Rapport combofix
uto
-
crapoulou Messages postés 42848 Date d'inscription Statut Modérateur, Contributeur sécurité Dernière intervention -
crapoulou Messages postés 42848 Date d'inscription Statut Modérateur, Contributeur sécurité Dernière intervention -
Bonjour, on m'a dit de poster mon rapport sur le forum... Personnellement, je n'y capte que dalle ^^
M'enfin :
ComboFix 10-11-13.01 - Compaq_Propriétaire 14/11/2010 16:21:05.1.2 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.959.295 [GMT 1:00]
Lancé depuis: c:\documents and settings\Compaq_Propriétaire\Bureau\ashedi.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Compaq_Propriétaire\Application Data\Microsoft\svchost.exe
c:\windows\system32\drivers\npf.sys
c:\windows\system32\Packet.dll
c:\windows\system32\pthreadVC.dll
c:\windows\system32\wpcap.dll
c:\windows\TEMP\logishrd\LVPrcInj02.dll
D:\Autorun.inf
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_NPF
-------\Service_NPF
((((((((((((((((((((((((((((( Fichiers créés du 2010-10-14 au 2010-11-14 ))))))))))))))))))))))))))))))))))))
.
2010-11-13 08:22 . 2010-11-13 08:22 -------- d-----w- c:\windows\Sun
2010-11-09 23:37 . 2010-11-09 23:37 -------- d-----w- c:\program files\CamStudio
2010-11-09 08:42 . 2008-04-14 02:33 26624 ----a-w- c:\documents and settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2010-11-08 20:29 . 2010-11-08 20:29 -------- d-----w- c:\program files\Windows Media Connect 2
2010-11-08 20:28 . 2010-11-08 20:29 -------- d-----w- C:\5f347cf02293defc01d0d4c0d1bc8197
2010-11-08 20:27 . 2010-11-09 09:05 -------- d-----w- c:\windows\system32\drivers\UMDF
2010-11-08 20:27 . 2010-11-08 20:27 -------- d-----w- c:\windows\system32\LogFiles
2010-11-06 12:10 . 2009-09-04 16:29 1892184 ----a-w- c:\windows\system32\D3DX9_42.dll
2010-11-06 12:10 . 2006-09-28 15:05 2414360 ----a-w- c:\windows\system32\d3dx9_31.dll
2010-11-06 12:10 . 2010-11-06 12:10 -------- d-----w- c:\windows\Logs
2010-11-06 12:09 . 2010-11-06 12:09 -------- d-----w- c:\program files\Winamp Detect
2010-11-06 12:09 . 2009-04-28 20:20 129520 ------w- c:\windows\system32\pxafs.dll
2010-11-06 12:09 . 2010-11-06 12:11 -------- d-----w- c:\program files\Winamp
2010-11-05 16:09 . 2010-09-18 06:53 974848 ------w- c:\windows\system32\dllcache\mfc42.dll
2010-11-05 16:09 . 2010-09-18 06:53 953856 ------w- c:\windows\system32\dllcache\mfc40u.dll
2010-11-05 16:07 . 2010-08-23 16:12 617472 ------w- c:\windows\system32\dllcache\comctl32.dll
2010-11-05 13:50 . 2010-11-05 13:50 -------- d-----w- c:\windows\l2schemas
2010-11-05 13:50 . 2010-11-05 13:50 -------- d-----w- c:\windows\system32\fr
2010-11-05 13:50 . 2010-11-05 13:50 -------- d-----w- c:\windows\system32\bits
2010-11-05 13:39 . 2010-11-05 13:39 -------- d-----w- c:\windows\EHome
2010-11-05 13:31 . 2010-11-05 13:31 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-11-05 13:13 . 2010-09-10 05:50 12800 ------w- c:\windows\system32\dllcache\xpshims.dll
2010-11-05 13:13 . 2010-09-10 05:50 602112 ------w- c:\windows\system32\dllcache\msfeeds.dll
2010-11-05 13:13 . 2010-09-10 05:50 55296 ------w- c:\windows\system32\dllcache\msfeedsbs.dll
2010-11-05 13:13 . 2010-09-10 05:50 1986560 ------w- c:\windows\system32\dllcache\iertutil.dll
2010-11-05 13:13 . 2010-09-10 05:50 247808 ------w- c:\windows\system32\dllcache\ieproxy.dll
2010-11-05 13:13 . 2010-09-10 05:50 11080192 ------w- c:\windows\system32\dllcache\ieframe.dll
2010-11-05 13:13 . 2010-09-10 05:50 743424 ------w- c:\windows\system32\dllcache\iedvtool.dll
2010-11-05 13:12 . 2010-11-05 13:50 -------- d-----w- c:\windows\system32\fr-FR
2010-11-05 13:12 . 2010-11-05 13:13 -------- dc-h--w- c:\windows\ie8
2010-11-05 11:01 . 2010-11-13 08:25 -------- d-----w- c:\windows\system32\NtmsData
2010-11-04 08:47 . 2010-11-04 08:47 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2010-11-04 08:45 . 2010-11-04 08:45 -------- d-----w- c:\program files\CCleaner
2010-11-04 08:42 . 2010-11-04 08:42 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2010-11-01 18:17 . 2010-11-01 18:17 -------- d-----w- c:\program files\MSXML 4.0
2010-11-01 18:05 . 2008-04-13 18:39 5504 ----a-w- c:\windows\system32\drivers\mstee.sys
