SVP AIDEZ MOI MON PC EST INFECTé
Résolu
baaziz80
Messages postés
62
Statut
Membre
-
jlpjlp Messages postés 52399 Statut Contributeur sécurité -
jlpjlp Messages postés 52399 Statut Contributeur sécurité -
Bonjour,
COMME LE DIT LE TITRE SVP AIDEZ MOI MON PC EST INFECTé .IL RAME MON UC EST A 100% DES URL INCONUS S AFFICHENT. JE SUIS TROP MAL AIDEZ MOI. G BITDEFENDER CCLEANER TUNEUP2008 SPYWARE DOCTOR ADAWARE ET SPYBOT. G FAIT UN RAPPORT HITJAKTHIS en mode sans echec LE VOILA ::::::::::::::::::::::::::::::::::::::::::::::::::::::::: Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:42:48, on 09/04/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Safe mode with network support
Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Windows\Explorer.EXE
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Defenza\pcd-as.exe
C:\Program Files\Defenza\pcdscanner.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\kader\Desktop\HiJackThis.exe
C:\Windows\system32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb126\SearchSettings.dll
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb126\SearchSettings.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [PCDAS] C:\Program Files\Defenza\pcd-as.exe /10003
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - (no file)
O13 - Gopher Prefix:
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.vista.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPAHelper.exe - Unknown owner - C:\Program Files\iPod Access for Windows\iPAHelper.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: lxcz_device - - C:\Windows\system32\lxczcoms.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: TOSHIBA Bluetooth Service - Unknown owner - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (file missing)
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe
COMME LE DIT LE TITRE SVP AIDEZ MOI MON PC EST INFECTé .IL RAME MON UC EST A 100% DES URL INCONUS S AFFICHENT. JE SUIS TROP MAL AIDEZ MOI. G BITDEFENDER CCLEANER TUNEUP2008 SPYWARE DOCTOR ADAWARE ET SPYBOT. G FAIT UN RAPPORT HITJAKTHIS en mode sans echec LE VOILA ::::::::::::::::::::::::::::::::::::::::::::::::::::::::: Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:42:48, on 09/04/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Safe mode with network support
Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Windows\Explorer.EXE
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Defenza\pcd-as.exe
C:\Program Files\Defenza\pcdscanner.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\kader\Desktop\HiJackThis.exe
C:\Windows\system32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb126\SearchSettings.dll
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb126\SearchSettings.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [PCDAS] C:\Program Files\Defenza\pcd-as.exe /10003
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - (no file)
O13 - Gopher Prefix:
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.vista.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPAHelper.exe - Unknown owner - C:\Program Files\iPod Access for Windows\iPAHelper.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: lxcz_device - - C:\Windows\system32\lxczcoms.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: TOSHIBA Bluetooth Service - Unknown owner - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (file missing)
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe
A voir également:
- SVP AIDEZ MOI MON PC EST INFECTé
- Mon pc est lent - Guide
- Reinitialiser pc - Guide
- Ma cle usb n'est pas reconnu par mon pc - Guide
- Downloader for pc - Télécharger - Téléchargement & Transfert
- Plus de son sur mon pc - Guide
5 réponses
slt
pour defensa regarde ici
https://forum.malekal.com/viewtopic.php?f=56&t=3439
_____________________
relance hijakchtis , fais do a system scan only, selectionne ces lignes et fais fix cheked:
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb126\SearchSettings.dll
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb126\SearchSettings.dll
O4 - HKLM\..\Run: [PCDAS] C:\Program Files\Defenza\pcd-as.exe /10003
O9 - Extra button: (no name) - {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - (no file)
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
_____________________
analyse ce fichier sur virus total et si infécté tu le rajoute dans la citation otmovit: https://www.virustotal.com/gui/
C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.vista.exe
________________
télécharge OTMoveIt
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe (de Old_Timer) sur ton Bureau. Ou sur https://www.luanagames.com/index.fr.html
double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.
Citation :
C:\Program Files\Defenza
C:\Program Files\Search Settings
C:\Program Files\Search Settings\kb126\SearchSettings.dll
C:\Program Files\Defenza\pcd-as.exe
clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.
il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.
_________________
vire spyware doctor car tu as déjà windows defender , spybot, et l'antiespion de bitdefender ce qui fait beaucoup!
___________________
télécharge Combofix de sUBs : Renomme le avant toute installation, par exemple, nomme le "KillBagle". aide ici : https://forum.pcastuces.com/sujet.asp?f=25&s=37315
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Sauvegarde le sur ton bureau et pas ailleurs !
Aide à l’utilisation de combofix ici: https://bibou0007.forumpro.fr/login?redirect=%2Ft121-topic
Double-clic sur combofix, Il va te poser une question, réponds par la touche 1 et entrée pour valider, laisse toi guider.
Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.
___________
colle un rapport avec smitfraud fix option 1
http://siri.urz.free.fr/Fix/SmitfraudFix.php
pour defensa regarde ici
https://forum.malekal.com/viewtopic.php?f=56&t=3439
_____________________
relance hijakchtis , fais do a system scan only, selectionne ces lignes et fais fix cheked:
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb126\SearchSettings.dll
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb126\SearchSettings.dll
O4 - HKLM\..\Run: [PCDAS] C:\Program Files\Defenza\pcd-as.exe /10003
O9 - Extra button: (no name) - {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - (no file)
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
_____________________
analyse ce fichier sur virus total et si infécté tu le rajoute dans la citation otmovit: https://www.virustotal.com/gui/
C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.vista.exe
________________
télécharge OTMoveIt
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe (de Old_Timer) sur ton Bureau. Ou sur https://www.luanagames.com/index.fr.html
double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.
Citation :
C:\Program Files\Defenza
C:\Program Files\Search Settings
C:\Program Files\Search Settings\kb126\SearchSettings.dll
C:\Program Files\Defenza\pcd-as.exe
clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.
il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.
_________________
vire spyware doctor car tu as déjà windows defender , spybot, et l'antiespion de bitdefender ce qui fait beaucoup!
___________________
télécharge Combofix de sUBs : Renomme le avant toute installation, par exemple, nomme le "KillBagle". aide ici : https://forum.pcastuces.com/sujet.asp?f=25&s=37315
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Sauvegarde le sur ton bureau et pas ailleurs !
Aide à l’utilisation de combofix ici: https://bibou0007.forumpro.fr/login?redirect=%2Ft121-topic
Double-clic sur combofix, Il va te poser une question, réponds par la touche 1 et entrée pour valider, laisse toi guider.
Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.
___________
colle un rapport avec smitfraud fix option 1
http://siri.urz.free.fr/Fix/SmitfraudFix.php
tout d abord merci il ma fallut du temps; rapport de otmovit ::: File/Folder C:\Program Files\Defenza not found.
C:\Program Files\Search Settings\kb126\temp moved successfully.
C:\Program Files\Search Settings\kb126\res moved successfully.
C:\Program Files\Search Settings\kb126 moved successfully.
C:\Program Files\Search Settings moved successfully.
File/Folder C:\Program Files\Search Settings\kb126\SearchSettings.dll not found.
File/Folder C:\Program Files\Defenza\pcd-as.exe C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.vista.exe not found.
OTMoveIt2 by OldTimer - Version 1.0.4.1 log created on 04092008_181730
RAPPORT DE COMBOFIX:::::::::::ComboFix 08-04-08.10 - kader 2008-04-09 18:24:23.1 - NTFSx86 NETWORK
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.1.1036.18.1576 [GMT 2:00]
Endroit: C:\Users\kader\Desktop\Combo-Fix.exe
.
TimedOut: Windir.dat
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MessengerSkinner
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MessengerSkinner\Conditions générales.url
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MessengerSkinner\Confidentialité.url
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MessengerSkinner\Désinstaller.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MessengerSkinner\Website.url
C:\Users\mirou\AppData\Local\uckygvdr.dat
C:\Users\mirou\AppData\Local\uckygvdr.exe
C:\Users\mirou\AppData\Local\uckygvdr_nav.dat
C:\Users\mirou\AppData\Local\uckygvdr_navps.dat
C:\Users\mirou\AppData\Roaming\MessengerSkinner
C:\Users\mirou\AppData\Roaming\MessengerSkinner\Userdata\pack1.cab
C:\Users\mirou\Desktop\internetgamebox.lnk
.
