Ecran bleu warning! spyware detected on your - Page 2

Précédent
  • 1
  • 2
  1. g!rly Messages postés 18462 Statut Contributeur 407
     
    Bonjour,

    Il serait préférable que tu fasses ton message personnel, cela rendra les postes plus compréhensibles et la réponse à ton problème sera plus efficace
    Procèdes comme ceci :
    http://pageperso.aol.fr/balltrap34/demofairesontmessage.htm

    A bientôt ''
    0
  2. kilerlove
     
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:35, on 03/09/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Executive Software\Diskeeper\DkService.exe
    C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Documents and Settings\All Users\Application Data\zwbmnqfe\lonuhqpy.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\mhytudaf.exe
    C:\WINDOWS\system32\rejolerk.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/?p=us
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [SchedulingAgent] mstinit.exe /firstlogon
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [uiwin] C:\WINDOWS\system32\mhytudaf.exe
    O4 - HKCU\..\Run: [sysenchk] C:\WINDOWS\system32\hebwpqpi.exe
    O4 - HKLM\..\Policies\Explorer\Run: [6pAP6Dg6XQ] C:\Documents and Settings\All Users\Application Data\zwbmnqfe\lonuhqpy.exe
    O4 - HKUS\S-1-5-19\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background (User 'SERVICE RÉSEAU')
    O4 - Global Startup: .security
    O4 - Global Startup: Inicio rápido de Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU)
    O14 - IERESET.INF: START_PAGE_URL=http://fr.yahoo.com/
    O15 - Trusted Zone: http://click.mirarsearch.com (HKLM)
    O15 - Trusted Zone: http://redirect.mirarsearch.com (HKLM)
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.59 85.255.112.120
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
    O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    0
  3. g!rly Messages postés 18462 Statut Contributeur 407
     
    Bonjour,

    Il serait préférable que tu fasses ton message personnel, cela rendra les postes plus compréhensibles et la réponse à ton problème sera plus efficace
    Procèdes comme ceci :
    http://pageperso.aol.fr/balltrap34/demofairesontmessage.htm

    A bientôt ''
    0
  4. alix
     
    voici le contre rendu

    ComboFix 08-11-30.01 - alix 2008-11-30 20:28:41.1 - NTFSx86
    Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1619 [GMT 1:00]
    * Un nouveau point de restauration a été créé
    .

    (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\windows\system32\adcxxfdk.ini
    c:\windows\system32\bsxsejjf.ini
    c:\windows\system32\cbqwes.dll
    c:\windows\system32\cdnvhrga.ini
    c:\windows\system32\ceuwrcci.ini
    c:\windows\system32\ddcApoPI.dll
    c:\windows\system32\drivers\npf.sys
    c:\windows\system32\etkuibmd.ini
    c:\windows\system32\fdownvby.ini
    c:\windows\system32\fjxaktot.ini
    c:\windows\system32\gaskdolf.ini
    c:\windows\system32\ioystggp.ini
    c:\windows\system32\jvussdtp.ini
    c:\windows\system32\kgdgjqlq.ini
    c:\windows\system32\kmvdospe.ini
    c:\windows\system32\kyapxnrg.ini
    c:\windows\system32\mfaqgpef.ini
    c:\windows\system32\miavpovt.ini
    c:\windows\system32\ngklrvjq.ini
    c:\windows\system32\ntdpoejj.ini
    c:\windows\system32\ntrncnig.ini
    c:\windows\system32\packet.dll
    c:\windows\system32\pwcjydrn.dll
    c:\windows\system32\qqqyikvr.ini
    c:\windows\system32\qwegrkuj.ini
    c:\windows\system32\rexsgfxq.ini
    c:\windows\system32\rnrwwcrb.ini
    c:\windows\system32\rpfhlipr.ini
    c:\windows\system32\sdmhvrha.ini
    c:\windows\system32\sspscfcc.ini
    c:\windows\system32\touwtitw.ini
    c:\windows\system32\uxFNoUvw.ini
    c:\windows\system32\uxFNoUvw.ini2
    c:\windows\system32\vdmwxanb.ini
    c:\windows\system32\wpcap.dll
    c:\windows\system32\xwgclpqd.ini
    c:\windows\system32\yajxpxst.ini
    c:\windows\Tasks\ncbstpip.job

    .
    ((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_BOONTY_GAMES
    -------\Service_Boonty Games
    -------\Service_NPF

    ((((((((((((((((((((((((((((( Fichiers créés du 2008-10-28 au 2008-11-30 ))))))))))))))))))))))))))))))))))))
    .

