Probleme OUTERINFO
Résolu/Fermé
Cromoszone
-
23 janv. 2008 à 11:00
g!rly Messages postés 18209 Date d'inscription vendredi 17 août 2007 Statut Contributeur Dernière intervention 30 novembre 2014 - 26 janv. 2008 à 15:51
g!rly Messages postés 18209 Date d'inscription vendredi 17 août 2007 Statut Contributeur Dernière intervention 30 novembre 2014 - 26 janv. 2008 à 15:51
52 réponses
g!rly
Messages postés
18209
Date d'inscription
vendredi 17 août 2007
Statut
Contributeur
Dernière intervention
30 novembre 2014
406
23 janv. 2008 à 17:54
23 janv. 2008 à 17:54
prends le ici :
http://www.sunbelt-software.com/Home-Home-Office/Sunbelt-Personal-Firewall/Download/
apres la periode d´essaie, il reste gratuit
@+
http://www.sunbelt-software.com/Home-Home-Office/Sunbelt-Personal-Firewall/Download/
apres la periode d´essaie, il reste gratuit
@+
AntiVir PersonalEdition Classic
Report file date: 2008-01-23 17:43
Scanning for 1064996 virus strains and unwanted programs.
Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 3, v.3264) [5.1.2600]
Username: ED
Computer name: MREDSTUDIO
Version information:
BUILD.DAT : 270 15603 Bytes 2007-09-19 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 2007-08-23 13:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 2007-08-16 12:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 2007-08-14 15:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 2007-08-21 12:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 2007-07-18 14:27:15
ANTIVIR1.VDF : 7.0.1.95 3367424 Bytes 2007-12-14 08:20:37
ANTIVIR2.VDF : 7.0.2.0 948736 Bytes 2008-01-15 08:20:37
ANTIVIR3.VDF : 7.0.2.34 335872 Bytes 2008-01-23 12:11:31
AVEWIN32.DLL : 7.6.0.48 3080704 Bytes 2008-01-21 08:20:37
AVWINLL.DLL : 1.0.0.7 14376 Bytes 2007-02-26 10:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 2007-07-18 07:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 2007-04-16 13:16:24
AVPACK32.DLL : 7.6.0.3 360488 Bytes 2008-01-21 08:20:37
AVREG.DLL : 7.0.1.6 30760 Bytes 2007-07-18 07:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 2007-08-28 12:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 2007-07-18 07:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 2007-03-08 11:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 2007-08-07 12:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 2007-08-21 12:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 2007-07-23 09:37:21
Configuration settings for the scan:
Jobname..........................: Rootkit search
Configuration file...............: I:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\PROFILES\rootkit.avp
Logging..........................: high
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Scan memory......................: off
Process scan.....................: off
Scan registry....................: off
Search for rootkits..............: on
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: high
Expanded search settings.........: 0x00300922
Start of the scan: 2008-01-23 17:43
Starting search for hidden objects.
'328336' objects were checked, '0' hidden objects were found.
End of the scan: 2008-01-23 17:53
Used time: 09:41 min
The scan has been done completely.
0 Scanning directories
0 Files were scanned
0 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
0 Files cannot be scanned
0 Files not concerned
0 Archives were scanned
0 Warnings
0 Notes
328336 Objects were scanned with rootkit scan
0 Hidden objects were found
Report file date: 2008-01-23 17:43
Scanning for 1064996 virus strains and unwanted programs.
Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 3, v.3264) [5.1.2600]
Username: ED
Computer name: MREDSTUDIO
Version information:
BUILD.DAT : 270 15603 Bytes 2007-09-19 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 2007-08-23 13:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 2007-08-16 12:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 2007-08-14 15:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 2007-08-21 12:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 2007-07-18 14:27:15
ANTIVIR1.VDF : 7.0.1.95 3367424 Bytes 2007-12-14 08:20:37
ANTIVIR2.VDF : 7.0.2.0 948736 Bytes 2008-01-15 08:20:37
ANTIVIR3.VDF : 7.0.2.34 335872 Bytes 2008-01-23 12:11:31
AVEWIN32.DLL : 7.6.0.48 3080704 Bytes 2008-01-21 08:20:37
AVWINLL.DLL : 1.0.0.7 14376 Bytes 2007-02-26 10:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 2007-07-18 07:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 2007-04-16 13:16:24
AVPACK32.DLL : 7.6.0.3 360488 Bytes 2008-01-21 08:20:37
AVREG.DLL : 7.0.1.6 30760 Bytes 2007-07-18 07:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 2007-08-28 12:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 2007-07-18 07:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 2007-03-08 11:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 2007-08-07 12:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 2007-08-21 12:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 2007-07-23 09:37:21
Configuration settings for the scan:
Jobname..........................: Rootkit search
Configuration file...............: I:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\PROFILES\rootkit.avp
Logging..........................: high
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Scan memory......................: off
Process scan.....................: off
Scan registry....................: off
Search for rootkits..............: on
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: high
Expanded search settings.........: 0x00300922
Start of the scan: 2008-01-23 17:43
Starting search for hidden objects.
'328336' objects were checked, '0' hidden objects were found.
End of the scan: 2008-01-23 17:53
Used time: 09:41 min
The scan has been done completely.
0 Scanning directories
0 Files were scanned
0 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
0 Files cannot be scanned
0 Files not concerned
0 Archives were scanned
0 Warnings
0 Notes
328336 Objects were scanned with rootkit scan
0 Hidden objects were found
g!rly
Messages postés
18209
Date d'inscription
vendredi 17 août 2007
Statut
Contributeur
Dernière intervention
30 novembre 2014
406
23 janv. 2008 à 18:11
23 janv. 2008 à 18:11
ok
comment va ton pc maintenant?
@+
comment va ton pc maintenant?
@+
Cela marche "bien" niveau OUTERINFO disparu et autres merde c ok
Mais je n'arrive plus a surfer via Explorer, super lent , il n'ouvre plus les page
là j'utilise Firefox....c pas normal pour IE
Qu'en penses tu ?
Mais je n'arrive plus a surfer via Explorer, super lent , il n'ouvre plus les page
là j'utilise Firefox....c pas normal pour IE
Qu'en penses tu ?
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
De plus, j'avais oublié, l'installation de nouveaux programmes + leurs lancement voir meme ceux deja installés....prennent un temps a se charger ????????????????????????????
g!rly
Messages postés
18209
Date d'inscription
vendredi 17 août 2007
Statut
Contributeur
Dernière intervention
30 novembre 2014
406
24 janv. 2008 à 15:52
24 janv. 2008 à 15:52
salut,
nettoie tes fichiers temporaires avec ceci :
nettoie tes fichiers temporaires avec ceci : atf cleaner, regarde le tuto...
http://www.infosecu.fr/atf.html
telecharge le ici :
http://serveur1.archive-host.com/membres/up/1366464061/ATF-Cleaner.rar
et nettoie ton registre avec ceci :
telecharge et instal regcleaner:
http://www.01net.com/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/4894.html
tutorial :
http://www.softastuces.com/tuto/maint/regcleaner/
depuis quand as tu un probleme avec internet explorer?
@+
nettoie tes fichiers temporaires avec ceci :
nettoie tes fichiers temporaires avec ceci : atf cleaner, regarde le tuto...
http://www.infosecu.fr/atf.html
telecharge le ici :
http://serveur1.archive-host.com/membres/up/1366464061/ATF-Cleaner.rar
et nettoie ton registre avec ceci :
telecharge et instal regcleaner:
http://www.01net.com/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/4894.html
tutorial :
http://www.softastuces.com/tuto/maint/regcleaner/
depuis quand as tu un probleme avec internet explorer?
@+
g!rly
Messages postés
18209
Date d'inscription
vendredi 17 août 2007
Statut
Contributeur
Dernière intervention
30 novembre 2014
406
24 janv. 2008 à 16:40
24 janv. 2008 à 16:40
re,
tu as nettoyer tes fichiers temporaires et les cles superflues a l´aide des logiciels que je t´ai indiqués?
@+
tu as nettoyer tes fichiers temporaires et les cles superflues a l´aide des logiciels que je t´ai indiqués?
@+
J'ai passé les 2 log.....Regcleaner a commencé sa tache ensuite il s'est evanoui, plus moyen de le lancer et il est present ds les PROCESSUS Actif ??????
