settings\Arnovero\Local Settings\Application Data\Loc.Mail.Bron.Tok\xxxxxxxxxxx@hotmail.fr.ini
c:\documents and settings\Arnovero\Local Settings\Application Data\Loc.Mail.Bron.Tok\xxxxxxxxxxxx8@hotmail.fr.ini
c:\documents and settings\Arnovero\Local Settings\Application Data\Loc.Mail.Bron.Tok\xxxxxxxxxxxxxxxxx@hotmail.fr.ini
c:\documents and settings\Arnovero\Local Settings\Application Data\Ok-SendMail-Bron-tok
.
((((((((((((((((((((((((((((( Fichiers créés du 2010-05-28 au 2010-06-28 ))))))))))))))))))))))))))))))))))))
.
2010-06-27 20:39 . 2010-06-27 20:39 -------- d-----w- c:\program files\Trend Micro
2010-06-27 20:16 . 2010-06-27 20:16 -------- d-sh--w- c:\documents and settings\LocalService\PrivacIE
2010-06-27 20:16 . 2010-06-27 20:16 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-06-27 20:16 . 2010-06-27 20:16 -------- d-----r- c:\documents and settings\LocalService\Favoris
2010-06-27 20:16 . 2010-06-27 20:16 -------- d--h--w- c:\windows\PIF
2010-06-27 20:12 . 2005-09-16 22:20 87768 ----a-w- c:\windows\system32\S32EVNT1.DLL
2010-06-27 20:12 . 2005-09-16 22:20 108168 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2010-06-27 20:12 . 2010-06-27 20:27 -------- d-----w- c:\program files\Symantec
2010-06-27 20:12 . 2010-06-27 20:20 -------- d-----w- c:\program files\Fichiers communs\Symantec Shared
2010-06-19 07:13 . 2010-06-19 07:13 -------- d-----w- c:\documents and settings\Arnovero\Application Data\Skypad
2010-06-19 07:13 . 2007-09-25 17:12 2453504 ---ha-w- c:\documents and settings\Arnovero\Application Data\Skypad\tmp\SkypadMain.exe
2010-06-19 07:13 . 2007-09-25 17:12 2453504 ---ha-w- c:\documents and settings\Arnovero\Application Data\Skypad\SkypadMain.exe
2010-06-19 07:13 . 2007-05-16 21:13 143360 ---ha-w- c:\documents and settings\Arnovero\Application Data\Skypad\tmp\TaskKeyHook.dll
2010-06-19 07:13 . 2007-05-16 21:13 143360 ------w- c:\documents and settings\Arnovero\Application Data\Skypad\TaskKeyHook.dll
2010-06-19 07:13 . 2005-05-31 16:13 249856 ---ha-w- c:\documents and settings\Arnovero\Application Data\Skypad\tmp\IMailDll.dll
2010-06-19 07:13 . 2005-05-31 16:13 249856 ------w- c:\documents and settings\Arnovero\Application Data\Skypad\IMailDll.dll
2010-06-19 07:13 . 2002-08-19 11:19 397856 ---ha-w- c:\documents and settings\Arnovero\Application Data\Skypad\XceedZip.dll
2010-06-19 07:13 . 2002-08-19 11:19 397856 ---ha-w- c:\documents and settings\Arnovero\Application Data\Skypad\tmp\XceedZip.dll
2010-06-09 16:29 . 2010-06-09 16:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Danware Data
2010-06-09 16:09 . 2010-05-06 10:33 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2010-06-09 15:10 . 2010-06-09 15:10 -------- d-----w- c:\documents and settings\Arnovero\Local Settings\Application Data\Conference Client
2010-06-09 15:09 . 2010-06-09 15:10 -------- d-----w- c:\documents and settings\Arnovero\Local Settings\Application Data\Radvision
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-28 05:42 . 2008-10-21 13:46 -------- d-----w- c:\program files\Symantec AntiVirus
2010-06-28 05:36 . 2008-10-26 09:42 -------- d-----w- c:\documents and settings\Arnovero\Application Data\Skype
2010-06-28 05:34 . 2008-10-26 09:44 -------- d-----w- c:\documents and settings\Arnovero\Application Data\skypePM
