Cheval de Troie indomptable!
Résolu
Robinson27
-
Robinson27 Messages postés 48 Statut Membre -
Robinson27 Messages postés 48 Statut Membre -
Bonjour,
mon ordinateur est infesté depuis un bout de temps et je n'arrive pas à m'en débarrasser. J'ai besoin d'aide. Après avoir parcouru le forum je n'ai pas tout saisi je me suis vite résolu à la nécessité de faire appel à un helper saint bernard. Voici le rapport de hijackthis.
Merci par avance pour votre aide
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:52:26, on 22/07/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\System Volume Information\_restore{d5fffa500b1b}\svchost.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\System Volume Information\_restore{d5fffa500b1b}\smss.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Dell Network Assistant\hnm_svc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Dell Network Assistant\ezi_hnm2.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearch.myway.com/jsp/dellsidebar.jsp?p=DR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O4 - HKLM\..\Run: [ISW] "C:\Program Files\CheckPoint\ZAForceField\ForceField.exe" /icon="hidden"
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\RunServices: [mymooz] C:\WINDOWS\system32\poolooforew.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Dell Network Assistant.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O17 - HKLM\System\CCS\Services\Tcpip\..\{98526CB8-C9E3-4982-8BAF-FFD27F2D33AC}: NameServer = 156.154.70.22,156.154.71.22
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Service Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Advanced Networking Service (hnmsvc) - SingleClick Systems - C:\Program Files\Dell Network Assistant\hnm_svc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Asset Management Daemon (su4qwgeorh) - Unknown owner - C:\WINDOWS\system32\noquujij.exe (file missing)
mon ordinateur est infesté depuis un bout de temps et je n'arrive pas à m'en débarrasser. J'ai besoin d'aide. Après avoir parcouru le forum je n'ai pas tout saisi je me suis vite résolu à la nécessité de faire appel à un helper saint bernard. Voici le rapport de hijackthis.
Merci par avance pour votre aide
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:52:26, on 22/07/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\System Volume Information\_restore{d5fffa500b1b}\svchost.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\System Volume Information\_restore{d5fffa500b1b}\smss.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Dell Network Assistant\hnm_svc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Dell Network Assistant\ezi_hnm2.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearch.myway.com/jsp/dellsidebar.jsp?p=DR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O4 - HKLM\..\Run: [ISW] "C:\Program Files\CheckPoint\ZAForceField\ForceField.exe" /icon="hidden"
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\RunServices: [mymooz] C:\WINDOWS\system32\poolooforew.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Dell Network Assistant.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O17 - HKLM\System\CCS\Services\Tcpip\..\{98526CB8-C9E3-4982-8BAF-FFD27F2D33AC}: NameServer = 156.154.70.22,156.154.71.22
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Service Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Advanced Networking Service (hnmsvc) - SingleClick Systems - C:\Program Files\Dell Network Assistant\hnm_svc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Asset Management Daemon (su4qwgeorh) - Unknown owner - C:\WINDOWS\system32\noquujij.exe (file missing)
A voir également:
- Cheval de Troie indomptable!
- Comment supprimer cheval de troie gratuitement - Télécharger - Antivirus & Antimalwares
- Ordinateur bloqué cheval de troie - Accueil - Arnaque
- Jeux de petit chevaux gratuit à télécharger - Télécharger - Jeux vidéo
- Cheval de troie virus - Accueil - Virus
- Qu'est ce que le cheval au poker - Forum Virus
65 réponses
bonjour
QuickScan Beta 32-bit v0.9.9.23
-------------------------------
Scan date: Sun Jul 25 14:33:12 2010
Machine ID: A40C538F
No infection found.
-------------------
Processes
---------
<verified> Advanced Networking Service 556 C:\Program Files\Dell Network Assistant\hnm_svc.exe
<verified> Apple Mobile Device Service 224 C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
<verified> ATI External Event Utility for WindowsN 1020 C:\WINDOWS\system32\Ati2evxx.exe
<verified> avast! Antivirus 1692 C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
<verified> avast! Antivirus 3928 C:\Program Files\Alwil Software\Avast5\AvastUI.exe
<verified> Bonjour 232 C:\Program Files\Bonjour\mDNSResponder.exe
<verified> COMODO Internet Security 3920 C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
<verified> COMODO Internet Security 1244 C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
<verified> Creative Service for CDROM Access 272 C:\WINDOWS\system32\CTsvcCDA.exe
<verified> Dell Network Assistant 3968 C:\Program Files\Dell Network Assistant\ezi_hnm2.exe
<verified> Firefox 3084 C:\Program Files\Mozilla Firefox\firefox.exe
<verified> Firefox 3464 C:\Program Files\Mozilla Firefox\plugin-container.exe
<verified> Hewlett-Packard hpotdd01 3988 C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
<verified> Microsoft® Windows® Operating System 288 C:\WINDOWS\eHome\ehRecvr.exe
<verified> Microsoft® Windows® Operating System 2196 C:\WINDOWS\ehome\mcrdsvc.exe
<verified> Microsoft® Windows® Operating System 2904 C:\WINDOWS\System32\alg.exe
<verified> Microsoft® Windows® Operating System 700 C:\WINDOWS\system32\csrss.exe
<verified> Microsoft® Windows® Operating System 3944 C:\WINDOWS\system32\ctfmon.exe
<verified> Microsoft® Windows® Operating System 2612 C:\WINDOWS\system32\dllhost.exe
<verified> Microsoft® Windows® Operating System 784 C:\WINDOWS\system32\lsass.exe
<verified> Microsoft® Windows® Operating System 1932 C:\WINDOWS\system32\spoolsv.exe
<verified> Microsoft® Windows® Operating System 1036 C:\WINDOWS\system32\svchost.exe
<verified> Microsoft® Windows® Operating System 1156 C:\WINDOWS\system32\svchost.exe
<verified> Microsoft® Windows® Operating System 1208 C:\WINDOWS\system32\svchost.exe
<verified> Microsoft® Windows® Operating System 3840 C:\WINDOWS\System32\svchost.exe
<verified> Microsoft® Windows® Operating System 1272 C:\WINDOWS\system32\svchost.exe
<verified> Microsoft® Windows® Operating System 200 C:\WINDOWS\system32\svchost.exe
<verified> Microsoft® Windows® Operating System 1536 C:\WINDOWS\system32\svchost.exe
<verified> Microsoft® Windows® Operating System 1592 C:\WINDOWS\system32\svchost.exe
<verified> Microsoft® Windows® Operating System 1508 C:\WINDOWS\system32\svchost.exe
<verified> Microsoft® Windows® Operating System 2200 C:\WINDOWS\system32\wuauclt.exe
<verified> Système d'exploitation Microsoft® Windo 484 C:\WINDOWS\eHome\ehSched.exe
<verified> Système d'exploitation Microsoft® Windo 3176 C:\WINDOWS\Explorer.EXE
<verified> Système d'exploitation Microsoft® Windo 772 C:\WINDOWS\system32\services.exe
<verified> Système d'exploitation Microsoft® Windo 652 C:\WINDOWS\System32\smss.exe
<verified> Système d'exploitation Microsoft® Windo 728 C:\WINDOWS\system32\winlogon.exe
Network activity
----------------
Process AvastSvc.exe (1692) connected on port 80 (HTTP) --> 88.221.84.41
Process AvastSvc.exe (1692) connected on port 80 (HTTP) --> 209.85.135.149
Process AvastSvc.exe (1692) connected on port 80 (HTTP) --> 74.125.39.148
Process AvastSvc.exe (1692) connected on port 80 (HTTP) --> 209.85.135.139
Process AvastSvc.exe (1692) connected on port 80 (HTTP) --> 88.221.84.19
Process AvastSvc.exe (1692) connected on port 80 (HTTP) --> 63.215.202.48
Process AvastSvc.exe (1692) connected on port 80 (HTTP) --> 81.52.205.167
Process ezi_hnm2.exe (3968) connected on port 80 (HTTP) --> alive.singleclicksystems.com
Process svchost.exe (1156) listens on ports: 135 (RPC)
Process svchost.exe (1208) listens on ports: 2869 (SSDP event notification, UPNP)
Autoruns and critical files
---------------------------
<verified> Apple Software Update C:\Program Files\Apple Software Update\SoftwareUpdate.exe
<verified> avast! Antivirus C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
<verified> COMODO Internet Security C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
<verified> FRU-Client Application C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe
<verified> Google Update C:\Program Files\Google\Update\GoogleUpdate.exe
