Suis-je infecté par Trojan-Dropper.Win32.Ager - Page 2

le fichier est ici : C:\infoSat.txt

tu vas dans démarrer < poste de travail < disque locale C:\ < et là il y a le fichier !

poste son contenu stp

++

et bah je doit être mongole parceke il y a rien du tout hihi ! lol
du coup je relance une analyse ! mais çà l'enregistre automatiquement parceque après l'analyse çà n'a rien demandé ?

voilà l'analyse est finie mais toujours rien ... il ne marque pas qu'il a supprimer des fichier rien de spécial...
désolé mais il n'y a toujours pas ce fichier C:\infoSat.txt ... même en le recherchant ...

c'est bizarre ...

télécharge combo-fix (par sUBs) ici :

http://download.bleepingcomputer.com/sUBs/Combo-Fix.exe

et enregistre le sur le bureau (pas besoin de le renommer, c'est fait)

déconnecte toi d'internet et ferme toutes tes applications.

désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)

double-clique sur combo-fix.exe et suis les instructions

à la fin, il va produire un rapport C:\ComboFix.txt

++

çà y est c'est parceque je n'avais pas fait exécuter en tant qu'administrateur ! :s

Thu Mar 20 23:20:23 2008
EliBagle v11.18 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Acción Directa):

Thu Mar 20 23:20:25 2008
EliBagle v11.18 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\

Nº Total de Directorios: 14457
Nº Total de Ficheros: 91590
Nº de Ficheros Analizados: 13165
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados: 0

ok, fais la manip avec combo !

la suite demain !

@+

bon cette version de combo semble expirée...
on verra demain ... fatiguée !

Salut

il faut le retélécharger !

++

et voili et voilou, je l'ai télécharger plus haut

ComboFix 08-03-20.5 - enzo 2008-03-21 16:53:17.2 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.1.1036.18.1029 [GMT 1:00]
Endroit: C:\Users\enzo\Downloads\ComboFix.exe
* Création d'un nouveau point de restauration
.

((((((((((((((((((((((((((((( Fichiers créés 2008-02-21 to 2008-03-21 ))))))))))))))))))))))))))))))))))))
.