Sinon moi comme log j'ai JV16 TOOLS (REg cleaner aussi)
Mais cela rame toujours mais grave....alors qu'avec Firefox quasi aucun temps d'attente
Bizarre Bizarre !!!!
Sinon moi comme log j'ai JV16 TOOLS (REg cleaner aussi)
Mais cela rame toujours mais grave....alors qu'avec Firefox quasi aucun temps d'attente
Bizarre Bizarre !!!!
g!rly
Messages postés
18209
Date d'inscription
vendredi 17 août 2007
Statut
Contributeur
Dernière intervention
30 novembre 2014
406
25 janv. 2008 à 00:22
25 janv. 2008 à 00:22
re,
on laisse passer la nuit on verra a nouveau demain...
dis moi quoi
@+
on laisse passer la nuit on verra a nouveau demain...
dis moi quoi
@+
Bonjour
Alors les choses ne s'arrange pas vraiment ...après un redemarrage, rien ne change...
Ce que j'ai remarqué, c'est que lorsque je lance IE....avant que la 1ere page ne s'affiche, il met "Connecting..." et en suite vient la page blanche pour pouvoir commencer.......
Ce qui semble amusant c'est que je pense que la page est chargée mais elle reste blanche..avec le sablier qui tourne
bonne matinée
Alors les choses ne s'arrange pas vraiment ...après un redemarrage, rien ne change...
Ce que j'ai remarqué, c'est que lorsque je lance IE....avant que la 1ere page ne s'affiche, il met "Connecting..." et en suite vient la page blanche pour pouvoir commencer.......
Ce qui semble amusant c'est que je pense que la page est chargée mais elle reste blanche..avec le sablier qui tourne
bonne matinée
g!rly
Messages postés
18209
Date d'inscription
vendredi 17 août 2007
Statut
Contributeur
Dernière intervention
30 novembre 2014
406
25 janv. 2008 à 16:07
25 janv. 2008 à 16:07
salut,
oui, ca ne s´arrange pas, peux tu me remontrer un hijack this stp
@+
oui, ca ne s´arrange pas, peux tu me remontrer un hijack this stp
@+
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:19, on 2008-01-25
Platform: Windows XP SP3, v.3264 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal
Running processes:
I:\WINDOWS\System32\smss.exe
I:\WINDOWS\system32\winlogon.exe
I:\WINDOWS\system32\services.exe
I:\WINDOWS\system32\lsass.exe
I:\WINDOWS\system32\svchost.exe
I:\WINDOWS\System32\svchost.exe
I:\WINDOWS\system32\spoolsv.exe
I:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
I:\WINDOWS\Explorer.EXE
I:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
I:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
I:\Program Files\Bonjour\mDNSResponder.exe
I:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
D:\Program Files\Kerio\kpf4ss.exe
I:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
I:\WINDOWS\system32\svehost.exe
I:\WINDOWS\system32\ctfmon.exe
I:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
I:\Program Files\Messenger\msmsgs.exe
D:\Program Files\Kerio\kpf4gui.exe
D:\Program Files\Kerio\kpf4gui.exe
I:\Program Files\Windows Live\Messenger\usnsvc.exe
I:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
D:\Program Files\Mozilla Firefox\firefox.exe
I:\Program Files\Windows Media Player\wmplayer.exe
D:\Program Files\totalcmd\TOTALCMD.EXE
I:\Program Files\Internet Explorer\IEXPLORE.EXE
I:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
I:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - I:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - I:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - I:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [avgnt] "I:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SoundMAXPnP] I:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "I:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "I:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Microsoft Updates] svehost.exe
O4 - HKLM\..\Run: [NeroFilterCheck] I:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\RunServices: [Microsoft Updates] svehost.exe
O4 - HKCU\..\Run: [ccleaner] "D:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKCU\..\Run: [ctfmon.exe] I:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "I:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "I:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - I:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - I:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - https://www.f-secure.com/en/home/support
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - I:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - I:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - I:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - I:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NBService - Nero AG - I:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - I:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - D:\Program Files\Kerio\kpf4ss.exe
Scan saved at 19:19, on 2008-01-25
Platform: Windows XP SP3, v.3264 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal
Running processes:
I:\WINDOWS\System32\smss.exe
I:\WINDOWS\system32\winlogon.exe
I:\WINDOWS\system32\services.exe
I:\WINDOWS\system32\lsass.exe
I:\WINDOWS\system32\svchost.exe
I:\WINDOWS\System32\svchost.exe
I:\WINDOWS\system32\spoolsv.exe
I:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
I:\WINDOWS\Explorer.EXE
I:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
I:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
I:\Program Files\Bonjour\mDNSResponder.exe
I:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
D:\Program Files\Kerio\kpf4ss.exe
I:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
I:\WINDOWS\system32\svehost.exe
I:\WINDOWS\system32\ctfmon.exe
I:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
I:\Program Files\Messenger\msmsgs.exe
D:\Program Files\Kerio\kpf4gui.exe
D:\Program Files\Kerio\kpf4gui.exe
I:\Program Files\Windows Live\Messenger\usnsvc.exe
I:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
D:\Program Files\Mozilla Firefox\firefox.exe
I:\Program Files\Windows Media Player\wmplayer.exe
D:\Program Files\totalcmd\TOTALCMD.EXE
I:\Program Files\Internet Explorer\IEXPLORE.EXE
I:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
I:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - I:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - I:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - I:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [avgnt] "I:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SoundMAXPnP] I:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "I:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "I:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Microsoft Updates] svehost.exe
O4 - HKLM\..\Run: [NeroFilterCheck] I:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\RunServices: [Microsoft Updates] svehost.exe
O4 - HKCU\..\Run: [ccleaner] "D:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKCU\..\Run: [ctfmon.exe] I:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "I:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "I:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - I:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - I:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - https://www.f-secure.com/en/home/support
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - I:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - I:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - I:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - I:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NBService - Nero AG - I:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - I:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - D:\Program Files\Kerio\kpf4ss.exe
g!rly
Messages postés
18209
Date d'inscription
vendredi 17 août 2007
Statut
Contributeur
Dernière intervention
30 novembre 2014
406
25 janv. 2008 à 19:24
25 janv. 2008 à 19:24
re,
il y a des processus qui semblent s´etre réveillés...
repasse combofix et post le resultat stp
@+
il y a des processus qui semblent s´etre réveillés...
repasse combofix et post le resultat stp
@+
ComboFix 08-01-23.2 - ED 2008-01-25 19:41:01.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.619 [GMT 1:00]
Running from: I:\Documents and Settings\ED\Desktop\ComboFix.exe
* Created a new restore point
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
I:\WINDOWS\system32\drivers\npf.sys
I:\WINDOWS\system32\packet.dll
I:\WINDOWS\system32\svehost.exe
I:\WINDOWS\system32\wpcap.dll
.
---- Previous Run -------
.
c:\windows\system\Update.exe
I:\Program Files\outerinfo
I:\Program Files\outerinfo\FF\chrome.manifest
I:\Program Files\outerinfo\FF\components\FF.dll
I:\Program Files\outerinfo\FF\components\OuterinfoAds.xpt
I:\Program Files\outerinfo\FF\install.rdf
I:\Program Files\outerinfo\Terms.rtf
I:\Program Files\Temporary
I:\VundoFix Backups
I:\VundoFix Backups\gfhkj.ini.bad
I:\VundoFix Backups\gfhkj.ini2.bad
I:\VundoFix Backups\jkhfg.dll.bad
I:\WINDOWS\system32\advpack.dll
I:\WINDOWS\system32\drivers\npf.sys
I:\WINDOWS\system32\fmbx.dll
I:\WINDOWS\system32\packet.dll
I:\WINDOWS\system32\racle~1
I:\WINDOWS\system32\racle~1\?racle\
I:\WINDOWS\system32\stem~1
I:\WINDOWS\system32\stem~1\??anregw.exe
I:\WINDOWS\system32\wpcap.dll
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\NPF
-------\NPF
((((((((((((((((((((((((( Files Created from 2007-12-25 to 2008-01-25 )))))))))))))))))))))))))))))))
.