2010-11-01 18:05 . 2008-04-13 18:46 10880 ----a-w- c:\windows\system32\drivers\ndisip.sys
2010-11-01 18:05 . 2008-04-13 18:46 15232 ----a-w- c:\windows\system32\drivers\streamip.sys
2010-11-01 18:05 . 2008-04-14 02:34 16384 ----a-w- c:\windows\system32\ipsink.ax
2010-11-01 18:05 . 2008-04-13 18:46 11136 ----a-w- c:\windows\system32\drivers\slip.sys
2010-11-01 18:05 . 2008-04-13 18:46 19200 ----a-w- c:\windows\system32\drivers\wstcodec.sys
2010-11-01 18:05 . 2008-04-13 18:46 85248 ----a-w- c:\windows\system32\drivers\nabtsfec.sys
2010-11-01 18:03 . 2010-11-01 18:08 -------- d-----w- c:\documents and settings\All Users\Application Data\LogiShrd
2010-11-01 18:03 . 2010-11-09 19:49 -------- d-----w- c:\program files\Logitech
2010-11-01 15:59 . 2010-11-01 15:59 -------- d-----w- c:\program files\Apowersoft
2010-11-01 15:31 . 2004-08-03 23:38 327168 ------w- c:\windows\system32\drivers\ati2mtaa.sys
2010-11-01 15:27 . 2010-11-01 15:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Messenger Plus!
2010-11-01 15:27 . 2010-11-01 15:27 -------- d-----w- c:\program files\Messenger Plus! Live
2010-11-01 14:58 . 2010-03-15 09:31 165376 ----a-w- c:\windows\system32\unrar.dll
2010-11-01 14:58 . 2010-01-17 15:18 151552 ----a-w- c:\windows\system32\ac3acm.acm
2010-11-01 14:58 . 2008-09-24 18:41 839680 ----a-w- c:\windows\system32\lameACM.acm
2010-11-01 14:58 . 2004-01-25 16:18 217088 ----a-w- c:\windows\system32\yv12vfw.dll
2010-11-01 14:58 . 2010-08-12 08:00 108032 ----a-w- c:\windows\system32\ff_vfw.dll
2010-11-01 14:58 . 2010-06-08 16:10 790528 ----a-w- c:\windows\system32\xvidcore.dll
2010-11-01 14:58 . 2010-06-08 16:10 134144 ----a-w- c:\windows\system32\xvidvfw.dll
2010-11-01 14:58 . 2010-11-01 14:58 -------- d-----w- c:\program files\K-Lite Codec Pack
2010-11-01 14:51 . 2010-11-01 14:51 -------- d-----w- c:\program files\VLC Player
2010-11-01 14:51 . 2010-11-01 14:51 -------- d-----w- c:\program files\Babylon
2010-11-01 14:44 . 2009-02-06 10:10 227840 ------w- c:\windows\system32\dllcache\wmiprvse.exe
2010-11-01 14:44 . 2010-04-28 18:13 2192000 ------w- c:\windows\system32\dllcache\ntoskrnl.exe
2010-11-01 14:44 . 2009-03-06 14:20 286720 ------w- c:\windows\system32\dllcache\pdh.dll
2010-11-01 14:44 . 2009-02-09 11:23 111104 ------w- c:\windows\system32\dllcache\services.exe
2010-11-01 14:44 . 2009-02-09 10:53 473600 ------w- c:\windows\system32\dllcache\fastprox.dll
2010-11-01 14:44 . 2009-02-09 10:53 401408 ------w- c:\windows\system32\dllcache\rpcss.dll
2010-11-01 14:44 . 2009-06-25 08:26 736768 ------w- c:\windows\system32\dllcache\lsasrv.dll
2010-11-01 14:44 . 2009-02-09 10:53 685568 ------w- c:\windows\system32\dllcache\advapi32.dll
2010-11-01 14:44 . 2009-02-09 10:53 453120 ------w- c:\windows\system32\dllcache\wmiprvsd.dll
2010-11-01 14:44 . 2009-02-09 10:53 739840 ------w- c:\windows\system32\dllcache\ntdll.dll
2010-11-01 14:44 . 2010-04-28 05:43 2148352 ------w- c:\windows\system32\dllcache\ntkrnlmp.exe
2010-11-01 14:44 . 2010-04-28 05:43 2026496 ------w- c:\windows\system32\dllcache\ntkrpamp.exe
2010-11-01 14:28 . 2010-07-16 12:04 221696 ------w- c:\windows\system32\dllcache\wordpad.exe
2010-11-01 14:28 . 2008-06-14 17:33 272768 ------w- c:\windows\system32\dllcache\bthport.sys
2010-11-01 14:28 . 2008-06-14 17:33 272768 ------w- c:\windows\system32\drivers\bthport.sys
2010-11-01 14:27 . 2010-08-26 13:39 357248 ------w- c:\windows\system32\dllcache\srv.sys
2010-11-01 14:26 . 2010-02-24 13:11 455680 ------w- c:\windows\system32\dllcache\mrxsmb.sys
2010-11-01 14:26 . 2009-11-21 15:58 471552 ------w- c:\windows\system32\dllcache\aclayers.dll
2010-11-01 14:26 . 2010-06-14 14:31 744448 ------w- c:\windows\system32\dllcache\helpsvc.exe
2010-11-01 14:25 . 2010-08-27 08:02 119808 ------w- c:\windows\system32\dllcache\t2embed.dll
2010-11-01 14:25 . 2009-10-15 16:32 81920 ------w- c:\windows\system32\dllcache\fontsub.dll
2010-10-30 19:28 . 2010-11-05 13:47 -------- d-----w- c:\windows\ServicePackFiles
2010-10-30 19:27 . 2008-05-08 14:02 203136 ------w- c:\windows\system32\dllcache\rmcast.sys
2010-10-30 19:27 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