2010-06-27 20:12 . 2008-10-21 13:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec
2010-06-27 20:09 . 2010-03-24 20:49 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-06-27 20:01 . 2010-03-24 20:49 2568656 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player.exe
2010-06-26 17:07 . 2004-08-05 12:00 77998 ----a-w- c:\windows\system32\perfc00C.dat
2010-06-26 17:07 . 2004-08-05 12:00 494382 ----a-w- c:\windows\system32\perfh00C.dat
2010-06-23 16:28 . 2008-10-22 18:39 -------- d-----w- c:\documents and settings\Arnovero\Application Data\Canon
2010-06-16 12:16 . 2009-05-30 16:26 21840 ----atw- c:\windows\system32\SIntfNT.dll
2010-06-16 12:16 . 2009-05-30 16:26 17212 ----atw- c:\windows\system32\SIntf32.dll
2010-06-16 12:16 . 2009-05-30 16:26 12067 ----atw- c:\windows\system32\SIntf16.dll
2010-06-05 11:49 . 2010-05-24 10:19 -------- d-----w- c:\program files\Microsoft Silverlight
2010-05-30 16:16 . 2009-11-08 15:11 -------- d-----w- c:\program files\Messenger Plus! Live
2010-05-23 15:50 . 2010-05-27 17:23 73216 ----a-w- c:\documents and settings\Arnovero\Application Data\Mozilla\Firefox\Profiles\mdfxs4ib.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc_fireftp.dll
2010-05-16 06:47 . 2010-05-16 06:47 -------- d-----w- c:\program files\Fichiers communs\Java
2010-05-16 06:47 . 2010-05-16 06:47 503808 ----a-w- c:\documents and settings\Arnovero\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-66decc0d-n\msvcp71.dll
2010-04-03 11:20 . 2010-04-03 11:20 1025992 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\SecurityScan_Release.exe
2010-03-30 22:16 . 2010-03-30 22:16 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2010-03-30 22:10 . 2010-03-30 22:10 295264 ----a-w- c:\windows\system32\PresentationHost.exe
.
((((((((((((((((((((((((((((( SnapShot@2010-06-27_21.46.58 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-06-28 05:42 . 2010-06-28 05:42 16384 c:\windows\temp\Perflib_Perfdata_134.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OSDOverLayIcon]
@="{8129812F-4AF8-4A47-85A5-D995B505880C}"
[HKEY_CLASSES_ROOT\CLSID\{8129812F-4AF8-4A47-85A5-D995B505880C}]
2009-04-16 14:32 53248 ----a-w- c:\program files\mes données\OSDExtension.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-12-20 16860672]
"Ai Nap"="c:\program files\ASUS\AI Suite\AiNap\AiNap.exe" [2007-12-10 1412608]
"CPU Power Monitor"="c:\program files\ASUS\AI Suite\AiGear3\CpuPowerMonitor.exe" [2008-01-09 627200]
"Cpu Level Up help"="c:\program files\ASUS\AI Suite\CpuLevelUpHelp.exe" [2007-11-30 881152]
"ASUS Energy Saving"="c:\program files\ASUS\AI Suite\EnergySaving\PwSave.exe" [2008-01-24 1352192]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-03-11 13520896]
"nwiz"="nwiz.exe" [2008-03-11 1626112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-03-11 86016]
"PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2003-12-04 406016]
"snp2uvc"="c:\windows\vsnp2uvc.exe" [2007-03-12 569344]
"SunJavaUpdateSched"="c:\program files\Fichiers communs\Java\Java Update\jusched.exe" [2010-02-18 248040]
"CANAL+ CANALSAT A LA DEMANDE"="c:\program files\Canal+\CANAL+ CANALSAT A LA DEMANDE\Launcher.exe" [2010-01-12 163928]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-17 421888]