    2008-11-30 20:33 . 2008-10-18 11:40 81,920 --a------ c:\documents and settings\alix.E1AF6476DDD6479\Application Data\logman.exe
    2008-11-30 20:14 . 2008-11-30 20:14 <REP> d-------- c:\program files\Trend Micro
    2008-11-30 20:01 . 2008-11-30 20:01 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
    2008-11-30 20:01 . 2008-11-30 20:01 <REP> d-------- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
    2008-11-30 20:01 . 2008-11-30 20:01 <REP> d-------- c:\documents and settings\alix.E1AF6476DDD6479\Application Data\Malwarebytes
    2008-11-30 20:01 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
    2008-11-30 20:01 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys
    2008-11-30 18:34 . 2008-11-30 18:35 <REP> d-------- c:\documents and settings\alix.E1AF6476DDD6479\SmitfraudFix
    2008-11-30 15:16 . 2008-11-30 15:16 <REP> d-------- c:\documents and settings\alix.E1AF6476DDD6479\Application Data\Lavasoft
    2008-11-30 13:36 . 2008-11-30 13:36 <REP> d-------- c:\documents and settings\All Users.WINDOWS\Application Data\Symantec
    2008-11-30 13:25 . 2008-10-18 11:40 81,920 --a------ c:\windows\system\mstinit.exe
    2008-11-30 13:25 . 2008-10-18 11:40 81,920 --a------ c:\windows\clipsrv.exe
    2008-11-29 17:58 . 2008-11-29 17:58 <REP> d-------- c:\program files\Stand O'Food
    2008-11-29 14:33 . 2008-11-29 14:33 <REP> d-------- c:\program files\Lavasoft
    2008-11-29 14:33 . 2008-11-29 14:39 <REP> d-------- c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft
    2008-11-29 13:06 . 2008-11-29 13:10 <REP> d-------- c:\documents and settings\alix.E1AF6476DDD6479\Application Data\Ancient Quest of Saqqarah__bfg
    2008-11-29 13:00 . 2008-11-30 13:25 2,100 --a------ c:\documents and settings\All Users.BAK
    2008-11-29 12:59 . 2008-11-30 15:13 <REP> d-------- c:\windows\system32\drivers\NAV
    2008-11-29 12:59 . 2008-11-29 12:59 <REP> d-------- c:\program files\Windows Sidebar
    2008-11-29 12:59 . 2008-11-29 12:59 <REP> d-------- c:\program files\Symantec
    2008-11-29 12:59 . 2008-11-29 12:59 <REP> d-------- c:\program files\Norton AntiVirus
    2008-11-29 12:59 . 2008-11-29 13:00 <REP> d-------- c:\program files\Fichiers communs\Symantec Shared
    2008-11-29 12:59 . 2008-11-29 13:00 <REP> d-------- c:\documents and settings\All Users.WINDOWS\Application Data\Norton
    2008-11-29 12:59 . 2008-11-29 12:59 124,464 --a------ c:\windows\system32\drivers\SYMEVENT.SYS
    2008-11-29 12:59 . 2008-11-29 12:59 60,808 --a------ c:\windows\system32\S32EVNT1.DLL
    2008-11-29 12:59 . 2008-11-29 12:59 35,888 -ra------ c:\windows\system32\drivers\SymIM.sys
    2008-11-29 12:59 . 2008-11-29 12:59 10,635 --a------ c:\windows\system32\drivers\SYMEVENT.CAT
    2008-11-29 12:59 . 2008-11-29 12:59 806 --a------ c:\windows\system32\drivers\SYMEVENT.INF
    2008-11-29 12:57 . 2008-11-29 12:58 <REP> d-------- c:\program files\NortonInstaller
    2008-11-29 12:57 . 2008-11-29 12:57 <REP> d-------- c:\documents and settings\All Users.WINDOWS\Application Data\NortonInstaller
    2008-11-29 11:55 . 2008-11-27 13:19 32,256 --a------ c:\windows\system32\frmwrk32.exe
    2008-11-29 11:55 . 2008-11-30 20:33 4,785 --a------ c:\windows\system32\warning.gif
    2008-11-29 11:55 . 2008-11-30 20:33 3,104 --a------ c:\windows\system32\ntdll64.exe
    2008-11-29 11:55 . 2008-11-30 20:33 1,349 --a------ c:\windows\system32\ahtn.htm
    2008-11-29 11:55 . 2008-11-29 11:55 1 --a------ c:\windows\system32\uniq.tll
    2008-11-29 11:55 . 2008-11-29 11:55 1 --a------ c:\windows\system32\test.ttt
    2008-11-28 17:28 . 2008-11-28 17:28 <REP> d-------- c:\documents and settings\alix.E1AF6476DDD6479\Application Data\PetShowCraze
    2008-11-28 17:07 . 2008-11-28 17:26 <REP> d-------- c:\documents and settings\alix.E1AF6476DDD6479\Application Data\JewelMatch2
