NDT2.SYS Résolu

Question

Bonjour,à tous
j'ai un doute  sur ndt2.sys
Avast panique des qu'il le voit
Mac Afee reste de marbre
alors virus où pas ?

green day · Accepted Answer

Salut

 avast a raison de s'affoler !

==> http://www.prevx.com/filenames/1524465597496960846-X1/NDT2.SYS.html

Télécharge ceci : 

Lien : http://www.commentcamarche.net/telecharger/telecharger 159 hijackthis

Démo : http://pageperso.aol.fr/balltrap34/demohijack.htm 

Choisir l'option "do a scan and a logfile", et faire un copier/coller du rapport ainsi générer sur le forum. 

++

freelog · Answer

ok merci
je fearais tout cela de chez moi 
ici je n'aipas accés à tous les sites 
je vous tient au courant
@+

freelog · Answer

pourquoi Mac Affee ne le considére pas comme un virus

green day · Answer

tu as deux antivirus ??

 les antivirus ne peuvent pas tout voir, est-il a jour ??

++

freelog · Answer

bonjour green day
non en fait j'ai deux ordinateurs avec 2 antivirus différents
je n'ai pas répondu avant car galère chez moi plus de téléphone plus d'internet (les boules)
sinon voici le post que tu m'a demandé

--Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:40:26, on 02/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
c:\program files\a-squared free\a2service.exe
C:\WINDOWS\System32\cisvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\SYSTEM32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\FastSysTray\FastsysTray.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\TuneUp Utilities 2007\MemOptimizer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Hercules\WiFi Station\WifiStation.exe
C:\WINDOWS\SYSTEM32\cidaemon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=55729C844D6A45819CAD368B3E178C9F
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=61005
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=61005
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=61005
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = localhost:3128
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O1 - Hosts: 82.98.86.177 quatch.com
O1 - Hosts: 82.98.86.162 electripulse.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: VSPopUp - {C89657E6-D083-4EA3-81D2-D7AD3D0ED490} - C:\WINDOWS\system32\vsPop.dll
O3 - Toolbar: (no name) - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - (no file)
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [OHE] C:\Program Files\Ohé\OHE.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [Fast SysTray] C:\Program Files\FastSysTray\FastsysTray.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1036 -noicon
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [TuneUp MemOptimizer] "C:\Program Files\TuneUp Utilities 2007\MemOptimizer.exe" autostart
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: []  (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: []  (User 'Default user')
O4 - Global Startup: WiFi Station.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{5D6DC9EF-CC1F-4436-BE24-CF1724AF61B6}: NameServer = 86.64.145.145,84.103.237.145
O17 - HKLM\System\CCS\Services\Tcpip\..\{9AEC1094-2F78-43B0-83E7-37623C7C8250}: NameServer = 86.64.145.145,84.103.237.145
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: fasmib - fasmib.dll (file missing)
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - c:\program files\a-squared free\a2service.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: McAfee Wireless Network Security Service (MWLSvc) - McAfee, Inc. - C:\Program Files\Mcafee\MWL\MwlSvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: O&O Defrag 2000 (OOD2000) - O&O Software GmbH - C:\WINDOWS\system32\OOD2000.exe
O23 - Service: perfmons Service (perfmons) - Unknown owner - C:\WINDOWS\system32\perfmonss.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: User Profile Hive Cleanup (UPHClean) - Unknown owner - C:\Program Files\UPHClean\uphclean.exe (file missing)
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe

green day · Answer

Salut

ok,

Télécharger ComboFix (par sUBs) sur le Bureau : http://download.bleepingcomputer.com/sUBs/ComboFix.exe 

* Démarrer en mode sans echec 
* Double cliquer combofix.exe. 
* Appuyer sur la touche Y (Yes) pour démarrer le scan 
* Le rapport sera crée dans: C:\Combofix.txt, poste le stp 

++

freelog · Answer

merci .
je fais ça ce soir
et je te post cela demain
Neuf ont assuré tout est "re ok"

@+

freelog · Answer

green-day
les lignes 01 et 020 m'interpelle 
d'aprés toi c'est normal ?

freelog · Answer

coome prévu en avance

ComboFix 08-02.05.3 - Béatrice 2008-02-05 12:53:15.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.139 [GMT 1:00]
Endroit: L:\Didier\Utilitaire Internet\Logiciels Utiles\ComboFix.exe
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
C:\WINDOWS\assys.dll
C:\WINDOWS\bhwin.sys
C:\WINDOWS\dat.txt
C:\WINDOWS\ffnsys.dll
C:\WINDOWS\Fonts\acrsecB.fon
C:\WINDOWS\Fonts\acrsecI.fon
C:\WINDOWS\gstcore.dll
C:\WINDOWS\mfnsys.dll
C:\WINDOWS\rs.txt
C:\WINDOWS\rsczsys.dll
C:\WINDOWS\snsys.dll
C:\WINDOWS\system32\cookie.dat
C:\WINDOWS\system32\drivers\npf.sys
C:\WINDOWS\system32\grouppolicy\machine\scripts\scripts.ini
C:\WINDOWS\system32\help.txt
C:\WINDOWS\system32\packet.dll
C:\WINDOWS\system32\ps.dat
C:\WINDOWS\system32\wanpacket.dll
C:\WINDOWS\system32\wpcap.dll
C:\WINDOWS\uawin.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_NPF

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-01-05 to 2008-02-05 ))))))))))))))))))))))))))))))))))))
.