((((((((((((((((((((((((((((( Fichiers créés 2008-03-09 to 2008-04-09 ))))))))))))))))))))))))))))))))))))
.
Pas de nouveau fichier créé dans cet espace de temps
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-09 16:12 --------- d---a-w C:\ProgramData\TEMP
2008-04-09 16:12 --------- d-----w C:\Program Files\Spyware Doctor
2008-04-09 15:52 --------- d-----w C:\Program Files\OFFICE One v7
2008-04-09 15:46 --------- d-----w C:\Program Files\MediaCoder
2008-04-09 15:45 --------- d-----w C:\Program Files\Lexmark 1200 Series
2008-04-09 15:42 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-09 15:42 --------- d-----w C:\Program Files\FinalBurner
2008-04-09 15:42 --------- d-----w C:\Program Files\DivX
2008-04-09 02:55 --------- d-----w C:\ProgramData\Spybot - Search & Destroy
2008-04-09 01:40 691,545 ----a-w C:\Windows\unins000.exe
2008-04-09 01:40 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-04-09 00:49 --------- d-----w C:\ProgramData\Google Updater
2008-04-09 00:01 --------- d-----w C:\Program Files\Lavasoft
2008-04-08 23:16 --------- d-----w C:\Program Files\ATI Technologies
2008-04-08 23:15 --------- d-----w C:\Program Files\Elaborate Bytes
2008-04-08 23:12 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-04-08 23:07 45,056 ----a-w C:\Windows\System32\acovcnt.exe
2008-04-08 16:55 --------- d-----w C:\Program Files\LimeWire
2008-04-08 13:24 --------- d-----w C:\Program Files\Java
2008-04-08 11:20 --------- d-----w C:\ProgramData\BitDefender
2008-04-08 11:18 --------- d-----w C:\Program Files\Common Files\BitDefender
2008-04-08 11:17 --------- d-----w C:\Program Files\BitDefender
2008-04-07 22:42 --------- d-----w C:\Program Files\StuffPlug3
2008-04-07 19:30 --------- d-----w C:\Program Files\Kaspersky Lab
2008-04-07 19:09 --------- d-----w C:\Program Files\free-downloads.net
2008-04-07 19:09 --------- d-----w C:\Program Files\Conduit
2008-04-07 18:46 --------- d-----w C:\ProgramData\Kaspersky Lab Setup Files
2008-04-07 12:22 --------- d-----w C:\Program Files\Free Easy Burner
2008-04-05 10:31 --------- d-----w C:\Program Files\Smallvideosoft
2008-04-05 10:26 --------- d-----w C:\Program Files\Common Files\AVSMedia
2008-04-05 10:26 --------- d-----w C:\Program Files\AVS4YOU
2008-04-05 10:25 --------- d-----w C:\Program Files\adslTV
2008-04-04 17:47 --------- d-----w C:\Program Files\Xilisoft
2008-04-04 13:00 --------- d-----w C:\Program Files\Norton Security Scan
2008-04-04 10:49 --------- d-----w C:\Users\mirou\AppData\Roaming\OFFICEOne7
2008-04-03 19:01 --------- d-----w C:\ProgramData\AVS4YOU
2008-04-03 18:36 --------- d-----w C:\Program Files\Common Files\GeoVid
2008-04-01 14:39 --------- d-----w C:\Program Files\QuickTime
2008-04-01 14:39 --------- d-----w C:\Program Files\iTunes
2008-04-01 14:39 --------- d-----w C:\Program Files\Google
2008-03-31 13:49 --------- d-----w C:\Program Files\MP3Gain
2008-03-30 18:19 --------- d-----w C:\ProgramData\Messenger Plus!
2008-03-29 18:22 --------- d-----w C:\Program Files\MyFree Codec
2008-03-29 18:20 --------- d-----w C:\Program Files\Samsung
2008-03-29 18:20 --------- d-----w C:\Program Files\MarkAny
2008-03-29 15:59 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-03-29 14:34 --------- d-----w C:\Users\mirou\AppData\Roaming\vlc
2008-03-28 16:21 --------- d-----w C:\Program Files\Safari
2008-03-28 16:19 --------- d-----w C:\Program Files\iPod
2008-03-26 03:15 --------- d-----w C:\Users\mirou\AppData\Roaming\U3
2008-03-26 02:05 --------- d-----w C:\ProgramData\Microsoft Help
2008-03-24 21:23 --------- d-----w C:\Program Files\MatchWare
2008-03-24 20:03 --------- d-----w C:\Users\mirou\AppData\Roaming\Nero
2008-03-24 16:59 716,272 ----a-w C:\Windows\system32\drivers\sptd.sys
2008-03-24 16:10 --------- d-----w C:\Program Files\MSBuild
2008-03-24 16:10 --------- d-----w C:\Program Files\Microsoft Works
2008-03-24 16:07 --------- d-----w C:\Program Files\Microsoft.NET
2008-03-24 16:02 --------- d-----w C:\Program Files\Microsoft Visual Studio 8
2008-03-24 15:28 --------- d-----w C:\Program Files\Common Files\Nero
2008-03-24 15:21 --------- d-----w C:\ProgramData\Nero
2008-03-24 00:03 --------- d-----w C:\Users\mirou\AppData\Roaming\TuneUp Software
2008-03-23 14:59 --------- d-----w C:\Program Files\TuneUp Utilities 2008
2008-03-23 14:54 306,432 ----a-w C:\Windows\System32\TuneUpDefragService.exe
2008-03-21 18:36 --------- d-----w C:\Program Files\e-anim
2008-03-17 12:53 --------- d-----w C:\ProgramData\WLInstaller
2008-03-16 13:22 --------- d-----w C:\Program Files\PhotoFiltre Studio
2008-03-15 15:26 --------- d-----w C:\Program Files\Picasa2
2008-03-15 14:53 --------- d-----w C:\Program Files\PhotoFiltre
2008-03-15 14:33 --------- d-----w C:\Program Files\Studio-Scrap
2008-03-15 14:32 --------- d-----w C:\Users\mirou\AppData\Roaming\Studio-Scrap
2008-03-15 13:55 --------- d-----w C:\Program Files\Tracker Software
2008-03-13 12:01 --------- d-----w C:\Program Files\WinHTTrack
2008-03-13 02:15 194,560 ----a-w C:\Windows\System32\WebClnt.dll
2008-03-13 02:15 110,080 ----a-w C:\Windows\system32\drivers\mrxdav.sys
2008-03-13 02:08 803,328 ----a-w C:\Windows\system32\drivers\tcpip.sys
2008-03-13 02:08 24,064 ----a-w C:\Windows\System32\netcfg.exe
2008-03-13 02:08 22,016 ----a-w C:\Windows\System32\netiougc.exe
2008-03-13 02:08 216,632 ----a-w C:\Windows\system32\drivers\netio.sys
2008-03-13 02:08 167,424 ----a-w C:\Windows\System32\tcpipcfg.dll
2008-03-13 02:02 824,832 ----a-w C:\Windows\System32\wininet.dll
2008-03-13 02:02 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-03-13 02:02 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-03-13 02:02 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-03-12 16:49 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-03-11 20:44 --------- d-----w C:\Program Files\Alcohol Soft
2008-02-26 18:01 --------- d-----w C:\Program Files\Inventel
2008-02-23 01:06 --------- d-----w C:\Program Files\TVAnts
2008-02-23 01:05 --------- d-----w C:\Program Files\SatelliteTVforPC
2008-02-23 01:00 --------- d-----w C:\Program Files\PC Accelerate
2008-02-23 00:59 --------- d-----w C:\ProgramData\eSellerate
2008-02-23 00:59 --------- d-----w C:\Program Files\Common Files\eSellerate
2008-02-23 00:47 --------- d-----w C:\Program Files\Replay Converter
2008-02-23 00:45 --------- d-----w C:\Program Files\VirtualDJ
2008-02-22 00:18 --------- d-----w C:\Program Files\DVDFab Platinum 4
2008-02-22 00:14 --------- d-----w C:\Program Files\ElcomSoft
2008-02-21 23:59 --------- d-----w C:\Program Files\IDA
2008-02-21 23:54 --------- d-----w C:\Program Files\SuperLogix
2008-02-21 02:20 --------- d-----w C:\Program Files\Easiestutils
2008-02-21 02:05 200,704 ----a-w C:\Windows\System32\nsr58C1.tmp
2008-02-21 02:05 1,044,480 ----a-w C:\Windows\System32\nsl5852.tmp
2006-05-03 10:06 163,328 --sh--r C:\Windows\System32\flvDX.dll