<verified> Microsoft® Windows® Operating System C:\WINDOWS\system32\cryptnet.dll
<verified> Microsoft® Windows® Operating System C:\WINDOWS\system32\ctfmon.exe
<verified> Microsoft® Windows® Operating System C:\WINDOWS\system32\dimsntfy.dll
<verified> Microsoft® Windows® Operating System C:\WINDOWS\system32\WPDShServiceObj.dll
<verified> Système d'exploitation Microsoft® Windo C:\WINDOWS\system32\browseui.dll
<verified> Système d'exploitation Microsoft® Windo C:\WINDOWS\system32\crypt32.dll
<verified> Système d'exploitation Microsoft® Windo C:\WINDOWS\system32\cscdll.dll
<verified> Système d'exploitation Microsoft® Windo C:\WINDOWS\system32\logonui.exe
<verified> Système d'exploitation Microsoft® Windo C:\WINDOWS\system32\sclgntfy.dll
<verified> Système d'exploitation Microsoft® Windo C:\WINDOWS\system32\shell32.dll
<verified> Système d'exploitation Microsoft® Windo C:\WINDOWS\system32\stobject.dll
<verified> Système d'exploitation Microsoft® Windo c:\windows\system32\userinit.exe
<verified> Système d'exploitation Microsoft® Windo C:\WINDOWS\system32\wlnotify.dll
<verified> Windows® Internet Explorer C:\WINDOWS\system32\webcheck.dll
Browser plugins
---------------
<unsigned> Bonjour C:\Program Files\Bonjour\mdnsNSP.dll
<unsigned> QuickTime Plug-in 7.6.4 C:\Program Files\Internet Explorer\plugins\npqtplugin.dll
<unsigned> QuickTime Plug-in 7.6.4 C:\Program Files\Internet Explorer\plugins\npqtplugin2.dll
<unsigned> QuickTime Plug-in 7.6.4 C:\Program Files\Internet Explorer\plugins\npqtplugin3.dll
<unsigned> QuickTime Plug-in 7.6.4 C:\Program Files\Internet Explorer\plugins\npqtplugin4.dll
<unsigned> QuickTime Plug-in 7.6.4 C:\Program Files\Internet Explorer\plugins\npqtplugin5.dll
<unsigned> QuickTime Plug-in 7.6.4 C:\Program Files\Internet Explorer\plugins\npqtplugin6.dll
<unsigned> QuickTime Plug-in 7.6.4 C:\Program Files\Internet Explorer\plugins\npqtplugin7.dll
<unsigned> QuickTime Plug-in 7.6.4 C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
<unsigned> QuickTime Plug-in 7.6.4 C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
<unsigned> QuickTime Plug-in 7.6.4 C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
<unsigned> QuickTime Plug-in 7.6.4 C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
<unsigned> QuickTime Plug-in 7.6.4 C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
<unsigned> QuickTime Plug-in 7.6.4 C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
<unsigned> QuickTime Plug-in 7.6.4 C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
<verified> AcroIEHelper Library c:\program files\fichiers communs\adobe\acrobat\activex\acroiehelper.dll
<verified> Adobe Acrobat C:\Program Files\Internet Explorer\plugins\nppdf32.dll
<verified> Adobe Acrobat C:\Program Files\Mozilla Firefox\plugins\nppdf32.dll
<verified> BitDefender QuickScan C:\Documents and Settings\Famille Lambert\Application Data\Mozilla\Firefox\Profiles\3krwldqt.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
<verified> BitDefender QuickScan C:\Documents and Settings\Famille Lambert\Application Data\Mozilla\Firefox\Profiles\3krwldqt.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
<verified> Drive Letter Access Component c:\windows\system32\dla\dlashx_w.dll
<verified> getPlus for Adobe 15235 C:\Documents and Settings\Famille Lambert\Application Data\Mozilla\Firefox\Profiles\3krwldqt.default\extensions\{CF40ACC5-E1BB-4aff-AC72-04C2F616BCA7}\plugins\np_gp.dll
<verified> getPlus for Adobe 15235 C:\Program Files\Mozilla Firefox\plugins\np_gp.dll
<verified> Google Update C:\Program Files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
<verified> InstallShield Update Service C:\WINDOWS\Downloaded Program Files\dwusplay.dll
<verified> InstallShield Update Service C:\WINDOWS\Downloaded Program Files\dwusplay.exe
<verified> InstallShield Update Service C:\WINDOWS\Downloaded Program Files\isusweb.dll
<verified> McAfee Virtual Technician C:\WINDOWS\Downloaded Program Files\McContentMgr.dll
<verified> McAfee Virtual Technician C:\WINDOWS\Downloaded Program Files\McHealthCheck.dll
<verified> McAfee Virtual Technician C:\WINDOWS\Downloaded Program Files\McLogMgr.dll
<verified> McAfee Virtual Technician C:\WINDOWS\Downloaded Program Files\McPlugins.dll
<verified> McAfee Virtual Technician C:\WINDOWS\Downloaded Program Files\McProdMgr.dll
<verified> McAfee Virtual Technician C:\WINDOWS\Downloaded Program Files\MVT.dll
<verified> McAfee Virtual Technician C:\WINDOWS\Downloaded Program Files\Uploader.exe
<verified> Microsoft Office 2003 C:\Program Files\Mozilla Firefox\plugins\NPOFFICE.DLL
<verified> Microsoft® Windows® Operating System C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
<verified> Microsoft® Windows® Operating System C:\WINDOWS\system32\rsvpsp.dll
<verified> Microsoft® Windows® Operating System C:\WINDOWS\system32\winrnr.dll
<verified> Mozilla Default Plug-in C:\Program Files\Mozilla Firefox\plugins\npnul32.dll
<verified> npitunes.dll C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
<verified> nppdf32.FRA C:\Program Files\Internet Explorer\plugins\nppdf32.FRA
<verified> nppdf32.FRA C:\Program Files\Mozilla Firefox\plugins\nppdf32.FRA
<verified> NPSWF32.dll C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
<verified> Système d'exploitation Microsoft® Windo C:\WINDOWS\system32\mswsock.dll
<verified> Windows® Internet Explorer C:\WINDOWS\system32\ieframe.dll
Missing files
-------------
File not found: C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
referenced in: HKLM\Software\Microsoft\Windows\CurrentVersion\Run\"ISW"
File not found: C:\Program Files\Messenger\msmsgs.exe
referenced in: HKLM\Software\Microsoft\Windows\CurrentVersion\Run\"MSMSGS"
referenced in: HKLM\Software\Microsoft\Internet Explorer\Extensions\{FB5F1910-F110-11d2-BB9E-00C04F795683}\"Exec"
File not found: C:\WINDOWS\System32\hidserv.dll
referenced in: HKLM\System\ControlSet001\services\HidServ\Parameters\"ServiceDll"
File not found: C:\WINDOWS\system32\poolooforew.exe
referenced in: \Software\Microsoft\Windows\CurrentVersion\RunServices\"mymooz"
Scan
----
<unsigned> MD5: 3a82373d1421d568f8cc6f38818dc253 C:\Program Files\Alwil Software\Avast5\defs\10072500\algo.dll
<unsigned> MD5: 292f92469efb2fd402e00742c06d539d C:\Program Files\Bonjour\mdnsNSP.dll
<unsigned> MD5: d3afa4999e35afcdf28df1c4aecde8d3 C:\Program Files\Internet Explorer\plugins\npqtplugin.dll
<unsigned> MD5: d3afa4999e35afcdf28df1c4aecde8d3 C:\Program Files\Internet Explorer\plugins\npqtplugin2.dll
<unsigned> MD5: d3afa4999e35afcdf28df1c4aecde8d3 C:\Program Files\Internet Explorer\plugins\npqtplugin3.dll
<unsigned> MD5: d3afa4999e35afcdf28df1c4aecde8d3 C:\Program Files\Internet Explorer\plugins\npqtplugin4.dll
<unsigned> MD5: d3afa4999e35afcdf28df1c4aecde8d3 C:\Program Files\Internet Explorer\plugins\npqtplugin5.dll
<unsigned> MD5: d3afa4999e35afcdf28df1c4aecde8d3 C:\Program Files\Internet Explorer\plugins\npqtplugin6.dll
<unsigned> MD5: d3afa4999e35afcdf28df1c4aecde8d3 C:\Program Files\Internet Explorer\plugins\npqtplugin7.dll
<unsigned> MD5: 10bed437023f93dd1ad8efa80e71280f C:\Program Files\Mozilla Firefox\freebl3.dll
<unsigned> MD5: dce543b6b3ff516bd65c1030e4b933ff C:\Program Files\Mozilla Firefox\nssdbm3.dll
<unsigned> MD5: d3afa4999e35afcdf28df1c4aecde8d3 C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
<unsigned> MD5: d3afa4999e35afcdf28df1c4aecde8d3 C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
<unsigned> MD5: d3afa4999e35afcdf28df1c4aecde8d3 C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
<unsigned> MD5: d3afa4999e35afcdf28df1c4aecde8d3 C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
<unsigned> MD5: d3afa4999e35afcdf28df1c4aecde8d3 C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
<unsigned> MD5: d3afa4999e35afcdf28df1c4aecde8d3 C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
<unsigned> MD5: d3afa4999e35afcdf28df1c4aecde8d3 C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
<unsigned> MD5: 222afed911cbf5f9a454adee53d31b30 C:\Program Files\Mozilla Firefox\softokn3.dll
<unsigned> MD5: bb445bcea5aa6bc695a56eb2fbb4686f C:\WINDOWS\System32\DLA\DLADResN.SYS
<unsigned> MD5: 184a03058c8cc399ea37dbeff6a8365a C:\WINDOWS\System32\mhn.dll
No file uploaded.
Scan finished - communication took 1 sec
Total traffic - 0.01 MB sent, 0.14 KB recvd
Scanned 719 files and modules - 24 seconds
==============================================================================
QuickScan Beta 32-bit v0.9.9.23
-------------------------------
Scan date: Sun Jul 25 14:33:12 2010
Machine ID: A40C538F
No infection found.