2008-02-02 11:39 . 2008-02-02 11:39 <REP> d-------- C:\Program Files\Trend Micro
2008-02-01 13:30 . 2004-08-28 14:00 21,504 --a------ C:\WINDOWS\system32\route.exe
2008-02-01 13:30 . 2004-08-28 14:00 21,504 --a--c--- C:\WINDOWS\system32\dllcache\route.exe
2008-02-01 13:09 . 2008-02-01 13:14 <REP> d-------- C:\Program Files\SUPERAntiSpyware
2008-02-01 13:09 . 2008-02-01 13:09 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-02-01 13:08 . 2008-02-01 13:08 45,056 --a------ C:\WINDOWS\system32\Indt2.sys
2008-01-31 19:07 . 2008-01-31 19:07 <REP> d-------- C:\Program Files\CCleaner
2008-01-30 10:46 . 2007-12-04 14:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe
2008-01-30 10:46 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2008-01-30 10:46 . 2007-12-04 13:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2008-01-30 10:46 . 2007-12-04 15:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2008-01-30 10:46 . 2007-12-04 15:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2008-01-30 10:46 . 2007-12-04 15:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2008-01-30 10:46 . 2007-12-04 15:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2008-01-30 10:46 . 2007-12-04 15:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2008-01-22 16:29 . 2008-01-22 16:29 131 --a------ C:\WINDOWS\AKDEL.bat
2008-01-14 17:14 . 2008-01-14 17:14 <REP> d-------- C:\WINDOWS\system32\drivers\USB
2008-01-14 16:50 . 2008-01-14 16:50 <REP> d-------- C:\Program Files\Hercules
2008-01-14 16:50 . 2006-03-09 11:33 366,080 --a------ C:\WINDOWS\system32\drivers\rt61.sys
2008-01-14 16:50 . 2006-03-09 11:33 365,440 --a------ C:\WINDOWS\system32\drivers\RT619x.sys
2008-01-14 16:50 . 2006-01-12 19:47 255,616 --a------ C:\WINDOWS\system32\drivers\rt73u98.sys
2008-01-14 16:50 . 2006-01-12 19:46 252,928 --a------ C:\WINDOWS\system32\drivers\rt73.sys
2008-01-14 16:50 . 2005-10-17 19:50 247,808 --a------ C:\WINDOWS\system32\drivers\rt25u98.sys
2008-01-14 16:50 . 2005-10-17 19:50 245,376 --a------ C:\WINDOWS\system32\drivers\rt2500usb.sys
2008-01-14 16:50 . 2005-10-20 15:00 244,608 --a------ C:\WINDOWS\system32\drivers\rt25009x.sys
2008-01-14 16:50 . 2005-10-20 15:00 243,328 --a------ C:\WINDOWS\system32\drivers\rt2500.sys
2008-01-13 10:05 . 2008-01-14 17:14 <REP> d-------- C:\Program Files\SuperLink
2008-01-13 09:36 . 2008-01-30 10:46 <REP> d-------- C:\Program Files\Alwil Software
2008-01-12 18:44 . 2008-01-12 18:44 22 --a------ C:\WINDOWS\system32\ati64hlp.stb
2008-01-12 18:00 . 2008-01-29 22:22 98,304 --a------ C:\WINDOWS\DUMP77b4.tmp
2008-01-12 18:00 . 2008-01-29 22:04 98,304 --a------ C:\WINDOWS\DUMP7796.tmp
2008-01-09 21:08 . 2004-11-28 21:09 679,936 --a------ C:\WINDOWS\system32\xvidcore.dll
2008-01-07 20:34 . 2008-01-07 20:34 <REP> d--h----- C:\WINDOWS\PIF
2008-01-06 16:11 . 2008-01-06 16:11 <REP> d-------- C:\Documents and Settings\LocalService\Application Data\McAfee