2010-10-30 19:26 . 2009-08-25 09:18 354816 ------w- c:\windows\system32\dllcache\winhttp.dll
2010-10-30 19:25 . 2008-10-15 16:35 337408 ------w- c:\windows\system32\dllcache\netapi32.dll
2010-10-28 13:50 . 2010-08-17 11:39 60936 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-10-28 13:50 . 2010-08-17 11:39 126856 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-10-28 13:50 . 2010-06-17 13:28 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2010-10-28 13:50 . 2010-06-17 13:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2010-10-28 13:50 . 2010-10-28 13:50 -------- d-----w- c:\program files\Avira
2010-10-28 13:50 . 2010-10-28 13:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2010-10-28 13:46 . 2001-08-23 15:04 12288 ----a-w- c:\windows\system32\drivers\mouhid.sys
2010-10-28 13:46 . 2008-04-13 18:45 60032 ----a-w- c:\windows\system32\drivers\usbaudio.sys
2010-10-28 13:46 . 2008-04-13 18:45 10368 ----a-w- c:\windows\system32\drivers\hidusb.sys
2010-10-28 13:46 . 2008-04-13 18:45 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2010-10-28 13:29 . 2010-10-28 13:29 -------- d-----w- c:\program files\Microsoft
2010-10-28 13:29 . 2010-10-28 13:29 -------- d-----w- c:\program files\Windows Live SkyDrive
2010-10-28 13:28 . 2010-10-28 13:29 -------- d-----w- c:\program files\Windows Live
2010-10-28 13:17 . 2010-10-28 13:17 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-10-28 13:17 . 2010-10-28 13:17 472808 ----a-w- c:\windows\system32\deployJava1.dll
2010-10-28 13:09 . 2010-10-28 13:09 -------- d-----w- c:\program files\Fichiers communs\Windows Live
2010-10-28 12:51 . 2010-11-10 17:15 -------- d-----w- c:\documents and settings\Compaq_Propriétaire
2010-10-28 12:50 . 2006-01-02 21:23 -------- d-----w- c:\windows\system32\config\systemprofile\WINDOWS
2010-10-28 12:49 . 2006-01-02 21:23 -------- d-----w- c:\documents and settings\Default User\WINDOWS
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-18 11:23 . 2004-08-05 11:00 974848 ----a-w- c:\windows\system32\mfc42u.dll
2010-09-18 06:53 . 2004-08-05 11:00 974848 ----a-w- c:\windows\system32\mfc42.dll
2010-09-18 06:53 . 2004-08-05 04:00 954368 ----a-w- c:\windows\system32\mfc40.dll
2010-09-18 06:53 . 2004-08-05 04:00 953856 ----a-w- c:\windows\system32\mfc40u.dll
2010-09-10 05:50 . 2004-08-05 11:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-09-10 05:50 . 2004-08-05 11:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-09-10 05:50 . 2004-08-05 11:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2010-09-01 11:51 . 2004-08-05 11:00 285824 ----a-w- c:\windows\system32\atmfd.dll
2010-09-01 07:55 . 2004-08-05 11:00 1852928 ----a-w- c:\windows\system32\win32k.sys
2010-08-27 08:02 . 2004-08-05 11:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2010-08-27 05:58 . 2004-08-05 11:00 99840 ----a-w- c:\windows\system32\srvsvc.dll
2010-08-27 01:43 . 2008-05-05 06:25 5632 ----a-w- c:\windows\system32\xpsp4res.dll
2010-08-26 13:39 . 2004-08-05 11:00 357248 ----a-w- c:\windows\system32\drivers\srv.sys
2010-08-23 16:12 . 2004-08-05 11:00 617472 ----a-w- c:\windows\system32\comctl32.dll
2010-08-17 13:17 . 2004-08-05 11:00 58880 ----a-w- c:\windows\system32\spoolsv.exe
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-03-08 16010240]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-22 237568]
"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-15 249856]
"HP Software Update"="c:\program files\HP\HP Software Update\HPwuSchd2.exe" [2005-02-17 49152]
"SunJavaUpdateSched"="c:\program files\Fichiers communs\Java\Java Update\jusched.exe" [2010-05-14 248552]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-08-17 281768]
"LogitechQuickCamRibbon"="c:\program files\Logitech\Logitech WebCam Software\LWS.exe" [2009-10-14 2793304]
c:\documents and settings\Compaq_Propri'taire\Menu D'marrer\Programmes\D'marrage\
Logitech . Enregistrement du produit.lnk - c:\program files\Logitech\Logitech WebCam Software\eReg.exe [2009-10-14 517384]
c:\documents and settings\Compaq_Propri'taire\Menu D'marrer\Programmes\D'marrage\
Logitech . Enregistrement du produit.lnk - c:\program files\Logitech\Logitech WebCam Software\eReg.exe [2009-10-14 517384]
