"myalbumphoto2007" - Page 2

voici le raport





SDFix: Version 1.90

Run by Propri‚taire on 2007-07-09 at 20:46

Microsoft Windows XP [version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:

Name:
NDnet1
NtmlSvc
runtime
runtime2

ImagePath:
\??\C:\WINDOWS\System32\ksys.sys
%SystemRoot%\System32\svchost.exe -k netsvcs
\??\C:\WINDOWS\System32\drivers\runtime.sys
\SystemRoot\system32\drivers\runtime2.sys

NDnet1 - Deleted
NtmlSvc - Deleted



Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

Trojan Files Found:

C:\WINDOWS\SYSTEM32\IALMCOIN.DLL - Deleted
C:\Program Files\Fichiers communs\Microsoft Shared\Web Folders\ibm00001.dll - Deleted
C:\Program Files\Fichiers communs\Microsoft Shared\Web Folders\ibm00002.dll - Deleted
C:\install\credits.bat - Deleted
C:\WINDOWS\b122.exe - Deleted
C:\WINDOWS\b128.exe - Deleted
C:\WINDOWS\b136.exe - Deleted
C:\WINDOWS\myalbum2007.zip - Deleted
C:\WINDOWS\system32\1_exception.nls - Deleted
C:\WINDOWS\system32\msvcrtd.exe - Deleted
C:\WINDOWS\Temp\$_2341233.TMP - Deleted
C:\WINDOWS\Temp\$_2341234.TMP - Deleted
C:\WINDOWS\Temp\$b17a2e8.tmp - Deleted
C:\WINDOWS\Temp\startdrv.exe - Deleted
C:\WINDOWS\wr.txt - Deleted
C:\WINDOWS\system32\xpdx.sys - Deleted
C:\WINDOWS\system32\drivers\runtime2.sys - Deleted


Folder C:\Program Files\InetGet2 - Removed

Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Program Files\\OrangeHSS\\Connectivity\\ConnectivityManager.exe"="C:\\Program Files\\OrangeHSS\\Connectivity\\ConnectivityManager.exe:*:enabled:CSS"

Remaining Files:
---------------

Backups Folder: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes:

C:\Documents and Settings\Propri‚taire\Local Settings\Application Data\Microsoft\Messenger\misspauleta@msn.com\Sharing Folders\halima45140@hotmail.fr\Thumbs.db
C:\Documents and Settings\Propri‚taire\Mes documents\Ma musique\Beyonce.-.BDay.2006.MP3.192kbps.www.MP3-Es.com\Thumbs.db
C:\Documents and Settings\Propri‚taire\Mes documents\Ma musique\Medhy Custos-Eponyme-2007 section-rnb.skyblog.com\Thumbs.db
C:\WINDOWS\SMINST\HPCD.SYS
C:\WINDOWS\LastGood.Tmp\INF\oem65.inf
C:\WINDOWS\LastGood.Tmp\INF\oem65.PNF
C:\WINDOWS\LastGood.Tmp\INF\oem66.inf
C:\WINDOWS\LastGood.Tmp\INF\oem66.PNF
C:\WINDOWS\LastGood.Tmp\INF\oem67.inf
C:\WINDOWS\LastGood.Tmp\INF\oem67.PNF
C:\WINDOWS\LastGood.Tmp\INF\oem68.inf
C:\WINDOWS\LastGood.Tmp\INF\oem68.PNF
C:\WINDOWS\LastGood.Tmp\INF\oem69.inf
C:\WINDOWS\LastGood.Tmp\INF\oem69.PNF
C:\WINDOWS\LastGood.Tmp\INF\oem70.inf
C:\WINDOWS\LastGood.Tmp\INF\oem70.PNF