-------------------
Processes
---------
<verified> Advanced Networking Service 556 C:\Program Files\Dell Network Assistant\hnm_svc.exe
<verified> Apple Mobile Device Service 224 C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
<verified> ATI External Event Utility for WindowsN 1020 C:\WINDOWS\system32\Ati2evxx.exe
<verified> avast! Antivirus 1692 C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
<verified> avast! Antivirus 3928 C:\Program Files\Alwil Software\Avast5\AvastUI.exe
<verified> Bonjour 232 C:\Program Files\Bonjour\mDNSResponder.exe
<verified> COMODO Internet Security 3920 C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
<verified> COMODO Internet Security 1244 C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
<verified> Creative Service for CDROM Access 272 C:\WINDOWS\system32\CTsvcCDA.exe
<verified> Dell Network Assistant 3968 C:\Program Files\Dell Network Assistant\ezi_hnm2.exe
<verified> Firefox 3084 C:\Program Files\Mozilla Firefox\firefox.exe
<verified> Firefox 3464 C:\Program Files\Mozilla Firefox\plugin-container.exe
<verified> Hewlett-Packard hpotdd01 3988 C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
<verified> Microsoft® Windows® Operating System 288 C:\WINDOWS\eHome\ehRecvr.exe
<verified> Microsoft® Windows® Operating System 2196 C:\WINDOWS\ehome\mcrdsvc.exe
<verified> Microsoft® Windows® Operating System 2904 C:\WINDOWS\System32\alg.exe
<verified> Microsoft® Windows® Operating System 700 C:\WINDOWS\system32\csrss.exe
<verified> Microsoft® Windows® Operating System 3944 C:\WINDOWS\system32\ctfmon.exe
<verified> Microsoft® Windows® Operating System 2612 C:\WINDOWS\system32\dllhost.exe
<verified> Microsoft® Windows® Operating System 784 C:\WINDOWS\system32\lsass.exe
<verified> Microsoft® Windows® Operating System 1932 C:\WINDOWS\system32\spoolsv.exe
<verified> Microsoft® Windows® Operating System 1036 C:\WINDOWS\system32\svchost.exe
<verified> Microsoft® Windows® Operating System 1156 C:\WINDOWS\system32\svchost.exe
<verified> Microsoft® Windows® Operating System 1208 C:\WINDOWS\system32\svchost.exe
<verified> Microsoft® Windows® Operating System 3840 C:\WINDOWS\System32\svchost.exe
<verified> Microsoft® Windows® Operating System 1272 C:\WINDOWS\system32\svchost.exe
<verified> Microsoft® Windows® Operating System 200 C:\WINDOWS\system32\svchost.exe
<verified> Microsoft® Windows® Operating System 1536 C:\WINDOWS\system32\svchost.exe
<verified> Microsoft® Windows® Operating System 1592 C:\WINDOWS\system32\svchost.exe
<verified> Microsoft® Windows® Operating System 1508 C:\WINDOWS\system32\svchost.exe
<verified> Microsoft® Windows® Operating System 2200 C:\WINDOWS\system32\wuauclt.exe
<verified> Système d'exploitation Microsoft® Windo 484 C:\WINDOWS\eHome\ehSched.exe
<verified> Système d'exploitation Microsoft® Windo 3176 C:\WINDOWS\Explorer.EXE
<verified> Système d'exploitation Microsoft® Windo 772 C:\WINDOWS\system32\services.exe
<verified> Système d'exploitation Microsoft® Windo 652 C:\WINDOWS\System32\smss.exe
<verified> Système d'exploitation Microsoft® Windo 728 C:\WINDOWS\system32\winlogon.exe
Network activity
----------------
Process AvastSvc.exe (1692) connected on port 80 (HTTP) --> 88.221.84.41
Process AvastSvc.exe (1692) connected on port 80 (HTTP) --> 209.85.135.149
Process AvastSvc.exe (1692) connected on port 80 (HTTP) --> 74.125.39.148
Process AvastSvc.exe (1692) connected on port 80 (HTTP) --> 209.85.135.139
Process AvastSvc.exe (1692) connected on port 80 (HTTP) --> 88.221.84.19
Process AvastSvc.exe (1692) connected on port 80 (HTTP) --> 63.215.202.48
Process AvastSvc.exe (1692) connected on port 80 (HTTP) --> 81.52.205.167
Process ezi_hnm2.exe (3968) connected on port 80 (HTTP) --> alive.singleclicksystems.com
Process svchost.exe (1156) listens on ports: 135 (RPC)
Process svchost.exe (1208) listens on ports: 2869 (SSDP event notification, UPNP)
Autoruns and critical files
---------------------------
<verified> Apple Software Update C:\Program Files\Apple Software Update\SoftwareUpdate.exe
<verified> avast! Antivirus C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
<verified> COMODO Internet Security C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
<verified> FRU-Client Application C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe
<verified> Google Update C:\Program Files\Google\Update\GoogleUpdate.exe
<verified> Microsoft® Windows® Operating System C:\WINDOWS\system32\cryptnet.dll
<verified> Microsoft® Windows® Operating System C:\WINDOWS\system32\ctfmon.exe
<verified> Microsoft® Windows® Operating System C:\WINDOWS\system32\dimsntfy.dll
<verified> Microsoft® Windows® Operating System C:\WINDOWS\system32\WPDShServiceObj.dll
<verified> Système d'exploitation Microsoft® Windo C:\WINDOWS\system32\browseui.dll
<verified> Système d'exploitation Microsoft® Windo C:\WINDOWS\system32\crypt32.dll
<verified> Système d'exploitation Microsoft® Windo C:\WINDOWS\system32\cscdll.dll
<verified> Système d'exploitation Microsoft® Windo C:\WINDOWS\system32\logonui.exe
<verified> Système d'exploitation Microsoft® Windo C:\WINDOWS\system32\sclgntfy.dll
<verified> Système d'exploitation Microsoft® Windo C:\WINDOWS\system32\shell32.dll
<verified> Système d'exploitation Microsoft® Windo C:\WINDOWS\system32\stobject.dll
<verified> Système d'exploitation Microsoft® Windo c:\windows\system32\userinit.exe
<verified> Système d'exploitation Microsoft® Windo C:\WINDOWS\system32\wlnotify.dll
<verified> Windows® Internet Explorer C:\WINDOWS\system32\webcheck.dll
Browser plugins
---------------
<unsigned> Bonjour C:\Program Files\Bonjour\mdnsNSP.dll
<unsigned> QuickTime Plug-in 7.6.4 C:\Program Files\Internet Explorer\plugins\npqtplugin.dll
<unsigned> QuickTime Plug-in 7.6.4 C:\Program Files\Internet Explorer\plugins\npqtplugin2.dll
<unsigned> QuickTime Plug-in 7.6.4 C:\Program Files\Internet Explorer\plugins\npqtplugin3.dll
<unsigned> QuickTime Plug-in 7.6.4 C:\Program Files\Internet Explorer\plugins\npqtplugin4.dll
<unsigned> QuickTime Plug-in 7.6.4 C:\Program Files\Internet Explorer\plugins\npqtplugin5.dll
<unsigned> QuickTime Plug-in 7.6.4 C:\Program Files\Internet Explorer\plugins\npqtplugin6.dll
<unsigned> QuickTime Plug-in 7.6.4 C:\Program Files\Internet Explorer\plugins\npqtplugin7.dll
<unsigned> QuickTime Plug-in 7.6.4 C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
<unsigned> QuickTime Plug-in 7.6.4 C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
<unsigned> QuickTime Plug-in 7.6.4 C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
<unsigned> QuickTime Plug-in 7.6.4 C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
<unsigned> QuickTime Plug-in 7.6.4 C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
<unsigned> QuickTime Plug-in 7.6.4 C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
<unsigned> QuickTime Plug-in 7.6.4 C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
<verified> AcroIEHelper Library c:\program files\fichiers communs\adobe\acrobat\activex\acroiehelper.dll
<verified> Adobe Acrobat C:\Program Files\Internet Explorer\plugins\nppdf32.dll
<verified> Adobe Acrobat C:\Program Files\Mozilla Firefox\plugins\nppdf32.dll
<verified> BitDefender QuickScan C:\Documents and Settings\Famille Lambert\Application Data\Mozilla\Firefox\Profiles\3krwldqt.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
<verified> BitDefender QuickScan C:\Documents and Settings\Famille Lambert\Application Data\Mozilla\Firefox\Profiles\3krwldqt.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
<verified> Drive Letter Access Component c:\windows\system32\dla\dlashx_w.dll
<verified> getPlus for Adobe 15235 C:\Documents and Settings\Famille Lambert\Application Data\Mozilla\Firefox\Profiles\3krwldqt.default\extensions\{CF40ACC5-E1BB-4aff-AC72-04C2F616BCA7}\plugins\np_gp.dll
<verified> getPlus for Adobe 15235 C:\Program Files\Mozilla Firefox\plugins\np_gp.dll
<verified> Google Update C:\Program Files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
<verified> InstallShield Update Service C:\WINDOWS\Downloaded Program Files\dwusplay.dll
<verified> InstallShield Update Service C:\WINDOWS\Downloaded Program Files\dwusplay.exe
<verified> InstallShield Update Service C:\WINDOWS\Downloaded Program Files\isusweb.dll