c:\documents and settings\Compaq_Propri'taire\Menu D'marrer\Programmes\D'marrage\
Logitech . Enregistrement du produit.lnk - c:\program files\Logitech\Logitech WebCam Software\eReg.exe [2009-10-14 517384]
c:\documents and settings\Compaq_Propri'taire\Menu D'marrer\Programmes\D'marrage\
Logitech . Enregistrement du produit.lnk - c:\program files\Logitech\Logitech WebCam Software\eReg.exe [2009-10-14 517384]
c:\documents and settings\Default User\Menu D'marrer\Programmes\D'marrage\
Pin.lnk - c:\hp\bin\CLOAKER.EXE [2006-1-2 27136]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Documents and Settings\\Compaq_Propriétaire\\Mes documents\\Téléchargements\\setup.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Logitech\\Vid HD\\Vid.exe"=
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [28/10/2010 14:50 135336]
S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [04/11/2010 09:42 136176]
.
Contenu du dossier 'Tâches planifiées'
2010-11-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-04 08:42]
2010-11-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-04 08:42]
2010-11-14 c:\windows\Tasks\User_Feed_Synchronization-{3C9BB79D-743E-4840-9C79-D339E916F7E1}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 03:31]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://search.babylon.com/home?AF=15627
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=63&bd=PRESARIO&pf=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=63&bd=PRESARIO&pf=desktop
uInternet Settings,ProxyServer = http=127.0.0.1:50370
IE: &Traduire à partir de l'anglais - c:\program files\Google\GoogleToolbar1.dll/cmwordtrans.html
IE: Pages liées - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Pages similaires - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Recherche &Google - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: Version de la page actuelle disponible dans le cache Google - c:\program files\Google\GoogleToolbar1.dll/cmcache.html
FF - ProfilePath - c:\documents and settings\Compaq_Propriétaire\Application Data\Mozilla\Firefox\Profiles\zfak4hww.default\
FF - prefs.js: keyword.URL - hxxp://utils.babylon.com/abt/index.php?url=
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 50370
FF - prefs.js: network.proxy.type - 1
FF - plugin: c:\program files\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npwachk.dll
---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true); // Simplified
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - ORPHELINS SUPPRIMES - - - -
HKLM-Run-PCDrProfiler - (no file)
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-14 16:27
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(604)
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'explorer.exe'(3612)
c:\windows\TEMP\logishrd\LVPrcInj01.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\RTHDCPL.EXE
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\program files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
c:\windows\System32\vssvc.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\rsmsink.exe
.
**************************************************************************
.
Heure de fin: 2010-11-14 16:30:27 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-11-14 15:30
Avant-CF: 136 261 181 440 octets libres
Après-CF: 140 514 783 232 octets libres
- - End Of File - - 56BF1CDDA19864442B096DED8B8FFDC1
M'enfin :
ComboFix 10-11-13.01 - Compaq_Propriétaire 14/11/2010 16:21:05.1.2 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.959.295 [GMT 1:00]
Lancé depuis: c:\documents and settings\Compaq_Propriétaire\Bureau\ashedi.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Compaq_Propriétaire\Application Data\Microsoft\svchost.exe
c:\windows\system32\drivers\npf.sys
c:\windows\system32\Packet.dll
c:\windows\system32\pthreadVC.dll
c:\windows\system32\wpcap.dll
c:\windows\TEMP\logishrd\LVPrcInj02.dll
D:\Autorun.inf
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_NPF
-------\Service_NPF
((((((((((((((((((((((((((((( Fichiers créés du 2010-10-14 au 2010-11-14 ))))))))))))))))))))))))))))))))))))
.