    2008-11-28 16:54 . 2008-11-28 16:54 <REP> d-------- c:\documents and settings\alix.E1AF6476DDD6479\Application Data\Dragon Altar Games
    2008-11-28 16:14 . 2008-11-28 16:14 <REP> d-------- c:\documents and settings\alix.E1AF6476DDD6479\Application Data\Jane s Hotel Family Hero
    2008-11-28 10:23 . 2008-11-28 10:23 244 --ah----- C:\sqmnoopt03.sqm
    2008-11-28 10:23 . 2008-11-28 10:23 232 --ah----- C:\sqmdata03.sqm
    2008-11-27 17:00 . 2008-11-27 17:00 244 --ah----- C:\sqmnoopt02.sqm
    2008-11-27 17:00 . 2008-11-27 17:00 232 --ah----- C:\sqmdata02.sqm
    2008-11-27 16:50 . 2008-11-27 16:50 244 --ah----- C:\sqmnoopt01.sqm
    2008-11-27 16:50 . 2008-11-27 16:50 232 --ah----- C:\sqmdata01.sqm
    2008-11-26 11:35 . 2008-11-26 11:34 410,976 --a------ c:\windows\system32\deploytk.dll
    2008-11-26 10:58 . 2008-11-26 10:58 297,697 --a------ c:\windows\system32\SpywareRemover.exe
    2008-11-25 13:20 . 2008-11-29 21:40 <REP> d-------- c:\program files\Games
    2008-11-24 21:06 . 2008-11-24 21:06 <REP> d-------- c:\documents and settings\alix.E1AF6476DDD6479\Application Data\MysteryStudio
    2008-11-21 18:29 . 2008-11-21 18:29 211,968 --a------ c:\windows\system32\winproc.dll
    2008-11-21 18:29 . 2007-08-07 12:03 9,216 --a------ c:\windows\system32\hostsa.db
    2008-11-21 18:29 . 2008-11-21 18:29 1,068 --a------ c:\windows\system32\hostsa.zip
    2008-11-20 22:16 . 2008-11-20 22:16 <REP> d-------- c:\documents and settings\alix.E1AF6476DDD6479\Application Data\Pi Eye Games
    2008-11-12 17:37 . 2008-11-12 19:31 <REP> d-------- C:\TEMP
    2008-11-12 17:35 . 2008-11-12 17:35 <REP> d-------- c:\program files\Alwil Software
    2008-11-12 16:43 . 2008-11-12 16:54 <REP> d-------- c:\program files\OrangeHSS
    2008-11-12 16:43 . 2007-12-11 20:22 65,536 --a------ c:\windows\system32\Autodial2000.dll
    2008-11-12 16:42 . 2008-11-12 16:42 <REP> d-------- c:\program files\Fichiers communs\France Telecom
    2008-11-11 01:07 . 2008-11-11 01:07 <REP> d-------- c:\program files\Securitoo
    2008-11-11 01:06 . 2006-03-01 18:53 94,208 --a------ c:\windows\system32\w32n50.dll
    2008-11-11 01:06 . 2003-09-23 10:38 34,688 --a------ c:\windows\system32\pcampr5.sys
    2008-11-11 01:06 . 2006-03-01 18:53 32,128 --a------ c:\windows\system32\pcandis5.sys
    2008-11-02 16:42 . 2008-11-02 16:42 <REP> d-------- c:\documents and settings\alix.E1AF6476DDD6479\Application Data\dvdcss
    2008-10-30 12:58 . 2008-10-30 12:58 19,517 --a------ c:\windows\system32\bvqgidbs.dll
    2008-10-30 12:55 . 2008-10-30 12:55 19,432 --a------ c:\windows\system32\pksoimad.exe
    2008-10-30 12:52 . 2008-10-30 12:52 19,522 --a------ c:\windows\system32\pawrgslg.dll
    2008-10-30 12:47 . 2008-10-30 12:47 19,432 --a------ c:\windows\system32\xbjoifub.exe
    2008-10-29 22:21 . 2008-10-29 22:21 19,432 --a------ c:\windows\system32\kouuavjv.exe
    2008-10-29 22:18 . 2008-10-29 22:18 19,522 --a------ c:\windows\system32\dmvbrhaa.dll
    2008-10-29 22:15 . 2008-10-29 22:15 19,517 --a------ c:\windows\system32\qmhixjmv.dll
    2008-10-29 22:09 . 2008-10-29 22:09 19,432 --a------ c:\windows\system32\qpvkbgsi.exe
    2008-10-29 21:18 . 2008-10-29 21:18 19,432 --a------ c:\windows\system32\miionbui.exe
    2008-10-29 21:09 . 2008-10-29 21:09 19,517 --a------ c:\windows\system32\fppspxaa.dll
    2008-10-29 21:06 . 2008-10-29 21:06 19,517 --a------ c:\windows\system32\xnvgmnyh.dll
    2008-10-29 20:12 . 2008-10-29 20:12 19,517 --a------ c:\windows\system32\lvtpjxgw.dll
    2008-10-29 20:09 . 2008-10-29 20:09 19,522 --a------ c:\windows\system32\xxdpfsmd.dll
    2008-10-29 20:06 . 2008-10-29 20:06 19,432 --a------ c:\windows\system32\tepchicl.exe
    2008-10-29 20:03 . 2008-10-29 20:03 19,517 --a------ c:\windows\system32\jgsivkpe.dll
    2008-10-29 19:12 . 2008-10-29 19:12 19,522 --a------ c:\windows\system32\mwjaylgd.dll