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-05 11:59 --------- d-----w C:\Program Files\Ohé
2008-02-01 12:18 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-02-01 12:07 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-01-31 17:59 --------- d-----w C:\Program Files\a-squared Free
2008-01-31 16:32 --------- d-----w C:\Program Files\Java
2008-01-22 15:39 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-22 15:38 --------- d-----w C:\Program Files\Windows Media Bonus Pack for Windows XP
2008-01-22 15:36 --------- d-----w C:\Program Files\Neuf
2008-01-22 15:28 --------- d-----w C:\Program Files\Morgan
2008-01-14 15:21 --------- d-----w C:\Program Files\Creative
2008-01-14 15:15 --------- d-----w C:\Program Files\neodivx2006
2008-01-14 15:05 --------- d-----w C:\Program Files\DVDFab Decrypter
2008-01-14 15:04 --------- d-----w C:\Program Files\DivX
2008-01-14 14:57 --------- d-----w C:\Program Files\adslTV
2008-01-13 08:39 --------- d-----w C:\Program Files\Fichiers communs\McAfee
2008-01-13 08:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee
2008-01-13 08:38 --------- d-----w C:\Program Files\McAfee
2008-01-12 17:11 --------- d-----w C:\Program Files\ATI Technologies
2008-01-06 15:37 --------- d-----w C:\Program Files\Fichiers communs\Ahead
2008-01-06 15:34 --------- d-----w C:\Program Files\Nero
2008-01-06 15:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
2008-01-06 14:56 --------- d-----w C:\Program Files\Fichiers communs\Nero
2008-01-02 22:10 --------- d-----w C:\Program Files\Pegasys Inc
2008-01-02 22:08 --------- d-----w C:\Program Files\Windows Media Connect 2
2007-12-31 19:54 --------- d-----w C:\Program Files\vso
2007-12-31 08:35 --------- d-----w C:\Program Files\Windows Defender
2007-12-29 16:17 --------- d-----w C:\Program Files\Micro Application
2007-12-27 20:22 --------- d-----w C:\Program Files\CyberLink
2007-12-24 15:36 --------- d-----w C:\Program Files\Fichiers communs\Panda Software
2007-12-21 12:22 --------- d-----w C:\Program Files\AC3Filter
2007-12-18 21:26 --------- d-----w C:\Program Files\Elaborate Bytes
2007-12-18 21:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\SlySoft
2007-12-18 21:25 --------- d-----w C:\Program Files\SlySoft
2007-12-15 11:48 --------- d-----w C:\Program Files\Free Audio Pack
2007-12-11 18:43 111,659 ----a-w C:\WINDOWS\BricoPackUninst.cmd
2007-12-06 22:03 --------- d-----w C:\Program Files\XnView
2007-11-26 09:38 238,848 ----a-w C:\WINDOWS\UNBOC.EXE
2006-12-28 10:24 139 --sh--w C:\Program Files\desktop.ini
2004-08-19 14:09 65,024 --sha-w C:\WINDOWS\system32\asycfilt.dll
2006-08-25 15:51 617,472 --sha-w C:\WINDOWS\system32\comctl32.dll
2004-08-19 14:09 1,028,096 --sha-w C:\WINDOWS\system32\mfc42.dll
2001-08-28 12:00 57,344 --sha-w C:\WINDOWS\system32\mfc42loc.dll
1996-01-05 07:45 35,088 --sha-w C:\WINDOWS\system32\MSJInt32.dll
1996-11-06 10:00 965,904 --sha-w C:\WINDOWS\system32\msjt3032.dll
1996-01-05 07:45 98,356 --sha-w C:\WINDOWS\system32\MSJtEr32.dll
2004-08-19 14:09 413,696 --sha-w C:\WINDOWS\system32\msvcp60.dll
2004-08-19 14:09 343,040 --sha-w C:\WINDOWS\system32\msvcrt.dll
2001-08-28 12:00 253,952 --sha-w C:\WINDOWS\system32\msvcrt20.dll
2007-05-17 11:29 549,376 --sha-w C:\WINDOWS\system32\oleaut32.dll
2004-08-19 14:09 83,456 --sha-w C:\WINDOWS\system32\olepro32.dll
2004-08-19 14:09 30,749 --sha-w C:\WINDOWS\system32\vbajet32.dll
1996-01-24 07:27 244,496 --sha-w C:\WINDOWS\system32\VBAR2232.dll
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ShedkoBadges_1]
@={01702EF5-1B33-487F-995F-6FA23F1D6652}

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ShedkoBadges_10]
@={10702EF5-1B33-487F-995F-6FA23F1D6652}

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ShedkoBadges_2]
@={02702EF5-1B33-487F-995F-6FA23F1D6652}

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ShedkoBadges_3]
@={03702EF5-1B33-487F-995F-6FA23F1D6652}

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ShedkoBadges_4]
@={04702EF5-1B33-487F-995F-6FA23F1D6652}

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ShedkoBadges_5]
@={05702EF5-1B33-487F-995F-6FA23F1D6652}

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ShedkoBadges_6]
@={06702EF5-1B33-487F-995F-6FA23F1D6652}

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ShedkoBadges_7]
@={07702EF5-1B33-487F-995F-6FA23F1D6652}

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ShedkoBadges_8]
@={08702EF5-1B33-487F-995F-6FA23F1D6652}

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ShedkoBadges_9]
@={09702EF5-1B33-487F-995F-6FA23F1D6652}

[HKEY_CLASSES_ROOT\CLSID\{01702EF5-1B33-487F-995F-6FA23F1D6652}]
2006-08-25 08:37 86016 --a------ C:\PROGRA~1\BADGES~1.0\BADGES~1.DLL