Finished




Logfile of HijackThis v1.99.1
Scan saved at 20:56, on 2007-07-09
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
c:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\notepad.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\hphmon05.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe
C:\Program Files\InterVideo\Common\bin\WinCinemaMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\OrangeHSS\Systray\SystrayApp.exe
C:\WINDOWS\VM305_STI.EXE
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Orange HSS\Orange Desktop Search\OrangeDesktopSearch.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe
C:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-fr9.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [WinCinemaMgr] "C:\Program Files\InterVideo\Common\bin\WinCinemaMgr.exe"
O4 - HKLM\..\Run: [Home Theater SchSvr] "C:\Program Files\Fichiers communs\InterVideo\SchSvr\SchSvr.exe"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "c:\Program Files\Fichiers communs\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [_SetRes] c:\hp\bin\cloaker c:\hp\bin\res.bat
O4 - HKLM\..\Run: [regcmdcons] c:\hp\bin\cloaker.exe c:\hp\bin\cmdcons.cmd
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\OrangeHSS\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [BigDog305] C:\WINDOWS\VM305_STI.EXE VIMICRO USB PC Camera V
O4 - HKLM\..\Run: [orahssStartup] "C:\Program Files\OrangeHSS\Launcher\Launcher.exe" -appid connectivityapp
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\Hewlett-Packard\Digital Imaging\bin\backupnotify.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [Orange Desktop Search] "C:\Program Files\Orange HSS\Orange Desktop Search\OrangeDesktopSearch.exe" /tray
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: LUMIX Simple Viewer.lnk = ?
O4 - Global Startup: Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk = C:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 3.79\AMVConverter\grab.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 3.79\MediaManager\grab.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by116w.bay116.mail.live.com/mail/resources/MsnPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe


j'espere que c'est bon?

le raport c'est celui de hijackthis

voici le rapport


AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 22:33 2007-07-09

+ Résultat de l'analyse:



C:\SDFix\backups\backups.zip/backups/b122.exe -> Adware.Softomate : Nettoyé.
C:\System Volume Information\_restore{BCBB538F-4B22-4C6E-BAFD-9A806D251BB2}\RP71\A0139733.exe -> Adware.Softomate : Nettoyé.
C:\System Volume Information\_restore{BCBB538F-4B22-4C6E-BAFD-9A806D251BB2}\RP71\A0139742.exe -> Adware.Softomate : Nettoyé.
C:\SDFix\backups\backups.zip/backups/msvcrtd.exe -> Backdoor.Agent.alm : Nettoyé.
C:\System Volume Information\_restore{BCBB538F-4B22-4C6E-BAFD-9A806D251BB2}\RP71\A0139736.exe -> Backdoor.Agent.alm : Nettoyé.
C:\System Volume Information\_restore{BCBB538F-4B22-4C6E-BAFD-9A806D251BB2}\RP71\A0139749.exe -> Backdoor.Agent.alm : Nettoyé.
C:\d.exe -> Backdoor.Agent.alm : Nettoyé.
C:\SDFix\backups\backups.zip/backups/b128.exe -> Downloader.PurityScan.eh : Nettoyé.
C:\System Volume Information\_restore{BCBB538F-4B22-4C6E-BAFD-9A806D251BB2}\RP71\A0139734.exe -> Downloader.PurityScan.eh : Nettoyé.
C:\System Volume Information\_restore{BCBB538F-4B22-4C6E-BAFD-9A806D251BB2}\RP71\A0139743.exe -> Downloader.PurityScan.eh : Nettoyé.
C:\SDFix\backups\backups.zip/backups/b136.exe -> Dropper.Agent.bfr : Nettoyé.
C:\System Volume Information\_restore{BCBB538F-4B22-4C6E-BAFD-9A806D251BB2}\RP71\A0139735.exe -> Dropper.Agent.bfr : Nettoyé.
C:\System Volume Information\_restore{BCBB538F-4B22-4C6E-BAFD-9A806D251BB2}\RP71\A0139744.exe -> Dropper.Agent.bfr : Nettoyé.
C:\WINDOWS\system32\config\systemprofile\Cookies\propriétaire@247realmedia[2].txt -> TrackingCookie.247realmedia : Nettoyé.
C:\WINDOWS\system32\config\systemprofile\Cookies\propriétaire@2o7[2].txt -> TrackingCookie.2o7 : Nettoyé.
C:\WINDOWS\system32\config\systemprofile\Cookies\propriétaire@msnaccountservices.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\WINDOWS\system32\config\systemprofile\Cookies\propriétaire@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.17:C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\pwx959jm.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.17:C:\WINDOWS\system32\config\systemprofile\Application Data\Mozilla\Firefox\Profiles\pwx959jm.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.18:C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\pwx959jm.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.18:C:\WINDOWS\system32\config\systemprofile\Application Data\Mozilla\Firefox\Profiles\pwx959jm.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.19:C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\pwx959jm.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.19:C:\WINDOWS\system32\config\systemprofile\Application Data\Mozilla\Firefox\Profiles\pwx959jm.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
C:\Documents and Settings\Propriétaire\Cookies\propriétaire@adtech[2].txt -> TrackingCookie.Adtech : Nettoyé.
C:\WINDOWS\system32\config\systemprofile\Cookies\propriétaire@adtech[2].txt -> TrackingCookie.Adtech : Nettoyé.
:mozilla.22:C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\pwx959jm.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.22:C:\WINDOWS\system32\config\systemprofile\Application Data\Mozilla\Firefox\Profiles\pwx959jm.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.23:C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\pwx959jm.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.23:C:\WINDOWS\system32\config\systemprofile\Application Data\Mozilla\Firefox\Profiles\pwx959jm.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.24:C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\pwx959jm.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.24:C:\WINDOWS\system32\config\systemprofile\Application Data\Mozilla\Firefox\Profiles\pwx959jm.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.27:C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\pwx959jm.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.27:C:\WINDOWS\system32\config\systemprofile\Application Data\Mozilla\Firefox\Profiles\pwx959jm.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
C:\WINDOWS\system32\config\systemprofile\Cookies\propriétaire@advertising[1].txt -> TrackingCookie.Advertising : Nettoyé.
C:\WINDOWS\system32\config\systemprofile\Cookies\propriétaire@adviva[2].txt -> TrackingCookie.Adviva : Nettoyé.
C:\Documents and Settings\Propriétaire\Cookies\propriétaire@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.
C:\WINDOWS\system32\config\systemprofile\Cookies\propriétaire@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.
C:\WINDOWS\system32\config\systemprofile\Cookies\propriétaire@bluestreak[2].txt -> TrackingCookie.Bluestreak : Nettoyé.
C:\WINDOWS\system32\config\systemprofile\Cookies\propriétaire@com[1].txt -> TrackingCookie.Com : Nettoyé.
C:\WINDOWS\system32\config\systemprofile\Cookies\propriétaire@doubleclick[1].txt -> TrackingCookie.Doubleclick : Nettoyé.
:mozilla.20:C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\pwx959jm.default\cookies.txt -> TrackingCookie.Estat : Nettoyé.