    2008-10-29 19:09 . 2008-10-29 19:09 19,517 --a------ c:\windows\system32\jivyspbb.dll
    2008-10-29 19:06 . 2008-10-29 19:06 19,432 --a------ c:\windows\system32\onefisml.exe
    2008-10-29 19:00 . 2008-10-29 19:00 19,432 --a------ c:\windows\system32\wvjeqjav.exe
    2008-10-29 18:09 . 2008-10-29 18:09 19,517 --a------ c:\windows\system32\tnivlynj.dll
    2008-10-29 18:06 . 2008-10-29 18:06 19,522 --a------ c:\windows\system32\lggrjjxm.dll
    2008-10-29 18:00 . 2008-10-29 18:00 19,432 --a------ c:\windows\system32\shiwpynx.exe
    2008-10-29 17:57 . 2008-10-29 17:57 19,522 --a------ c:\windows\system32\fgweshyu.dll
    2008-10-29 17:06 . 2008-10-29 17:06 19,432 --a------ c:\windows\system32\eplifyta.exe
    2008-10-29 17:00 . 2008-10-29 17:00 19,522 --a------ c:\windows\system32\jfbjutob.dll
    2008-10-29 16:57 . 2008-10-29 16:57 19,517 --a------ c:\windows\system32\pskkhfla.dll
    2008-10-29 16:54 . 2008-10-29 16:54 19,522 --a------ c:\windows\system32\ykgcgqmb.dll
    2008-10-29 16:03 . 2008-10-29 16:03 19,517 --a------ c:\windows\system32\aemusfek.dll
    2008-10-29 15:57 . 2008-10-29 15:57 19,432 --a------ c:\windows\system32\ufbekpns.exe
    2008-10-29 15:54 . 2008-10-29 15:54 19,522 --a------ c:\windows\system32\fnsabdvo.dll
    2008-10-29 15:51 . 2008-10-29 15:51 19,432 --a------ c:\windows\system32\jsiufmxn.exe
    2008-10-29 12:36 . 2008-10-29 12:36 19,432 --a------ c:\windows\system32\chdvhwcn.exe
    2008-10-29 12:33 . 2008-10-29 12:33 19,517 --a------ c:\windows\system32\mdqkwfyd.dll
    2008-10-29 12:27 . 2008-10-29 12:27 19,522 --a------ c:\windows\system32\uxytsvbs.dll
    2008-10-28 12:33 . 2008-10-28 12:33 19,432 --a------ c:\windows\system32\mffqulpl.exe
    2008-10-28 12:30 . 2008-10-28 12:30 19,517 --a------ c:\windows\system32\dlaycolu.dll
    2008-10-21 18:46 . 2008-10-21 18:46 <REP> d-------- c:\documents and settings\alix.E1AF6476DDD6479\Application Data\JoyBits
    2008-10-21 17:43 . 2008-11-25 12:53 <REP> d-------- c:\documents and settings\All Users.WINDOWS\Application Data\MumboJumbo
    2008-10-18 17:15 . 2008-10-18 17:15 <REP> d-------- c:\program files\Jojo's Fashion Show 2 - Las Cruces
    2008-10-18 12:40 . 2008-10-18 12:40 <REP> d-------- c:\program files\TuneUp Utilities 2007
    2008-10-18 11:43 . 2008-11-30 20:23 <REP> d-------- c:\program files\Fichiers communs\Wise Installation Wizard
    2008-10-18 11:43 . 2008-10-18 12:42 <REP> d-------- c:\documents and settings\All Users.WINDOWS\Application Data\TuneUp Software
    2008-10-18 11:40 . 2008-10-18 11:40 81,920 --a------ c:\windows\system32\drivers\comrepl.exe
    2008-10-18 11:40 . 2008-10-18 11:40 81,920 --a------ c:\documents and settings\alix.E1AF6476DDD6479\Application Data\ieudinit.exe
    2008-10-14 10:20 . 2008-10-14 03:00 12,862 --a------ c:\windows\webgame.ico
    2008-10-11 15:56 . 2008-10-11 15:56 <REP> d-------- c:\documents and settings\alix.E1AF6476DDD6479\Application Data\SPORE
    2008-10-11 15:56 . 2008-10-11 15:56 <REP> dr-h----- c:\documents and settings\alix.E1AF6476DDD6479\Application Data\SecuROM
    2008-10-09 16:04 . 2008-11-16 19:35 <REP> d-------- c:\documents and settings\alix.E1AF6476DDD6479\Application Data\Gamelab
    2008-10-08 22:17 . 2008-10-11 09:29 <REP> d-------- c:\program files\Jojos Fashion Show 2
    2008-10-08 12:21 . 2008-10-08 12:21 <REP> d-------- c:\windows\Slingo Supreme
    2008-10-08 12:21 . 2008-10-08 12:21 <REP> d-------- c:\windows\Cooking Dash
    2008-10-08 12:21 . 2008-10-08 12:21 <REP> d-------- c:\program files\Slingo Supreme
    2008-10-08 12:21 . 2008-10-08 12:21 <REP> d-------- c:\program files\Cooking Dash
    2008-10-07 21:11 . 2008-10-07 21:11 <REP> d-------- c:\documents and settings\alix.E1AF6476DDD6479\Application Data\EleFun Games
    2008-10-06 13:42 . 2008-10-13 14:06 211,968 --a------ c:\windows\WinProc.dll