[HKEY_CLASSES_ROOT\CLSID\{10702EF5-1B33-487F-995F-6FA23F1D6652}]
2006-08-25 08:37 86016 --a------ C:\PROGRA~1\BADGES~1.0\BADGES~1.DLL

[HKEY_CLASSES_ROOT\CLSID\{02702EF5-1B33-487F-995F-6FA23F1D6652}]
2006-08-25 08:37 86016 --a------ C:\PROGRA~1\BADGES~1.0\BADGES~1.DLL

[HKEY_CLASSES_ROOT\CLSID\{03702EF5-1B33-487F-995F-6FA23F1D6652}]
2006-08-25 08:37 86016 --a------ C:\PROGRA~1\BADGES~1.0\BADGES~1.DLL

[HKEY_CLASSES_ROOT\CLSID\{04702EF5-1B33-487F-995F-6FA23F1D6652}]
2006-08-25 08:37 86016 --a------ C:\PROGRA~1\BADGES~1.0\BADGES~1.DLL

[HKEY_CLASSES_ROOT\CLSID\{05702EF5-1B33-487F-995F-6FA23F1D6652}]
2006-08-25 08:37 86016 --a------ C:\PROGRA~1\BADGES~1.0\BADGES~1.DLL

[HKEY_CLASSES_ROOT\CLSID\{06702EF5-1B33-487F-995F-6FA23F1D6652}]
2006-08-25 08:37 86016 --a------ C:\PROGRA~1\BADGES~1.0\BADGES~1.DLL

[HKEY_CLASSES_ROOT\CLSID\{07702EF5-1B33-487F-995F-6FA23F1D6652}]
2006-08-25 08:37 86016 --a------ C:\PROGRA~1\BADGES~1.0\BADGES~1.DLL

[HKEY_CLASSES_ROOT\CLSID\{08702EF5-1B33-487F-995F-6FA23F1D6652}]
2006-08-25 08:37 86016 --a------ C:\PROGRA~1\BADGES~1.0\BADGES~1.DLL

[HKEY_CLASSES_ROOT\CLSID\{09702EF5-1B33-487F-995F-6FA23F1D6652}]
2006-08-25 08:37 86016 --a------ C:\PROGRA~1\BADGES~1.0\BADGES~1.DLL

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TuneUp MemOptimizer"="C:\Program Files\TuneUp Utilities 2007\MemOptimizer.exe" [2007-01-17 13:47 311816]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15:09 15360]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 09:59 204288]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-07-16 02:30 476702]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SiSUSBRG"="C:\WINDOWS\SiSUSBrg.exe" [2002-04-26 10:17 102400]
"OHE"="C:\Program Files\Ohé\OHE.exe" [ ]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [2003-05-15 15:41 163840]
"Fast SysTray"="C:\Program Files\FastSysTray\FastsysTray.exe" [2005-10-05 09:39 556032]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 11:48 157592]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2004-12-01 00:25 32768]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fasmib]
fasmib.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"CTStartup"=C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
"Ulead AutoDetector"=C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe
"SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
"BackgroundSwitcher"=C:\WINDOWS\system32\bgswitch.exe
"FastUser"=C:\WINDOWS\system32\fast.exe
"PCTVOICE"=pctspk.exe
"CoolSwitch"=C:\WINDOWS\system32\taskswitch.exe
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
"Corel Photo Downloader"="C:\Program Files\Fichiers communs\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup
"CloneCDTray"="C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
"ATIPTA"=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime

R1 cpuidlep;CpuIdle Pro System Driver;C:\WINDOWS\system32\drivers\cpuidlep.sys [2007-10-26 22:25]
S2 Ca533av;JDC 3.0S Webcam;C:\WINDOWS\system32\Drivers\Ca533av.sys []
S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\PCASp50.sys [2005-11-19 02:13]
S3 USBCamera;JDC 3.0S Camera;C:\WINDOWS\system32\Drivers\Bulk533.sys []
S3 Usblink;Usblink Driver;C:\WINDOWS\system32\Drivers\ulink.sys [2003-06-02 15:28]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-02-02 20:48:27 C:\WINDOWS\Tasks\Maintenance en 1 clic.job"
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
"2008-02-05 11:50:38 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-05 12:59:49
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
c:\program files\a-squared free\a2service.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Hercules\WiFi Station\WifiStation.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-02-05 13:02:32 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-05 12:02:14
.
2008-02-01 12:30:22 --- E O F ---