:mozilla.20:C:\WINDOWS\system32\config\systemprofile\Application Data\Mozilla\Firefox\Profiles\pwx959jm.default\cookies.txt -> TrackingCookie.Estat : Nettoyé.
C:\WINDOWS\system32\config\systemprofile\Cookies\propriétaire@estat[1].txt -> TrackingCookie.Estat : Nettoyé.
C:\WINDOWS\system32\config\systemprofile\Cookies\propriétaire@fastclick[2].txt -> TrackingCookie.Fastclick : Nettoyé.
C:\WINDOWS\system32\config\systemprofile\Cookies\propriétaire@ehg-telecomitalia.hitbox[2].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\WINDOWS\system32\config\systemprofile\Cookies\propriétaire@ehg-warnerbrothers.hitbox[2].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\WINDOWS\system32\config\systemprofile\Cookies\propriétaire@hitbox[2].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\WINDOWS\system32\config\systemprofile\Cookies\propriétaire@searchportal.information[2].txt -> TrackingCookie.Information : Nettoyé.
C:\WINDOWS\system32\config\systemprofile\Cookies\propriétaire@beta.search.live[1].txt -> TrackingCookie.Live : Nettoyé.
C:\Documents and Settings\Propriétaire\Cookies\propriétaire@mediaplex[2].txt -> TrackingCookie.Mediaplex : Nettoyé.
C:\WINDOWS\system32\config\systemprofile\Cookies\propriétaire@mediaplex[1].txt -> TrackingCookie.Mediaplex : Nettoyé.
C:\Documents and Settings\Propriétaire\Cookies\propriétaire@ssl-hints.netflame[1].txt -> TrackingCookie.Netflame : Nettoyé.
C:\Documents and Settings\Propriétaire\Cookies\propriétaire@overture[2].txt -> TrackingCookie.Overture : Nettoyé.
C:\WINDOWS\system32\config\systemprofile\Cookies\propriétaire@ads.pointroll[1].txt -> TrackingCookie.Pointroll : Nettoyé.
C:\WINDOWS\system32\config\systemprofile\Cookies\propriétaire@revenue[2].txt -> TrackingCookie.Revenue : Nettoyé.
C:\Documents and Settings\Propriétaire\Cookies\propriétaire@bs.serving-sys[2].txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\Documents and Settings\Propriétaire\Cookies\propriétaire@serving-sys[1].txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\WINDOWS\system32\config\systemprofile\Cookies\propriétaire@bs.serving-sys[2].txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\WINDOWS\system32\config\systemprofile\Cookies\propriétaire@serving-sys[1].txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.10:C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\pwx959jm.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.10:C:\WINDOWS\system32\config\systemprofile\Application Data\Mozilla\Firefox\Profiles\pwx959jm.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.11:C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\pwx959jm.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.11:C:\WINDOWS\system32\config\systemprofile\Application Data\Mozilla\Firefox\Profiles\pwx959jm.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.6:C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\pwx959jm.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.6:C:\WINDOWS\system32\config\systemprofile\Application Data\Mozilla\Firefox\Profiles\pwx959jm.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\Documents and Settings\Propriétaire\Cookies\propriétaire@www.smartadserver[1].txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\WINDOWS\system32\config\systemprofile\Cookies\propriétaire@smartadserver[1].txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\WINDOWS\system32\config\systemprofile\Cookies\propriétaire@www.smartadserver[2].txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\WINDOWS\system32\config\systemprofile\Cookies\propriétaire@statcounter[1].txt -> TrackingCookie.Statcounter : Nettoyé.
C:\WINDOWS\system32\config\systemprofile\Cookies\propriétaire@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Nettoyé.
:mozilla.7:C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\pwx959jm.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.7:C:\WINDOWS\system32\config\systemprofile\Application Data\Mozilla\Firefox\Profiles\pwx959jm.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.8:C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\pwx959jm.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.8:C:\WINDOWS\system32\config\systemprofile\Application Data\Mozilla\Firefox\Profiles\pwx959jm.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
C:\Documents and Settings\Propriétaire\Cookies\propriétaire@weborama[2].txt -> TrackingCookie.Weborama : Nettoyé.
C:\WINDOWS\system32\config\systemprofile\Cookies\propriétaire@weborama[2].txt -> TrackingCookie.Weborama : Nettoyé.
C:\WINDOWS\system32\config\systemprofile\Cookies\propriétaire@m.webtrends[1].txt -> TrackingCookie.Webtrends : Nettoyé.
C:\WINDOWS\system32\config\systemprofile\Cookies\propriétaire@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Nettoyé.
C:\SDFix\backups\backups.zip/backups/xpdx.sys -> Trojan.Pakes.ag : Nettoyé.
C:\System Volume Information\_restore{BCBB538F-4B22-4C6E-BAFD-9A806D251BB2}\RP71\A0139740.sys -> Trojan.Pakes.ag : Nettoyé.