2005-08-24 22:10 174,592 --sha-w C:\Windows\System32\ncfpsys.exe
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-22 23:27 815104]
"NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 16:57 153136]
"BDAgent"="C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe" [2008-02-16 17:45 360448]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-08-08 10:25 1828136]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Spybot - Search & Destroy"="C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" [2005-05-31 01:04 4393096]
"Lexmark 1200 Series Uninstall"="" []
"MSNFix"="C:\Users\kader\Desktop\MSNFix\MSNFix.bat /pass2" [ ]
"GrpConv"="grpconv -o" []
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{88485281-8b4b-4f8d-9ede-82e29a064277}"= C:\PROGRA~1\MarkAny\CONTEN~1\MACSMA~1.DLL [2004-11-23 17:51 192512]
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Outil de mise à jour Google.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Outil de mise à jour Google.lnk
backup=C:\Windows\pss\Outil de mise à jour Google.lnk.CommonStartup
backupExtension=.CommonStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitDefender Antiphishing Helper]
--a------ 2007-10-09 15:46 61440 C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
--a------ 2008-03-15 17:13 1836544 C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RestartNeroSetup]
C:\Users\kader\Desktop\nero\Installation\Setupx.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ehTray.exe"=C:\Windows\ehome\ehTray.exe
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
"AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Password Protect USB 3.6.1"=C:\Windows\system32\ncfpsys.exe
"ASUS Camera ScreenSaver"=C:\Windows\ASScrProlog.exe
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe"
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" -atboottime
"SMSTray"=C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe
"BitDefender Antiphishing Helper"="C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{626A4C5E-D9B0-427F-9A36-65EAECDF51A9}"= UDP:4662:LPHANT
"{81C57B69-7EEA-4EBE-8790-3302EDC61C7B}"= TCP:4672:LPHANT2
"{7FAEAADA-FD91-4AF6-B1AD-695C88667EC8}"= UDP:C:\Program Files\lphant\eLePhantClient.exe:lphant
"{540E054D-4791-44BD-A7E2-C885042B8A04}"= TCP:C:\Program Files\lphant\eLePhantClient.exe:lphant
"TCP Query User{936B446D-0D63-4859-BC54-8E97D32BBF8B}C:\\program files\\lphant\\elephantclient.exe"= UDP:C:\program files\lphant\elephantclient.exe:lphant Client
"UDP Query User{0B874E1D-E796-4607-BE06-C89C93477E84}C:\\program files\\lphant\\elephantclient.exe"= TCP:C:\program files\lphant\elephantclient.exe:lphant Client
"{03C1E629-2B33-47B1-B53E-A46E9FBE78E2}"= UDP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb
"{DBADDE4E-55D0-4F74-8A57-ECF91E5ABD80}"= TCP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb
"{166ACAB8-B741-4C52-A4B3-770D731488AA}"= UDP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray
"{F9748E1A-7C99-4284-B2AE-1FD1FB0CCE4C}"= TCP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray
"{9C34DEF2-2E8A-4AA5-87F3-F7ECD4BCD5E5}"= UDP:C:\Program Files\Winamp Remote\bin\OrbIR.exe:OrbIR
"{BF135AFF-1123-4F0A-96E5-B9435FA2C72B}"= TCP:C:\Program Files\Winamp Remote\bin\OrbIR.exe:OrbIR
"{A3171276-B81B-4617-8336-B985AE666BA4}"= UDP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client
"{88594D48-5A5E-431B-9D30-EACF1BB450AA}"= TCP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client
"TCP Query User{B54C2741-C518-4605-94D6-02315AE74A61}C:\\program files\\limewire\\limewire.exe"= UDP:C:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{20070461-65C0-42B7-A918-ADC007537A0E}C:\\program files\\limewire\\limewire.exe"= TCP:C:\program files\limewire\limewire.exe:LimeWire
"TCP Query User{392E68E3-C8E4-4417-A205-8B3C57AB6137}C:\\program files\\videolan\\vlc\\vlc.exe"= UDP:C:\program files\videolan\vlc\vlc.exe:VLC media player
"UDP Query User{2F8F5656-18A8-42CB-BFD6-9331A8504CA1}C:\\program files\\videolan\\vlc\\vlc.exe"= TCP:C:\program files\videolan\vlc\vlc.exe:VLC media player
"TCP Query User{BF63338C-5131-4E94-9EAD-07F48A37F9E3}C:\\program files\\skype\\phone\\skype.exe"= UDP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"UDP Query User{EF983016-E802-4667-94B2-29F57408BFF8}C:\\program files\\skype\\phone\\skype.exe"= TCP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"UDP Query User{4674E56B-86BE-435F-A9C5-A8BCFB154E40}C:\\program files\\pando networks\\pando\\pando.exe"= C:\program files\pando networks\pando\pando.exe:pando
"TCP Query User{76843D20-AE5D-4B27-94BA-187B644D3AA7}C:\\program files\\pando networks\\pando\\pando.exe"= RA4=LocalSubnet:LocalSubnet|C:\program files\pando networks\pando\pando.exe:pando
"TCP Query User{A00C1A24-E63C-402B-A9D3-23DAC5888201}C:\\program files\\pando networks\\pando\\pando.exe"= C:\program files\pando networks\pando\pando.exe:pando
"UDP Query User{FC27D876-FE65-41BE-AB3C-75BB04107CF5}C:\\program files\\pando networks\\pando\\pando.exe"= RA4=LocalSubnet:LocalSubnet|C:\program files\pando networks\pando\pando.exe:pando
"{C1864D0A-AC91-42B3-9C26-A51747FE7AEC}"= UDP:C:\Windows\System32\lxczcoms.exe:Lexmark Communications System
"{4D274531-A2DE-46C5-90A5-895193C7F605}"= TCP:C:\Windows\System32\lxczcoms.exe:Lexmark Communications System
"{3B301C66-E314-4EFE-9766-0694CA43E7B3}"= UDP:C:\Windows\System32\spool\drivers\w32x86\3\lxczpswx.exe:Printer Status Window
"{6C2F00EC-C76B-4676-A5A5-EF6FA0EA36C5}"= TCP:C:\Windows\System32\spool\drivers\w32x86\3\lxczpswx.exe:Printer Status Window
"{AA164D05-F808-403A-853B-67498B02D518}"= UDP:56379:Pando P2P TCP Listening Port
"{37FD76D3-C1BD-41A6-8781-14A7ED57DC7C}"= TCP:56379:Pando P2P UDP Listening Port
"TCP Query User{070D4680-1559-4BA6-BD1A-B7FE595B6E97}C:\\users\\kader\\appdata\\local\\temp\\rar$ex10.891\\cryptload_1.0.4\\routerclient.exe"= UDP:C:\users\kader\appdata\local\temp\rar$ex10.891\cryptload_1.0.4\routerclient.exe:routerclient.exe
"UDP Query User{1B7C7309-9438-4071-86D4-79E46EFBA61B}C:\\users\\kader\\appdata\\local\\temp\\rar$ex10.891\\cryptload_1.0.4\\routerclient.exe"= TCP:C:\users\kader\appdata\local\temp\rar$ex10.891\cryptload_1.0.4\routerclient.exe:routerclient.exe
"TCP Query User{D7CD2555-38AB-491D-98CE-79C335B0FBAE}C:\\users\\kader\\appdata\\roaming\\jlc's software\\internet tv\\update.exe"= UDP:C:\users\kader\appdata\roaming\jlc's software\internet tv\update.exe:update.exe
"UDP Query User{74A2DBE5-37AF-4450-A502-25ABFDEFB7F8}C:\\users\\kader\\appdata\\roaming\\jlc's software\\internet tv\\update.exe"= TCP:C:\users\kader\appdata\roaming\jlc's software\internet tv\update.exe:update.exe
"{6CD601FF-965E-4725-B805-374C3C96E81F}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{F70F6EA4-BF3D-498D-956D-7636D7EE9079}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{990A4D0F-0DD9-4754-9BC2-694B0C1BAE01}"= UDP:C:\Program Files\iolo\System Mechanic Professional 7\Personal Firewall\ioloFW.exe:iolo Firewall®