2008-01-25 15:08 . 2008-01-25 15:13 49 --a------ I:\WINDOWS\NeroDigital.ini
2008-01-25 14:44 . 2008-01-25 14:44 1,158 --a------ I:\WINDOWS\mozver.dat
2008-01-24 16:06 . 2008-01-24 16:08 <DIR> d-------- I:\WINDOWS\system32\NtmsData
2008-01-24 16:00 . 2008-01-24 16:00 <DIR> d-------- I:\Program Files\Nero
2008-01-24 16:00 . 2008-01-24 16:01 <DIR> d-------- I:\Program Files\Common Files\Ahead
2008-01-24 15:16 . 2008-01-24 15:16 0 --a------ I:\WINDOWS\nsreg.dat
2008-01-24 14:52 . 2008-01-24 14:49 3,974,440 --a------ I:\WINDOWS\system32\AdvrCntr3.dll
2008-01-24 10:36 . 2008-01-24 15:46 <DIR> d-------- I:\Program Files\Common Files\Nero
2008-01-23 18:21 . 2008-01-25 09:18 1,061 --a------ I:\WINDOWS\system32\drivers\fwdrv.err
2008-01-23 13:35 . 2000-08-31 08:00 51,200 --a------ I:\WINDOWS\Nircmd.exe
2008-01-23 13:01 . 2008-01-23 13:01 <DIR> d-------- I:\Program Files\Trend Micro
2008-01-23 12:47 . 1996-01-09 10:38 283,648 --a------ I:\WINDOWS\uninst.exe
2008-01-22 23:42 . 2007-07-30 19:19 271,224 --a------ I:\WINDOWS\system32\mucltui.dll
2008-01-22 23:42 . 2007-07-30 19:19 30,072 --a------ I:\WINDOWS\system32\mucltui.dll.mui
2008-01-22 21:21 . 2008-01-22 21:21 <DIR> d----c--- I:\WINDOWS\system32\DRVSTORE
2008-01-22 11:51 . 2008-01-22 11:51 <DIR> d-------- I:\Program Files\illiminable
2008-01-22 10:30 . 2008-01-22 21:21 <DIR> d--hsc--- I:\Program Files\Common Files\WindowsLiveInstaller
2008-01-22 10:29 . 2008-01-22 21:21 <DIR> d-------- I:\Program Files\Windows Live
2008-01-22 10:29 . 2008-01-22 10:29 <DIR> d-------- I:\Program Files\Bonjour
2008-01-22 10:18 . 2008-01-22 10:18 <DIR> d-------- I:\Program Files\Common Files\Macrovision Shared
2008-01-21 11:32 . 2008-01-21 11:32 <DIR> d-------- I:\WINDOWS\system32\Adobe
2008-01-21 11:32 . 2004-08-17 02:40 16,384 --a------ I:\WINDOWS\system32\FileOps.exe
2008-01-21 11:18 . 2008-01-21 11:18 <DIR> d-------- I:\WINDOWS\Sun
2008-01-21 11:16 . 2007-09-24 23:31 69,632 --a------ I:\WINDOWS\system32\javacpl.cpl
2008-01-21 11:15 . 2008-01-21 11:16 <DIR> d-------- I:\Program Files\Java
2008-01-21 11:14 . 2008-01-21 11:14 <DIR> d-------- I:\Program Files\Common Files\Java
2008-01-21 10:02 . 2008-01-23 15:00 <DIR> d-------- I:\Program Files\Common Files\Adobe
2008-01-21 09:32 . 2007-11-30 18:14 83,072 --a------ I:\WINDOWS\system32\drivers\wdmaud.sys
2008-01-21 09:32 . 2007-11-30 18:14 83,072 --a--c--- I:\WINDOWS\system32\dllcache\wdmaud.sys
2008-01-21 09:32 . 2007-11-30 17:30 6,272 --a------ I:\WINDOWS\system32\drivers\splitter.sys
2008-01-21 09:32 . 2007-11-30 17:30 6,272 --a--c--- I:\WINDOWS\system32\dllcache\splitter.sys
2008-01-21 09:31 . 2007-11-30 17:30 52,864 --a------ I:\WINDOWS\system32\drivers\DMusic.sys
2008-01-21 09:31 . 2007-11-30 17:30 52,864 --a--c--- I:\WINDOWS\system32\dllcache\dmusic.sys
2008-01-21 09:28 . 2007-11-30 17:30 56,576 --a------ I:\WINDOWS\system32\drivers\swmidi.sys
2008-01-21 09:28 . 2007-11-30 17:30 56,576 --a--c--- I:\WINDOWS\system32\dllcache\swmidi.sys
2008-01-21 09:24 . 2007-11-30 18:17 146,048 --a------ I:\WINDOWS\system32\drivers\portcls.sys
2008-01-21 09:24 . 2007-11-30 18:17 146,048 --a--c--- I:\WINDOWS\system32\dllcache\portcls.sys
2008-01-21 09:24 . 2007-12-01 00:27 129,536 --a------ I:\WINDOWS\system32\ksproxy.ax
2008-01-21 09:24 . 2007-12-01 00:27 129,536 --a--c--- I:\WINDOWS\system32\dllcache\ksproxy.ax
2008-01-21 09:24 . 2007-11-30 17:30 60,160 --a------ I:\WINDOWS\system32\drivers\drmk.sys
2008-01-21 09:24 . 2007-11-30 17:30 60,160 --a--c--- I:\WINDOWS\system32\dllcache\drmk.sys
2008-01-21 09:24 . 2007-12-01 00:25 4,096 --a------ I:\WINDOWS\system32\ksuser.dll
2008-01-21 09:24 . 2007-12-01 00:25 4,096 --a--c--- I:\WINDOWS\system32\dllcache\ksuser.dll
2008-01-21 09:23 . 2008-01-21 09:23 <DIR> d--h----- I:\Program Files\InstallShield Installation Information
2008-01-21 09:23 . 2008-01-21 09:23 <DIR> d-------- I:\Program Files\Analog Devices
2008-01-21 09:22 . 2008-01-21 09:22 <DIR> d-------- I:\Program Files\Common Files\InstallShield
2008-01-21 09:18 . 2008-01-21 09:18 <DIR> d-------- I:\Program Files\Avira
2008-01-21 09:16 . 2008-01-25 19:34 2,729 --a------ I:\WINDOWS\wincmd.ini
2008-01-21 09:16 . 2007-06-21 07:01 545 --a------ I:\WINDOWS\UC.PIF
2008-01-21 09:16 . 2007-06-21 07:01 545 --a------ I:\WINDOWS\RAR.PIF
2008-01-21 09:16 . 2007-06-21 07:01 545 --a------ I:\WINDOWS\PKZIP.PIF
2008-01-21 09:16 . 2007-06-21 07:01 545 --a------ I:\WINDOWS\PKUNZIP.PIF
2008-01-21 09:16 . 2007-06-21 07:01 545 --a------ I:\WINDOWS\NOCLOSE.PIF
2008-01-21 09:16 . 2007-06-21 07:01 545 --a------ I:\WINDOWS\LHA.PIF
2008-01-21 09:16 . 2007-06-21 07:01 545 --a------ I:\WINDOWS\ARJ.PIF
2008-01-21 09:09 . 2008-01-21 09:29 <DIR> d-------- I:\Program Files\Dot1XCfg
2008-01-21 09:03 . 2008-01-21 09:03 <DIR> d--h----- I:\Program Files\Uninstall Information
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-21 07:50 --------- d-----w I:\Program Files\microsoft frontpage
2008-01-21 07:49 --------- d-----w I:\Program Files\Windows Media Connect 2
2007-12-29 14:43 96,512 ----a-w I:\WINDOWS\system32\drivers\atapi.sys
2007-12-29 14:43 96,384 ----a-w I:\WINDOWS\system32\drivers\scsiport.sys
2007-12-29 14:43 80,128 ----a-w I:\WINDOWS\system32\drivers\parport.sys
2007-12-29 14:43 79,232 ----a-w I:\WINDOWS\system32\drivers\sdbus.sys
2007-12-29 14:43 71,168 ----a-w I:\WINDOWS\system32\drivers\dxg.sys
2007-12-29 14:43 7,168 ----a-w I:\WINDOWS\system32\hccoin.dll
2007-12-29 14:43 68,224 ----a-w I:\WINDOWS\system32\drivers\pci.sys
2007-12-29 14:43 64,512 ----a-w I:\WINDOWS\system32\drivers\serial.sys
2007-12-29 14:43 63,744 ----a-w I:\WINDOWS\system32\drivers\mf.sys
2007-12-29 14:43 62,976 ----a-w I:\WINDOWS\system32\drivers\cdrom.sys
2007-12-29 14:43 61,824 ----a-w I:\WINDOWS\system32\drivers\nic1394.sys
2007-12-29 14:43 60,800 ----a-w I:\WINDOWS\system32\drivers\arp1394.sys
2007-12-29 14:43 59,520 ----a-w I:\WINDOWS\system32\drivers\usbhub.sys
2007-12-29 14:43 52,736 ----a-w I:\WINDOWS\system32\wzcsapi.dll
2007-12-29 14:43 52,480 ----a-w I:\WINDOWS\system32\drivers\i8042prt.sys
2007-12-29 14:43 52,224 ----a-w I:\WINDOWS\system32\dmutil.dll
2007-12-29 14:43 483,840 ----a-w I:\WINDOWS\system32\wzcsvc.dll
2007-12-29 14:43 47,616 ----a-w I:\WINDOWS\system32\iyuv_32.dll
2007-12-29 14:43 47,104 ----a-w I:\WINDOWS\system32\cnbjmon.dll
2007-12-29 14:43 42,752 ----a-w I:\WINDOWS\system32\drivers\p3.sys
2007-12-29 14:43 42,112 ----a-w I:\WINDOWS\system32\drivers\imapi.sys
2007-12-29 14:43 4,352 ----a-w I:\WINDOWS\system32\drivers\swenum.sys
2007-12-29 14:43 37,760 ----a-w I:\WINDOWS\system32\drivers\amdk7.sys
2007-12-29 14:43 37,376 ----a-w I:\WINDOWS\system32\drivers\amdk6.sys
2007-12-29 14:43 37,248 ----a-w I:\WINDOWS\system32\drivers\isapnp.sys