2010-11-13 08:22 . 2010-11-13 08:22 -------- d-----w- c:\windows\Sun
2010-11-09 23:37 . 2010-11-09 23:37 -------- d-----w- c:\program files\CamStudio
2010-11-09 08:42 . 2008-04-14 02:33 26624 ----a-w- c:\documents and settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2010-11-08 20:29 . 2010-11-08 20:29 -------- d-----w- c:\program files\Windows Media Connect 2
2010-11-08 20:28 . 2010-11-08 20:29 -------- d-----w- C:\5f347cf02293defc01d0d4c0d1bc8197
2010-11-08 20:27 . 2010-11-09 09:05 -------- d-----w- c:\windows\system32\drivers\UMDF
2010-11-08 20:27 . 2010-11-08 20:27 -------- d-----w- c:\windows\system32\LogFiles
2010-11-06 12:10 . 2009-09-04 16:29 1892184 ----a-w- c:\windows\system32\D3DX9_42.dll
2010-11-06 12:10 . 2006-09-28 15:05 2414360 ----a-w- c:\windows\system32\d3dx9_31.dll
2010-11-06 12:10 . 2010-11-06 12:10 -------- d-----w- c:\windows\Logs
2010-11-06 12:09 . 2010-11-06 12:09 -------- d-----w- c:\program files\Winamp Detect
2010-11-06 12:09 . 2009-04-28 20:20 129520 ------w- c:\windows\system32\pxafs.dll
2010-11-06 12:09 . 2010-11-06 12:11 -------- d-----w- c:\program files\Winamp
2010-11-05 16:09 . 2010-09-18 06:53 974848 ------w- c:\windows\system32\dllcache\mfc42.dll
2010-11-05 16:09 . 2010-09-18 06:53 953856 ------w- c:\windows\system32\dllcache\mfc40u.dll
2010-11-05 16:07 . 2010-08-23 16:12 617472 ------w- c:\windows\system32\dllcache\comctl32.dll
2010-11-05 13:50 . 2010-11-05 13:50 -------- d-----w- c:\windows\l2schemas
2010-11-05 13:50 . 2010-11-05 13:50 -------- d-----w- c:\windows\system32\fr
2010-11-05 13:50 . 2010-11-05 13:50 -------- d-----w- c:\windows\system32\bits
2010-11-05 13:39 . 2010-11-05 13:39 -------- d-----w- c:\windows\EHome
2010-11-05 13:31 . 2010-11-05 13:31 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-11-05 13:13 . 2010-09-10 05:50 12800 ------w- c:\windows\system32\dllcache\xpshims.dll
2010-11-05 13:13 . 2010-09-10 05:50 602112 ------w- c:\windows\system32\dllcache\msfeeds.dll
2010-11-05 13:13 . 2010-09-10 05:50 55296 ------w- c:\windows\system32\dllcache\msfeedsbs.dll
2010-11-05 13:13 . 2010-09-10 05:50 1986560 ------w- c:\windows\system32\dllcache\iertutil.dll
2010-11-05 13:13 . 2010-09-10 05:50 247808 ------w- c:\windows\system32\dllcache\ieproxy.dll
2010-11-05 13:13 . 2010-09-10 05:50 11080192 ------w- c:\windows\system32\dllcache\ieframe.dll
2010-11-05 13:13 . 2010-09-10 05:50 743424 ------w- c:\windows\system32\dllcache\iedvtool.dll
2010-11-05 13:12 . 2010-11-05 13:50 -------- d-----w- c:\windows\system32\fr-FR
2010-11-05 13:12 . 2010-11-05 13:13 -------- dc-h--w- c:\windows\ie8
2010-11-05 11:01 . 2010-11-13 08:25 -------- d-----w- c:\windows\system32\NtmsData
2010-11-04 08:47 . 2010-11-04 08:47 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2010-11-04 08:45 . 2010-11-04 08:45 -------- d-----w- c:\program files\CCleaner
2010-11-04 08:42 . 2010-11-04 08:42 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2010-11-01 18:17 . 2010-11-01 18:17 -------- d-----w- c:\program files\MSXML 4.0
2010-11-01 18:05 . 2008-04-13 18:39 5504 ----a-w- c:\windows\system32\drivers\mstee.sys
2010-11-01 18:05 . 2008-04-13 18:46 10880 ----a-w- c:\windows\system32\drivers\ndisip.sys
2010-11-01 18:05 . 2008-04-13 18:46 15232 ----a-w- c:\windows\system32\drivers\streamip.sys
2010-11-01 18:05 . 2008-04-14 02:34 16384 ----a-w- c:\windows\system32\ipsink.ax
2010-11-01 18:05 . 2008-04-13 18:46 11136 ----a-w- c:\windows\system32\drivers\slip.sys
2010-11-01 18:05 . 2008-04-13 18:46 19200 ----a-w- c:\windows\system32\drivers\wstcodec.sys
2010-11-01 18:05 . 2008-04-13 18:46 85248 ----a-w- c:\windows\system32\drivers\nabtsfec.sys
2010-11-01 18:03 . 2010-11-01 18:08 -------- d-----w- c:\documents and settings\All Users\Application Data\LogiShrd
2010-11-01 18:03 . 2010-11-09 19:49 -------- d-----w- c:\program files\Logitech
2010-11-01 15:59 . 2010-11-01 15:59 -------- d-----w- c:\program files\Apowersoft
2010-11-01 15:31 . 2004-08-03 23:38 327168 ------w- c:\windows\system32\drivers\ati2mtaa.sys
2010-11-01 15:27 . 2010-11-01 15:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Messenger Plus!