"{76D4BD1B-0ADA-43D8-832C-55D606ED23A3}"= TCP:C:\Program Files\iolo\System Mechanic Professional 7\Personal Firewall\ioloFW.exe:iolo Firewall®
"{3C2D0285-5C65-4E9B-8249-4CA0161E1BEB}"= UDP:C:\Program Files\iolo\System Mechanic Professional 7\AntiVirus\ioloAV.exe:iolo AntiVirus®
"{51B23680-9173-4EF0-887C-0E4744291658}"= TCP:C:\Program Files\iolo\System Mechanic Professional 7\AntiVirus\ioloAV.exe:iolo AntiVirus®
"{88EBC447-BFD0-4381-90EE-C8755850F9CE}"= UDP:C:\Program Files\iolo\System Mechanic Professional 7\AntiVirus\iAVEmailScanner.exe:iolo AntiVirus® Email Protection
"{B2A4A7F3-2445-48B6-8E9E-CCF76DCBC76A}"= TCP:C:\Program Files\iolo\System Mechanic Professional 7\AntiVirus\iAVEmailScanner.exe:iolo AntiVirus® Email Protection
"{D5495441-4FFB-4039-B19D-33964DADA734}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{6560C9F9-91E1-4BBB-8A84-0312A7BC6730}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{2445382D-255C-4556-9A14-D8CE870F830A}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{69F96B65-514D-40DA-95BC-CF333F6C890C}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{94CDD280-C4E1-4DC4-B7D7-92814EEBBDC2}"= UDP:C:\Windows\System32\muzapp.exe:MUZ AOD APP player
"{370B59A9-FBAB-4AA1-B743-18718E1F0F09}"= TCP:C:\Windows\System32\muzapp.exe:MUZ AOD APP player
"TCP Query User{93BA8A02-7B89-44B2-9AC2-A52CB87E52A8}C:\\programdata\\kaspersky lab setup files\\kaspersky internet security 7.0.1.321\\french\\setup.exe"= UDP:C:\programdata\kaspersky lab setup files\kaspersky internet security 7.0.1.321\french\setup.exe:Programme d'installation de Kaspersky Internet Security 7.0
"UDP Query User{8C8B7786-0F78-45FC-A710-236BFE7E56EE}C:\\programdata\\kaspersky lab setup files\\kaspersky internet security 7.0.1.321\\french\\setup.exe"= TCP:C:\programdata\kaspersky lab setup files\kaspersky internet security 7.0.1.321\french\setup.exe:Programme d'installation de Kaspersky Internet Security 7.0
"TCP Query User{C9381EC4-7EE0-4ED0-9BAA-FFB0B86F9526}C:\\programdata\\kaspersky lab setup files\\kaspersky internet security 7.0.1.321\\french\\setup.exe"= UDP:C:\programdata\kaspersky lab setup files\kaspersky internet security 7.0.1.321\french\setup.exe:Programme d'installation de Kaspersky Internet Security 7.0
"UDP Query User{0DBC1280-F501-4603-BE12-9DC66AD061E2}C:\\programdata\\kaspersky lab setup files\\kaspersky internet security 7.0.1.321\\french\\setup.exe"= TCP:C:\programdata\kaspersky lab setup files\kaspersky internet security 7.0.1.321\french\setup.exe:Programme d'installation de Kaspersky Internet Security 7.0
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
"DisabledInterfaces"= {73EB23E6-C574-4700-A6C0-A629EEAAD4D2},{D2EA8F3D-BD76-4AB8-8F3B-BA5D44F1881A}
R3 athr;Atheros Extensible Wireless LAN device driver;C:\Windows\system32\DRIVERS\athr.sys [2007-03-01 03:04]
R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;C:\Windows\system32\DRIVERS\bdfndisf.sys [2008-01-25 15:40]
R3 RTSTOR;USB Mass Storage Device;C:\Windows\system32\drivers\RTSTOR.SYS [2008-01-03 21:35]
S1 ElRawDisk;ElRawDisk;C:\Windows\system32\drivers\elrawdsk.sys [2007-09-20 14:12]
S2 TOSHIBA Bluetooth Service;TOSHIBA Bluetooth Service;C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe []
S2 UxTuneUp;TuneUp Extension de thème;C:\Windows\System32\svchost.exe [2006-11-02 11:45]
S3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2007-03-06 17:04]
S3 StMp3Rec;Pilote de périphérique de la restauration de lecteur;C:\Windows\system32\Drivers\StMp3Rec.sys [2005-08-26 11:22]
S3 SynMini;USB2.0 1.3M Web Cam;C:\Windows\system32\Drivers\SynMini.sys [2006-04-19 02:04]
S3 SynScan;USB2.0 1.3M Web Cam Still Image;C:\Windows\system32\Drivers\SynScan.sys [2006-04-19 02:04]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\Windows\System32\TuneUpDefragService.exe [2008-03-23 16:54]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
bdx REG_MULTI_SZ scan
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
\shell\AutoRun\command - H:\Autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8d123ea9-a68b-11dc-8503-001d607deb18}]
\shell\AutoRun\command - H:\autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aee715a2-a2b1-11dc-80a0-001d607deb18}]
\shell\AutoRun\command - E:\InstallAll.exe
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-04-04 15:15:00 C:\Windows\Tasks\Maintenance en 1 clic.job"
- C:\Program Files\TuneUp Utilities 2008\OneClick.exe
"2008-04-04 13:27:02 C:\Windows\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
"2008-04-08 21:38:19 C:\Windows\Tasks\User_Feed_Synchronization-{21DC5361-7888-47BE-A484-1E957CB3BFF4}.job"
- C:\Windows\system32\msfeedssync.exe
"2008-04-09 14:20:00 C:\Windows\Tasks\User_Feed_Synchronization-{2F93FEA3-FDC8-4532-9AF0-BB059CD9DFB2}.job"
- C:\Windows\system32\msfeedssync.exe
.
**************************************************************************
catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-09 18:27:18
Windows 6.0.6000 NTFS
Balayage processus cachés ...
Balayage caché autostart entries ...
Balayage des fichiers cachés ...
Scan terminé avec succès
Les fichiers cachés: 0
**************************************************************************
.
Temps d'accomplissement: 2008-04-09 18:27:53
ComboFix-quarantined-files.txt 2008-04-09 16:27:48
Le texte du message associé au numéro 0x2379 est introuvable dans le fichier de messages pour Application.
Le texte du message associé au numéro 0x2379 est introuvable dans le fichier de messages pour Application.
.
2008-04-09 14:20:43 --- E O F ---
rapport de smitfraudfix :::::::: SmitFraudFix v2.310
Scan done at 18:30:41,86, 09/04/2008
Run from C:\Windows\System32\SmitfraudFix
OS: Microsoft Windows [version 6.0.6000] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode
»»»»»»»»»»»»»»»»»»»»»»»» Process
C:\Windows\system32\csrss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\Explorer.exe
C:\Windows\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\wbem\wmiprvse.exe
»»»»»»»»»»»»»»»»»»»»»»»» hosts
»»»»»»»»»»»»»»»»»»»»»»»» C:\
»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows
»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system
»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web
»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32
»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles
»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\kader
»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\kader\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Start Menu
»»»»»»»»»»»»»»»»»»»»»»»»
»»»»»»»»»»»»»»»»»»»»»»»» Desktop
»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys
»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!
VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\\PROGRA~1\\Google\\GOOGLE~3\\GOEC62~1.DLL"
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\Windows\\system32\\userinit.exe,"
"System"=""
»»»»»»»»»»»»»»»»»»»»»»»» Rustock
»»»»»»»»»»»»»»»»»»»»»»»» DNS
Description: Atheros AR5006EG Wireless Network Adapter
DNS Server Search Order: 192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{D2EA8F3D-BD76-4AB8-8F3B-BA5D44F1881A}: DhcpNameServer=192.168.1.1
»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection
»»»»»»»»»»»»»»»»»»»»»»»» End
voila tout merci
C:\Program Files\Search Settings\kb126\temp moved successfully.
C:\Program Files\Search Settings\kb126\res moved successfully.
C:\Program Files\Search Settings\kb126 moved successfully.
C:\Program Files\Search Settings moved successfully.
File/Folder C:\Program Files\Search Settings\kb126\SearchSettings.dll not found.
File/Folder C:\Program Files\Defenza\pcd-as.exe C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.vista.exe not found.
OTMoveIt2 by OldTimer - Version 1.0.4.1 log created on 04092008_181730
RAPPORT DE COMBOFIX:::::::::::ComboFix 08-04-08.10 - kader 2008-04-09 18:24:23.1 - NTFSx86 NETWORK
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.1.1036.18.1576 [GMT 2:00]
Endroit: C:\Users\kader\Desktop\Combo-Fix.exe
.
TimedOut: Windir.dat
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MessengerSkinner
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MessengerSkinner\Conditions générales.url
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MessengerSkinner\Confidentialité.url
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MessengerSkinner\Désinstaller.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MessengerSkinner\Website.url
C:\Users\mirou\AppData\Local\uckygvdr.dat
C:\Users\mirou\AppData\Local\uckygvdr.exe
C:\Users\mirou\AppData\Local\uckygvdr_nav.dat
C:\Users\mirou\AppData\Local\uckygvdr_navps.dat
C:\Users\mirou\AppData\Roaming\MessengerSkinner
C:\Users\mirou\AppData\Roaming\MessengerSkinner\Userdata\pack1.cab
C:\Users\mirou\Desktop\internetgamebox.lnk
.
((((((((((((((((((((((((((((( Fichiers créés 2008-03-09 to 2008-04-09 ))))))))))))))))))))))))))))))))))))
.
Pas de nouveau fichier créé dans cet espace de temps
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-09 16:12 --------- d---a-w C:\ProgramData\TEMP
2008-04-09 16:12 --------- d-----w C:\Program Files\Spyware Doctor
2008-04-09 15:52 --------- d-----w C:\Program Files\OFFICE One v7
2008-04-09 15:46 --------- d-----w C:\Program Files\MediaCoder
2008-04-09 15:45 --------- d-----w C:\Program Files\Lexmark 1200 Series
2008-04-09 15:42 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-09 15:42 --------- d-----w C:\Program Files\FinalBurner
2008-04-09 15:42 --------- d-----w C:\Program Files\DivX
2008-04-09 02:55 --------- d-----w C:\ProgramData\Spybot - Search & Destroy
2008-04-09 01:40 691,545 ----a-w C:\Windows\unins000.exe
2008-04-09 01:40 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-04-09 00:49 --------- d-----w C:\ProgramData\Google Updater
2008-04-09 00:01 --------- d-----w C:\Program Files\Lavasoft
2008-04-08 23:16 --------- d-----w C:\Program Files\ATI Technologies
2008-04-08 23:15 --------- d-----w C:\Program Files\Elaborate Bytes
2008-04-08 23:12 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-04-08 23:07 45,056 ----a-w C:\Windows\System32\acovcnt.exe
2008-04-08 16:55 --------- d-----w C:\Program Files\LimeWire
2008-04-08 13:24 --------- d-----w C:\Program Files\Java
2008-04-08 11:20 --------- d-----w C:\ProgramData\BitDefender
2008-04-08 11:18 --------- d-----w C:\Program Files\Common Files\BitDefender
2008-04-08 11:17 --------- d-----w C:\Program Files\BitDefender
2008-04-07 22:42 --------- d-----w C:\Program Files\StuffPlug3
2008-04-07 19:30 --------- d-----w C:\Program Files\Kaspersky Lab
2008-04-07 19:09 --------- d-----w C:\Program Files\free-downloads.net
2008-04-07 19:09 --------- d-----w C:\Program Files\Conduit
2008-04-07 18:46 --------- d-----w C:\ProgramData\Kaspersky Lab Setup Files
2008-04-07 12:22 --------- d-----w C:\Program Files\Free Easy Burner
2008-04-05 10:31 --------- d-----w C:\Program Files\Smallvideosoft
2008-04-05 10:26 --------- d-----w C:\Program Files\Common Files\AVSMedia
2008-04-05 10:26 --------- d-----w C:\Program Files\AVS4YOU
2008-04-05 10:25 --------- d-----w C:\Program Files\adslTV
2008-04-04 17:47 --------- d-----w C:\Program Files\Xilisoft
2008-04-04 13:00 --------- d-----w C:\Program Files\Norton Security Scan
2008-04-04 10:49 --------- d-----w C:\Users\mirou\AppData\Roaming\OFFICEOne7
2008-04-03 19:01 --------- d-----w C:\ProgramData\AVS4YOU
2008-04-03 18:36 --------- d-----w C:\Program Files\Common Files\GeoVid
2008-04-01 14:39 --------- d-----w C:\Program Files\QuickTime
2008-04-01 14:39 --------- d-----w C:\Program Files\iTunes
2008-04-01 14:39 --------- d-----w C:\Program Files\Google
2008-03-31 13:49 --------- d-----w C:\Program Files\MP3Gain
2008-03-30 18:19 --------- d-----w C:\ProgramData\Messenger Plus!