2007-12-29 14:43 36,864 ----a-w I:\WINDOWS\system32\drivers\hidclass.sys
2007-12-29 14:43 36,736 ----a-w I:\WINDOWS\system32\drivers\crusoe.sys
2007-12-29 14:43 36,352 ----a-w I:\WINDOWS\system32\drivers\intelppm.sys
2007-12-29 14:43 36,352 ----a-w I:\WINDOWS\system32\drivers\disk.sys
2007-12-29 14:43 35,840 ----a-w I:\WINDOWS\system32\drivers\processr.sys
2007-12-29 14:43 35,328 ----a-w I:\WINDOWS\system32\pid.dll
2007-12-29 14:43 30,208 ----a-w I:\WINDOWS\system32\drivers\usbehci.sys
2007-12-29 14:43 30,080 ----a-w I:\WINDOWS\system32\drivers\modem.sys
2007-12-29 14:43 27,392 ----a-w I:\WINDOWS\system32\drivers\fdc.sys
2007-12-29 14:43 264,832 ----a-w I:\WINDOWS\system32\drivers\http.sys
2007-12-29 14:43 25,728 ----a-w I:\WINDOWS\system32\drivers\usbcamd2.sys
2007-12-29 14:43 25,600 ----a-w I:\WINDOWS\system32\drivers\usbcamd.sys
2007-12-29 14:43 25,344 ----a-w I:\WINDOWS\system32\drivers\sonydcam.sys
2007-12-29 14:43 24,960 ----a-w I:\WINDOWS\system32\drivers\pciidex.sys
2007-12-29 14:43 24,960 ----a-w I:\WINDOWS\system32\drivers\hidparse.sys
2007-12-29 14:43 24,576 ----a-w I:\WINDOWS\system32\drivers\kbdclass.sys
2007-12-29 14:43 23,040 ----a-w I:\WINDOWS\system32\drivers\mouclass.sys
2007-12-29 14:43 20,992 ----a-w I:\WINDOWS\system32\hid.dll
2007-12-29 14:43 20,608 ----a-w I:\WINDOWS\system32\drivers\usbuhci.sys
2007-12-29 14:43 20,480 ----a-w I:\WINDOWS\system32\drivers\flpydisk.sys
2007-12-29 14:43 2,306,560 ----a-w I:\WINDOWS\system32\ntoskrnl.exe
2007-12-29 14:43 2,185,216 ----a-w I:\WINDOWS\system32\ntkrnlpa.exe
2007-12-29 14:43 193,024 ----a-w I:\WINDOWS\system32\fsquirt.exe
2007-12-29 14:43 187,776 ----a-w I:\WINDOWS\system32\drivers\acpi.sys
2007-12-29 14:43 16,896 ----a-w I:\WINDOWS\system32\msyuv.dll
2007-12-29 14:43 15,872 ----a-w I:\WINDOWS\system32\drivers\usbintel.sys
2007-12-29 14:43 15,744 ----a-w I:\WINDOWS\system32\drivers\serenum.sys
2007-12-29 14:43 15,488 ----a-w I:\WINDOWS\system32\drivers\mssmbios.sys
2007-12-29 14:43 15,360 ----a-w I:\WINDOWS\system32\pjlmon.dll
2007-12-29 14:43 143,872 ----a-w I:\WINDOWS\system32\drivers\usbport.sys
2007-12-29 14:43 14,592 ----a-w I:\WINDOWS\system32\drivers\ndisuio.sys
2007-12-29 14:43 120,192 ----a-w I:\WINDOWS\system32\drivers\pcmcia.sys
2007-12-29 14:43 12,288 ----a-w I:\WINDOWS\system32\drivers\tunmp.sys
2007-12-29 14:43 11,904 ----a-w I:\WINDOWS\system32\drivers\sffdisk.sys
2007-12-29 14:43 11,392 ----a-w I:\WINDOWS\system32\drivers\sfloppy.sys
2007-12-29 14:43 11,008 ----a-w I:\WINDOWS\system32\drivers\sffp_sd.sys
2007-12-29 14:43 108,032 ----a-w I:\WINDOWS\system32\wshbth.dll
2007-12-29 14:43 10,368 ----a-w I:\WINDOWS\system32\drivers\hidusb.sys
2007-12-29 14:43 10,240 ----a-w I:\WINDOWS\system32\drivers\sffp_mmc.sys
2007-12-29 14:43 1,613,824 ----a-w I:\WINDOWS\system32\sfcfiles.dll
2007-12-29 14:36 86,073 ----a-w I:\WINDOWS\system32\usrfaxa.dll
2007-12-29 14:36 8,192 ----a-w I:\WINDOWS\system32\tsbyuv.dll
2007-12-29 14:36 8,192 ----a-w I:\WINDOWS\system32\streamci.dll
2007-12-29 14:36 77,891 ----a-w I:\WINDOWS\system32\usrmlnka.exe
2007-12-29 14:36 77,890 ----a-w I:\WINDOWS\system32\usrdpa.dll
2007-12-29 14:36 77,883 ----a-w I:\WINDOWS\system32\usrrtosa.dll
2007-12-29 14:36 72,192 ----a-w I:\WINDOWS\system32\sprio800.dll
2007-12-29 14:36 70,656 ----a-w I:\WINDOWS\system32\sprio600.dll
2007-12-29 14:36 69,700 ----a-w I:\WINDOWS\system32\usrshuta.exe
2007-12-29 14:36 69,699 ----a-w I:\WINDOWS\system32\usrcoina.dll
2007-12-29 14:36 69,632 ----a-w I:\WINDOWS\system32\spnike.dll
2007-12-29 14:36 61,508 ----a-w I:\WINDOWS\system32\usrprbda.exe
2007-12-29 14:36 61,500 ----a-w I:\WINDOWS\system32\usrcntra.dll
2007-12-29 14:36 58,112 ----a-w I:\WINDOWS\system32\drivers\vdmindvd.sys
2007-12-29 14:36 55,296 ----a-w I:\WINDOWS\system32\dvdplay.exe
2007-12-29 14:36 53,305 ----a-w I:\WINDOWS\system32\usrlbva.dll
2007-12-29 14:36 51,712 ----a-w I:\WINDOWS\system32\drivers\tosdvd.sys
2007-12-29 14:36 49,211 ----a-w I:\WINDOWS\system32\usrvpa.dll
2007-12-29 14:36 49,211 ----a-w I:\WINDOWS\system32\usrsdpia.dll
2007-12-29 14:36 49,209 ----a-w I:\WINDOWS\system32\usrv80a.dll
2007-12-29 14:36 45,116 ----a-w I:\WINDOWS\system32\usrvoica.dll
2007-12-29 14:36 41,019 ----a-w I:\WINDOWS\system32\usrsvpia.dll
2007-12-29 14:36 4,736 ----a-w I:\WINDOWS\system32\drivers\usbd.sys
2007-12-29 14:36 323,641 ----a-w I:\WINDOWS\system32\usrdtea.dll
2007-12-29 14:36 3,456 ----a-w I:\WINDOWS\system32\drivers\oprghdlr.sys
2007-12-29 14:36 3,328 ----a-w I:\WINDOWS\system32\drivers\pciide.sys
2007-12-29 14:36 3,200 ----a-w I:\WINDOWS\system32\wowfax.dll
2007-12-29 14:36 262,528 ----a-w I:\WINDOWS\system32\drivers\cinemst2.sys
2007-12-29 14:36 21,376 ----a-w I:\WINDOWS\system32\drivers\tsbvcap.sys
2007-12-29 14:36 18,688 ----a-w I:\WINDOWS\system32\drivers\cdaudio.sys
2007-12-29 14:36 157,696 ----a-w I:\WINDOWS\system32\paqsp.dll
2007-12-29 14:36 147,968 ----a-w I:\WINDOWS\system32\mdwmdmsp.dll
2007-12-29 14:36 13,952 ----a-w I:\WINDOWS\system32\drivers\cbidf2k.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccleaner"="D:\Program Files\CCleaner\CCleaner.exe" [2007-11-22 17:10 787696]
"ctfmon.exe"="I:\WINDOWS\system32\ctfmon.exe" [2007-12-01 00:26 15360]
"MsnMsgr"="I:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
"MSMSGS"="I:\Program Files\Messenger\msmsgs.exe" [2007-12-01 00:26 1695232]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="I:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-01-21 09:20 249896]
"SoundMAXPnP"="I:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 09:11 1388544]
"SunJavaUpdateSched"="I:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"Adobe Reader Speed Launcher"="I:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06 40048]
"NeroFilterCheck"="I:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, credssp.dll, msnsspc.dll
R1 fwdrv;Firewall Driver;I:\WINDOWS\system32\drivers\fwdrv.sys [2007-04-26 10:21]
R1 khips;Kerio HIPS Driver;I:\WINDOWS\system32\drivers\khips.sys [2007-04-26 10:21]
R2 SPF4;Sunbelt Personal Firewall 4;"D:\Program Files\Kerio\kpf4ss.exe" [2007-04-26 10:21]
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-25 19:47:27
Windows 5.1.2600 Service Pack 3, v.3264 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.619 [GMT 1:00]
Running from: I:\Documents and Settings\ED\Desktop\ComboFix.exe
* Created a new restore point
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
I:\WINDOWS\system32\drivers\npf.sys
I:\WINDOWS\system32\packet.dll
I:\WINDOWS\system32\svehost.exe
I:\WINDOWS\system32\wpcap.dll
.
---- Previous Run -------
.
c:\windows\system\Update.exe
I:\Program Files\outerinfo
I:\Program Files\outerinfo\FF\chrome.manifest
I:\Program Files\outerinfo\FF\components\FF.dll