freelog · Answer

coome prévu en avance

ComboFix 08-02.05.3 - Béatrice 2008-02-05 12:53:15.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.139 [GMT 1:00]
Endroit: L:\Didier\Utilitaire Internet\Logiciels Utiles\ComboFix.exe
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
C:\WINDOWS\assys.dll
C:\WINDOWS\bhwin.sys
C:\WINDOWS\dat.txt
C:\WINDOWS\ffnsys.dll
C:\WINDOWS\Fonts\acrsecB.fon
C:\WINDOWS\Fonts\acrsecI.fon
C:\WINDOWS\gstcore.dll
C:\WINDOWS\mfnsys.dll
C:\WINDOWS\rs.txt
C:\WINDOWS\rsczsys.dll
C:\WINDOWS\snsys.dll
C:\WINDOWS\system32\cookie.dat
C:\WINDOWS\system32\drivers\npf.sys
C:\WINDOWS\system32\grouppolicy\machine\scripts\scripts.ini
C:\WINDOWS\system32\help.txt
C:\WINDOWS\system32\packet.dll
C:\WINDOWS\system32\ps.dat
C:\WINDOWS\system32\wanpacket.dll
C:\WINDOWS\system32\wpcap.dll
C:\WINDOWS\uawin.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_NPF

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-01-05 to 2008-02-05 ))))))))))))))))))))))))))))))))))))
.

2008-02-02 11:39 . 2008-02-02 11:39 <REP> d-------- C:\Program Files\Trend Micro
2008-02-01 13:30 . 2004-08-28 14:00 21,504 --a------ C:\WINDOWS\system32\route.exe
2008-02-01 13:30 . 2004-08-28 14:00 21,504 --a--c--- C:\WINDOWS\system32\dllcache\route.exe
2008-02-01 13:09 . 2008-02-01 13:14 <REP> d-------- C:\Program Files\SUPERAntiSpyware
2008-02-01 13:09 . 2008-02-01 13:09 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-02-01 13:08 . 2008-02-01 13:08 45,056 --a------ C:\WINDOWS\system32\Indt2.sys
2008-01-31 19:07 . 2008-01-31 19:07 <REP> d-------- C:\Program Files\CCleaner
2008-01-30 10:46 . 2007-12-04 14:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe
2008-01-30 10:46 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2008-01-30 10:46 . 2007-12-04 13:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2008-01-30 10:46 . 2007-12-04 15:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2008-01-30 10:46 . 2007-12-04 15:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2008-01-30 10:46 . 2007-12-04 15:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2008-01-30 10:46 . 2007-12-04 15:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2008-01-30 10:46 . 2007-12-04 15:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2008-01-22 16:29 . 2008-01-22 16:29 131 --a------ C:\WINDOWS\AKDEL.bat
2008-01-14 17:14 . 2008-01-14 17:14 <REP> d-------- C:\WINDOWS\system32\drivers\USB
2008-01-14 16:50 . 2008-01-14 16:50 <REP> d-------- C:\Program Files\Hercules
2008-01-14 16:50 . 2006-03-09 11:33 366,080 --a------ C:\WINDOWS\system32\drivers\rt61.sys
2008-01-14 16:50 . 2006-03-09 11:33 365,440 --a------ C:\WINDOWS\system32\drivers\RT619x.sys
2008-01-14 16:50 . 2006-01-12 19:47 255,616 --a------ C:\WINDOWS\system32\drivers\rt73u98.sys
2008-01-14 16:50 . 2006-01-12 19:46 252,928 --a------ C:\WINDOWS\system32\drivers\rt73.sys
2008-01-14 16:50 . 2005-10-17 19:50 247,808 --a------ C:\WINDOWS\system32\drivers\rt25u98.sys
2008-01-14 16:50 . 2005-10-17 19:50 245,376 --a------ C:\WINDOWS\system32\drivers\rt2500usb.sys
2008-01-14 16:50 . 2005-10-20 15:00 244,608 --a------ C:\WINDOWS\system32\drivers\rt25009x.sys
2008-01-14 16:50 . 2005-10-20 15:00 243,328 --a------ C:\WINDOWS\system32\drivers\rt2500.sys
2008-01-13 10:05 . 2008-01-14 17:14 <REP> d-------- C:\Program Files\SuperLink
2008-01-13 09:36 . 2008-01-30 10:46 <REP> d-------- C:\Program Files\Alwil Software
2008-01-12 18:44 . 2008-01-12 18:44 22 --a------ C:\WINDOWS\system32\ati64hlp.stb
2008-01-12 18:00 . 2008-01-29 22:22 98,304 --a------ C:\WINDOWS\DUMP77b4.tmp
2008-01-12 18:00 . 2008-01-29 22:04 98,304 --a------ C:\WINDOWS\DUMP7796.tmp
2008-01-09 21:08 . 2004-11-28 21:09 679,936 --a------ C:\WINDOWS\system32\xvidcore.dll
2008-01-07 20:34 . 2008-01-07 20:34 <REP> d--h----- C:\WINDOWS\PIF
2008-01-06 16:11 . 2008-01-06 16:11 <REP> d-------- C:\Documents and Settings\LocalService\Application Data\McAfee