2008-03-29 18:22 --------- d-----w C:\Program Files\MyFree Codec
2008-03-29 18:20 --------- d-----w C:\Program Files\Samsung
2008-03-29 18:20 --------- d-----w C:\Program Files\MarkAny
2008-03-29 15:59 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-03-29 14:34 --------- d-----w C:\Users\mirou\AppData\Roaming\vlc
2008-03-28 16:21 --------- d-----w C:\Program Files\Safari
2008-03-28 16:19 --------- d-----w C:\Program Files\iPod
2008-03-26 03:15 --------- d-----w C:\Users\mirou\AppData\Roaming\U3
2008-03-26 02:05 --------- d-----w C:\ProgramData\Microsoft Help
2008-03-24 21:23 --------- d-----w C:\Program Files\MatchWare
2008-03-24 20:03 --------- d-----w C:\Users\mirou\AppData\Roaming\Nero
2008-03-24 16:59 716,272 ----a-w C:\Windows\system32\drivers\sptd.sys
2008-03-24 16:10 --------- d-----w C:\Program Files\MSBuild
2008-03-24 16:10 --------- d-----w C:\Program Files\Microsoft Works
2008-03-24 16:07 --------- d-----w C:\Program Files\Microsoft.NET
2008-03-24 16:02 --------- d-----w C:\Program Files\Microsoft Visual Studio 8
2008-03-24 15:28 --------- d-----w C:\Program Files\Common Files\Nero
2008-03-24 15:21 --------- d-----w C:\ProgramData\Nero
2008-03-24 00:03 --------- d-----w C:\Users\mirou\AppData\Roaming\TuneUp Software
2008-03-23 14:59 --------- d-----w C:\Program Files\TuneUp Utilities 2008
2008-03-23 14:54 306,432 ----a-w C:\Windows\System32\TuneUpDefragService.exe
2008-03-21 18:36 --------- d-----w C:\Program Files\e-anim
2008-03-17 12:53 --------- d-----w C:\ProgramData\WLInstaller
2008-03-16 13:22 --------- d-----w C:\Program Files\PhotoFiltre Studio
2008-03-15 15:26 --------- d-----w C:\Program Files\Picasa2
2008-03-15 14:53 --------- d-----w C:\Program Files\PhotoFiltre
2008-03-15 14:33 --------- d-----w C:\Program Files\Studio-Scrap
2008-03-15 14:32 --------- d-----w C:\Users\mirou\AppData\Roaming\Studio-Scrap
2008-03-15 13:55 --------- d-----w C:\Program Files\Tracker Software
2008-03-13 12:01 --------- d-----w C:\Program Files\WinHTTrack
2008-03-13 02:15 194,560 ----a-w C:\Windows\System32\WebClnt.dll
2008-03-13 02:15 110,080 ----a-w C:\Windows\system32\drivers\mrxdav.sys
2008-03-13 02:08 803,328 ----a-w C:\Windows\system32\drivers\tcpip.sys
2008-03-13 02:08 24,064 ----a-w C:\Windows\System32\netcfg.exe
2008-03-13 02:08 22,016 ----a-w C:\Windows\System32\netiougc.exe
2008-03-13 02:08 216,632 ----a-w C:\Windows\system32\drivers\netio.sys
2008-03-13 02:08 167,424 ----a-w C:\Windows\System32\tcpipcfg.dll
2008-03-13 02:02 824,832 ----a-w C:\Windows\System32\wininet.dll
2008-03-13 02:02 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-03-13 02:02 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-03-13 02:02 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-03-12 16:49 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-03-11 20:44 --------- d-----w C:\Program Files\Alcohol Soft
2008-02-26 18:01 --------- d-----w C:\Program Files\Inventel
2008-02-23 01:06 --------- d-----w C:\Program Files\TVAnts
2008-02-23 01:05 --------- d-----w C:\Program Files\SatelliteTVforPC
2008-02-23 01:00 --------- d-----w C:\Program Files\PC Accelerate
2008-02-23 00:59 --------- d-----w C:\ProgramData\eSellerate
2008-02-23 00:59 --------- d-----w C:\Program Files\Common Files\eSellerate
2008-02-23 00:47 --------- d-----w C:\Program Files\Replay Converter
2008-02-23 00:45 --------- d-----w C:\Program Files\VirtualDJ
2008-02-22 00:18 --------- d-----w C:\Program Files\DVDFab Platinum 4
2008-02-22 00:14 --------- d-----w C:\Program Files\ElcomSoft
2008-02-21 23:59 --------- d-----w C:\Program Files\IDA
2008-02-21 23:54 --------- d-----w C:\Program Files\SuperLogix
2008-02-21 02:20 --------- d-----w C:\Program Files\Easiestutils
2008-02-21 02:05 200,704 ----a-w C:\Windows\System32\nsr58C1.tmp
2008-02-21 02:05 1,044,480 ----a-w C:\Windows\System32\nsl5852.tmp
2006-05-03 10:06 163,328 --sh--r C:\Windows\System32\flvDX.dll
2005-08-24 22:10 174,592 --sha-w C:\Windows\System32\ncfpsys.exe
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-22 23:27 815104]
"NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 16:57 153136]
"BDAgent"="C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe" [2008-02-16 17:45 360448]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-08-08 10:25 1828136]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Spybot - Search & Destroy"="C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" [2005-05-31 01:04 4393096]
"Lexmark 1200 Series Uninstall"="" []
"MSNFix"="C:\Users\kader\Desktop\MSNFix\MSNFix.bat /pass2" [ ]
"GrpConv"="grpconv -o" []
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{88485281-8b4b-4f8d-9ede-82e29a064277}"= C:\PROGRA~1\MarkAny\CONTEN~1\MACSMA~1.DLL [2004-11-23 17:51 192512]
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Outil de mise à jour Google.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Outil de mise à jour Google.lnk
backup=C:\Windows\pss\Outil de mise à jour Google.lnk.CommonStartup
backupExtension=.CommonStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitDefender Antiphishing Helper]
--a------ 2007-10-09 15:46 61440 C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
--a------ 2008-03-15 17:13 1836544 C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RestartNeroSetup]
C:\Users\kader\Desktop\nero\Installation\Setupx.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ehTray.exe"=C:\Windows\ehome\ehTray.exe
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
"AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Password Protect USB 3.6.1"=C:\Windows\system32\ncfpsys.exe
"ASUS Camera ScreenSaver"=C:\Windows\ASScrProlog.exe
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe"
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" -atboottime
"SMSTray"=C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe
"BitDefender Antiphishing Helper"="C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{626A4C5E-D9B0-427F-9A36-65EAECDF51A9}"= UDP:4662:LPHANT
"{81C57B69-7EEA-4EBE-8790-3302EDC61C7B}"= TCP:4672:LPHANT2
"{7FAEAADA-FD91-4AF6-B1AD-695C88667EC8}"= UDP:C:\Program Files\lphant\eLePhantClient.exe:lphant
"{540E054D-4791-44BD-A7E2-C885042B8A04}"= TCP:C:\Program Files\lphant\eLePhantClient.exe:lphant
"TCP Query User{936B446D-0D63-4859-BC54-8E97D32BBF8B}C:\\program files\\lphant\\elephantclient.exe"= UDP:C:\program files\lphant\elephantclient.exe:lphant Client
"UDP Query User{0B874E1D-E796-4607-BE06-C89C93477E84}C:\\program files\\lphant\\elephantclient.exe"= TCP:C:\program files\lphant\elephantclient.exe:lphant Client
"{03C1E629-2B33-47B1-B53E-A46E9FBE78E2}"= UDP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb
"{DBADDE4E-55D0-4F74-8A57-ECF91E5ABD80}"= TCP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb
"{166ACAB8-B741-4C52-A4B3-770D731488AA}"= UDP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray
"{F9748E1A-7C99-4284-B2AE-1FD1FB0CCE4C}"= TCP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray
"{9C34DEF2-2E8A-4AA5-87F3-F7ECD4BCD5E5}"= UDP:C:\Program Files\Winamp Remote\bin\OrbIR.exe:OrbIR
"{BF135AFF-1123-4F0A-96E5-B9435FA2C72B}"= TCP:C:\Program Files\Winamp Remote\bin\OrbIR.exe:OrbIR
"{A3171276-B81B-4617-8336-B985AE666BA4}"= UDP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client
"{88594D48-5A5E-431B-9D30-EACF1BB450AA}"= TCP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client
"TCP Query User{B54C2741-C518-4605-94D6-02315AE74A61}C:\\program files\\limewire\\limewire.exe"= UDP:C:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{20070461-65C0-42B7-A918-ADC007537A0E}C:\\program files\\limewire\\limewire.exe"= TCP:C:\program files\limewire\limewire.exe:LimeWire
"TCP Query User{392E68E3-C8E4-4417-A205-8B3C57AB6137}C:\\program files\\videolan\\vlc\\vlc.exe"= UDP:C:\program files\videolan\vlc\vlc.exe:VLC media player