I:\Program Files\outerinfo\FF\components\OuterinfoAds.xpt
I:\Program Files\outerinfo\FF\install.rdf
I:\Program Files\outerinfo\Terms.rtf
I:\Program Files\Temporary
I:\VundoFix Backups
I:\VundoFix Backups\gfhkj.ini.bad
I:\VundoFix Backups\gfhkj.ini2.bad
I:\VundoFix Backups\jkhfg.dll.bad
I:\WINDOWS\system32\advpack.dll
I:\WINDOWS\system32\drivers\npf.sys
I:\WINDOWS\system32\fmbx.dll
I:\WINDOWS\system32\packet.dll
I:\WINDOWS\system32\racle~1
I:\WINDOWS\system32\racle~1\?racle\
I:\WINDOWS\system32\stem~1
I:\WINDOWS\system32\stem~1\??anregw.exe
I:\WINDOWS\system32\wpcap.dll
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\NPF
-------\NPF
((((((((((((((((((((((((( Files Created from 2007-12-25 to 2008-01-25 )))))))))))))))))))))))))))))))
.
2008-01-25 15:08 . 2008-01-25 15:13 49 --a------ I:\WINDOWS\NeroDigital.ini
2008-01-25 14:44 . 2008-01-25 14:44 1,158 --a------ I:\WINDOWS\mozver.dat
2008-01-24 16:06 . 2008-01-24 16:08 <DIR> d-------- I:\WINDOWS\system32\NtmsData
2008-01-24 16:00 . 2008-01-24 16:00 <DIR> d-------- I:\Program Files\Nero
2008-01-24 16:00 . 2008-01-24 16:01 <DIR> d-------- I:\Program Files\Common Files\Ahead
2008-01-24 15:16 . 2008-01-24 15:16 0 --a------ I:\WINDOWS\nsreg.dat
2008-01-24 14:52 . 2008-01-24 14:49 3,974,440 --a------ I:\WINDOWS\system32\AdvrCntr3.dll
2008-01-24 10:36 . 2008-01-24 15:46 <DIR> d-------- I:\Program Files\Common Files\Nero
2008-01-23 18:21 . 2008-01-25 09:18 1,061 --a------ I:\WINDOWS\system32\drivers\fwdrv.err
2008-01-23 13:35 . 2000-08-31 08:00 51,200 --a------ I:\WINDOWS\Nircmd.exe
2008-01-23 13:01 . 2008-01-23 13:01 <DIR> d-------- I:\Program Files\Trend Micro
2008-01-23 12:47 . 1996-01-09 10:38 283,648 --a------ I:\WINDOWS\uninst.exe
2008-01-22 23:42 . 2007-07-30 19:19 271,224 --a------ I:\WINDOWS\system32\mucltui.dll
2008-01-22 23:42 . 2007-07-30 19:19 30,072 --a------ I:\WINDOWS\system32\mucltui.dll.mui
2008-01-22 21:21 . 2008-01-22 21:21 <DIR> d----c--- I:\WINDOWS\system32\DRVSTORE
2008-01-22 11:51 . 2008-01-22 11:51 <DIR> d-------- I:\Program Files\illiminable
2008-01-22 10:30 . 2008-01-22 21:21 <DIR> d--hsc--- I:\Program Files\Common Files\WindowsLiveInstaller
2008-01-22 10:29 . 2008-01-22 21:21 <DIR> d-------- I:\Program Files\Windows Live
2008-01-22 10:29 . 2008-01-22 10:29 <DIR> d-------- I:\Program Files\Bonjour
2008-01-22 10:18 . 2008-01-22 10:18 <DIR> d-------- I:\Program Files\Common Files\Macrovision Shared
2008-01-21 11:32 . 2008-01-21 11:32 <DIR> d-------- I:\WINDOWS\system32\Adobe
2008-01-21 11:32 . 2004-08-17 02:40 16,384 --a------ I:\WINDOWS\system32\FileOps.exe
2008-01-21 11:18 . 2008-01-21 11:18 <DIR> d-------- I:\WINDOWS\Sun
2008-01-21 11:16 . 2007-09-24 23:31 69,632 --a------ I:\WINDOWS\system32\javacpl.cpl
2008-01-21 11:15 . 2008-01-21 11:16 <DIR> d-------- I:\Program Files\Java
2008-01-21 11:14 . 2008-01-21 11:14 <DIR> d-------- I:\Program Files\Common Files\Java
2008-01-21 10:02 . 2008-01-23 15:00 <DIR> d-------- I:\Program Files\Common Files\Adobe
2008-01-21 09:32 . 2007-11-30 18:14 83,072 --a------ I:\WINDOWS\system32\drivers\wdmaud.sys
2008-01-21 09:32 . 2007-11-30 18:14 83,072 --a--c--- I:\WINDOWS\system32\dllcache\wdmaud.sys
2008-01-21 09:32 . 2007-11-30 17:30 6,272 --a------ I:\WINDOWS\system32\drivers\splitter.sys
2008-01-21 09:32 . 2007-11-30 17:30 6,272 --a--c--- I:\WINDOWS\system32\dllcache\splitter.sys
2008-01-21 09:31 . 2007-11-30 17:30 52,864 --a------ I:\WINDOWS\system32\drivers\DMusic.sys
2008-01-21 09:31 . 2007-11-30 17:30 52,864 --a--c--- I:\WINDOWS\system32\dllcache\dmusic.sys
2008-01-21 09:28 . 2007-11-30 17:30 56,576 --a------ I:\WINDOWS\system32\drivers\swmidi.sys
2008-01-21 09:28 . 2007-11-30 17:30 56,576 --a--c--- I:\WINDOWS\system32\dllcache\swmidi.sys
2008-01-21 09:24 . 2007-11-30 18:17 146,048 --a------ I:\WINDOWS\system32\drivers\portcls.sys
2008-01-21 09:24 . 2007-11-30 18:17 146,048 --a--c--- I:\WINDOWS\system32\dllcache\portcls.sys
2008-01-21 09:24 . 2007-12-01 00:27 129,536 --a------ I:\WINDOWS\system32\ksproxy.ax
2008-01-21 09:24 . 2007-12-01 00:27 129,536 --a--c--- I:\WINDOWS\system32\dllcache\ksproxy.ax
2008-01-21 09:24 . 2007-11-30 17:30 60,160 --a------ I:\WINDOWS\system32\drivers\drmk.sys
2008-01-21 09:24 . 2007-11-30 17:30 60,160 --a--c--- I:\WINDOWS\system32\dllcache\drmk.sys
2008-01-21 09:24 . 2007-12-01 00:25 4,096 --a------ I:\WINDOWS\system32\ksuser.dll
2008-01-21 09:24 . 2007-12-01 00:25 4,096 --a--c--- I:\WINDOWS\system32\dllcache\ksuser.dll
2008-01-21 09:23 . 2008-01-21 09:23 <DIR> d--h----- I:\Program Files\InstallShield Installation Information
2008-01-21 09:23 . 2008-01-21 09:23 <DIR> d-------- I:\Program Files\Analog Devices
2008-01-21 09:22 . 2008-01-21 09:22 <DIR> d-------- I:\Program Files\Common Files\InstallShield
2008-01-21 09:18 . 2008-01-21 09:18 <DIR> d-------- I:\Program Files\Avira
2008-01-21 09:16 . 2008-01-25 19:34 2,729 --a------ I:\WINDOWS\wincmd.ini
2008-01-21 09:16 . 2007-06-21 07:01 545 --a------ I:\WINDOWS\UC.PIF
2008-01-21 09:16 . 2007-06-21 07:01 545 --a------ I:\WINDOWS\RAR.PIF
2008-01-21 09:16 . 2007-06-21 07:01 545 --a------ I:\WINDOWS\PKZIP.PIF
2008-01-21 09:16 . 2007-06-21 07:01 545 --a------ I:\WINDOWS\PKUNZIP.PIF
2008-01-21 09:16 . 2007-06-21 07:01 545 --a------ I:\WINDOWS\NOCLOSE.PIF
2008-01-21 09:16 . 2007-06-21 07:01 545 --a------ I:\WINDOWS\LHA.PIF
2008-01-21 09:16 . 2007-06-21 07:01 545 --a------ I:\WINDOWS\ARJ.PIF
2008-01-21 09:09 . 2008-01-21 09:29 <DIR> d-------- I:\Program Files\Dot1XCfg
2008-01-21 09:03 . 2008-01-21 09:03 <DIR> d--h----- I:\Program Files\Uninstall Information
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-21 07:50 --------- d-----w I:\Program Files\microsoft frontpage
2008-01-21 07:49 --------- d-----w I:\Program Files\Windows Media Connect 2
2007-12-29 14:43 96,512 ----a-w I:\WINDOWS\system32\drivers\atapi.sys
2007-12-29 14:43 96,384 ----a-w I:\WINDOWS\system32\drivers\scsiport.sys
2007-12-29 14:43 80,128 ----a-w I:\WINDOWS\system32\drivers\parport.sys
2007-12-29 14:43 79,232 ----a-w I:\WINDOWS\system32\drivers\sdbus.sys
2007-12-29 14:43 71,168 ----a-w I:\WINDOWS\system32\drivers\dxg.sys
2007-12-29 14:43 7,168 ----a-w I:\WINDOWS\system32\hccoin.dll
2007-12-29 14:43 68,224 ----a-w I:\WINDOWS\system32\drivers\pci.sys
2007-12-29 14:43 64,512 ----a-w I:\WINDOWS\system32\drivers\serial.sys
2007-12-29 14:43 63,744 ----a-w I:\WINDOWS\system32\drivers\mf.sys
2007-12-29 14:43 62,976 ----a-w I:\WINDOWS\system32\drivers\cdrom.sys
2007-12-29 14:43 61,824 ----a-w I:\WINDOWS\system32\drivers\nic1394.sys
2007-12-29 14:43 60,800 ----a-w I:\WINDOWS\system32\drivers\arp1394.sys
2007-12-29 14:43 59,520 ----a-w I:\WINDOWS\system32\drivers\usbhub.sys
2007-12-29 14:43 52,736 ----a-w I:\WINDOWS\system32\wzcsapi.dll