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-05 11:59 --------- d-----w C:\Program Files\Ohé
2008-02-01 12:18 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-02-01 12:07 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-01-31 17:59 --------- d-----w C:\Program Files\a-squared Free
2008-01-31 16:32 --------- d-----w C:\Program Files\Java
2008-01-22 15:39 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-22 15:38 --------- d-----w C:\Program Files\Windows Media Bonus Pack for Windows XP
2008-01-22 15:36 --------- d-----w C:\Program Files\Neuf
2008-01-22 15:28 --------- d-----w C:\Program Files\Morgan
2008-01-14 15:21 --------- d-----w C:\Program Files\Creative
2008-01-14 15:15 --------- d-----w C:\Program Files\neodivx2006
2008-01-14 15:05 --------- d-----w C:\Program Files\DVDFab Decrypter
2008-01-14 15:04 --------- d-----w C:\Program Files\DivX
2008-01-14 14:57 --------- d-----w C:\Program Files\adslTV
2008-01-13 08:39 --------- d-----w C:\Program Files\Fichiers communs\McAfee
2008-01-13 08:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee
2008-01-13 08:38 --------- d-----w C:\Program Files\McAfee
2008-01-12 17:11 --------- d-----w C:\Program Files\ATI Technologies
2008-01-06 15:37 --------- d-----w C:\Program Files\Fichiers communs\Ahead
2008-01-06 15:34 --------- d-----w C:\Program Files\Nero
2008-01-06 15:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
2008-01-06 14:56 --------- d-----w C:\Program Files\Fichiers communs\Nero
2008-01-02 22:10 --------- d-----w C:\Program Files\Pegasys Inc
2008-01-02 22:08 --------- d-----w C:\Program Files\Windows Media Connect 2
2007-12-31 19:54 --------- d-----w C:\Program Files\vso
2007-12-31 08:35 --------- d-----w C:\Program Files\Windows Defender
2007-12-29 16:17 --------- d-----w C:\Program Files\Micro Application
2007-12-27 20:22 --------- d-----w C:\Program Files\CyberLink
2007-12-24 15:36 --------- d-----w C:\Program Files\Fichiers communs\Panda Software
2007-12-21 12:22 --------- d-----w C:\Program Files\AC3Filter
2007-12-18 21:26 --------- d-----w C:\Program Files\Elaborate Bytes
2007-12-18 21:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\SlySoft
2007-12-18 21:25 --------- d-----w C:\Program Files\SlySoft
2007-12-15 11:48 --------- d-----w C:\Program Files\Free Audio Pack
2007-12-11 18:43 111,659 ----a-w C:\WINDOWS\BricoPackUninst.cmd
2007-12-06 22:03 --------- d-----w C:\Program Files\XnView
2007-11-26 09:38 238,848 ----a-w C:\WINDOWS\UNBOC.EXE
2006-12-28 10:24 139 --sh--w C:\Program Files\desktop.ini
2004-08-19 14:09 65,024 --sha-w C:\WINDOWS\system32\asycfilt.dll
2006-08-25 15:51 617,472 --sha-w C:\WINDOWS\system32\comctl32.dll
2004-08-19 14:09 1,028,096 --sha-w C:\WINDOWS\system32\mfc42.dll
2001-08-28 12:00 57,344 --sha-w C:\WINDOWS\system32\mfc42loc.dll
1996-01-05 07:45 35,088 --sha-w C:\WINDOWS\system32\MSJInt32.dll
1996-11-06 10:00 965,904 --sha-w C:\WINDOWS\system32\msjt3032.dll
1996-01-05 07:45 98,356 --sha-w C:\WINDOWS\system32\MSJtEr32.dll
2004-08-19 14:09 413,696 --sha-w C:\WINDOWS\system32\msvcp60.dll
2004-08-19 14:09 343,040 --sha-w C:\WINDOWS\system32\msvcrt.dll
2001-08-28 12:00 253,952 --sha-w C:\WINDOWS\system32\msvcrt20.dll
2007-05-17 11:29 549,376 --sha-w C:\WINDOWS\system32\oleaut32.dll
2004-08-19 14:09 83,456 --sha-w C:\WINDOWS\system32\olepro32.dll
2004-08-19 14:09 30,749 --sha-w C:\WINDOWS\system32\vbajet32.dll
1996-01-24 07:27 244,496 --sha-w C:\WINDOWS\system32\VBAR2232.dll
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ShedkoBadges_1]
@={01702EF5-1B33-487F-995F-6FA23F1D6652}

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ShedkoBadges_10]
@={10702EF5-1B33-487F-995F-6FA23F1D6652}

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ShedkoBadges_2]
@={02702EF5-1B33-487F-995F-6FA23F1D6652}

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ShedkoBadges_3]
@={03702EF5-1B33-487F-995F-6FA23F1D6652}

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ShedkoBadges_4]
@={04702EF5-1B33-487F-995F-6FA23F1D6652}

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ShedkoBadges_5]
@={05702EF5-1B33-487F-995F-6FA23F1D6652}

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ShedkoBadges_6]
@={06702EF5-1B33-487F-995F-6FA23F1D6652}