"UDP Query User{2F8F5656-18A8-42CB-BFD6-9331A8504CA1}C:\\program files\\videolan\\vlc\\vlc.exe"= TCP:C:\program files\videolan\vlc\vlc.exe:VLC media player
"TCP Query User{BF63338C-5131-4E94-9EAD-07F48A37F9E3}C:\\program files\\skype\\phone\\skype.exe"= UDP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"UDP Query User{EF983016-E802-4667-94B2-29F57408BFF8}C:\\program files\\skype\\phone\\skype.exe"= TCP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"UDP Query User{4674E56B-86BE-435F-A9C5-A8BCFB154E40}C:\\program files\\pando networks\\pando\\pando.exe"= C:\program files\pando networks\pando\pando.exe:pando
"TCP Query User{76843D20-AE5D-4B27-94BA-187B644D3AA7}C:\\program files\\pando networks\\pando\\pando.exe"= RA4=LocalSubnet:LocalSubnet|C:\program files\pando networks\pando\pando.exe:pando
"TCP Query User{A00C1A24-E63C-402B-A9D3-23DAC5888201}C:\\program files\\pando networks\\pando\\pando.exe"= C:\program files\pando networks\pando\pando.exe:pando
"UDP Query User{FC27D876-FE65-41BE-AB3C-75BB04107CF5}C:\\program files\\pando networks\\pando\\pando.exe"= RA4=LocalSubnet:LocalSubnet|C:\program files\pando networks\pando\pando.exe:pando
"{C1864D0A-AC91-42B3-9C26-A51747FE7AEC}"= UDP:C:\Windows\System32\lxczcoms.exe:Lexmark Communications System
"{4D274531-A2DE-46C5-90A5-895193C7F605}"= TCP:C:\Windows\System32\lxczcoms.exe:Lexmark Communications System
"{3B301C66-E314-4EFE-9766-0694CA43E7B3}"= UDP:C:\Windows\System32\spool\drivers\w32x86\3\lxczpswx.exe:Printer Status Window
"{6C2F00EC-C76B-4676-A5A5-EF6FA0EA36C5}"= TCP:C:\Windows\System32\spool\drivers\w32x86\3\lxczpswx.exe:Printer Status Window
"{AA164D05-F808-403A-853B-67498B02D518}"= UDP:56379:Pando P2P TCP Listening Port
"{37FD76D3-C1BD-41A6-8781-14A7ED57DC7C}"= TCP:56379:Pando P2P UDP Listening Port
"TCP Query User{070D4680-1559-4BA6-BD1A-B7FE595B6E97}C:\\users\\kader\\appdata\\local\\temp\\rar$ex10.891\\cryptload_1.0.4\\routerclient.exe"= UDP:C:\users\kader\appdata\local\temp\rar$ex10.891\cryptload_1.0.4\routerclient.exe:routerclient.exe
"UDP Query User{1B7C7309-9438-4071-86D4-79E46EFBA61B}C:\\users\\kader\\appdata\\local\\temp\\rar$ex10.891\\cryptload_1.0.4\\routerclient.exe"= TCP:C:\users\kader\appdata\local\temp\rar$ex10.891\cryptload_1.0.4\routerclient.exe:routerclient.exe
"TCP Query User{D7CD2555-38AB-491D-98CE-79C335B0FBAE}C:\\users\\kader\\appdata\\roaming\\jlc's software\\internet tv\\update.exe"= UDP:C:\users\kader\appdata\roaming\jlc's software\internet tv\update.exe:update.exe
"UDP Query User{74A2DBE5-37AF-4450-A502-25ABFDEFB7F8}C:\\users\\kader\\appdata\\roaming\\jlc's software\\internet tv\\update.exe"= TCP:C:\users\kader\appdata\roaming\jlc's software\internet tv\update.exe:update.exe
"{6CD601FF-965E-4725-B805-374C3C96E81F}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{F70F6EA4-BF3D-498D-956D-7636D7EE9079}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{990A4D0F-0DD9-4754-9BC2-694B0C1BAE01}"= UDP:C:\Program Files\iolo\System Mechanic Professional 7\Personal Firewall\ioloFW.exe:iolo Firewall®
"{76D4BD1B-0ADA-43D8-832C-55D606ED23A3}"= TCP:C:\Program Files\iolo\System Mechanic Professional 7\Personal Firewall\ioloFW.exe:iolo Firewall®
"{3C2D0285-5C65-4E9B-8249-4CA0161E1BEB}"= UDP:C:\Program Files\iolo\System Mechanic Professional 7\AntiVirus\ioloAV.exe:iolo AntiVirus®
"{51B23680-9173-4EF0-887C-0E4744291658}"= TCP:C:\Program Files\iolo\System Mechanic Professional 7\AntiVirus\ioloAV.exe:iolo AntiVirus®
"{88EBC447-BFD0-4381-90EE-C8755850F9CE}"= UDP:C:\Program Files\iolo\System Mechanic Professional 7\AntiVirus\iAVEmailScanner.exe:iolo AntiVirus® Email Protection
"{B2A4A7F3-2445-48B6-8E9E-CCF76DCBC76A}"= TCP:C:\Program Files\iolo\System Mechanic Professional 7\AntiVirus\iAVEmailScanner.exe:iolo AntiVirus® Email Protection
"{D5495441-4FFB-4039-B19D-33964DADA734}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{6560C9F9-91E1-4BBB-8A84-0312A7BC6730}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{2445382D-255C-4556-9A14-D8CE870F830A}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{69F96B65-514D-40DA-95BC-CF333F6C890C}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{94CDD280-C4E1-4DC4-B7D7-92814EEBBDC2}"= UDP:C:\Windows\System32\muzapp.exe:MUZ AOD APP player
"{370B59A9-FBAB-4AA1-B743-18718E1F0F09}"= TCP:C:\Windows\System32\muzapp.exe:MUZ AOD APP player
"TCP Query User{93BA8A02-7B89-44B2-9AC2-A52CB87E52A8}C:\\programdata\\kaspersky lab setup files\\kaspersky internet security 7.0.1.321\\french\\setup.exe"= UDP:C:\programdata\kaspersky lab setup files\kaspersky internet security 7.0.1.321\french\setup.exe:Programme d'installation de Kaspersky Internet Security 7.0
"UDP Query User{8C8B7786-0F78-45FC-A710-236BFE7E56EE}C:\\programdata\\kaspersky lab setup files\\kaspersky internet security 7.0.1.321\\french\\setup.exe"= TCP:C:\programdata\kaspersky lab setup files\kaspersky internet security 7.0.1.321\french\setup.exe:Programme d'installation de Kaspersky Internet Security 7.0
"TCP Query User{C9381EC4-7EE0-4ED0-9BAA-FFB0B86F9526}C:\\programdata\\kaspersky lab setup files\\kaspersky internet security 7.0.1.321\\french\\setup.exe"= UDP:C:\programdata\kaspersky lab setup files\kaspersky internet security 7.0.1.321\french\setup.exe:Programme d'installation de Kaspersky Internet Security 7.0
"UDP Query User{0DBC1280-F501-4603-BE12-9DC66AD061E2}C:\\programdata\\kaspersky lab setup files\\kaspersky internet security 7.0.1.321\\french\\setup.exe"= TCP:C:\programdata\kaspersky lab setup files\kaspersky internet security 7.0.1.321\french\setup.exe:Programme d'installation de Kaspersky Internet Security 7.0
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
"DisabledInterfaces"= {73EB23E6-C574-4700-A6C0-A629EEAAD4D2},{D2EA8F3D-BD76-4AB8-8F3B-BA5D44F1881A}
R3 athr;Atheros Extensible Wireless LAN device driver;C:\Windows\system32\DRIVERS\athr.sys [2007-03-01 03:04]
R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;C:\Windows\system32\DRIVERS\bdfndisf.sys [2008-01-25 15:40]
R3 RTSTOR;USB Mass Storage Device;C:\Windows\system32\drivers\RTSTOR.SYS [2008-01-03 21:35]
S1 ElRawDisk;ElRawDisk;C:\Windows\system32\drivers\elrawdsk.sys [2007-09-20 14:12]
S2 TOSHIBA Bluetooth Service;TOSHIBA Bluetooth Service;C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe []
S2 UxTuneUp;TuneUp Extension de thème;C:\Windows\System32\svchost.exe [2006-11-02 11:45]
S3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2007-03-06 17:04]
S3 StMp3Rec;Pilote de périphérique de la restauration de lecteur;C:\Windows\system32\Drivers\StMp3Rec.sys [2005-08-26 11:22]
S3 SynMini;USB2.0 1.3M Web Cam;C:\Windows\system32\Drivers\SynMini.sys [2006-04-19 02:04]
S3 SynScan;USB2.0 1.3M Web Cam Still Image;C:\Windows\system32\Drivers\SynScan.sys [2006-04-19 02:04]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\Windows\System32\TuneUpDefragService.exe [2008-03-23 16:54]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
bdx REG_MULTI_SZ scan
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
\shell\AutoRun\command - H:\Autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8d123ea9-a68b-11dc-8503-001d607deb18}]
\shell\AutoRun\command - H:\autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aee715a2-a2b1-11dc-80a0-001d607deb18}]
\shell\AutoRun\command - E:\InstallAll.exe
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-04-04 15:15:00 C:\Windows\Tasks\Maintenance en 1 clic.job"
- C:\Program Files\TuneUp Utilities 2008\OneClick.exe
"2008-04-04 13:27:02 C:\Windows\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
"2008-04-08 21:38:19 C:\Windows\Tasks\User_Feed_Synchronization-{21DC5361-7888-47BE-A484-1E957CB3BFF4}.job"
- C:\Windows\system32\msfeedssync.exe
"2008-04-09 14:20:00 C:\Windows\Tasks\User_Feed_Synchronization-{2F93FEA3-FDC8-4532-9AF0-BB059CD9DFB2}.job"
- C:\Windows\system32\msfeedssync.exe
.