Fin du rapport

il faut que je quiite mes application pour faire combofix?

voila




"Propri‚taire" - 2007-07-09 22:56:44 - ComboFix 07-07-08.7 - Service Pack 1

/wow section - STAGE #3

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Program Files\winpop
C:\WINDOWS\system32\nvs2.inf


((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_FOPF


((((((((((((((((((((((((( Files Created from 2007-06-09 to 2007-07-09 )))))))))))))))))))))))))))))))


2007-07-09 21:30 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-07-09 20:45 <REP> d-------- C:\WINDOWS\ERUNT
2007-07-08 21:57 <REP> d-------- C:\WINDOWS\BDOSCAN8
2007-07-08 21:45 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-08 18:35 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-07-08 18:35 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-07-08 18:35 4,946 --a------ C:\WINDOWS\system32\tmp.reg
2007-07-08 18:35 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-07-03 21:08 <REP> d-------- C:\Program Files\Hijackthis Version Fran‡aise
2007-07-03 19:54 <REP> d-------- C:\DOCUME~1\PROPRI~1\APPLIC~1\Lavasoft
2007-07-03 19:51 <REP> d-------- C:\Program Files\Lavasoft
2007-07-03 16:27 102,800 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2007-07-01 17:54 <REP> d-------- C:\install
2007-07-01 17:44 <REP> d-------- C:\WINDOWS\SxsCaPendDel
2007-06-29 19:35 <REP> d-------- C:\Program Files\Ashampoo
2007-06-28 21:07 <REP> d-------- C:\Program Files\AxBx
2007-06-28 18:37 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
2007-06-27 19:51 <REP> d-------- C:\Program Files\Alwil Software
2007-06-27 13:10 <REP> d--hs---- C:\UGA6PV
2007-06-27 13:09 <REP> d-------- C:\DOCUME~1\PROPRI~1\APPLIC~1\VirusGarde
2007-06-11 13:56 <REP> d-------- C:\DOCUME~1\PROPRI~1\APPLIC~1\Panasonic
2007-06-11 13:55 77,824 --a------ C:\WINDOWS\system32\PICEntry.dll
2007-06-11 13:55 73,728 --a------ C:\WINDOWS\system32\PICSDK.dll
2007-06-11 13:55 65,536 --a------ C:\WINDOWS\system32\EPPicMgr.dll
2007-06-11 13:55 495,616 --a------ C:\WINDOWS\system32\PICSDK2.dll
2007-06-11 13:55 4,943 --a------ C:\WINDOWS\system32\EPPICPattern6.dat
2007-06-11 13:55 31,053 --a------ C:\WINDOWS\system32\EPPICPattern131.dat
2007-06-11 13:55 27,417 --a------ C:\WINDOWS\system32\EPPICPattern121.dat
2007-06-11 13:55 26,154 --a------ C:\WINDOWS\system32\EPPICPattern1.dat
2007-06-11 13:55 24,903 --a------ C:\WINDOWS\system32\EPPICPattern3.dat
2007-06-11 13:55 21,390 --a------ C:\WINDOWS\system32\EPPICPattern5.dat
2007-06-11 13:55 20,148 --a------ C:\WINDOWS\system32\EPPICPattern2.dat
2007-06-11 13:55 114,688 --a------ C:\WINDOWS\system32\EpPicPrt.dll
2007-06-11 13:55 111,932 --a------ C:\WINDOWS\system32\EPPICPrinterDB.dat
2007-06-11 13:55 11,811 --a------ C:\WINDOWS\system32\EPPICPattern4.dat
2007-06-11 13:55 1,146 --a------ C:\WINDOWS\system32\EPPICPresetData_DU.dat
2007-06-11 13:55 1,139 --a------ C:\WINDOWS\system32\EPPICPresetData_PT.dat
2007-06-11 13:55 1,139 --a------ C:\WINDOWS\system32\EPPICPresetData_BP.dat
2007-06-11 13:55 1,136 --a------ C:\WINDOWS\system32\EPPICPresetData_ES.dat
2007-06-11 13:55 1,129 --a------ C:\WINDOWS\system32\EPPICPresetData_FR.dat
2007-06-11 13:55 1,129 --a------ C:\WINDOWS\system32\EPPICPresetData_CF.dat
2007-06-11 13:55 1,120 --a------ C:\WINDOWS\system32\EPPICPresetData_IT.dat
2007-06-11 13:55 1,107 --a------ C:\WINDOWS\system32\EPPICPresetData_GE.dat
2007-06-11 13:55 1,104 --a------ C:\WINDOWS\system32\EPPICPresetData_EN.dat
2007-06-11 13:54 45,056 --a------ C:\WINDOWS\system32\PhDi2.sys
2007-06-11 13:54 <REP> d-------- C:\Program Files\Panasonic
2007-06-11 13:54 <REP> d-------- C:\DOCUME~1\PROPRI~1\APPLIC~1\InstallShield
2007-06-10 19:53 61,536 -ra------ C:\WINDOWS\system32\drivers\se45bus.sys
2007-06-10 19:53 5,872 -ra------ C:\WINDOWS\system32\drivers\se45whnt.sys
2007-06-10 19:53 5,872 -ra------ C:\WINDOWS\system32\drivers\se45wh.sys