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ShedkoBadges_7]
@={07702EF5-1B33-487F-995F-6FA23F1D6652}

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ShedkoBadges_8]
@={08702EF5-1B33-487F-995F-6FA23F1D6652}

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ShedkoBadges_9]
@={09702EF5-1B33-487F-995F-6FA23F1D6652}

[HKEY_CLASSES_ROOT\CLSID\{01702EF5-1B33-487F-995F-6FA23F1D6652}]
2006-08-25 08:37 86016 --a------ C:\PROGRA~1\BADGES~1.0\BADGES~1.DLL

[HKEY_CLASSES_ROOT\CLSID\{10702EF5-1B33-487F-995F-6FA23F1D6652}]
2006-08-25 08:37 86016 --a------ C:\PROGRA~1\BADGES~1.0\BADGES~1.DLL

[HKEY_CLASSES_ROOT\CLSID\{02702EF5-1B33-487F-995F-6FA23F1D6652}]
2006-08-25 08:37 86016 --a------ C:\PROGRA~1\BADGES~1.0\BADGES~1.DLL

[HKEY_CLASSES_ROOT\CLSID\{03702EF5-1B33-487F-995F-6FA23F1D6652}]
2006-08-25 08:37 86016 --a------ C:\PROGRA~1\BADGES~1.0\BADGES~1.DLL

[HKEY_CLASSES_ROOT\CLSID\{04702EF5-1B33-487F-995F-6FA23F1D6652}]
2006-08-25 08:37 86016 --a------ C:\PROGRA~1\BADGES~1.0\BADGES~1.DLL

[HKEY_CLASSES_ROOT\CLSID\{05702EF5-1B33-487F-995F-6FA23F1D6652}]
2006-08-25 08:37 86016 --a------ C:\PROGRA~1\BADGES~1.0\BADGES~1.DLL

[HKEY_CLASSES_ROOT\CLSID\{06702EF5-1B33-487F-995F-6FA23F1D6652}]
2006-08-25 08:37 86016 --a------ C:\PROGRA~1\BADGES~1.0\BADGES~1.DLL

[HKEY_CLASSES_ROOT\CLSID\{07702EF5-1B33-487F-995F-6FA23F1D6652}]
2006-08-25 08:37 86016 --a------ C:\PROGRA~1\BADGES~1.0\BADGES~1.DLL

[HKEY_CLASSES_ROOT\CLSID\{08702EF5-1B33-487F-995F-6FA23F1D6652}]
2006-08-25 08:37 86016 --a------ C:\PROGRA~1\BADGES~1.0\BADGES~1.DLL

[HKEY_CLASSES_ROOT\CLSID\{09702EF5-1B33-487F-995F-6FA23F1D6652}]
2006-08-25 08:37 86016 --a------ C:\PROGRA~1\BADGES~1.0\BADGES~1.DLL

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TuneUp MemOptimizer"="C:\Program Files\TuneUp Utilities 2007\MemOptimizer.exe" [2007-01-17 13:47 311816]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15:09 15360]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 09:59 204288]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-07-16 02:30 476702]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SiSUSBRG"="C:\WINDOWS\SiSUSBrg.exe" [2002-04-26 10:17 102400]
"OHE"="C:\Program Files\Ohé\OHE.exe" [ ]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [2003-05-15 15:41 163840]
"Fast SysTray"="C:\Program Files\FastSysTray\FastsysTray.exe" [2005-10-05 09:39 556032]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 11:48 157592]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2004-12-01 00:25 32768]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fasmib]
fasmib.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"CTStartup"=C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
"Ulead AutoDetector"=C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe
"SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
"BackgroundSwitcher"=C:\WINDOWS\system32\bgswitch.exe
"FastUser"=C:\WINDOWS\system32\fast.exe
"PCTVOICE"=pctspk.exe
"CoolSwitch"=C:\WINDOWS\system32\taskswitch.exe
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
"Corel Photo Downloader"="C:\Program Files\Fichiers communs\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup
"CloneCDTray"="C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
"ATIPTA"=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime

R1 cpuidlep;CpuIdle Pro System Driver;C:\WINDOWS\system32\drivers\cpuidlep.sys [2007-10-26 22:25]
S2 Ca533av;JDC 3.0S Webcam;C:\WINDOWS\system32\Drivers\Ca533av.sys []
S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\PCASp50.sys [2005-11-19 02:13]
S3 USBCamera;JDC 3.0S Camera;C:\WINDOWS\system32\Drivers\Bulk533.sys []
S3 Usblink;Usblink Driver;C:\WINDOWS\system32\Drivers\ulink.sys [2003-06-02 15:28]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-02-02 20:48:27 C:\WINDOWS\Tasks\Maintenance en 1 clic.job"
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
"2008-02-05 11:50:38 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-05 12:59:49
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
c:\program files\a-squared free\a2service.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Hercules\WiFi Station\WifiStation.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-02-05 13:02:32 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-05 12:02:14
.
2008-02-01 12:30:22 --- E O F ---

green day · Answer

Salut

ok,

1/ # Télécharge RavAntivirus d'Evosla :
http://ww25.evosla.com/compteur.php?soft=rav_antivirus