**************************************************************************
catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-09 18:27:18
Windows 6.0.6000 NTFS
Balayage processus cachés ...
Balayage caché autostart entries ...
Balayage des fichiers cachés ...
Scan terminé avec succès
Les fichiers cachés: 0
**************************************************************************
.
Temps d'accomplissement: 2008-04-09 18:27:53
ComboFix-quarantined-files.txt 2008-04-09 16:27:48
Le texte du message associé au numéro 0x2379 est introuvable dans le fichier de messages pour Application.
Le texte du message associé au numéro 0x2379 est introuvable dans le fichier de messages pour Application.
.
2008-04-09 14:20:43 --- E O F ---
rapport de smitfraudfix :::::::: SmitFraudFix v2.310
Scan done at 18:30:41,86, 09/04/2008
Run from C:\Windows\System32\SmitfraudFix
OS: Microsoft Windows [version 6.0.6000] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode
»»»»»»»»»»»»»»»»»»»»»»»» Process
C:\Windows\system32\csrss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\Explorer.exe
C:\Windows\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\wbem\wmiprvse.exe
»»»»»»»»»»»»»»»»»»»»»»»» hosts
»»»»»»»»»»»»»»»»»»»»»»»» C:\
»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows
»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system
»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web
»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32
»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles
»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\kader
»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\kader\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Start Menu
»»»»»»»»»»»»»»»»»»»»»»»»
»»»»»»»»»»»»»»»»»»»»»»»» Desktop
»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys
»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!
VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\\PROGRA~1\\Google\\GOOGLE~3\\GOEC62~1.DLL"
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\Windows\\system32\\userinit.exe,"
"System"=""
»»»»»»»»»»»»»»»»»»»»»»»» Rustock
»»»»»»»»»»»»»»»»»»»»»»»» DNS
Description: Atheros AR5006EG Wireless Network Adapter
DNS Server Search Order: 192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{D2EA8F3D-BD76-4AB8-8F3B-BA5D44F1881A}: DhcpNameServer=192.168.1.1
»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection
»»»»»»»»»»»»»»»»»»»»»»»» End
voila tout merci
télécharger sur le bureau
Navilog.zip
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe
= Double-Clic navilog1.zip
= Extraire tout sur le bureau
= Double-Clic navilog1 qui est sur le bureau
= Appuyer sur une touche jusqu' arriver aux options
= Choisir option 1
un rapport : fixnavi.txt dans C : va se creer
le copier/coller dans ton prochain message.
Navilog.zip
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe
= Double-Clic navilog1.zip
= Extraire tout sur le bureau
= Double-Clic navilog1 qui est sur le bureau
= Appuyer sur une touche jusqu' arriver aux options
= Choisir option 1
un rapport : fixnavi.txt dans C : va se creer
le copier/coller dans ton prochain message.
rapport : fixnavi.txt :::::::::::::::: Search Navipromo version 3.5.2 commencé le 09/04/2008 à 19:25:09,38
!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!
Outil exécuté depuis C:\Program Files\navilog1
Session actuelle : "kader"
Mise à jour le 29.03.2008 à 22h00 par IL-MAFIOSO
Microsoft Windows Vista 6.0.6000
Internet Explorer : 7.0.6000.16609
Système de fichiers : NTFS
Executé en mode normal
*** Recherche Programmes installés ***
*** Recherche dossiers dans C:\Windows ***
*** Recherche dossiers dans C:\Program Files ***
*** Recherche dossiers dans C:\ProgramData ***
*** Recherche dossiers dans C:\ProgramData\Microsoft\Windows\Start Menu\Programs ***
*** Recherche dossiers dans ***
*** Recherche dossiers dans C:\Users\kader\AppData\Local\virtualstore\Program Files ***
*** Recherche dossiers dans C:\Users\kader\AppData\Roaming ***
*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net
Aucun Fichier trouvé
*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!
* Recherche dans C:\Windows\system32 *
* Recherche dans C:\Users\kader\AppData\Local\Microsoft *
* Recherche dans C:\Users\kader\AppData\Local\virtualstore\windows\system32 *
* Recherche dans C:\Users\kader\AppData\Local *
* Recherche dans "C:\Users\mirou\AppData\Local" *
*** Recherche fichiers ***
*** Recherche clés spécifiques dans le Registre ***
*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)
1)Recherche nouveaux fichiers Instant Access :
2)Recherche Heuristique :
* Dans C:\Windows\system32 :
* Dans C:\Users\kader\AppData\Local\Microsoft :
* Dans C:\Users\kader\AppData\Local\virtualstore\windows\system32 :
* Dans C:\Users\kader\AppData\Local :
ovnwzjq.dat trouvé !
ovnwzjq_nav.dat trouvé !
ovnwzjq_navps.dat trouvé !
* Dans "C:\Users\mirou\AppData\Local" :
3)Recherche Certificats :
Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltd absent !
4)Recherche fichiers connus :
*** Analyse terminée le 09/04/2008 à 19:35:02,33 ***
!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!
Outil exécuté depuis C:\Program Files\navilog1
Session actuelle : "kader"
Mise à jour le 29.03.2008 à 22h00 par IL-MAFIOSO
Microsoft Windows Vista 6.0.6000
Internet Explorer : 7.0.6000.16609
Système de fichiers : NTFS
Executé en mode normal
*** Recherche Programmes installés ***
*** Recherche dossiers dans C:\Windows ***
*** Recherche dossiers dans C:\Program Files ***
*** Recherche dossiers dans C:\ProgramData ***
*** Recherche dossiers dans C:\ProgramData\Microsoft\Windows\Start Menu\Programs ***
*** Recherche dossiers dans ***
*** Recherche dossiers dans C:\Users\kader\AppData\Local\virtualstore\Program Files ***
*** Recherche dossiers dans C:\Users\kader\AppData\Roaming ***
*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net
Aucun Fichier trouvé
*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!
* Recherche dans C:\Windows\system32 *
* Recherche dans C:\Users\kader\AppData\Local\Microsoft *
* Recherche dans C:\Users\kader\AppData\Local\virtualstore\windows\system32 *
* Recherche dans C:\Users\kader\AppData\Local *
* Recherche dans "C:\Users\mirou\AppData\Local" *
*** Recherche fichiers ***
*** Recherche clés spécifiques dans le Registre ***
*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)
1)Recherche nouveaux fichiers Instant Access :
2)Recherche Heuristique :
* Dans C:\Windows\system32 :
* Dans C:\Users\kader\AppData\Local\Microsoft :
* Dans C:\Users\kader\AppData\Local\virtualstore\windows\system32 :
* Dans C:\Users\kader\AppData\Local :
ovnwzjq.dat trouvé !
ovnwzjq_nav.dat trouvé !
ovnwzjq_navps.dat trouvé !
* Dans "C:\Users\mirou\AppData\Local" :
3)Recherche Certificats :
Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltd absent !
4)Recherche fichiers connus :
*** Analyse terminée le 09/04/2008 à 19:35:02,33 ***
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question