<verified> McAfee Virtual Technician C:\WINDOWS\Downloaded Program Files\McContentMgr.dll
<verified> McAfee Virtual Technician C:\WINDOWS\Downloaded Program Files\McHealthCheck.dll
<verified> McAfee Virtual Technician C:\WINDOWS\Downloaded Program Files\McLogMgr.dll
<verified> McAfee Virtual Technician C:\WINDOWS\Downloaded Program Files\McPlugins.dll
<verified> McAfee Virtual Technician C:\WINDOWS\Downloaded Program Files\McProdMgr.dll
<verified> McAfee Virtual Technician C:\WINDOWS\Downloaded Program Files\MVT.dll
<verified> McAfee Virtual Technician C:\WINDOWS\Downloaded Program Files\Uploader.exe
<verified> Microsoft Office 2003 C:\Program Files\Mozilla Firefox\plugins\NPOFFICE.DLL
<verified> Microsoft® Windows® Operating System C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
<verified> Microsoft® Windows® Operating System C:\WINDOWS\system32\rsvpsp.dll
<verified> Microsoft® Windows® Operating System C:\WINDOWS\system32\winrnr.dll
<verified> Mozilla Default Plug-in C:\Program Files\Mozilla Firefox\plugins\npnul32.dll
<verified> npitunes.dll C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
<verified> nppdf32.FRA C:\Program Files\Internet Explorer\plugins\nppdf32.FRA
<verified> nppdf32.FRA C:\Program Files\Mozilla Firefox\plugins\nppdf32.FRA
<verified> NPSWF32.dll C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
<verified> Système d'exploitation Microsoft® Windo C:\WINDOWS\system32\mswsock.dll
<verified> Windows® Internet Explorer C:\WINDOWS\system32\ieframe.dll
Missing files
-------------
File not found: C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
referenced in: HKLM\Software\Microsoft\Windows\CurrentVersion\Run\"ISW"
File not found: C:\Program Files\Messenger\msmsgs.exe
referenced in: HKLM\Software\Microsoft\Windows\CurrentVersion\Run\"MSMSGS"
referenced in: HKLM\Software\Microsoft\Internet Explorer\Extensions\{FB5F1910-F110-11d2-BB9E-00C04F795683}\"Exec"
File not found: C:\WINDOWS\System32\hidserv.dll
referenced in: HKLM\System\ControlSet001\services\HidServ\Parameters\"ServiceDll"
File not found: C:\WINDOWS\system32\poolooforew.exe
referenced in: \Software\Microsoft\Windows\CurrentVersion\RunServices\"mymooz"
Scan
----
<unsigned> MD5: 3a82373d1421d568f8cc6f38818dc253 C:\Program Files\Alwil Software\Avast5\defs\10072500\algo.dll
<unsigned> MD5: 292f92469efb2fd402e00742c06d539d C:\Program Files\Bonjour\mdnsNSP.dll
<unsigned> MD5: d3afa4999e35afcdf28df1c4aecde8d3 C:\Program Files\Internet Explorer\plugins\npqtplugin.dll
<unsigned> MD5: d3afa4999e35afcdf28df1c4aecde8d3 C:\Program Files\Internet Explorer\plugins\npqtplugin2.dll
<unsigned> MD5: d3afa4999e35afcdf28df1c4aecde8d3 C:\Program Files\Internet Explorer\plugins\npqtplugin3.dll
<unsigned> MD5: d3afa4999e35afcdf28df1c4aecde8d3 C:\Program Files\Internet Explorer\plugins\npqtplugin4.dll
<unsigned> MD5: d3afa4999e35afcdf28df1c4aecde8d3 C:\Program Files\Internet Explorer\plugins\npqtplugin5.dll
<unsigned> MD5: d3afa4999e35afcdf28df1c4aecde8d3 C:\Program Files\Internet Explorer\plugins\npqtplugin6.dll
<unsigned> MD5: d3afa4999e35afcdf28df1c4aecde8d3 C:\Program Files\Internet Explorer\plugins\npqtplugin7.dll
<unsigned> MD5: 10bed437023f93dd1ad8efa80e71280f C:\Program Files\Mozilla Firefox\freebl3.dll
<unsigned> MD5: dce543b6b3ff516bd65c1030e4b933ff C:\Program Files\Mozilla Firefox\nssdbm3.dll
<unsigned> MD5: d3afa4999e35afcdf28df1c4aecde8d3 C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
<unsigned> MD5: d3afa4999e35afcdf28df1c4aecde8d3 C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
<unsigned> MD5: d3afa4999e35afcdf28df1c4aecde8d3 C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
<unsigned> MD5: d3afa4999e35afcdf28df1c4aecde8d3 C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
<unsigned> MD5: d3afa4999e35afcdf28df1c4aecde8d3 C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
<unsigned> MD5: d3afa4999e35afcdf28df1c4aecde8d3 C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
<unsigned> MD5: d3afa4999e35afcdf28df1c4aecde8d3 C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
<unsigned> MD5: 222afed911cbf5f9a454adee53d31b30 C:\Program Files\Mozilla Firefox\softokn3.dll
<unsigned> MD5: bb445bcea5aa6bc695a56eb2fbb4686f C:\WINDOWS\System32\DLA\DLADResN.SYS
<unsigned> MD5: 184a03058c8cc399ea37dbeff6a8365a C:\WINDOWS\System32\mhn.dll
No file uploaded.
Scan finished - communication took 1 sec
Total traffic - 0.01 MB sent, 0.14 KB recvd
Scanned 719 files and modules - 24 seconds
==============================================================================
Bonsoir
désolé. Grosse période de taf. Je vs ai répondu par courrier. Ça ne passait pas.
Encore merci
désolé. Grosse période de taf. Je vs ai répondu par courrier. Ça ne passait pas.
Encore merci
On continu la désinfection.
/!\ A l'attention de ceux qui passent sur ce sujet /!\
Le logiciel qui suit n'est pas à utiliser à la légère et peut faire des dégâts s'il est mal utilisé ! Ne le faites que si un helpeur du forum qui connait bien cet outil vous l'a recommandé.
/!\ Désactive tous tes logiciels de protection (Antivirus, Antispywares) /!\
* Télécharge combofix(de sUBs) sur ton Bureau.
* Double-clique sur ComboFix.exe afin de le lancer.
* Il va te demander d'installer la console de récupération : accepte. (important en cas de problème)
/!\ Ne touche ni à la souris, ni au clavier durant le scan /!\
* Lorsque la recherche sera terminée, un rapport apparaîtra.
* Héberge le rapport C:\Combofix.txt sur le site cijoint.fr, puis copie/colle le lien fournit dans ta prochaine réponse sur le forum
#Si combofix ne veut pas se lancer renommes le en ccm.exe et éxécutes le en mode sans échec .
Tutoriel officiel de Combofix : http://www.bleepingcomputer.com/combofix/fr/comment-utiliser¬-combofix
/!\ A l'attention de ceux qui passent sur ce sujet /!\
Le logiciel qui suit n'est pas à utiliser à la légère et peut faire des dégâts s'il est mal utilisé ! Ne le faites que si un helpeur du forum qui connait bien cet outil vous l'a recommandé.
/!\ Désactive tous tes logiciels de protection (Antivirus, Antispywares) /!\
* Télécharge combofix(de sUBs) sur ton Bureau.
* Double-clique sur ComboFix.exe afin de le lancer.
* Il va te demander d'installer la console de récupération : accepte. (important en cas de problème)
/!\ Ne touche ni à la souris, ni au clavier durant le scan /!\
* Lorsque la recherche sera terminée, un rapport apparaîtra.
* Héberge le rapport C:\Combofix.txt sur le site cijoint.fr, puis copie/colle le lien fournit dans ta prochaine réponse sur le forum
#Si combofix ne veut pas se lancer renommes le en ccm.exe et éxécutes le en mode sans échec .
Tutoriel officiel de Combofix : http://www.bleepingcomputer.com/combofix/fr/comment-utiliser¬-combofix
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
bonjour
voici le lien pour combofix:
http://www.cijoint.fr/cjlink.php?file=cj201007/cijfUVACYW.txt
cdlt
voici le lien pour combofix:
http://www.cijoint.fr/cjlink.php?file=cj201007/cijfUVACYW.txt
cdlt
/!\ ATTENTION /!\ Le script qui suit a été écrit spécialement pour Robinson27 , il n'est pas transposable sur un autre ordinateur !
* Télécharge ce dossier Robinson27
* Fais un clic-droit dessus --> Extraire tout --> choisis le Bureau comme destination
* Un autre dossier va apparaitre, prends le fichier CFScript.txt qui se trouve à l'intérieur et place le sur le Bureau et pas ailleurs.
* Désactive tes logiciels de protection
* Fais un glisser/déposer de ce fichier CFScript.txt sur le fichier Combofix.exe
comme ceci :http://img155.imageshack.us/img155/4837/cfscriptop0.gif
* Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal !
/!\ Ne touche ni à la souris, ni au clavier durant le scan /!\
* Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
* Si le fichier ne s'ouvre pas, il se trouve ici ? C:\ComboFix.txt
* Télécharge ce dossier Robinson27
* Fais un clic-droit dessus --> Extraire tout --> choisis le Bureau comme destination
* Un autre dossier va apparaitre, prends le fichier CFScript.txt qui se trouve à l'intérieur et place le sur le Bureau et pas ailleurs.
* Désactive tes logiciels de protection
* Fais un glisser/déposer de ce fichier CFScript.txt sur le fichier Combofix.exe
comme ceci :http://img155.imageshack.us/img155/4837/cfscriptop0.gif
* Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal !
/!\ Ne touche ni à la souris, ni au clavier durant le scan /!\
* Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
* Si le fichier ne s'ouvre pas, il se trouve ici ? C:\ComboFix.txt
le pb c'est que je n'ai pas l'icone de combofix sur mon bureau et si je reclique dessus ca veut relancer le logiciel. que dois je faire?
jai mis le nouveau rapport de combofix que j'ai posté ici comme ce matin:
http://www.cijoint.fr/cjlink.php?file=cj201007/cijrhd84Q0.txt
http://www.cijoint.fr/cjlink.php?file=cj201007/cijrhd84Q0.txt
Tu n'as pas fais le script combo noté ici.
https://forums.commentcamarche.net/forum/affich-18578792-cheval-de-troie-indomptable?page=2#29
https://forums.commentcamarche.net/forum/affich-18578792-cheval-de-troie-indomptable?page=2#29
Non plus.On fera différemment plus tard car je préfére traiter une infection bootkit.
1/ Télécharge Bootkit Remover et décompresse le sur ton bureau.
2/ Télécharge BTKR_Runbox ( de jeanmimigab ) également sur ton bureau.
Note : Tu dois avoir ces deux fichiers sur ton bureau -> Remover.exe et BTKR_Runbox.exe
3/ Lance BTKR_Runbox, puis sélectionne l'option n°1. Valide en appuyant sur [Entrée]
4/ Suis les instructions et copie/colle le rapport dans ta prochaine réponse.
1/ Télécharge Bootkit Remover et décompresse le sur ton bureau.
2/ Télécharge BTKR_Runbox ( de jeanmimigab ) également sur ton bureau.
Note : Tu dois avoir ces deux fichiers sur ton bureau -> Remover.exe et BTKR_Runbox.exe
3/ Lance BTKR_Runbox, puis sélectionne l'option n°1. Valide en appuyant sur [Entrée]
4/ Suis les instructions et copie/colle le rapport dans ta prochaine réponse.
il ne se passe rien après l'étape 1. j'ai pris qd mm ce rapport:
http://www.cijoint.fr/cjlink.php?file=cj201007/cijD5yDDOR.txt
http://www.cijoint.fr/cjlink.php?file=cj201007/cijD5yDDOR.txt
bonjour j'ai un trojan et je ne sais pas comment m'en debarrasser , j'ai comme antivirus avast et il ne ma rien trouvé c pc tool qui la detecté . j'ai fait un rapport avec bootkit remover et voila ce qui me donne .
Bootkit Remover
(c) 2009 eSage Lab
www.esagelab.com
Program version: 1.1.0.0
OS Version: Microsoft Windows Vista Home Premium Edition Service Pack 2 (build 6002), 32-bit
System volume is \\.\C:
\\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000'00100000
Boot sector MD5 is: b23e5cbb74b4fcefd775b490fc8131e6
Size Device Name MBR Status
--------------------------------------------
465 GB \\.\PhysicalDrive0 Unknown boot code
Unknown boot code has been found on some of your physical disks.
To inspect the boot code manually, dump the master boot sector:
remover.exe dump <device_name> [output_file]
To disinfect the master boot sector, use the following command:
remover.exe fix <device_name>
Done;
Press any key to quit...
Pouvez vous m'aidez.
Bootkit Remover
(c) 2009 eSage Lab
www.esagelab.com
Program version: 1.1.0.0
OS Version: Microsoft Windows Vista Home Premium Edition Service Pack 2 (build 6002), 32-bit
System volume is \\.\C:
\\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000'00100000
Boot sector MD5 is: b23e5cbb74b4fcefd775b490fc8131e6
Size Device Name MBR Status
--------------------------------------------
465 GB \\.\PhysicalDrive0 Unknown boot code
Unknown boot code has been found on some of your physical disks.
To inspect the boot code manually, dump the master boot sector:
remover.exe dump <device_name> [output_file]
To disinfect the master boot sector, use the following command:
remover.exe fix <device_name>
Done;
Press any key to quit...
Pouvez vous m'aidez.
@samu5545
Il est préférable d'ouvrir un autre topic afin de ne pas saturer celui de Robinson27 .Merci.
@Robinson27
desinstalles Bootkit Remover et télécharges a partir du lien ci-desous.
http://sd-1.archive-host.com/membres/up/93804828040693895/Boot_Kit_install.exe
BTKR_Runbox,va se lancer automatiquement puis sélectionne l'option n°1. Valide en appuyant sur [Entrée]
4/ Suis les instructions et copie/colle le rapport dans ta prochaine réponse.
Il est préférable d'ouvrir un autre topic afin de ne pas saturer celui de Robinson27 .Merci.
@Robinson27
desinstalles Bootkit Remover et télécharges a partir du lien ci-desous.
http://sd-1.archive-host.com/membres/up/93804828040693895/Boot_Kit_install.exe
BTKR_Runbox,va se lancer automatiquement puis sélectionne l'option n°1. Valide en appuyant sur [Entrée]
4/ Suis les instructions et copie/colle le rapport dans ta prochaine réponse.
en espérant que ce soit ça:
Bootkit Remover version 1.0.0.1
(c) 2009 eSage Lab
www.esagelab.com
\\.\C: -> \\.\PhysicalDrive0
MD5: 6def5ffcbcdbdb4082f1015625e597bd
\\.\D: -> \\.\PhysicalDrive0
Size Device Name MBR Status
--------------------------------------------
232 GB \\.\PhysicalDrive0 OK (DOS/Win32 Boot code found)
Press any key to quit...
Bootkit Remover version 1.0.0.1
(c) 2009 eSage Lab
www.esagelab.com
\\.\C: -> \\.\PhysicalDrive0
MD5: 6def5ffcbcdbdb4082f1015625e597bd
\\.\D: -> \\.\PhysicalDrive0
Size Device Name MBR Status
--------------------------------------------
232 GB \\.\PhysicalDrive0 OK (DOS/Win32 Boot code found)
Press any key to quit...
* Télécharge OTM (OtmoveIT de Old_Timer) sur ton Bureau
ou
* http://www.itxassociates.com/OT-Tools/OTM.exe
* Double-clique sur OTM.exe pour le lancer.
* Copie la liste qui se trouve en gras dans la citation ci-dessous et colle-la dans le cadre de gauche de OTM sous Paste Instructions for Items to be Moved.
-----------------------------
:files
c:\program files\adobe\photoshop album edition découverte\3.2\apps\apdproxy .exe
c:\program files\antivirusfirewall\common\fsm32 .exe
c:\program files\antivirusfirewall\fsgui\tnbutil .exe
c:\program files\creative\mediasource\detector\ctdetect .exe
c:\program files\fichiers communs\apple\mobile device support\bin\applesyncnotifier .exe
c:\program files\itunes\ituneshelper .exe
c:\program files\messenger\msmsgs .exe
c:\program files\quicktime\qttask .exe
c:\windows\system32\ctfmon .exe
c:\program files\quicktime\qttask .exe
:commands
[emptytemp]
[reboot]
-----------------------------
* clique sur MoveIt! puis ferme OTM.
* Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
* Accepte en cliquant sur YES.
* Poste le rapport situé dans C:\_OTM\MovedFiles.
* Le nom du rapport correspond au moment de sa création : date_heure.log
ou
* http://www.itxassociates.com/OT-Tools/OTM.exe
* Double-clique sur OTM.exe pour le lancer.
* Copie la liste qui se trouve en gras dans la citation ci-dessous et colle-la dans le cadre de gauche de OTM sous Paste Instructions for Items to be Moved.
-----------------------------
:files
c:\program files\adobe\photoshop album edition découverte\3.2\apps\apdproxy .exe
c:\program files\antivirusfirewall\common\fsm32 .exe
c:\program files\antivirusfirewall\fsgui\tnbutil .exe
c:\program files\creative\mediasource\detector\ctdetect .exe
c:\program files\fichiers communs\apple\mobile device support\bin\applesyncnotifier .exe
c:\program files\itunes\ituneshelper .exe
c:\program files\messenger\msmsgs .exe
c:\program files\quicktime\qttask .exe
c:\windows\system32\ctfmon .exe
c:\program files\quicktime\qttask .exe
:commands
[emptytemp]
[reboot]
-----------------------------
* clique sur MoveIt! puis ferme OTM.
* Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
* Accepte en cliquant sur YES.
* Poste le rapport situé dans C:\_OTM\MovedFiles.
* Le nom du rapport correspond au moment de sa création : date_heure.log
c'est bon?
All processes killed
========== FILES ==========
c:\program files\adobe\photoshop album edition découverte\3.2\apps\apdproxy .exe moved successfully.
c:\program files\antivirusfirewall\common\fsm32 .exe moved successfully.
c:\program files\antivirusfirewall\fsgui\tnbutil .exe moved successfully.
c:\program files\creative\mediasource\detector\ctdetect .exe moved successfully.
c:\program files\fichiers communs\apple\mobile device support\bin\applesyncnotifier .exe moved successfully.
c:\program files\itunes\ituneshelper .exe moved successfully.
c:\program files\messenger\msmsgs .exe moved successfully.
File/Folder c:\program files\quicktime\qttask .exe not found.
c:\windows\system32\ctfmon .exe moved successfully.
File/Folder c:\program files\quicktime\qttask .exe not found.
========== COMMANDS ==========
[EMPTYTEMP]
User: Administrateur
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: All Users
User: Default User
->Temp folder emptied: 59964 bytes
->Temporary Internet Files folder emptied: 32768 bytes
User: Famille Lambert
->Temp folder emptied: 6322 bytes
->Temporary Internet Files folder emptied: 82538 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 41389583 bytes
->Google Chrome cache emptied: 0 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 3013 bytes
User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 32902 bytes
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 19569 bytes
%systemroot%\System32 .tmp files removed: 3124736 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 499712 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 63211 bytes
RecycleBin emptied: 613135 bytes
Total Files Cleaned = 44,00 mb
OTM by OldTimer - Version 3.1.15.0 log created on 08012010_205653
Files moved on Reboot...