# Si tu as une clé USB, disque dur externe, etc, branche-les sans les ouvrir avant de lancer ce FIX
# Fais un clic droit sur le fichier .ZIP > Extraire sur > le Bureau
# Doucle-clique sur >> RAV.exe << afin de lancer l'outil.
# Une fois RAV ANTIVIRUS lancé, laisse-le réagir , il scanne automatiquement tout les lecteurs (disques fixes et amovibles)
# Si infection > un log s'établira, sinon le soft affichera (très rapide) ==>Votre Ordinateur est sain .
# Retire tes disques amovibles et redémarrez votre ordinateur.
# Poste le rapport, si infection!

2/ Télécharge sur le bureau Flash Disinfector (de SUBS) à cette adresse : http://www.techsupportforum.com/sectools/sUBs/Flash_Disinfector.exe

Double-clique sur l’icône.
Les icônes vont disparaître. C’est normal.
Si un rapport est généré en cas d'infection, sauvegarde-le sur le bureau, et poste le ensuite
Redémarre ensuite le PC.

++

freelog · Answer

voilà tout est ok
encore merci
et au plaisir

green day · Answer

Salut

 ce n'est pas encore tout à fait fini ...

++

freelog · Answer

pourquoi qu'est-il prévu au programme?
à priori tout va bien 
surtout que j'ai du bricoler la base de registre 
combofix m'avait modifié des clefs
c'est vrai qu'il est un peu long à démarer
mais rien de dramatique
allez fais -moi pas peur ?

green day · Answer

lol ! rien de méchant, tout n'a pas été supprimer encore ! :)

poste un nouveau hijack stp

++

freelog · Answer

voilà et encore merci

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:21:39, on 08/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
c:\program files\a-squared free\a2service.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\FastSysTray\FastsysTray.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\TuneUp Utilities 2007\MemOptimizer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Hercules\WiFi Station\WifiStation.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = localhost:3128
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: VSPopUp - {C89657E6-D083-4EA3-81D2-D7AD3D0ED490} - C:\WINDOWS\system32\vsPop.dll
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [OHE] C:\Program Files\Ohé\OHE.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [Fast SysTray] C:\Program Files\FastSysTray\FastsysTray.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1036 -noicon
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [TuneUp MemOptimizer] "C:\Program Files\TuneUp Utilities 2007\MemOptimizer.exe" autostart
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime (User 'Default user')
O4 - Global Startup: WiFi Station.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O17 - HKLM\System\CCS\Services\Tcpip\..\{9AEC1094-2F78-43B0-83E7-37623C7C8250}: NameServer = 86.64.145.145,84.103.237.145
O17 - HKLM\System\CCS\Services\Tcpip\..\{D1F8766A-BF81-4BE4-B709-66B643A3D24D}: NameServer = 86.64.145.145,84.103.237.145
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: fasmib - fasmib.dll (file missing)
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - c:\program files\a-squared free\a2service.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: McAfee Wireless Network Security Service (MWLSvc) - McAfee, Inc. - C:\Program Files\Mcafee\MWL\MwlSvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: O&O Defrag 2000 (OOD2000) - O&O Software GmbH - C:\WINDOWS\system32\OOD2000.exe
O23 - Service: perfmons Service (perfmons) - Unknown owner - C:\WINDOWS\system32\perfmonss.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: User Profile Hive Cleanup (UPHClean) - Unknown owner - C:\Program Files\UPHClean\uphclean.exe (file missing)
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe

green day · Answer

Salut

désolée d'avoir tarder !

 Télécharge SDFix sur ton bureau 

http://downloads.andymanchesta.com/RemovalTools/SDFix.exe 

Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. 
Redémarre ton ordinateur en mode sans échec 
Ouvre le dossier SDFix qui vient d'être créé sur le Bureau et double clique sur RunThis.cmd pour lancer le script. 
Appuie sur Y pour commencer le processus de nettoyage. 
Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer. 
Appuie sur une touche pour redémarrer le PC. 
Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers. 
Après le chargement du Bureau, l'outil terminera son travail et affichera Finished. 
Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau. 
Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt. 
Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau log Hijackthis ! 

++

freelog · Answer

non ce n'est pas grave
de plus je n'aurai plus de soucis avec les trojans
car cet ordinateur devant changer de fonction 
je viens de le formater
celà dis j'ai toujours eu Avast mais du coup là j'hésite
vu qu'il y avait quand même du "brun" sur mon PC
encore un grand merci de ton aide

green day · Answer

Salut

 il reste quoi ?? :)

tu peux remplacer avast par antivir et installe aussi un parefeu comme zone alarme



++

green day · Answer

Salut

 il reste quoi ??

NDT2.SYS

22 réponses

Discussions similaires

Newsletters