"ccApp"="c:\program files\Fichiers communs\Symantec Shared\ccApp.exe" [2005-12-21 48800]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2006-05-27 85744]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ckpNotify]
2006-04-09 18:59 24674 ----a-w- c:\windows\system32\ckpNotify.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-06-12 00:38 34672 ----a-w- c:\program files\Adobe\Reader\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcSoft Connection Service]
2007-10-11 06:45 31232 ----a-w- c:\program files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Easy-PrintToolBox]
2004-01-14 01:10 409600 ----a-w- c:\program files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2009-07-26 15:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-03-17 19:53 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_SERVICE.EXE"=
"c:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_GUI.EXE"=
"c:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SCC.EXE"=
"c:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_SDS.EXE"=
"c:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_DIAGNOSTICS.EXE"=
"c:\\Program Files\\Hercules\\DualPix Exchange\\Station2.exe"=
"c:\\WINDOWS\\system32\\ftp.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\helpctr.exe"=
"c:\\WINDOWS\\system32\\rtcshare.exe"=
"d:\\Softwares\\NETOP\\Teacher\\ntchw32.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"= -
Re-Bonjour,
Rapport Part 2
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundTimestampRequest"= 1 (0x1)
"AllowInboundMaskRequest"= 1 (0x1)
"AllowInboundRouterRequest"= 1 (0x1)
"AllowOutboundDestinationUnreachable"= 1 (0x1)
"AllowOutboundTimeExceeded"= 1 (0x1)
R1 CbFs;CbFs;c:\windows\system32\drivers\cbfs32.sys [01/06/2009 23:48 137384]
R2 CanalPlus.VOD;CanalPlus.VOD;c:\program files\Canal+\CANAL+ CANALSAT A LA DEMANDE\VOD\CanalPlus.VOD.exe [28/04/2009 17:33 188416]
R2 CP_OMDRV;Check Point Office Mode Module;c:\windows\system32\drivers\omdrv.sys [21/10/2008 16:18 36400]
R2 VNASC;Check Point Virtual Network Adapter - SecureClient;c:\windows\system32\drivers\vnasc.sys [21/10/2008 16:19 109072]
R2 VPN-1;VPN-1 Module;c:\windows\system32\drivers\vpn.sys [21/10/2008 16:18 671472]
R3 BENDER;Pinnacle DV/AV Capture;c:\windows\system32\drivers\bender.sys [21/10/2008 19:45 180480]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Fichiers communs\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [27/06/2010 22:15 102448]
R3 FW1;SecuRemote Miniport;c:\windows\system32\drivers\fw.sys [21/10/2008 16:19 2234320]
S3 camfilt2;camfilt2;c:\windows\system32\drivers\camfilt2.sys [21/10/2008 20:43 94208]
S3 OPTENET_FILTER;Orange Contrôle Parental;c:\program files\Controle Parental\bin\optproxy.exe --> c:\program files\Controle Parental\bin\optproxy.exe [?]
S3 RTL8187B;NETGEAR WG111v3 Wireless-G USB Adapter Vista Driver;c:\windows\system32\drivers\wg111v3.sys [31/07/2009 08:12 341504]
S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [27/05/2006 05:51 169200]
S3 Service CANALPLAY;Service CANALPLAY;c:\program files\Lecteur CANALPLAY\CanalPlayService.exe [27/12/2008 19:15 436096]
S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\drivers\VBoxNetAdp.sys [12/02/2010 21:34 99152]
S3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys --> c:\windows\system32\DRIVERS\VBoxNetFlt.sys [?]
.