    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-11-30 19:33 --------- d-----w c:\documents and settings\alix.E1AF6476DDD6479\Application Data\OpenOffice.org2
    2008-11-30 17:15 --------- d-----w c:\program files\eMule
    2008-11-30 14:11 5,330 --sha-w c:\windows\system32\KGyGaAvL.sys
    2008-11-30 14:11 --------- d-----w c:\documents and settings\alix.E1AF6476DDD6479\Application Data\Corel
    2008-11-29 20:39 --------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\BigFishGamesCache
    2008-11-29 16:59 --------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\Playrix Entertainment
    2008-11-29 11:22 --------- d---a-w c:\documents and settings\All Users.WINDOWS\Application Data\TEMP
    2008-11-27 19:26 --------- d-----w c:\documents and settings\alix.E1AF6476DDD6479\Application Data\uTorrent
    2008-11-27 13:53 --------- d-----w c:\program files\Everest Poker
    2008-11-26 10:34 --------- d-----w c:\program files\Java
    2008-11-24 20:32 --------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\Valusoft
    2008-11-24 20:32 --------- d-----w c:\documents and settings\alix.E1AF6476DDD6479\Application Data\Valusoft
    2008-11-23 15:37 --------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\PlayFirst
    2008-11-16 20:31 --------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\Fugazo
    2008-11-16 19:41 --------- d-----w c:\documents and settings\alix.E1AF6476DDD6479\Application Data\Pogo Games
    2008-11-16 08:54 --------- d-----w c:\program files\bfgclient
    2008-11-12 18:32 --------- d-----w c:\program files\Eset
    2008-11-12 15:59 --------- d-----w c:\program files\uTorrent
    2008-10-11 14:56 107,888 ----a-w c:\windows\system32\CmdLineExt.dll
    2008-10-11 14:34 --------- d--h--w c:\program files\InstallShield Installation Information
    2008-10-09 14:57 --------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\MythPeople
    2008-04-08 16:33 0 ----a-w c:\program files\temp01
    2008-04-09 18:55 8 --sh--r c:\windows\system32\EF9CE43B7D.sys
    .