2010-11-01 15:27 . 2010-11-01 15:27 -------- d-----w- c:\program files\Messenger Plus! Live
2010-11-01 14:58 . 2010-03-15 09:31 165376 ----a-w- c:\windows\system32\unrar.dll
2010-11-01 14:58 . 2010-01-17 15:18 151552 ----a-w- c:\windows\system32\ac3acm.acm
2010-11-01 14:58 . 2008-09-24 18:41 839680 ----a-w- c:\windows\system32\lameACM.acm
2010-11-01 14:58 . 2004-01-25 16:18 217088 ----a-w- c:\windows\system32\yv12vfw.dll
2010-11-01 14:58 . 2010-08-12 08:00 108032 ----a-w- c:\windows\system32\ff_vfw.dll
2010-11-01 14:58 . 2010-06-08 16:10 790528 ----a-w- c:\windows\system32\xvidcore.dll
2010-11-01 14:58 . 2010-06-08 16:10 134144 ----a-w- c:\windows\system32\xvidvfw.dll
2010-11-01 14:58 . 2010-11-01 14:58 -------- d-----w- c:\program files\K-Lite Codec Pack
2010-11-01 14:51 . 2010-11-01 14:51 -------- d-----w- c:\program files\VLC Player
2010-11-01 14:51 . 2010-11-01 14:51 -------- d-----w- c:\program files\Babylon
2010-11-01 14:44 . 2009-02-06 10:10 227840 ------w- c:\windows\system32\dllcache\wmiprvse.exe
2010-11-01 14:44 . 2010-04-28 18:13 2192000 ------w- c:\windows\system32\dllcache\ntoskrnl.exe
2010-11-01 14:44 . 2009-03-06 14:20 286720 ------w- c:\windows\system32\dllcache\pdh.dll
2010-11-01 14:44 . 2009-02-09 11:23 111104 ------w- c:\windows\system32\dllcache\services.exe
2010-11-01 14:44 . 2009-02-09 10:53 473600 ------w- c:\windows\system32\dllcache\fastprox.dll
2010-11-01 14:44 . 2009-02-09 10:53 401408 ------w- c:\windows\system32\dllcache\rpcss.dll
2010-11-01 14:44 . 2009-06-25 08:26 736768 ------w- c:\windows\system32\dllcache\lsasrv.dll
2010-11-01 14:44 . 2009-02-09 10:53 685568 ------w- c:\windows\system32\dllcache\advapi32.dll
2010-11-01 14:44 . 2009-02-09 10:53 453120 ------w- c:\windows\system32\dllcache\wmiprvsd.dll
2010-11-01 14:44 . 2009-02-09 10:53 739840 ------w- c:\windows\system32\dllcache\ntdll.dll
2010-11-01 14:44 . 2010-04-28 05:43 2148352 ------w- c:\windows\system32\dllcache\ntkrnlmp.exe
2010-11-01 14:44 . 2010-04-28 05:43 2026496 ------w- c:\windows\system32\dllcache\ntkrpamp.exe
2010-11-01 14:28 . 2010-07-16 12:04 221696 ------w- c:\windows\system32\dllcache\wordpad.exe
2010-11-01 14:28 . 2008-06-14 17:33 272768 ------w- c:\windows\system32\dllcache\bthport.sys
2010-11-01 14:28 . 2008-06-14 17:33 272768 ------w- c:\windows\system32\drivers\bthport.sys
2010-11-01 14:27 . 2010-08-26 13:39 357248 ------w- c:\windows\system32\dllcache\srv.sys
2010-11-01 14:26 . 2010-02-24 13:11 455680 ------w- c:\windows\system32\dllcache\mrxsmb.sys
2010-11-01 14:26 . 2009-11-21 15:58 471552 ------w- c:\windows\system32\dllcache\aclayers.dll
2010-11-01 14:26 . 2010-06-14 14:31 744448 ------w- c:\windows\system32\dllcache\helpsvc.exe
2010-11-01 14:25 . 2010-08-27 08:02 119808 ------w- c:\windows\system32\dllcache\t2embed.dll
2010-11-01 14:25 . 2009-10-15 16:32 81920 ------w- c:\windows\system32\dllcache\fontsub.dll
2010-10-30 19:28 . 2010-11-05 13:47 -------- d-----w- c:\windows\ServicePackFiles
2010-10-30 19:27 . 2008-05-08 14:02 203136 ------w- c:\windows\system32\dllcache\rmcast.sys
2010-10-30 19:27 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
2010-10-30 19:26 . 2009-08-25 09:18 354816 ------w- c:\windows\system32\dllcache\winhttp.dll
2010-10-30 19:25 . 2008-10-15 16:35 337408 ------w- c:\windows\system32\dllcache\netapi32.dll
2010-10-28 13:50 . 2010-08-17 11:39 60936 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-10-28 13:50 . 2010-08-17 11:39 126856 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-10-28 13:50 . 2010-06-17 13:28 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2010-10-28 13:50 . 2010-06-17 13:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2010-10-28 13:50 . 2010-10-28 13:50 -------- d-----w- c:\program files\Avira
2010-10-28 13:50 . 2010-10-28 13:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2010-10-28 13:46 . 2001-08-23 15:04 12288 ----a-w- c:\windows\system32\drivers\mouhid.sys