Pas de nouveau fichier créé dans cet espace de temps

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-20 22:42 --------- d-----w C:\Program Files\eMule
2008-03-20 22:42 --------- d-----w C:\PROGRA~2\eMule
2008-03-20 11:53 --------- d-----w C:\Program Files\BitDefender
2008-03-20 10:42 --------- d-----w C:\Program Files\Common Files\BitDefender
2008-03-20 10:22 --------- d-----w C:\Program Files\Securitoo
2008-03-20 10:20 --------- d-----w C:\PROGRA~2\F-Secure
2008-03-19 22:43 --------- d-----w C:\Program Files\Navilog1
2008-03-18 18:31 --------- d-----w C:\Users\enzo\AppData\Roaming\eMule
2008-03-17 21:48 --------- d-----w C:\Program Files\EasyBits For Kids
2008-03-14 14:45 --------- d-----w C:\Program Files\Services en ligne
2008-03-12 02:30 --------- d-----w C:\Program Files\Windows Mail
2008-03-12 02:24 --------- d-----w C:\PROGRA~2\Microsoft Help
2008-03-11 21:20 --------- d---a-w C:\PROGRA~2\TEMP
2008-03-11 17:27 --------- d-----w C:\Users\enzo\AppData\Roaming\PlayFirst
2008-03-11 17:27 --------- d-----w C:\PROGRA~2\PlayFirst
2008-03-05 09:28 --------- d-----w C:\Users\enzo\AppData\Roaming\Roxio
2008-03-01 14:21 --------- d-----w C:\PROGRA~2\HipSoft
2008-02-28 12:20 --------- d-----w C:\Users\enzo\AppData\Roaming\FloodLightGames
2008-02-28 12:20 --------- d-----w C:\PROGRA~2\FloodLightGames
2008-02-28 09:27 --------- d-----w C:\Program Files\Common Files\Adobe
2008-02-28 08:57 --------- d-----w C:\Program Files\HP
2008-02-28 08:57 --------- d-----w C:\PROGRA~2\HPSSUPPLY
2008-02-28 02:04 --------- d-----w C:\Program Files\Windows Live
2008-02-23 16:56 --------- d-----w C:\PROGRA~2\AWEM
2008-02-19 13:47 30,016 ----a-w C:\Windows\system32\drivers\fsndis5.sys
2008-02-16 16:43 --------- d-----w C:\PROGRA~2\Go Go Gourmet
2008-02-14 02:12 194,560 ----a-w C:\Windows\System32\WebClnt.dll
2008-02-14 02:12 110,080 ----a-w C:\Windows\system32\drivers\mrxdav.sys
2008-02-14 02:06 803,328 ----a-w C:\Windows\system32\drivers\tcpip.sys
2008-02-14 02:06 45,112 ----a-w C:\Windows\system32\drivers\pciidex.sys
2008-02-14 02:06 3,505,720 ----a-w C:\Windows\System32\ntkrnlpa.exe
2008-02-14 02:06 3,471,928 ----a-w C:\Windows\System32\ntoskrnl.exe
2008-02-14 02:06 24,064 ----a-w C:\Windows\System32\netcfg.exe
2008-02-14 02:06 22,016 ----a-w C:\Windows\System32\netiougc.exe
2008-02-14 02:06 216,632 ----a-w C:\Windows\system32\drivers\netio.sys
2008-02-14 02:06 21,560 ----a-w C:\Windows\system32\drivers\atapi.sys
2008-02-14 02:06 167,424 ----a-w C:\Windows\System32\tcpipcfg.dll
2008-02-14 02:06 154,624 ----a-w C:\Windows\system32\drivers\nwifi.sys
2008-02-14 02:06 15,928 ----a-w C:\Windows\system32\drivers\pciide.sys
2008-02-14 02:06 109,624 ----a-w C:\Windows\system32\drivers\ataport.sys
2008-02-14 02:05 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-02-14 02:05 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-02-14 02:05 4,247,552 ----a-w C:\Windows\System32\GameUXLegacyGDFs.dll
2008-02-14 02:05 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-02-14 02:05 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-02-14 02:05 1,686,528 ----a-w C:\Windows\System32\gameux.dll
2008-02-14 02:02 824,832 ----a-w C:\Windows\System32\wininet.dll
2008-02-14 02:02 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-02-14 02:02 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-02-14 02:02 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-02-13 20:22 --------- d-----w C:\Program Files\Google
2008-02-12 21:18 --------- d-----w C:\Users\enzo\AppData\Roaming\ScreenSeven
2008-02-12 16:46 --------- d-----w C:\Program Files\Orange
2008-02-12 16:46 --------- d-----w C:\Program Files\GamesBar
2008-02-12 16:46 --------- d-----w C:\PROGRA~2\Oberon Games
2008-02-01 10:17 587,264 ----a-w C:\Windows\WLXPGSS.SCR
2008-01-31 10:14 --------- d-----w C:\PROGRA~2\HP
2008-01-22 20:02 --------- d-----w C:\Program Files\MSECache
2008-01-10 05:50 1,244,672 ----a-w C:\Windows\System32\mcmde.dll
2008-01-09 07:25 11,776 ----a-w C:\Windows\System32\sbunattend.exe
2008-01-07 15:39 81,984 ----a-w C:\Windows\System32\bdod.bin
2008-01-02 13:26 301,568 ----a-w C:\Windows\System32\rrhqquj.exe
2007-11-09 08:26 174 --sha-w C:\Program Files\desktop.ini
.