    ------- Sigcheck -------

    2006-04-14 13:04 297984 70921de4c83652dc301a05f0cc46c985 c:\windows\system32\termsrv.dll
    .
    ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "QuickTime Task"="c:\program files\QuickTime Alternative\QTTask.exe" [2008-03-28 413696]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-26 136600]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
    "Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-03-28 593920]
    "SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 868352]
    "ORAHSSSessionManager"="c:\program files\OrangeHSS\SessionManager\SessionManager.exe" [2007-12-12 107248]
    "SpywareCleaner"="c:\windows\system32\SpywareRemover.exe" [2008-11-26 297697]
    "Corel Photo Downloader"="c:\program files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe" [2007-02-06 478800]
    "Framework Windows"="frmwrk32.exe" [2008-11-27 c:\windows\system32\frmwrk32.exe]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "nlpo_04"="md %USERPROFILE%\Local Settings\Temp" [X]
    "tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-04 44544]
    "nlpo_05"="advpack.dll" [2004-08-04 c:\windows\system32\advpack.dll]
    "nlpo_06"="advpack.dll" [2004-08-04 c:\windows\system32\advpack.dll]
    "nlpo_08"="advpack.dll" [2004-08-04 c:\windows\system32\advpack.dll]
    "nlpo_09"="advpack.dll" [2004-08-04 c:\windows\system32\advpack.dll]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
    "MstInit"="c:\windows\System\mstinit.exe" [2008-10-18 81920]

    [HKEY_CURRENT_USER\software\microsoft\windows\Currentversion\policies\explorer\Run]
    "Logman"="c:\docume~1\ALIX~1.E1A\LOCALS~1\APPLIC~1\MICROS~1\logman.exe" [2008-10-18 81920]

    [HKEY_USERS\.DEFAULT\software\microsoft\windows\Currentversion\policies\explorer\Run]
    "ComRepl"="c:\windows\System32\drivers\comrepl.exe" [2008-10-18 81920]

    c:\documents and settings\alix.E1AF6476DDD6479\Menu D‚marrer\Programmes\D‚marrage\
    OpenOffice.org 2.4.lnk - c:\program files\OpenOffice.org 2.4\program\quickstart.exe [2008-01-21 393216]

    c:\documents and settings\All Users.WINDOWS\Menu D‚marrer\Programmes\D‚marrage\
    Wireless Configuration Utility HW.15.lnk - c:\program files\TRENDnet\TRENDnet TEW-421PC_TEW-423PI\WlanCU.exe [2007-01-30 577536]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
    "DisableTaskMgr"= 1 (0x1)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
    "ForceClassicControlPanel"= 1 (0x1)
    "NoSetActiveDesktop"= 1 (0x1)
    "NoActiveDesktopChanges"= 1 (0x1)