File move failed. C:\WINDOWS\temp\_avast5_\Webshlock.txt scheduled to be moved on reboot.
Registry entries deleted on Reboot...
All processes killed
========== FILES ==========
c:\program files\adobe\photoshop album edition découverte\3.2\apps\apdproxy .exe moved successfully.
c:\program files\antivirusfirewall\common\fsm32 .exe moved successfully.
c:\program files\antivirusfirewall\fsgui\tnbutil .exe moved successfully.
c:\program files\creative\mediasource\detector\ctdetect .exe moved successfully.
c:\program files\fichiers communs\apple\mobile device support\bin\applesyncnotifier .exe moved successfully.
c:\program files\itunes\ituneshelper .exe moved successfully.
c:\program files\messenger\msmsgs .exe moved successfully.
File/Folder c:\program files\quicktime\qttask .exe not found.
c:\windows\system32\ctfmon .exe moved successfully.
File/Folder c:\program files\quicktime\qttask .exe not found.
========== COMMANDS ==========
[EMPTYTEMP]
User: Administrateur
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: All Users
User: Default User
->Temp folder emptied: 59964 bytes
->Temporary Internet Files folder emptied: 32768 bytes
User: Famille Lambert
->Temp folder emptied: 6322 bytes
->Temporary Internet Files folder emptied: 82538 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 41389583 bytes
->Google Chrome cache emptied: 0 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 3013 bytes
User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 32902 bytes
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 19569 bytes
%systemroot%\System32 .tmp files removed: 3124736 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 499712 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 63211 bytes
RecycleBin emptied: 613135 bytes
Total Files Cleaned = 44,00 mb
OTM by OldTimer - Version 3.1.15.0 log created on 08012010_205653
Files moved on Reboot...
File move failed. C:\WINDOWS\temp\_avast5_\Webshlock.txt scheduled to be moved on reboot.
Registry entries deleted on Reboot...
Méme chose avec OTM
:services
uumrpphs
su4qwgeorh
tnggilleug
sddczfwn
zwsjpjap
:files
c:\windows\system32\Drivers\uumrpphs.sys
c:\windows\system32\noquujij.exe
c:\docume~1\FAMILL~1\LOCALS~1\Temp\prbmb.sys
c:\windows\System32\Drivers\sddczfwn.sys
c:\windows\System32\Drivers\zwsjpjap.sys
c:\documents and settings\Famille Lambert\spyqfuv.exe \u
c:\windows\system32\poolooforew.exe
:reg
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\uumrpphs.sys]
:commands
[emptytemp]
[reboot]
Post le rapport.
Tu peux desinstaller Spybot qui est devenue obsolete et profite en pour retirer f secure.
:services
uumrpphs
su4qwgeorh
tnggilleug
sddczfwn
zwsjpjap
:files
c:\windows\system32\Drivers\uumrpphs.sys
c:\windows\system32\noquujij.exe
c:\docume~1\FAMILL~1\LOCALS~1\Temp\prbmb.sys
c:\windows\System32\Drivers\sddczfwn.sys
c:\windows\System32\Drivers\zwsjpjap.sys
c:\documents and settings\Famille Lambert\spyqfuv.exe \u
c:\windows\system32\poolooforew.exe
:reg
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\uumrpphs.sys]
:commands
[emptytemp]
[reboot]
Post le rapport.
Tu peux desinstaller Spybot qui est devenue obsolete et profite en pour retirer f secure.
la suite:
All processes killed
========== SERVICES/DRIVERS ==========
Service uumrpphs stopped successfully!
Service uumrpphs deleted successfully!
Service su4qwgeorh stopped successfully!
Service su4qwgeorh deleted successfully!
Service tnggilleug stopped successfully!
Service tnggilleug deleted successfully!
Service sddczfwn stopped successfully!
Service sddczfwn deleted successfully!
Service zwsjpjap stopped successfully!
Service zwsjpjap deleted successfully!
========== FILES ==========
File/Folder c:\windows\system32\Drivers\uumrpphs.sys not found.
File/Folder c:\windows\system32\noquujij.exe not found.
File/Folder c:\docume~1\FAMILL~1\LOCALS~1\Temp\prbmb.sys not found.
File/Folder c:\windows\System32\Drivers\sddczfwn.sys not found.
File/Folder c:\windows\System32\Drivers\zwsjpjap.sys not found.
File/Folder c:\documents and settings\Famille Lambert\spyqfuv.exe \u not found.
File/Folder c:\windows\system32\poolooforew.exe not found.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\uumrpphs.sys\ deleted successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: Administrateur
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: All Users
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Famille Lambert
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 8215016 bytes
->Google Chrome cache emptied: 0 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 8,00 mb
OTM by OldTimer - Version 3.1.15.0 log created on 08012010_234215
Files moved on Reboot...
File move failed. C:\WINDOWS\temp\_avast5_\Webshlock.txt scheduled to be moved on reboot.
Registry entries deleted on Reboot...
All processes killed
========== SERVICES/DRIVERS ==========
Service uumrpphs stopped successfully!
Service uumrpphs deleted successfully!
Service su4qwgeorh stopped successfully!
Service su4qwgeorh deleted successfully!
Service tnggilleug stopped successfully!
Service tnggilleug deleted successfully!
Service sddczfwn stopped successfully!
Service sddczfwn deleted successfully!
Service zwsjpjap stopped successfully!
Service zwsjpjap deleted successfully!
========== FILES ==========
File/Folder c:\windows\system32\Drivers\uumrpphs.sys not found.
File/Folder c:\windows\system32\noquujij.exe not found.
File/Folder c:\docume~1\FAMILL~1\LOCALS~1\Temp\prbmb.sys not found.
File/Folder c:\windows\System32\Drivers\sddczfwn.sys not found.
File/Folder c:\windows\System32\Drivers\zwsjpjap.sys not found.
File/Folder c:\documents and settings\Famille Lambert\spyqfuv.exe \u not found.
File/Folder c:\windows\system32\poolooforew.exe not found.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\uumrpphs.sys\ deleted successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: Administrateur
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: All Users
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Famille Lambert
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 8215016 bytes
->Google Chrome cache emptied: 0 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 8,00 mb
OTM by OldTimer - Version 3.1.15.0 log created on 08012010_234215
Files moved on Reboot...
File move failed. C:\WINDOWS\temp\_avast5_\Webshlock.txt scheduled to be moved on reboot.
Registry entries deleted on Reboot...
Important: A faire dans l'ordre
1/ Pour supprimer combofix.
# Cliquez sur Démarrer >> Exécuter ...
# Maintenant, tapez ou fait un copié/collé ComboFix /uninstall et cliquez sur OK.
2/ Télécharge combofix(de sUBs) sur ton Bureau.
Lance combofix et post moi le rapport.
1/ Pour supprimer combofix.
# Cliquez sur Démarrer >> Exécuter ...
# Maintenant, tapez ou fait un copié/collé ComboFix /uninstall et cliquez sur OK.
2/ Télécharge combofix(de sUBs) sur ton Bureau.
Lance combofix et post moi le rapport.
ComboFix 10-08-01.02 - Famille Lambert 02/08/2010 10:50:31.4.2 - x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1022.579 [GMT 2:00]
Lancé depuis: c:\documents and settings\Famille Lambert\Mes documents\Téléchargements\ComboFix.exe
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: COMODO Firewall *disabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
* Un nouveau point de restauration a été créé
.
((((((((((((((((((((((((((((( Fichiers créés du 2010-07-02 au 2010-08-02 ))))))))))))))))))))))))))))))))))))
.