2010-10-28 13:46 . 2008-04-13 18:45 60032 ----a-w- c:\windows\system32\drivers\usbaudio.sys
2010-10-28 13:46 . 2008-04-13 18:45 10368 ----a-w- c:\windows\system32\drivers\hidusb.sys
2010-10-28 13:46 . 2008-04-13 18:45 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2010-10-28 13:29 . 2010-10-28 13:29 -------- d-----w- c:\program files\Microsoft
2010-10-28 13:29 . 2010-10-28 13:29 -------- d-----w- c:\program files\Windows Live SkyDrive
2010-10-28 13:28 . 2010-10-28 13:29 -------- d-----w- c:\program files\Windows Live
2010-10-28 13:17 . 2010-10-28 13:17 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-10-28 13:17 . 2010-10-28 13:17 472808 ----a-w- c:\windows\system32\deployJava1.dll
2010-10-28 13:09 . 2010-10-28 13:09 -------- d-----w- c:\program files\Fichiers communs\Windows Live
2010-10-28 12:51 . 2010-11-10 17:15 -------- d-----w- c:\documents and settings\Compaq_Propriétaire
2010-10-28 12:50 . 2006-01-02 21:23 -------- d-----w- c:\windows\system32\config\systemprofile\WINDOWS
2010-10-28 12:49 . 2006-01-02 21:23 -------- d-----w- c:\documents and settings\Default User\WINDOWS
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-18 11:23 . 2004-08-05 11:00 974848 ----a-w- c:\windows\system32\mfc42u.dll
2010-09-18 06:53 . 2004-08-05 11:00 974848 ----a-w- c:\windows\system32\mfc42.dll
2010-09-18 06:53 . 2004-08-05 04:00 954368 ----a-w- c:\windows\system32\mfc40.dll
2010-09-18 06:53 . 2004-08-05 04:00 953856 ----a-w- c:\windows\system32\mfc40u.dll
2010-09-10 05:50 . 2004-08-05 11:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-09-10 05:50 . 2004-08-05 11:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-09-10 05:50 . 2004-08-05 11:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2010-09-01 11:51 . 2004-08-05 11:00 285824 ----a-w- c:\windows\system32\atmfd.dll
2010-09-01 07:55 . 2004-08-05 11:00 1852928 ----a-w- c:\windows\system32\win32k.sys
2010-08-27 08:02 . 2004-08-05 11:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2010-08-27 05:58 . 2004-08-05 11:00 99840 ----a-w- c:\windows\system32\srvsvc.dll
2010-08-27 01:43 . 2008-05-05 06:25 5632 ----a-w- c:\windows\system32\xpsp4res.dll
2010-08-26 13:39 . 2004-08-05 11:00 357248 ----a-w- c:\windows\system32\drivers\srv.sys
2010-08-23 16:12 . 2004-08-05 11:00 617472 ----a-w- c:\windows\system32\comctl32.dll
2010-08-17 13:17 . 2004-08-05 11:00 58880 ----a-w- c:\windows\system32\spoolsv.exe
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-03-08 16010240]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-22 237568]
"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-15 249856]
"HP Software Update"="c:\program files\HP\HP Software Update\HPwuSchd2.exe" [2005-02-17 49152]
"SunJavaUpdateSched"="c:\program files\Fichiers communs\Java\Java Update\jusched.exe" [2010-05-14 248552]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-08-17 281768]
"LogitechQuickCamRibbon"="c:\program files\Logitech\Logitech WebCam Software\LWS.exe" [2009-10-14 2793304]
c:\documents and settings\Compaq_Propri'taire\Menu D'marrer\Programmes\D'marrage\
Logitech . Enregistrement du produit.lnk - c:\program files\Logitech\Logitech WebCam Software\eReg.exe [2009-10-14 517384]
c:\documents and settings\Compaq_Propri'taire\Menu D'marrer\Programmes\D'marrage\
Logitech . Enregistrement du produit.lnk - c:\program files\Logitech\Logitech WebCam Software\eReg.exe [2009-10-14 517384]
c:\documents and settings\Compaq_Propri'taire\Menu D'marrer\Programmes\D'marrage\
Logitech . Enregistrement du produit.lnk - c:\program files\Logitech\Logitech WebCam Software\eReg.exe [2009-10-14 517384]
c:\documents and settings\Compaq_Propri'taire\Menu D'marrer\Programmes\D'marrage\
Logitech . Enregistrement du produit.lnk - c:\program files\Logitech\Logitech WebCam Software\eReg.exe [2009-10-14 517384]
c:\documents and settings\Default User\Menu D'marrer\Programmes\D'marrage\