2007-12-29 14:43 52,480 ----a-w I:\WINDOWS\system32\drivers\i8042prt.sys
2007-12-29 14:43 52,224 ----a-w I:\WINDOWS\system32\dmutil.dll
2007-12-29 14:43 483,840 ----a-w I:\WINDOWS\system32\wzcsvc.dll
2007-12-29 14:43 47,616 ----a-w I:\WINDOWS\system32\iyuv_32.dll
2007-12-29 14:43 47,104 ----a-w I:\WINDOWS\system32\cnbjmon.dll
2007-12-29 14:43 42,752 ----a-w I:\WINDOWS\system32\drivers\p3.sys
2007-12-29 14:43 42,112 ----a-w I:\WINDOWS\system32\drivers\imapi.sys
2007-12-29 14:43 4,352 ----a-w I:\WINDOWS\system32\drivers\swenum.sys
2007-12-29 14:43 37,760 ----a-w I:\WINDOWS\system32\drivers\amdk7.sys
2007-12-29 14:43 37,376 ----a-w I:\WINDOWS\system32\drivers\amdk6.sys
2007-12-29 14:43 37,248 ----a-w I:\WINDOWS\system32\drivers\isapnp.sys
2007-12-29 14:43 36,864 ----a-w I:\WINDOWS\system32\drivers\hidclass.sys
2007-12-29 14:43 36,736 ----a-w I:\WINDOWS\system32\drivers\crusoe.sys
2007-12-29 14:43 36,352 ----a-w I:\WINDOWS\system32\drivers\intelppm.sys
2007-12-29 14:43 36,352 ----a-w I:\WINDOWS\system32\drivers\disk.sys
2007-12-29 14:43 35,840 ----a-w I:\WINDOWS\system32\drivers\processr.sys
2007-12-29 14:43 35,328 ----a-w I:\WINDOWS\system32\pid.dll
2007-12-29 14:43 30,208 ----a-w I:\WINDOWS\system32\drivers\usbehci.sys
2007-12-29 14:43 30,080 ----a-w I:\WINDOWS\system32\drivers\modem.sys
2007-12-29 14:43 27,392 ----a-w I:\WINDOWS\system32\drivers\fdc.sys
2007-12-29 14:43 264,832 ----a-w I:\WINDOWS\system32\drivers\http.sys
2007-12-29 14:43 25,728 ----a-w I:\WINDOWS\system32\drivers\usbcamd2.sys
2007-12-29 14:43 25,600 ----a-w I:\WINDOWS\system32\drivers\usbcamd.sys
2007-12-29 14:43 25,344 ----a-w I:\WINDOWS\system32\drivers\sonydcam.sys
2007-12-29 14:43 24,960 ----a-w I:\WINDOWS\system32\drivers\pciidex.sys
2007-12-29 14:43 24,960 ----a-w I:\WINDOWS\system32\drivers\hidparse.sys
2007-12-29 14:43 24,576 ----a-w I:\WINDOWS\system32\drivers\kbdclass.sys
2007-12-29 14:43 23,040 ----a-w I:\WINDOWS\system32\drivers\mouclass.sys
2007-12-29 14:43 20,992 ----a-w I:\WINDOWS\system32\hid.dll
2007-12-29 14:43 20,608 ----a-w I:\WINDOWS\system32\drivers\usbuhci.sys
2007-12-29 14:43 20,480 ----a-w I:\WINDOWS\system32\drivers\flpydisk.sys
2007-12-29 14:43 2,306,560 ----a-w I:\WINDOWS\system32\ntoskrnl.exe
2007-12-29 14:43 2,185,216 ----a-w I:\WINDOWS\system32\ntkrnlpa.exe
2007-12-29 14:43 193,024 ----a-w I:\WINDOWS\system32\fsquirt.exe
2007-12-29 14:43 187,776 ----a-w I:\WINDOWS\system32\drivers\acpi.sys
2007-12-29 14:43 16,896 ----a-w I:\WINDOWS\system32\msyuv.dll
2007-12-29 14:43 15,872 ----a-w I:\WINDOWS\system32\drivers\usbintel.sys
2007-12-29 14:43 15,744 ----a-w I:\WINDOWS\system32\drivers\serenum.sys
2007-12-29 14:43 15,488 ----a-w I:\WINDOWS\system32\drivers\mssmbios.sys
2007-12-29 14:43 15,360 ----a-w I:\WINDOWS\system32\pjlmon.dll
2007-12-29 14:43 143,872 ----a-w I:\WINDOWS\system32\drivers\usbport.sys
2007-12-29 14:43 14,592 ----a-w I:\WINDOWS\system32\drivers\ndisuio.sys
2007-12-29 14:43 120,192 ----a-w I:\WINDOWS\system32\drivers\pcmcia.sys
2007-12-29 14:43 12,288 ----a-w I:\WINDOWS\system32\drivers\tunmp.sys
2007-12-29 14:43 11,904 ----a-w I:\WINDOWS\system32\drivers\sffdisk.sys
2007-12-29 14:43 11,392 ----a-w I:\WINDOWS\system32\drivers\sfloppy.sys
2007-12-29 14:43 11,008 ----a-w I:\WINDOWS\system32\drivers\sffp_sd.sys
2007-12-29 14:43 108,032 ----a-w I:\WINDOWS\system32\wshbth.dll
2007-12-29 14:43 10,368 ----a-w I:\WINDOWS\system32\drivers\hidusb.sys
2007-12-29 14:43 10,240 ----a-w I:\WINDOWS\system32\drivers\sffp_mmc.sys
2007-12-29 14:43 1,613,824 ----a-w I:\WINDOWS\system32\sfcfiles.dll
2007-12-29 14:36 86,073 ----a-w I:\WINDOWS\system32\usrfaxa.dll
2007-12-29 14:36 8,192 ----a-w I:\WINDOWS\system32\tsbyuv.dll
2007-12-29 14:36 8,192 ----a-w I:\WINDOWS\system32\streamci.dll
2007-12-29 14:36 77,891 ----a-w I:\WINDOWS\system32\usrmlnka.exe
2007-12-29 14:36 77,890 ----a-w I:\WINDOWS\system32\usrdpa.dll
2007-12-29 14:36 77,883 ----a-w I:\WINDOWS\system32\usrrtosa.dll
2007-12-29 14:36 72,192 ----a-w I:\WINDOWS\system32\sprio800.dll
2007-12-29 14:36 70,656 ----a-w I:\WINDOWS\system32\sprio600.dll
2007-12-29 14:36 69,700 ----a-w I:\WINDOWS\system32\usrshuta.exe
2007-12-29 14:36 69,699 ----a-w I:\WINDOWS\system32\usrcoina.dll
2007-12-29 14:36 69,632 ----a-w I:\WINDOWS\system32\spnike.dll
2007-12-29 14:36 61,508 ----a-w I:\WINDOWS\system32\usrprbda.exe
2007-12-29 14:36 61,500 ----a-w I:\WINDOWS\system32\usrcntra.dll
2007-12-29 14:36 58,112 ----a-w I:\WINDOWS\system32\drivers\vdmindvd.sys
2007-12-29 14:36 55,296 ----a-w I:\WINDOWS\system32\dvdplay.exe
2007-12-29 14:36 53,305 ----a-w I:\WINDOWS\system32\usrlbva.dll
2007-12-29 14:36 51,712 ----a-w I:\WINDOWS\system32\drivers\tosdvd.sys
2007-12-29 14:36 49,211 ----a-w I:\WINDOWS\system32\usrvpa.dll
2007-12-29 14:36 49,211 ----a-w I:\WINDOWS\system32\usrsdpia.dll
2007-12-29 14:36 49,209 ----a-w I:\WINDOWS\system32\usrv80a.dll
2007-12-29 14:36 45,116 ----a-w I:\WINDOWS\system32\usrvoica.dll
2007-12-29 14:36 41,019 ----a-w I:\WINDOWS\system32\usrsvpia.dll
2007-12-29 14:36 4,736 ----a-w I:\WINDOWS\system32\drivers\usbd.sys
2007-12-29 14:36 323,641 ----a-w I:\WINDOWS\system32\usrdtea.dll
2007-12-29 14:36 3,456 ----a-w I:\WINDOWS\system32\drivers\oprghdlr.sys
2007-12-29 14:36 3,328 ----a-w I:\WINDOWS\system32\drivers\pciide.sys
2007-12-29 14:36 3,200 ----a-w I:\WINDOWS\system32\wowfax.dll
2007-12-29 14:36 262,528 ----a-w I:\WINDOWS\system32\drivers\cinemst2.sys
2007-12-29 14:36 21,376 ----a-w I:\WINDOWS\system32\drivers\tsbvcap.sys
2007-12-29 14:36 18,688 ----a-w I:\WINDOWS\system32\drivers\cdaudio.sys
2007-12-29 14:36 157,696 ----a-w I:\WINDOWS\system32\paqsp.dll
2007-12-29 14:36 147,968 ----a-w I:\WINDOWS\system32\mdwmdmsp.dll
2007-12-29 14:36 13,952 ----a-w I:\WINDOWS\system32\drivers\cbidf2k.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccleaner"="D:\Program Files\CCleaner\CCleaner.exe" [2007-11-22 17:10 787696]
"ctfmon.exe"="I:\WINDOWS\system32\ctfmon.exe" [2007-12-01 00:26 15360]
"MsnMsgr"="I:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
"MSMSGS"="I:\Program Files\Messenger\msmsgs.exe" [2007-12-01 00:26 1695232]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="I:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-01-21 09:20 249896]
"SoundMAXPnP"="I:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 09:11 1388544]
"SunJavaUpdateSched"="I:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"Adobe Reader Speed Launcher"="I:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06 40048]
"NeroFilterCheck"="I:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, credssp.dll, msnsspc.dll
R1 fwdrv;Firewall Driver;I:\WINDOWS\system32\drivers\fwdrv.sys [2007-04-26 10:21]
R1 khips;Kerio HIPS Driver;I:\WINDOWS\system32\drivers\khips.sys [2007-04-26 10:21]