2010-07-25 15:54 . 2010-07-25 15:54 -------- d-----w- c:\program files\iPod
2010-07-25 15:54 . 2010-07-25 15:55 -------- d-----w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-07-25 15:46 . 2010-07-25 15:46 -------- d-----w- c:\program files\Bonjour
2010-07-25 15:41 . 2010-07-25 15:41 73000 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.2.1.5\SetupAdmin.exe
2010-07-25 15:32 . 2010-07-25 15:32 71992 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\Safari 5.33.16.0\SetupAdmin.exe
2010-07-25 12:15 . 2010-07-25 12:33 -------- d-----w- c:\documents and settings\Famille Lambert\Application Data\QuickScan
2010-07-25 12:15 . 2010-05-31 14:34 702120 ----a-w- c:\documents and settings\Famille Lambert\Application Data\Mozilla\Firefox\Profiles\3krwldqt.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
2010-07-25 12:15 . 2010-05-31 14:34 868456 ----a-w- c:\documents and settings\Famille Lambert\Application Data\Mozilla\Firefox\Profiles\3krwldqt.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
2010-07-24 17:09 . 2010-07-24 17:38 -------- d-----w- c:\program files\Ad-Remover
2010-07-24 15:28 . 2010-07-24 15:51 -------- d-----w- c:\program files\Navilog1
2010-07-24 15:26 . 2010-07-24 15:57 -------- d---a-w- C:\Navilog1
2010-07-23 07:36 . 2010-07-27 13:10 -------- d-----w- c:\program files\ZHPDiag
2010-07-22 15:51 . 2010-07-22 15:51 -------- d-----w- c:\program files\Trend Micro
2010-07-22 14:37 . 2010-07-22 14:37 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2010-07-22 14:04 . 2010-07-22 14:04 -------- d-----w- c:\documents and settings\Famille Lambert\Application Data\Malwarebytes
2010-07-22 14:04 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-22 14:04 . 2010-07-22 14:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-07-22 14:04 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-07-22 14:04 . 2010-07-22 14:21 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-07-22 13:53 . 2010-07-22 13:54 -------- d-----w- c:\documents and settings\All Users\Application Data\COMODO
2010-07-22 13:41 . 2010-07-22 13:41 -------- d-----w- c:\program files\COMODO
2010-07-22 13:36 . 2010-07-22 13:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Comodo Downloader
2010-07-22 11:13 . 2010-07-22 11:13 -------- d-----w- c:\program files\CCleaner
2010-07-14 18:08 . 2010-07-14 18:08 81016 ----a-w- c:\documents and settings\NetworkService\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-07-14 18:07 . 2010-07-14 18:07 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\PCHealth
2010-07-14 14:59 . 2010-07-14 14:59 -------- d-----w- c:\windows\Internet Logs
2010-07-14 11:45 . 2010-06-14 14:31 744448 ------w- c:\windows\system32\dllcache\helpsvc.exe
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-02 08:35 . 2007-02-25 17:49 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-08-01 18:56 . 2009-09-11 16:18 -------- d-----w- c:\program files\iTunes
2010-08-01 16:32 . 2010-08-01 16:26 -------- d-----w- c:\program files\Boot_Kit
2010-07-25 15:54 . 2009-09-11 16:12 -------- d-----w- c:\program files\Fichiers communs\Apple
2010-07-25 15:50 . 2009-09-11 16:16 -------- d-----w- c:\program files\QuickTime
2010-07-25 15:36 . 2009-10-21 08:42 -------- d-----w- c:\program files\Safari
2010-07-22 14:41 . 2010-07-22 14:32 -------- d-----w- c:\program files\Google
2010-06-14 14:31 . 2005-09-01 05:15 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-06 17:33 . 2010-06-06 17:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky SDK
2010-06-04 09:55 . 2010-06-04 09:55 229312 ----a-w- c:\windows\system32\drivers\cmdGuard.sys
2010-06-03 19:14 . 2007-12-16 15:52 -------- d-----w- c:\program files\AntivirusFirewall
2010-06-03 19:12 . 2007-12-16 15:54 -------- d-----w- c:\documents and settings\All Users\Application Data\F-Secure
2010-06-03 19:11 . 2005-09-01 04:53 66576 ----a-w- c:\windows\system32\perfc00C.dat
2010-06-03 19:11 . 2005-09-01 04:53 451938 ----a-w- c:\windows\system32\perfh00C.dat
2010-06-03 17:32 . 2010-06-03 17:32 4 ----a-w- c:\program files\64140.dat
2010-06-01 17:37 . 2010-06-06 19:12 221568 ------w- c:\windows\system32\MpSigStub.exe
2010-06-01 17:00 . 2010-06-01 17:00 278288 ----a-w- c:\windows\system32\guard32.dll
2010-06-01 17:00 . 2010-06-01 17:00 87824 ----a-w- c:\windows\system32\drivers\inspect.sys
2010-06-01 17:00 . 2010-06-01 17:00 25240 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2010-06-01 17:00 . 2010-06-01 17:00 15464 ----a-w- c:\windows\system32\drivers\cmderd.sys
2010-05-18 14:35 . 2010-05-18 14:35 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-05-18 14:35 . 2010-05-18 14:35 197920 ----a-w- c:\windows\system32\dnssdX.dll
2010-05-18 14:35 . 2010-05-18 14:35 107808 ----a-w- c:\windows\system32\dns-sd.exe
2010-05-06 10:33 . 2005-09-01 04:53 916480 ----a-w- c:\windows\system32\wininet.dll
2010-05-05 17:10 . 2010-05-05 17:10 4 ----a-w- c:\program files\41265.dat
2007-01-20 10:28 . 2006-10-02 14:17 88 --sh--r- c:\windows\system32\A5C174EE61.sys
2007-02-17 18:33 . 2006-10-02 14:17 5018 --sha-w- c:\windows\system32\KGyGaAvL.sys
.
[code]<pre>
c:\program files\QuickTime\qttask .exe
c:\program files\Spybot - Search & Destroy\teatimer .exe
</pre>/code
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISW"="c:\program files\CheckPoint\ZAForceField\ForceField.exe" [N/A]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2010-06-01 2039240]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-06-28 2837864]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-07-21 141608]
"AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-07-13 47904]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 39264]
c:\documents and settings\All Users\Menu D'marrer\Programmes\D'marrage\
Dell Network Assistant.lnk - c:\windows\Installer\{0240BDFB-2995-4A3F-8C96-18D41282B716}\Icon0240BDFB3.exe [2006-8-23 7168]
hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-4-6 28672]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Digital Line Detect.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSConfig]
c:\documents and settings\Famille Lambert\spyqfuv.exe \u [X]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
c:\program files\quicktime\qttask .exe -atboottime [X]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
c:\program files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe [N/A]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [N/A]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative Detector]
c:\program files\Creative\MediaSource\Detector\CTDetect.exe [N/A]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 02:33 15360 ----a-w- c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\F-Secure Manager]
c:\program files\AntivirusFirewall\Common\FSM32.EXE [N/A]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\F-Secure TNB]
c:\program files\AntivirusFirewall\FSGUI\TNBUtil.exe [N/A]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-07-21 13:53 141608 ----a-w- c:\program files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mymooz]
c:\windows\system32\poolooforew.exe [N/A]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SetDefaultMIDI]
2004-12-22 09:40 24576 ----a-w- c:\windows\MIDIDEF.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
c:\program files\Spybot - Search & Destroy\TeaTimer.exe [N/A]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Dell Network Assistant\\ezi_hnm2.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [22/07/2010 16:32 165456]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [04/06/2010 11:55 229312]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [01/06/2010 19:00 25240]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [22/07/2010 16:32 17744]
S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [22/07/2010 16:32 136176]
.
Contenu du dossier 'Tâches planifiées'
2010-07-22 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
2007-03-29 c:\windows\Tasks\FRU Task 2003-04-06 08:52ewlett-Packard2003-04-06 08:52p psc 1200 series5E771253C1676EBED677BF361FDFC537825E15B8157968151.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-05 22:52]
2010-08-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-22 14:32]
2010-08-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-22 14:32]
.
.
------- Examen supplémentaire -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
TCP: {98526CB8-C9E3-4982-8BAF-FFD27F2D33AC} = 156.154.70.22,156.154.71.22
FF - ProfilePath - c:\documents and settings\Famille Lambert\Application Data\Mozilla\Firefox\Profiles\3krwldqt.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-&p=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-&p=
FF - component: c:\documents and settings\Famille Lambert\Application Data\Mozilla\Firefox\Profiles\3krwldqt.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
FF - plugin: c:\documents and settings\Famille Lambert\Application Data\Mozilla\Firefox\Profiles\3krwldqt.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJPI142_03.dll
---- PARAMETRES FIREFOX ----
FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-02 10:56
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø*€|ÿÿÿÿ*€|ù*9~*]
"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'explorer.exe'(2548)
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Heure de fin: 2010-08-02 11:00:22
ComboFix-quarantined-files.txt 2010-08-02 09:00
ComboFix2.txt 2010-07-30 21:42
Avant-CF: 149 258 670 080 octets libres
Après-CF: 149 245 796 352 octets libres
- - End Of File - - B16388D8680B0549ABCE3CFD9DDB3B58
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1022.579 [GMT 2:00]
Lancé depuis: c:\documents and settings\Famille Lambert\Mes documents\Téléchargements\ComboFix.exe
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: COMODO Firewall *disabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
* Un nouveau point de restauration a été créé
.
((((((((((((((((((((((((((((( Fichiers créés du 2010-07-02 au 2010-08-02 ))))))))))))))))))))))))))))))))))))
.