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-09 18:56:45 -------- d-----w C:\Program Files\Hijackthis Version Française
2007-07-09 18:54:11 -------- d---a-w C:\Program Files\Fichiers communs\Symantec Shared
2007-07-08 19:37:38 -------- d---a-w C:\Program Files\Norton AntiVirus
2007-07-08 19:37:22 -------- d-----w C:\Program Files\eMule
2007-07-08 12:21:02 -------- d-----w C:\Program Files\SymNetDrv
2007-07-08 12:21:01 -------- d-----w C:\Program Files\Multimedia Card Reader
2007-07-06 12:17:44 -------- d-----w C:\Program Files\Wanadoo
2007-07-01 15:49:20 -------- d-----w C:\Program Files\MSN Messenger
2007-06-29 09:48:24 -------- d-----w C:\Program Files\LimeWire
2007-06-22 09:04:25 -------- d-----w C:\DOCUME~1\PROPRI~1\APPLIC~1\Screenshot Sender
2007-06-11 11:55:53 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-05-28 20:47:13 -------- d-----w C:\Program Files\DivX


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2001-03-03 03:02 37808 --a------ C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BDF3E430-B101-42AD-A544-FADC6B084872}]
2002-11-21 05:11 112224 --a------ c:\Program Files\Norton AntiVirus\NavShExt.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CamMonitor"="c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe" [2002-10-07 15:23]
"HPHUPD05"="c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [2003-05-23 11:03]
"KBD"="C:\HP\KBD\KBD.EXE" [2003-02-12 04:02]
"StorageGuard"="C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" [2003-02-13 16:01]
"WinCinemaMgr"="C:\Program Files\InterVideo\Common\bin\WinCinemaMgr.exe" [2003-08-08 10:57]
"Home Theater SchSvr"="C:\Program Files\Fichiers communs\InterVideo\SchSvr\SchSvr.exe" []
"VTTimer"="VTTimer.exe" [2003-05-08 08:32 C:\WINDOWS\system32\VTTimer.exe]
"nwiz"="nwiz.exe" [2003-05-03 07:19 C:\WINDOWS\system32\nwiz.exe]
"ccApp"="c:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" [2002-11-20 05:10]
"ccRegVfy"="c:\Program Files\Fichiers communs\Symantec Shared\ccRegVfy.exe" [2002-11-20 05:11]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-05 08:24 C:\WINDOWS\system32\Ati2mdxx.exe]
"_SetRes"="c:\hp\bin\cloaker c:\hp\bin\res.bat" []
"regcmdcons"="c:\hp\bin\cloaker.exe" [1999-11-07 15:11]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-07-19 22:10]
"Sunkist2k"="C:\Program Files\Multimedia Card Reader\shwicon2k.exe" [2003-07-24 17:13]
"Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2007-02-17 19:24]
"Microsoft Works Update Detection"="C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe" [2002-07-18 16:36]
"SystrayORAHSS"="C:\Program Files\OrangeHSS\Systray\SystrayApp.exe" [2007-01-04 11:45]
"orahssStartup"="C:\Program Files\OrangeHSS\Launcher\Launcher.exe" [2007-01-04 11:40]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-04-23 15:11]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BackupNotify"="c:\Program Files\Hewlett-Packard\Digital Imaging\bin\backupnotify.exe" [2003-06-23 05:25]
"NVIEW"="nview.dll,nViewLoadHook" []
"Orange Desktop Search"="C:\Program Files\Orange HSS\Orange Desktop Search\OrangeDesktopSearch.exe" [2006-11-02 16:08]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableCMD"=0 (0x0)
"DisableRegistryTools"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2007-05-30 14:29]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Driver]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Guard]
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - netsvcs
NtmlSvc