((((((((((((((((((((((((((((( snapshot@2008-03-17_23.05.50,71 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-03-17 10:50:56 67,584 --s-a-w C:\Windows\bootstat.dat
+ 2008-03-21 13:01:53 67,584 --s-a-w C:\Windows\bootstat.dat
- 2007-10-19 07:10:44 21,760 ----a-w C:\Windows\Help\OEM\scripts\HCNetworkTest.exe
+ 2007-10-19 08:10:44 21,760 ----a-w C:\Windows\Help\OEM\scripts\HCNetworkTest.exe
- 2007-11-06 12:36:08 29,952 ----a-w C:\Windows\Help\OEM\scripts\HPScript.exe
+ 2007-11-06 13:36:08 29,952 ----a-w C:\Windows\Help\OEM\scripts\HPScript.exe
- 2008-03-13 12:41:15 51,200 ----a-w C:\Windows\inf\infpub.dat
+ 2008-03-20 10:43:09 51,200 ----a-w C:\Windows\inf\infpub.dat
- 2008-03-13 12:07:46 86,016 ----a-w C:\Windows\inf\infstor.dat
+ 2008-03-20 10:43:09 86,016 ----a-w C:\Windows\inf\infstor.dat
- 2008-03-13 12:41:15 86,016 ----a-w C:\Windows\inf\infstrng.dat
+ 2008-03-20 10:43:09 86,016 ----a-w C:\Windows\inf\infstrng.dat
- 2008-03-17 10:48:28 1,211,616 ----a-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
+ 2008-03-18 10:44:22 1,211,616 ----a-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
- 2007-12-05 18:17:31 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-03-18 10:31:52 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2007-12-05 18:17:31 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-03-18 10:31:52 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-03-17 21:06:04 262,144 ----a-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\UsrClass.dat
+ 2008-03-21 15:23:59 262,144 ----a-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\UsrClass.dat
- 2007-12-05 18:17:31 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-03-18 10:31:52 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-03-17 10:52:24 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat
+ 2008-03-21 13:06:39 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat
+ 2008-03-21 13:06:39 262,144 ---ha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1
- 2008-03-17 21:59:41 262,144 ----a-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\UsrClass.dat
+ 2008-03-21 15:52:56 262,144 ----a-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\UsrClass.dat
- 2008-03-17 10:52:19 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat
+ 2008-03-21 13:06:39 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat
+ 2008-03-21 13:06:39 262,144 ---ha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
+ 2007-12-04 13:04:28 837,496 ----a-w C:\Windows\System32\aswBoot.exe
+ 2007-12-04 12:54:04 95,608 ----a-w C:\Windows\System32\AvastSS.scr
- 2008-03-17 21:58:34 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-03-21 15:09:36 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-03-17 21:58:34 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-03-21 15:09:36 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-03-17 21:58:34 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-03-21 15:09:36 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-03-17 21:58:57 262,144 ----a-w C:\Windows\System32\config\systemprofile\ntuser.dat
+ 2008-03-20 12:44:42 262,144 ----a-w C:\Windows\System32\config\systemprofile\ntuser.dat
+ 2008-03-20 12:44:42 262,144 ---ha-w C:\Windows\System32\config\systemprofile\ntuser.dat.LOG1
+ 2007-12-04 14:52:16 45,648 ----a-w C:\Windows\System32\drivers\aswMonFlt.sys
+ 2007-12-04 14:53:39 23,152 ----a-w C:\Windows\System32\drivers\aswRdr.sys
+ 2007-12-04 14:51:52 42,912 ----a-w C:\Windows\System32\drivers\aswTdi.sys
+ 2008-01-25 14:40:32 85,520 ----a-w C:\Windows\System32\DriverStore\FileRepository\netsf.inf_5636459c\bdfndisf.sys
- 2002-01-05 02:48:16 974,848 ----a-w C:\Windows\System32\mfc70.dll
+ 2002-01-05 01:48:16 974,848 ----a-w C:\Windows\System32\mfc70.dll
- 2002-01-05 02:36:38 964,608 ----a-w C:\Windows\System32\mfc70u.dll
+ 2002-01-05 01:36:38 964,608 ----a-w C:\Windows\System32\mfc70u.dll
- 2003-03-18 20:20:00 1,060,864 ----a-w C:\Windows\System32\mfc71.dll
+ 2003-03-18 19:20:00 1,060,864 ----a-w C:\Windows\System32\mfc71.dll
- 2003-03-18 20:12:12 1,047,552 ----a-w C:\Windows\System32\mfc71u.dll
+ 2003-03-18 19:12:12 1,047,552 ----a-w C:\Windows\System32\mfc71u.dll
- 2002-01-05 02:38:38 54,784 ----a-w C:\Windows\System32\msvci70.dll
+ 2002-01-05 01:38:38 54,784 ----a-w C:\Windows\System32\msvci70.dll
- 2002-01-05 02:40:20 487,424 ----a-w C:\Windows\System32\msvcp70.dll
+ 2002-01-05 01:40:20 487,424 ----a-w C:\Windows\System32\msvcp70.dll
- 2003-03-18 19:14:52 499,712 ----a-w C:\Windows\System32\msvcp71.dll
+ 2003-03-18 18:14:52 499,712 ----a-w C:\Windows\System32\msvcp71.dll
- 2002-01-05 01:37:28 344,064 ----a-w C:\Windows\System32\msvcr70.dll
+ 2002-01-05 00:37:28 344,064 ----a-w C:\Windows\System32\msvcr70.dll
- 2003-02-21 03:42:22 348,160 ----a-w C:\Windows\System32\msvcr71.dll
+ 2003-02-21 02:42:22 348,160 ----a-w C:\Windows\System32\msvcr71.dll
- 2008-03-05 09:27:28 107,924 ----a-w C:\Windows\System32\perfc009.dat
+ 2008-03-20 10:19:58 106,154 ----a-w C:\Windows\System32\perfc009.dat
- 2008-03-05 09:27:28 121,564 ----a-w C:\Windows\System32\perfc00C.dat
+ 2008-03-20 10:19:58 119,794 ----a-w C:\Windows\System32\perfc00C.dat
- 2008-03-05 09:27:28 619,250 ----a-w C:\Windows\System32\perfh009.dat
+ 2008-03-20 10:19:58 615,176 ----a-w C:\Windows\System32\perfh009.dat
- 2008-03-05 09:27:28 699,900 ----a-w C:\Windows\System32\perfh00C.dat
+ 2008-03-20 10:19:58 695,826 ----a-w C:\Windows\System32\perfh00C.dat
- 2008-03-12 13:12:19 6,291,456 ----a-w C:\Windows\System32\SMI\Store\Machine\schema.dat
+ 2008-03-20 10:44:40 6,291,456 ----a-w C:\Windows\System32\SMI\Store\Machine\schema.dat
- 2008-03-17 10:52:50 11,952 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1138599250-2242693678-3118802764-1000_UserData.bin
+ 2008-03-21 13:08:46 12,748 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1138599250-2242693678-3118802764-1000_UserData.bin
- 2008-03-17 10:52:50 62,634 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-03-21 13:08:44 63,688 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2008-03-17 06:21:57 3,172 ----a-w C:\Windows\System32\WDI\ERCQueuedResolutions.dat
+ 2008-03-20 22:51:34 3,172 ----a-w C:\Windows\System32\WDI\ERCQueuedResolutions.dat
- 2008-03-17 10:52:48 55,978 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-03-21 13:08:43 57,796 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
- 2008-03-12 02:30:24 1,479,653 ----a-w C:\Windows\winsxs\ManifestCache\6.0.6001.18000_001c50b5_blobs.bin
+ 2008-03-20 10:44:09 2,076,293 ----a-w C:\Windows\winsxs\ManifestCache\6.0.6001.18000_001c50b5_blobs.bin
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-02-13 21:22 171448]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
"MSConfig"="C:\Windows\system32\msconfig.exe" [2006-11-02 10:45 222208]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="%WINDIR%\SMINST\launcher.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [ ]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableLockWorkstation"= 0 (0x0)
"DisableChangePassword"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoLogoff"= 0 (0x0)