Contenu du dossier 'Tâches planifiées'
2010-06-18 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
2010-06-28 c:\windows\Tasks\User_Feed_Synchronization-{05C5DBA7-4CB1-4553-8689-A72CE15A2233}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.orange.fr/
uInternet Connection Wizard,ShellNext = iexplore
IE: ajouter cette page à vos favoris Orange - c:\documents and settings\Arnovero\Application Data\Orange\MessengerByOrange\addfavorites.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Easy-WebPrint Ajouter à la liste d'impressions - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint Impression rapide - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Imprimer - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: Easy-WebPrint Prévisualiser - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: envoyer le texte sélectionné par sms - c:\documents and settings\Arnovero\Application Data\Orange\MessengerByOrange\sendsmsselectedtext.html
IE: envoyer par sms - c:\documents and settings\Arnovero\Application Data\Orange\MessengerByOrange\sendsms.html
IE: envoyer un mail - c:\documents and settings\Arnovero\Application Data\Orange\MessengerByOrange\sendmail.html
IE: orange.fr - c:\documents and settings\Arnovero\Application Data\Orange\MessengerByOrange\orange.html
IE: rechercher le texte sélectionné - c:\documents and settings\Arnovero\Application Data\Orange\MessengerByOrange\selectedsearch.html
IE: traduire la page - c:\documents and settings\Arnovero\Application Data\Orange\MessengerByOrange\translate.html
IE: traduire le texte sélectionné - c:\documents and settings\Arnovero\Application Data\Orange\MessengerByOrange\translateSelectedText.html
Trusted Zone: canalplay.com
Trusted Zone: canalplusactive.com
Trusted Zone: canalplay.com
Trusted Zone: canalplusactive.com
FF - ProfilePath - c:\documents and settings\Arnovero\Application Data\Mozilla\Firefox\Profiles\mdfxs4ib.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr
FF - prefs.js: keyword.URL - hxxp://rws.search.ke.voila.fr/RW/S/opensearch_orange?rdata=
FF - component: c:\documents and settings\Arnovero\Application Data\Mozilla\Firefox\Profiles\mdfxs4ib.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc_fireftp.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\Adobe\Reader\Reader\browser\nppdf32.dll
FF - plugin: c:\program files\Canal+\CANAL+ CANALSAT A LA DEMANDE\VOD\npCpVod.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-28 07:49
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'explorer.exe'(3128)
c:\program files\mes données\OSDExtension.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
c:\program files\Fichiers communs\Symantec Shared\ccSetMgr.exe
c:\program files\Fichiers communs\Symantec Shared\SNDSrvc.exe
c:\program files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files\Symantec AntiVirus\DefWatch.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Symantec AntiVirus\Rtvscan.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\RUNDLL32.EXE
c:\program files\ASUS\AASP\1.00.59\aaCenter.exe
.
**************************************************************************
.
Heure de fin: 2010-06-28 07:50:53 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-06-28 05:50
ComboFix2.txt 2010-06-27 21:47
Avant-CF: 52 045 590 528 octets libres
Après-CF: 52 041 441 280 octets libres
- - End Of File - - 564211EB6707B0661F45A5F8BCBCFD3E -
Contributeur sécuritéSalut tipain62
On va vérifier si rien de caché :
Faire un scan avec Nod32 en ligne (il faut utiliser Internet Explorer) ici :
https://www.eset.com/int/home/online-scanner/
(coche toutes les cases à chaque fois, sauf les deux dernières a la fin du scan, sinon le rapport est supprimer)
A la fin, colle le rapport : C:\Program Files\EsetOnlineScanner\log.txt
@++ :) -
Bonjour,
voici le rapport :
ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# IEXPLORE.EXE=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=a1f63bab2ef17d4ab1705bcccbbc7d23
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2010-06-29 06:32:20
# local_time=2010-06-29 08:32:20 (+0100, Paris, Madrid (heure d'été))
# country="France"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 118709 118709 0 0
# compatibility_mode=8192 67108863 100 0 132 132 0 0
# scanned=77627
# found=3
# cleaned=3
# scan_time=3272
C:\System Volume Information\_restore{A45D25A7-CCE0-4335-B428-61957698CE9A}\RP622\A0069073.scr Win32/Brontok.T worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
D:\Softwares\Acdsee\ACDSee.rar probably a variant of Win32/Agent trojan (deleted - quarantined) 00000000000000000000000000000000 C
D:\Softwares\Nero 9\unit_app_75\Toolbar.exe Win32/Toolbar.AskSBar application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C -
Contributeur sécuritéSalut tipain62
Cela est bon, as-tu d'autre souci?
@++ :) -
Bonsoir,
Tout semble ok maintenant. Merci bien pour ton aide. juste 2 petits points.
A chaque démarrage du PC j'ai un fichier RTHDCPL_Dump.txt qui est créé sur C:\
Le contenu est :
[01]OS Major Version:5, Minor Version:1, Build Number:2600, Platform Id:2
[01]wManualLangID = 24951
[01]LangFile_Manual = C:\DOCUME~1\Arnovero\LOCALS~1\Temp\English.bin
[03] wInitLang = 1036
[03] LangFile_Auto = C:\DOCUME~1\Arnovero\LOCALS~1\Temp\French.bin
[01]OS Major Version:5, Minor Version:1, Build Number:2600, Platform Id:2
[01]wManualLangID = 24951
[01]LangFile_Manual = C:\DOCUME~1\Arnovero\LOCALS~1\Temp\English.bin
[03] wInitLang = 1036
[03] LangFile_Auto = C:\DOCUME~1\Arnovero\LOCALS~1\Temp\French.bin
A chaque démarrage se recréent dans C:\Documents and Settings\Arnovero\Local Settings\temp, des fichiers *.bin (une trentaine) qui semblent correspondre à des langues.