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
    "NoSetActiveDesktop"= 1 (0x1)
    "NoActiveDesktopChanges"= 1 (0x1)

    [HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\windows]
    "load"=c:\docume~1\ALIX~1.E1A\APPLIC~1\logman.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=cbgllk.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride"=dword:00000001
    "FirewallOverride"=dword:00000001
    "AntiVirusDisableNotify"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "c:\\Program Files\\eMule\\emule.exe"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "c:\\Program Files\\uTorrent\\uTorrent.exe"=
    "c:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=
    "d:\\Rappelz\\HackShield\\HSUpdate.exe"=
    "c:\\Program Files\\OrangeHSS\\Connectivity\\ConnectivityManager.exe"=

    R0 SymEFA;Symantec Extended File Attributes;\SystemRoot\\SystemRoot\System32\Drivers\NAV\1001000.021\SYMEFA.SYS []
    R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\Drivers\NAV\1001000.021\BHDrvx86.sys [2008-11-29 255536]
    R1 ccHP;Symantec Hash Provider;c:\windows\system32\Drivers\NAV\1001000.021\ccHPx86.sys [2008-11-29 362544]
    R1 IDSxpx86;IDSxpx86;\??\c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20080826.006\IDSxpx86.sys [2008-11-29 274808]
    R2 Norton AntiVirus;Norton AntiVirus;"c:\program files\Norton AntiVirus\Engine\16.1.0.33\ccSvcHst.exe" /s "Norton AntiVirus" /m "c:\program files\Norton AntiVirus\Engine\16.1.0.33\diMaster.dll" /prefetch:1 []
    S3 EraserUtilDrv10822;EraserUtilDrv10822;\??\c:\program files\Fichiers communs\Symantec Shared\EENGINE\EraserUtilDrv10822.sys []
    S3 se59bus;Sony Ericsson Device 089 driver (WDM);c:\windows\system32\DRIVERS\se59bus.sys [2008-06-30 61536]
    S3 se59mdfl;Sony Ericsson Device 089 USB WMC Modem Filter;c:\windows\system32\DRIVERS\se59mdfl.sys [2008-06-30 9360]
    S3 se59mdm;Sony Ericsson Device 089 USB WMC Modem Driver;c:\windows\system32\DRIVERS\se59mdm.sys [2008-06-30 97088]
    S3 se59mgmt;Sony Ericsson Device 089 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\se59mgmt.sys [2008-06-30 88624]
    S3 se59nd5;Sony Ericsson Device 089 USB Ethernet Emulation SEMC59 (NDIS);c:\windows\system32\DRIVERS\se59nd5.sys [2008-06-30 18704]
    S3 se59obex;Sony Ericsson Device 089 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\se59obex.sys [2008-06-30 86432]
    S3 se59unic;Sony Ericsson Device 089 USB Ethernet Emulation SEMC59 (WDM);c:\windows\system32\DRIVERS\se59unic.sys [2008-06-30 90800]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{53c0424a-43bf-11dd-b201-000000000000}]
    \Shell\AutoRun\command - wd_windows_tools\setup.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{90a11ccf-0504-11dd-9400-806d6172696f}]
    \Shell\AutoRun\command - E:\Setup.exe
    .
    Contenu du dossier 'Tâches planifiées'

    2008-11-28 c:\windows\Tasks\1-Click Maintenance.job
    - c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2006-12-19 15:53]

    2008-11-27 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57]
    .
    - - - - ORPHELINS SUPPRIMES - - - -

    BHO-{1FB5C8F6-82F0-49CE-BCD9-9C80DDA48E26} - (no file)
    BHO-{8C8A0F0B-BE38-4BD1-B116-7E7B10BD4B48} - (no file)
    HKLM-Run-msspac - ortfta.dll
    HKU-Default-Run-UberIcon - c:\program files\UberIcon\UberIcon Manager.exe
    ShellExecuteHooks-{1FB5C8F6-82F0-49CE-BCD9-9C80DDA48E26} - (no file)
    Notify-pmnkjHaA - pmnkjHaA.dll