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\Windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^LUMIX Simple Viewer.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\LUMIX Simple Viewer.lnk
backup=C:\Windows\pss\LUMIX Simple Viewer.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WiFi Station pour Livebox.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WiFi Station pour Livebox.lnk
backup=C:\Windows\pss\WiFi Station pour Livebox.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^enzo^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^BoontyBox Boonty.com.lnk]
path=C:\Users\enzo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BoontyBox Boonty.com.lnk
backup=C:\Windows\pss\BoontyBox Boonty.com.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware]
--a------ 2007-06-11 10:25 6731312 C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
--a------ 2006-11-02 13:35 125440 C:\Windows\ehome\ehTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\F-Secure Manager]
C:\Program Files\Securitoo\Common\FSM32.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\F-Secure TNB]
C:\Program Files\Securitoo\FSGUI\TNBUtil.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Health Check Scheduler]
--a------ 2007-05-24 12:13 71176 c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2007-03-11 21:34 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPAdvisor]
--a------ 2007-06-01 12:40 1783400 C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
--a------ 2007-04-18 16:01 65536 c:\hp\support\hpsysdrv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2007-11-15 13:11 267048 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
--a------ 2006-12-08 17:16 65536 C:\HP\KBD\KbdStub.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 11:34 5724184 C:\Program Files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2007-07-06 20:15 8466432 C:\Windows\system32\NvCpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 2007-07-06 20:15 81920 C:\Windows\system32\NvMcTray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvSvc]
--a------ 2007-07-06 20:15 86016 C:\Windows\system32\nvsvc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orange Desktop Search]
--a------ 2007-01-17 15:10 4938016 C:\Program Files\Orange HSS\Orange Desktop Search\OrangeDesktopSearch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OsdMaestro]
--a------ 2007-02-15 12:59 118784 C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-11-14 23:43 286720 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
--a------ 2007-07-06 12:06 4669440 C:\Windows\RtHDVCpl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
--a------ 2008-01-09 08:25 1232896 C:\Program Files\Windows Sidebar\sidebar.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateReg]
--a------ 2007-04-07 01:56 54936 C:\Windows\system32\jureg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2008-02-13 21:22 171448 C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
--a------ 2007-09-04 07:12 1006264 C:\Program Files\Windows Defender\MSASCui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WindowsWelcomeCenter]
--a------ 2006-11-02 13:34 2159104 C:\Windows\System32\oobefldr.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{1B3AD448-BE5A-4790-8A80-7E3254F72F21}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{0FB5F214-D970-4FAE-9DB5-039811DFE0E1}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{5E591280-E657-4D0E-928C-DE0BB1765D89}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{E6ECDFED-1D58-4324-8CB4-500491AAA6F2}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
"UDP Query User{289B13A4-8611-4964-B0F4-A00EA3183F2C}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
"{12967359-27D7-4493-9D0B-A2EDCF69CF36}"= UDP:C:\Users\enzo\AppData\Local\Zylom Games\Diner Dash 2 Deluxe\wrapper.exe:Diner Dash 2 Deluxe
"{DBCECD3C-8588-40F5-AA2C-167B15AB72D1}"= TCP:C:\Users\enzo\AppData\Local\Zylom Games\Diner Dash 2 Deluxe\wrapper.exe:Diner Dash 2 Deluxe
"{2624EA7F-4822-4849-811E-0BA90C982FB3}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{10DC5902-F1C5-4EA3-A6C1-B7613F673116}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{1A55F9E9-7252-42A6-962C-BDD2E80D900F}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\ImpCnt.exe:IncrediMail
"{082D2037-924B-4E72-827C-F902084127A0}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\ImpCnt.exe:IncrediMail
"{AD39CD84-2EDF-462A-B461-FA3111EDF4D5}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\IncMail.exe:IncrediMail
"{AE46E2C9-A405-46E5-8487-A28A38BBADF3}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\IncMail.exe:IncrediMail
"{6C0A22C9-2BC7-4383-ACBB-E17949E9C2D8}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\ImApp.exe:IncrediMail
"{D1901AC5-62F0-4DE0-B915-0ACB93D9392F}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\ImApp.exe:IncrediMail