2010-07-25 15:54 . 2010-07-25 15:54 -------- d-----w- c:\program files\iPod
2010-07-25 15:54 . 2010-07-25 15:55 -------- d-----w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-07-25 15:46 . 2010-07-25 15:46 -------- d-----w- c:\program files\Bonjour
2010-07-25 15:41 . 2010-07-25 15:41 73000 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.2.1.5\SetupAdmin.exe
2010-07-25 15:32 . 2010-07-25 15:32 71992 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\Safari 5.33.16.0\SetupAdmin.exe
2010-07-25 12:15 . 2010-07-25 12:33 -------- d-----w- c:\documents and settings\Famille Lambert\Application Data\QuickScan
2010-07-25 12:15 . 2010-05-31 14:34 702120 ----a-w- c:\documents and settings\Famille Lambert\Application Data\Mozilla\Firefox\Profiles\3krwldqt.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
2010-07-25 12:15 . 2010-05-31 14:34 868456 ----a-w- c:\documents and settings\Famille Lambert\Application Data\Mozilla\Firefox\Profiles\3krwldqt.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
2010-07-24 17:09 . 2010-07-24 17:38 -------- d-----w- c:\program files\Ad-Remover
2010-07-24 15:28 . 2010-07-24 15:51 -------- d-----w- c:\program files\Navilog1
2010-07-24 15:26 . 2010-07-24 15:57 -------- d---a-w- C:\Navilog1
2010-07-23 07:36 . 2010-07-27 13:10 -------- d-----w- c:\program files\ZHPDiag
2010-07-22 15:51 . 2010-07-22 15:51 -------- d-----w- c:\program files\Trend Micro
2010-07-22 14:37 . 2010-07-22 14:37 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2010-07-22 14:04 . 2010-07-22 14:04 -------- d-----w- c:\documents and settings\Famille Lambert\Application Data\Malwarebytes
2010-07-22 14:04 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-22 14:04 . 2010-07-22 14:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-07-22 14:04 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-07-22 14:04 . 2010-07-22 14:21 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-07-22 13:53 . 2010-07-22 13:54 -------- d-----w- c:\documents and settings\All Users\Application Data\COMODO
2010-07-22 13:41 . 2010-07-22 13:41 -------- d-----w- c:\program files\COMODO
2010-07-22 13:36 . 2010-07-22 13:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Comodo Downloader
2010-07-22 11:13 . 2010-07-22 11:13 -------- d-----w- c:\program files\CCleaner
2010-07-14 18:08 . 2010-07-14 18:08 81016 ----a-w- c:\documents and settings\NetworkService\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-07-14 18:07 . 2010-07-14 18:07 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\PCHealth
2010-07-14 14:59 . 2010-07-14 14:59 -------- d-----w- c:\windows\Internet Logs
2010-07-14 11:45 . 2010-06-14 14:31 744448 ------w- c:\windows\system32\dllcache\helpsvc.exe
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-02 08:35 . 2007-02-25 17:49 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-08-01 18:56 . 2009-09-11 16:18 -------- d-----w- c:\program files\iTunes
2010-08-01 16:32 . 2010-08-01 16:26 -------- d-----w- c:\program files\Boot_Kit
2010-07-25 15:54 . 2009-09-11 16:12 -------- d-----w- c:\program files\Fichiers communs\Apple
2010-07-25 15:50 . 2009-09-11 16:16 -------- d-----w- c:\program files\QuickTime
2010-07-25 15:36 . 2009-10-21 08:42 -------- d-----w- c:\program files\Safari
2010-07-22 14:41 . 2010-07-22 14:32 -------- d-----w- c:\program files\Google
2010-06-14 14:31 . 2005-09-01 05:15 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-06 17:33 . 2010-06-06 17:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky SDK
2010-06-04 09:55 . 2010-06-04 09:55 229312 ----a-w- c:\windows\system32\drivers\cmdGuard.sys
2010-06-03 19:14 . 2007-12-16 15:52 -------- d-----w- c:\program files\AntivirusFirewall
2010-06-03 19:12 . 2007-12-16 15:54 -------- d-----w- c:\documents and settings\All Users\Application Data\F-Secure
2010-06-03 19:11 . 2005-09-01 04:53 66576 ----a-w- c:\windows\system32\perfc00C.dat
2010-06-03 19:11 . 2005-09-01 04:53 451938 ----a-w- c:\windows\system32\perfh00C.dat
2010-06-03 17:32 . 2010-06-03 17:32 4 ----a-w- c:\program files\64140.dat
2010-06-01 17:37 . 2010-06-06 19:12 221568 ------w- c:\windows\system32\MpSigStub.exe
2010-06-01 17:00 . 2010-06-01 17:00 278288 ----a-w- c:\windows\system32\guard32.dll
2010-06-01 17:00 . 2010-06-01 17:00 87824 ----a-w- c:\windows\system32\drivers\inspect.sys
2010-06-01 17:00 . 2010-06-01 17:00 25240 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2010-06-01 17:00 . 2010-06-01 17:00 15464 ----a-w- c:\windows\system32\drivers\cmderd.sys
2010-05-18 14:35 . 2010-05-18 14:35 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-05-18 14:35 . 2010-05-18 14:35 197920 ----a-w- c:\windows\system32\dnssdX.dll
2010-05-18 14:35 . 2010-05-18 14:35 107808 ----a-w- c:\windows\system32\dns-sd.exe
2010-05-06 10:33 . 2005-09-01 04:53 916480 ----a-w- c:\windows\system32\wininet.dll
2010-05-05 17:10 . 2010-05-05 17:10 4 ----a-w- c:\program files\41265.dat
2007-01-20 10:28 . 2006-10-02 14:17 88 --sh--r- c:\windows\system32\A5C174EE61.sys
2007-02-17 18:33 . 2006-10-02 14:17 5018 --sha-w- c:\windows\system32\KGyGaAvL.sys
.
[code]<pre>
c:\program files\QuickTime\qttask .exe
c:\program files\Spybot - Search & Destroy\teatimer .exe
</pre>/code
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISW"="c:\program files\CheckPoint\ZAForceField\ForceField.exe" [N/A]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2010-06-01 2039240]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-06-28 2837864]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-07-21 141608]
"AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-07-13 47904]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 39264]
c:\documents and settings\All Users\Menu D'marrer\Programmes\D'marrage\
Dell Network Assistant.lnk - c:\windows\Installer\{0240BDFB-2995-4A3F-8C96-18D41282B716}\Icon0240BDFB3.exe [2006-8-23 7168]
hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-4-6 28672]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Digital Line Detect.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSConfig]
c:\documents and settings\Famille Lambert\spyqfuv.exe \u [X]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
c:\program files\quicktime\qttask .exe -atboottime [X]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
c:\program files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe [N/A]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [N/A]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative Detector]
c:\program files\Creative\MediaSource\Detector\CTDetect.exe [N/A]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 02:33 15360 ----a-w- c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\F-Secure Manager]
c:\program files\AntivirusFirewall\Common\FSM32.EXE [N/A]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\F-Secure TNB]
c:\program files\AntivirusFirewall\FSGUI\TNBUtil.exe [N/A]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-07-21 13:53 141608 ----a-w- c:\program files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mymooz]
c:\windows\system32\poolooforew.exe [N/A]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SetDefaultMIDI]
2004-12-22 09:40 24576 ----a-w- c:\windows\MIDIDEF.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
c:\program files\Spybot - Search & Destroy\TeaTimer.exe [N/A]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Dell Network Assistant\\ezi_hnm2.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [22/07/2010 16:32 165456]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [04/06/2010 11:55 229312]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [01/06/2010 19:00 25240]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [22/07/2010 16:32 17744]
S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [22/07/2010 16:32 136176]
.
Contenu du dossier 'Tâches planifiées'
2010-07-22 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
2007-03-29 c:\windows\Tasks\FRU Task 2003-04-06 08:52ewlett-Packard2003-04-06 08:52p psc 1200 series5E771253C1676EBED677BF361FDFC537825E15B8157968151.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-05 22:52]
2010-08-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-22 14:32]
2010-08-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-22 14:32]
.
.
------- Examen supplémentaire -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
TCP: {98526CB8-C9E3-4982-8BAF-FFD27F2D33AC} = 156.154.70.22,156.154.71.22
FF - ProfilePath - c:\documents and settings\Famille Lambert\Application Data\Mozilla\Firefox\Profiles\3krwldqt.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-&p=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-&p=
FF - component: c:\documents and settings\Famille Lambert\Application Data\Mozilla\Firefox\Profiles\3krwldqt.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
FF - plugin: c:\documents and settings\Famille Lambert\Application Data\Mozilla\Firefox\Profiles\3krwldqt.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJPI142_03.dll
---- PARAMETRES FIREFOX ----
FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-02 10:56
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø*€|ÿÿÿÿ*€|ù*9~*]
"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'explorer.exe'(2548)
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Heure de fin: 2010-08-02 11:00:22
ComboFix-quarantined-files.txt 2010-08-02 09:00
ComboFix2.txt 2010-07-30 21:42
Avant-CF: 149 258 670 080 octets libres
Après-CF: 149 245 796 352 octets libres
- - End Of File - - B16388D8680B0549ABCE3CFD9DDB3B58
/!\ ATTENTION /!\ Le script qui suit a été écrit spécialement pour Robinson27 , il n'est pas transposable sur un autre ordinateur !
* Télécharge ce dossier Robinson27.zip
* Fais un clic-droit dessus --> Extraire tout --> choisis le Bureau comme destination
* Un autre dossier va apparaitre, prends le fichier CFScript.txt qui se trouve à l'intérieur et place le sur le Bureau et pas ailleurs.
* Désactive tes logiciels de protection
* Fais un glisser/déposer de ce fichier CFScript.txt sur le fichier Combofix.exe
comme ceci :http://img155.imageshack.us/img155/4837/cfscriptop0.gif
* Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal !
/!\ Ne touche ni à la souris, ni au clavier durant le scan /!\
* Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
* Si le fichier ne s'ouvre pas, il se trouve ici ? C:\ComboFix.txt
* Télécharge ce dossier Robinson27.zip
* Fais un clic-droit dessus --> Extraire tout --> choisis le Bureau comme destination
* Un autre dossier va apparaitre, prends le fichier CFScript.txt qui se trouve à l'intérieur et place le sur le Bureau et pas ailleurs.
* Désactive tes logiciels de protection
* Fais un glisser/déposer de ce fichier CFScript.txt sur le fichier Combofix.exe
comme ceci :http://img155.imageshack.us/img155/4837/cfscriptop0.gif
* Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal !
/!\ Ne touche ni à la souris, ni au clavier durant le scan /!\
* Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
* Si le fichier ne s'ouvre pas, il se trouve ici ? C:\ComboFix.txt
ok .Fait ce nouveau script.
pour robinson27
Héberge le rapport C:\Combofix.txt sur le site cijoint.fr, puis copie/colle le lien fournit dans ta prochaine réponse sur le forum
pour robinson27
Héberge le rapport C:\Combofix.txt sur le site cijoint.fr, puis copie/colle le lien fournit dans ta prochaine réponse sur le forum