R2 SPF4;Sunbelt Personal Firewall 4;"D:\Program Files\Kerio\kpf4ss.exe" [2007-04-26 10:21]
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-25 19:47:27
Windows 5.1.2600 Service Pack 3, v.3264 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
g!rly
Messages postés
18209
Date d'inscription
vendredi 17 août 2007
Statut
Contributeur
Dernière intervention
30 novembre 2014
406
25 janv. 2008 à 19:57
25 janv. 2008 à 19:57
re,
et un nouveau hijack this
@+
et un nouveau hijack this
@+
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:59, on 2008-01-25
Platform: Windows XP SP3, v.3264 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal
Running processes:
I:\WINDOWS\System32\smss.exe
I:\WINDOWS\system32\winlogon.exe
I:\WINDOWS\system32\services.exe
I:\WINDOWS\system32\lsass.exe
I:\WINDOWS\system32\svchost.exe
I:\WINDOWS\System32\svchost.exe
I:\WINDOWS\system32\spoolsv.exe
I:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
I:\WINDOWS\Explorer.EXE
I:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
I:\Program Files\Bonjour\mDNSResponder.exe
D:\Program Files\Kerio\kpf4ss.exe
D:\Program Files\Kerio\kpf4gui.exe
D:\Program Files\Kerio\kpf4gui.exe
I:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
I:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
I:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
I:\WINDOWS\system32\ctfmon.exe
I:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
I:\Program Files\Messenger\msmsgs.exe
I:\Program Files\Windows Live\Messenger\usnsvc.exe
D:\Program Files\Mozilla Firefox\firefox.exe
I:\Program Files\Windows Media Player\wmplayer.exe
I:\Program Files\Internet Explorer\IEXPLORE.EXE
I:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
I:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - I:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - I:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - I:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [avgnt] "I:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SoundMAXPnP] I:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "I:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "I:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] I:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [ccleaner] "D:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKCU\..\Run: [ctfmon.exe] I:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "I:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "I:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - I:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - I:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - https://www.f-secure.com/en/home/support
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - I:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - I:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - I:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - I:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NBService - Nero AG - I:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - I:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - D:\Program Files\Kerio\kpf4ss.exe
Scan saved at 19:59, on 2008-01-25
Platform: Windows XP SP3, v.3264 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal
Running processes:
I:\WINDOWS\System32\smss.exe
I:\WINDOWS\system32\winlogon.exe
I:\WINDOWS\system32\services.exe
I:\WINDOWS\system32\lsass.exe
I:\WINDOWS\system32\svchost.exe
I:\WINDOWS\System32\svchost.exe
I:\WINDOWS\system32\spoolsv.exe
I:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
I:\WINDOWS\Explorer.EXE
I:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
I:\Program Files\Bonjour\mDNSResponder.exe
D:\Program Files\Kerio\kpf4ss.exe
D:\Program Files\Kerio\kpf4gui.exe
D:\Program Files\Kerio\kpf4gui.exe
I:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
I:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
I:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
I:\WINDOWS\system32\ctfmon.exe
I:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
I:\Program Files\Messenger\msmsgs.exe
I:\Program Files\Windows Live\Messenger\usnsvc.exe
D:\Program Files\Mozilla Firefox\firefox.exe
I:\Program Files\Windows Media Player\wmplayer.exe
I:\Program Files\Internet Explorer\IEXPLORE.EXE
I:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
I:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - I:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - I:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - I:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [avgnt] "I:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SoundMAXPnP] I:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "I:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "I:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] I:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [ccleaner] "D:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKCU\..\Run: [ctfmon.exe] I:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "I:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "I:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - I:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - I:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - https://www.f-secure.com/en/home/support
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - I:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - I:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - I:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - I:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NBService - Nero AG - I:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - I:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - D:\Program Files\Kerio\kpf4ss.exe
g!rly
Messages postés
18209
Date d'inscription
vendredi 17 août 2007
Statut
Contributeur
Dernière intervention
30 novembre 2014
406
25 janv. 2008 à 20:06
25 janv. 2008 à 20:06
re,
coche et fix cette ligne stp
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
et dis moi si elle disparait quand tu refais un scan juste apres
@+
coche et fix cette ligne stp
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
et dis moi si elle disparait quand tu refais un scan juste apres
@+
Oui , la ligne est partie...........
voilà le log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:12, on 2008-01-25
Platform: Windows XP SP3, v.3264 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal
Running processes:
I:\WINDOWS\System32\smss.exe
I:\WINDOWS\system32\winlogon.exe
I:\WINDOWS\system32\services.exe
I:\WINDOWS\system32\lsass.exe
I:\WINDOWS\system32\svchost.exe
I:\WINDOWS\System32\svchost.exe
I:\WINDOWS\system32\spoolsv.exe
I:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
I:\WINDOWS\Explorer.EXE
I:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
I:\Program Files\Bonjour\mDNSResponder.exe
D:\Program Files\Kerio\kpf4ss.exe
D:\Program Files\Kerio\kpf4gui.exe
D:\Program Files\Kerio\kpf4gui.exe
I:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
I:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
I:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
I:\WINDOWS\system32\ctfmon.exe
I:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
I:\Program Files\Messenger\msmsgs.exe
I:\Program Files\Windows Live\Messenger\usnsvc.exe
D:\Program Files\Mozilla Firefox\firefox.exe
I:\Program Files\Windows Media Player\wmplayer.exe
I:\Program Files\Internet Explorer\IEXPLORE.EXE
I:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
I:\WINDOWS\system32\wuauclt.exe
I:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - I:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - I:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - I:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [avgnt] "I:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SoundMAXPnP] I:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "I:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "I:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] I:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [ccleaner] "D:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKCU\..\Run: [ctfmon.exe] I:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "I:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "I:\Program Files\Messenger\msmsgs.exe" /background
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - I:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - I:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - https://www.f-secure.com/en/home/support
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - I:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - I:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - I:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - I:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NBService - Nero AG - I:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - I:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - D:\Program Files\Kerio\kpf4ss.exe
voilà le log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:12, on 2008-01-25
Platform: Windows XP SP3, v.3264 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal
Running processes:
I:\WINDOWS\System32\smss.exe
I:\WINDOWS\system32\winlogon.exe
I:\WINDOWS\system32\services.exe
I:\WINDOWS\system32\lsass.exe
I:\WINDOWS\system32\svchost.exe
I:\WINDOWS\System32\svchost.exe
I:\WINDOWS\system32\spoolsv.exe
I:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
I:\WINDOWS\Explorer.EXE
I:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
I:\Program Files\Bonjour\mDNSResponder.exe
D:\Program Files\Kerio\kpf4ss.exe
D:\Program Files\Kerio\kpf4gui.exe
D:\Program Files\Kerio\kpf4gui.exe
I:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
I:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
I:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
I:\WINDOWS\system32\ctfmon.exe
I:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
I:\Program Files\Messenger\msmsgs.exe
I:\Program Files\Windows Live\Messenger\usnsvc.exe
D:\Program Files\Mozilla Firefox\firefox.exe
I:\Program Files\Windows Media Player\wmplayer.exe
I:\Program Files\Internet Explorer\IEXPLORE.EXE
I:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
I:\WINDOWS\system32\wuauclt.exe
I:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - I:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - I:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - I:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [avgnt] "I:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SoundMAXPnP] I:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "I:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "I:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] I:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [ccleaner] "D:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKCU\..\Run: [ctfmon.exe] I:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "I:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "I:\Program Files\Messenger\msmsgs.exe" /background
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - I:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - I:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - https://www.f-secure.com/en/home/support
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - I:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - I:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - I:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - I:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NBService - Nero AG - I:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - I:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - D:\Program Files\Kerio\kpf4ss.exe
g!rly
Messages postés
18209
Date d'inscription
vendredi 17 août 2007
Statut
Contributeur
Dernière intervention
30 novembre 2014
406
25 janv. 2008 à 20:25
25 janv. 2008 à 20:25
bon c´est cool
fais ceci :
A.V.G :
-> Télécharger AVG Anti-Spyware (ewido)
http://www.commentcamarche.net/telecharger/telecharger 218 avg anti spyware
-> L´installer.
-> lancer AVG Anti-Spyware et clicker sur le bouton Mise à jour. Patienter...
p.s : si les mises a jours ne se font pas, elles sont telechargable ici :
http://downloads.ewido.net/avgas-signatures-full-current.exe
-> Sur la page "analyse":
choisir d´abord l'onglet "paramètres".
sous « Comment réagir » clicker sur « Actions recommandées » et dans le menu déroulant, choisir « Supprimer ».
-> Lancer le scan, (c´est long...).
-> A la fin du scan copier Et coller le rapport ici.
-> Une aide en image au cas ou :
Tutoriel d´installation et de parametrages :
http://www.kachouri.com/tuto/tuto-161-avg-anti-spyware-75-pour-votre-securite.html
@+
fais ceci :
A.V.G :
-> Télécharger AVG Anti-Spyware (ewido)
http://www.commentcamarche.net/telecharger/telecharger 218 avg anti spyware
-> L´installer.
-> lancer AVG Anti-Spyware et clicker sur le bouton Mise à jour. Patienter...
p.s : si les mises a jours ne se font pas, elles sont telechargable ici :
http://downloads.ewido.net/avgas-signatures-full-current.exe
-> Sur la page "analyse":
choisir d´abord l'onglet "paramètres".
sous « Comment réagir » clicker sur « Actions recommandées » et dans le menu déroulant, choisir « Supprimer ».
-> Lancer le scan, (c´est long...).
-> A la fin du scan copier Et coller le rapport ici.
-> Une aide en image au cas ou :
Tutoriel d´installation et de parametrages :
http://www.kachouri.com/tuto/tuto-161-avg-anti-spyware-75-pour-votre-securite.html
@+