Pin.lnk - c:\hp\bin\CLOAKER.EXE [2006-1-2 27136]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Documents and Settings\\Compaq_Propriétaire\\Mes documents\\Téléchargements\\setup.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Logitech\\Vid HD\\Vid.exe"=
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [28/10/2010 14:50 135336]
S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [04/11/2010 09:42 136176]
.
Contenu du dossier 'Tâches planifiées'
2010-11-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-04 08:42]
2010-11-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-04 08:42]
2010-11-14 c:\windows\Tasks\User_Feed_Synchronization-{3C9BB79D-743E-4840-9C79-D339E916F7E1}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 03:31]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://search.babylon.com/home?AF=15627
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=63&bd=PRESARIO&pf=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=63&bd=PRESARIO&pf=desktop
uInternet Settings,ProxyServer = http=127.0.0.1:50370
IE: &Traduire à partir de l'anglais - c:\program files\Google\GoogleToolbar1.dll/cmwordtrans.html
IE: Pages liées - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Pages similaires - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Recherche &Google - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: Version de la page actuelle disponible dans le cache Google - c:\program files\Google\GoogleToolbar1.dll/cmcache.html
FF - ProfilePath - c:\documents and settings\Compaq_Propriétaire\Application Data\Mozilla\Firefox\Profiles\zfak4hww.default\
FF - prefs.js: keyword.URL - hxxp://utils.babylon.com/abt/index.php?url=
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 50370
FF - prefs.js: network.proxy.type - 1
FF - plugin: c:\program files\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npwachk.dll
---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true); // Simplified
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - ORPHELINS SUPPRIMES - - - -
HKLM-Run-PCDrProfiler - (no file)
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-14 16:27
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(604)
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'explorer.exe'(3612)
c:\windows\TEMP\logishrd\LVPrcInj01.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\RTHDCPL.EXE
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\program files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
c:\windows\System32\vssvc.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\rsmsink.exe
.
**************************************************************************
.
Heure de fin: 2010-11-14 16:30:27 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-11-14 15:30
Avant-CF: 136 261 181 440 octets libres
Après-CF: 140 514 783 232 octets libres
- - End Of File - - 56BF1CDDA19864442B096DED8B8FFDC1
2 réponses
Bonjour,
Qui t'a dit de poster le rapport Combofix sur le forum au juste ?
Quel est le problème rencontré ?
Qui t'a dit de poster le rapport Combofix sur le forum au juste ?
Quel est le problème rencontré ?
# /!\Désactive temporairement toute protection résidente /!\ (Antivirus, Antispywares...)
# Double clique sur ComboFix.exe. (Sous Vista et Seven, il faut cliquer droit sur Combofix.exe et choisir "Exécuter en tant qu'administrateur").
# Accepte la licence en cliquant sur "Oui".
# Le programme va vous demander si vous souhaitez installer la Console de Récupération. C'est une précaution, au cas où l'ordinateur tomberait en panne. Je vous conseille donc très fortement de l'installer, ça ne coûte rien, et ça pourrait potentiellement servir !
# Lorsque l'opération sera terminée, un rapport apparaîtra. Postez ce rapport dans votre prochaine réponse sur le forum.
# Le rapport se trouve ici : %SystemDrive%ComboFix.txt (%systemdrive% étant la partition où est installée Windows; C: en général)
Poste le rapport sur le forum car un CFScript sera peut-être nécessaire
Normalement à ce stade tu n'as plus Gomeo
C'était écrit donc bon...