    .
    ------- Examen supplémentaire -------
    .
    FireFox -: Profile - c:\documents and settings\alix.E1AF6476DDD6479\Application Data\Mozilla\Firefox\Profiles\46x0vpfd.default\
    FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.fr/
    FF -: plugin - c:\documents and settings\All Users.WINDOWS\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
    FF -: plugin - c:\program files\iTunes\Mozilla Plugins\npitunes.dll
    FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll
    FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npjp2.dll
    FF -: plugin - c:\program files\Mozilla Firefox\plugins\np_gp.dll
    FF -: plugin - c:\program files\Mozilla Firefox\plugins\npdeploytk.dll
    FF -: plugin - c:\program files\Mozilla Firefox\plugins\npmozax.dll
    FF -: plugin - c:\program files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-11-30 20:33:12
    Windows 5.1.2600 Service Pack 2 NTFS

    Recherche de processus cachés ...

    Recherche d'éléments en démarrage automatique cachés ...

    Recherche de fichiers cachés ...

    Scan terminé avec succès
    Fichiers cachés: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Norton AntiVirus]
    "ImagePath"="\"c:\program files\Norton AntiVirus\Engine\16.1.0.33\ccSvcHst.exe\" /s \"Norton AntiVirus\" /m \"c:\program files\Norton AntiVirus\Engine\16.1.0.33\diMaster.dll\" /prefetch:1"
    .
    --------------------- DLLs chargées dans les processus actifs ---------------------

    - - - - - - - > 'winlogon.exe'(232)
    c:\windows\system32\SETUPAPI.dll
    c:\windows\system32\sfc_os.dll
    c:\windows\system32\Ati2evxx.dll

    - - - - - - - > 'lsass.exe'(404)
    c:\windows\system32\setupapi.dll

    - - - - - - - > 'csrss.exe'(1368)
    c:\windows\system32\winsrv.dll
    .
    ------------------------ Autres processus actifs ------------------------
    .
    c:\windows\system32\ati2evxx.exe
    c:\windows\system32\ati2evxx.exe
    c:\program files\OpenOffice.org 2.4\program\soffice.exe
    c:\program files\OpenOffice.org 2.4\program\soffice.bin
    c:\program files\OrangeHSS\Launcher\Launcher.exe
    c:\progra~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\[u]0/u\AlertModule.exe
    c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\windows\system32\Crypserv.exe
    c:\program files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe
    c:\progra~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\[u]0/u\FTRTSVC.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\program files\Norton AntiVirus\Engine\16.1.0.33\ccSvcHst.exe
    c:\program files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe
    c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
    c:\windows\system32\PSIService.exe
    c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
    c:\program files\iPod\bin\iPodService.exe
    c:\windows\system32\wbem\wmiapsrv.exe
    c:\windows\system32\wscntfy.exe
    c:\program files\Norton AntiVirus\Engine\16.1.0.33\ccSvcHst.exe
    c:\windows\system32\WgaTray.exe
    c:\program files\OrangeHSS\Systray\SystrayApp.exe
    c:\program files\OrangeHSS\Deskboard\Deskboard.exe
    c:\program files\OrangeHSS\Connectivity\ConnectivityManager.exe
    c:\program files\Fichiers communs\Teleca Shared\Generic.exe
    c:\program files\OrangeHSS\Connectivity\corecom\CoreCom.exe
    c:\program files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
    c:\program files\OrangeHSS\Connectivity\corecom\OraConfigRecover.exe
    c:\progra~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\[u]0/u\FTCOMModule.exe
    .
    **************************************************************************
    .
    Heure de fin: 2008-11-30 20:37:44 - La machine a redémarré [alix]
    ComboFix-quarantined-files.txt 2008-11-30 19:37:39

    Avant-CF: 29,206,294,528 octets libres
    Après-CF: 29,132,550,144 octets libres

    WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect /usepmtimer

    379 --- E O F --- 2008-07-15 11:33:37
    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. g!rly Messages postés 18462 Statut Contributeur 407
     
    je t´ai jamais rien demandé
    0
Précédent
  • 1
  • 2

Discussions similaires

usb device over current
jean-michel -
Robin -

39 réponses
suite au message "secure boot violation" impossible d'accéder à window
Walloute -
Malekal_morte- -

9 réponses
Page bleue : your PC ran into a problem and needs to restart
pitchalou -
Malekal_morte- -

2 réponses