As-tu une idée ? Est-ce grave ?
A+ -
Contributeur sécuritéSalut tipain62
Un problème avec la carte son realtek, voir a changer le pilote...
https://www.touslesdrivers.com/index.php?v_page=29
@++ :) -
Salut
Ok merci de ton aide
A+ -
Contributeur sécuritéSalut tipain62
Pour des raisons de sécurité et surtout pour garder ton PC propre, on va désactiver la restauration système sur tous les lecteurs :
- Clique droit sur le Poste de travail sur le bureau, dans propriété tu cliques sur l'onglet Restauration système
- Coche la case désactiver la restauration et applique
Redémarre l'ordinateur et réactive la restauration système.
Tutoriel XP : http://www.libellules.ch/desactiver_restauration.php
-----
On va faire un ménage des outils téléchargés pour la désinfection, télécharge Tools Cleaner sur le bureau :
http://pc-system.fr/
- Double clique sur ToolsCleaner2.exe sur le bureau
- Clique sur Recherche et laisse le scan agir.
- Clique sur Suppression pour finaliser.
- Tu peux, si tu le souhaites, te servir des Options facultatives.
- Clique sur Quitter pour obtenir le rapport.
- Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).
- Si des outils restes après le passage de Tools Cleaner, tu pourras les supprimer manuellement ainsi que tous les rapports qui on été généré lors de la désinfection.
-----
Important de mettre à jour Windows et tes logiciels :
Mettre Windows(catégories critique, Services Pack et Services Release) à jour : http://www.windowsupdate.com/windowsupdate/v6/default.aspx
Faire un scan de vulnérabilités afin de vérifier que tes logiciels soit à jour sans failles de sécurités et mettre à jour :
https://www.malekal.com/tester-la-vulnerabilite-de-son-systeme-2/
Faire un ménage des fichiers inutiles et de la base de registre :
https://www.malekal.com/tutoriel-ccleaner/
Dis moi quand cela est fais où si tu as des soucis et on passe à la résolution du sujet par la suite.
@++ :) -
Bonsoir,
Impeccable pb résolu.
Envcore merci. -
Contributeur sécuritéSalut tipain62
Bien de rien, je te donne quelques consignes de sécurité :
- Windows Update parfaitement à jour http://www.windowsupdate.com/windowsupdate/v6/default.aspx (catégories critique, Services Pack et Services Release)
- pare-feu bien paramétré, je te conseil ZoneAlarm :
https://www.malekal.com/tutoriel-zonealarm-firewall/
- antivirus bien paramétré et mis à jour régulièrement (quotidiennement s'il le faut) avec un scan complet régulier (journalier s'il le faut).
- une attitude prudente vis à vis de la navigation (pas de sites douteux : cracks, warez, sexe...) et vis à vis de la messagerie (fichiers joints aux messages doivent être scannés avant d'être ouverts)
- pas de téléchargement illégal, qui est le principal facteur d'infection (µTorrent, BitTorrent, eMule, Limewire, etc..) https://forum.malekal.com/viewtopic.php?t=893&start=
- une attitude vigilante (être à l'affût d'un fonctionnement inhabituel de son système)
- nettoyage hebdomadaire du système (suppression des fichiers inutiles, nettoyage de la base de registre, scandisk, defrag)
- scan hebdomadaire antispyware, je conseil MalwareByte's Anti-Malware :
https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
- un contrôle régulier de la console JAVA pour s'assurer qu'elle est à jour :
https://www.java.com/en/download/uninstalltool.jsp
- faire régulièrement un scan de vulnérabilités afin de vérifier que tes logiciels soit à jour sans failles de sécurités :
https://www.malekal.com/tester-la-vulnerabilite-de-son-systeme-2/
De bonne lecture si tu veux en savoir plus sur la sécurité et le fonctionnement de Windows :
http://www.malekal.com/menu_windows_general.php
http://www.malekal.com/menu_windows_securite.php
Bonne journée/soirée et bon surf
@++ :)