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"DoNotAllowExceptions"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2007-12-04 15:52]
R3 netr73;Hercules Wireless USB Dongle Driver for Vista;C:\Windows\system32\DRIVERS\netr73.sys [2007-01-31 17:01]
S3 PCD5SRVC{BD6912E3-AC9D80E8-05020000};PCD5SRVC{BD6912E3-AC9D80E8-05020000} - PCDR Kernel Mode Service Helper Driver;C:\PROGRA~1\PC-DOC~1\PCD5SRVC.pkms [2007-05-16 01:47]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-21 16:55:13
Windows 6.0.6000 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-03-21 16:55:54
ComboFix-quarantined-files.txt 2008-03-21 15:55:50
ComboFix2.txt 2008-03-17 22:06:15
.
2008-03-21 13:06:51 --- E O F ---

bon tout semble être rentré dans l'ordre depuis la désinfection par DR WEB !
plus rien n'est bloqué et plus de problème de connection
dis moi si je t'envois quand même de nouveaux rapports pour être sûr ? mais à priori c'est bon...
allé merci mille fois ! bon week end de pâques... et peut être à bientôt (non j'espère pas être à nouveau infecté ! lol)

Salut

très bien ! poste un dernier hijack, et evite la mule, sinon tu n'auras pas fini de désinfecter ton PC ... :/

@+