*Newly Created Service* - AVGASCLN

Contents of the 'Scheduled Tasks' folder
2007-07-08 12:21:00 C:\WINDOWS\tasks\At1.job
2007-07-08 12:21:00 C:\WINDOWS\tasks\At10.job
2007-07-08 12:21:00 C:\WINDOWS\tasks\At11.job
2007-07-08 12:21:00 C:\WINDOWS\tasks\At12.job
2007-07-08 12:21:00 C:\WINDOWS\tasks\At13.job
2007-07-08 12:21:00 C:\WINDOWS\tasks\At14.job
2007-07-08 12:21:00 C:\WINDOWS\tasks\At15.job
2007-07-08 12:21:00 C:\WINDOWS\tasks\At16.job
2007-07-08 12:21:00 C:\WINDOWS\tasks\At17.job
2007-07-08 12:21:00 C:\WINDOWS\tasks\At18.job
2007-07-08 12:21:00 C:\WINDOWS\tasks\At19.job
2007-07-08 12:21:00 C:\WINDOWS\tasks\At2.job
2007-07-08 12:21:00 C:\WINDOWS\tasks\At20.job
2007-07-08 12:21:00 C:\WINDOWS\tasks\At21.job
2007-07-08 12:21:00 C:\WINDOWS\tasks\At22.job
2007-07-08 12:21:00 C:\WINDOWS\tasks\At23.job
2007-07-08 12:21:00 C:\WINDOWS\tasks\At24.job
2007-07-08 12:21:00 C:\WINDOWS\tasks\At3.job
2007-07-08 12:21:00 C:\WINDOWS\tasks\At4.job
2007-07-08 12:21:00 C:\WINDOWS\tasks\At5.job
2007-07-08 12:21:00 C:\WINDOWS\tasks\At6.job
2007-07-08 12:21:00 C:\WINDOWS\tasks\At7.job
2007-07-08 12:21:00 C:\WINDOWS\tasks\At8.job
2007-07-08 12:21:00 C:\WINDOWS\tasks\At9.job
2007-02-16 21:12:13 C:\WINDOWS\tasks\Connexion Facile à Internet.job
2007-02-11 14:40:43 C:\WINDOWS\tasks\FRU Task #Hewlett-Packard#hp psc 2170 series#1171204262.job
2007-03-16 19:07:00 C:\WINDOWS\tasks\Norton AntiVirus - Analyser mon ordinateur.job
2007-03-02 18:14:56 C:\WINDOWS\tasks\Symantec NetDetect.job

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-09 23:09:36
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-09 23:17:20 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-07-09 23:16

--- E O F ---

si sa marche msn mais en laissant desactivé la restauration du systeme sa fait rien?

nen nen sa y est je l'ai plus! merci pour tout ton aide