Rapport hijackthis
Bonjour,
j' ai un souci avec mon pc, il freeze souvent, j' ai donc fais une analyse hyjackthis, pouvez vous s' il vous plait me dire dire si je suis infecté ? merci d' avance
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:58:11, on 24/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\RALINK\Common\RaUI.exe
C:\Program Files\ArcSoft\TotalMedia 3\TMMonitor.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Stèf.STEF-F68C337AD2\Mes documents\Mes fichiers reçus\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe
O4 - Global Startup: TMMonitor.lnk = C:\Program Files\ArcSoft\TotalMedia 3\TMMonitor.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 5197 bytes
--
code mario kart wii : 3394-3607-6920
pseudo : robix
j' ai un souci avec mon pc, il freeze souvent, j' ai donc fais une analyse hyjackthis, pouvez vous s' il vous plait me dire dire si je suis infecté ? merci d' avance
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:58:11, on 24/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\RALINK\Common\RaUI.exe
C:\Program Files\ArcSoft\TotalMedia 3\TMMonitor.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Stèf.STEF-F68C337AD2\Mes documents\Mes fichiers reçus\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe
O4 - Global Startup: TMMonitor.lnk = C:\Program Files\ArcSoft\TotalMedia 3\TMMonitor.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 5197 bytes
--
code mario kart wii : 3394-3607-6920
pseudo : robix
Configuration: Windows XP Firefox 2.0.0.14
2 réponses
-
Contributeur sécuritéTélécharge Combofix de sUBs : Renomme le avant toute installation, par exemple, nomme le "KillBagle". aide ici : https://forum.pcastuces.com/sujet.asp?f=25&s=37315
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Sauvegarde le sur ton bureau et pas ailleurs !
Aide à l’utilisation de combofix ici: https://bibou0007.forumpro.fr/login?redirect=%2Ft121-topic
Double-clic sur combofix, Il va te poser une question, réponds par la touche 1 et entrée pour valider, laisse toi guider.
Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.
_____________________
colle le rapport d'un scan en ligne
avec un des suivants: (désactiver avast le temps du scan)
bitdefender en ligne :
http://www.bitdefender.fr/scan_fr/scan8/ie.html
Panda en ligne :
http://pandasoftware.fr-
ComboFix 08-04-24.1 - Stèf 2008-04-25 17:58:07.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1441 [GMT 2:00]
Endroit: C:\Documents and Settings\Stèf.STEF-F68C337AD2\Bureau\KillBagle.exe
* Création d'un nouveau point de restauration
[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.
((((((((((((((((((((((((((((( Fichiers créés 2008-03-25 to 2008-04-25 ))))))))))))))))))))))))))))))))))))
.
2008-04-25 17:58 . 2008-04-25 17:58 1,024 --ah----- C:\Documents and Settings\Default User.WINDOWS\ntuser.dat.LOG
2008-04-24 18:42 . 2008-04-24 18:42 <REP> d--hs---- C:\found.000
2008-04-22 06:18 . 2008-03-01 14:58 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-04-22 06:18 . 2007-07-01 05:31 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-04-22 06:18 . 2007-07-01 05:36 1,048,576 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-04-22 06:18 . 2008-03-01 14:58 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-04-22 06:18 . 2008-03-01 14:58 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-04-22 06:18 . 2008-03-01 14:58 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-04-22 06:18 . 2008-03-01 14:58 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
2008-04-22 06:18 . 2008-03-01 14:58 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-04-22 06:18 . 2008-02-22 12:00 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-04-19 19:31 . 2008-04-19 19:31 <REP> d-------- C:\Documents and Settings\Stèf.STEF-F68C337AD2\Application Data\Nero
2008-04-19 19:30 . 2008-04-19 19:30 <REP> d-------- C:\Program Files\Nero
2008-04-19 19:30 . 2008-04-19 19:30 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Nero
2008-04-19 19:30 . 2006-03-17 11:45 1,757,184 --a------ C:\WINDOWS\system32\imagX7.dll
2008-04-19 19:30 . 2006-03-17 11:45 802,816 --a------ C:\WINDOWS\system32\imagXRA7.dll
2008-04-19 19:30 . 2006-03-17 11:45 497,296 --a------ C:\WINDOWS\system32\imagXpr7.dll
2008-04-19 19:30 . 2006-03-17 14:49 368,640 --a------ C:\WINDOWS\system32\TwnLib4.dll
2008-04-19 19:30 . 2006-03-17 11:45 258,048 --a------ C:\WINDOWS\system32\imagXR7.dll
2008-04-19 18:13 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-04-19 18:13 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2008-04-19 18:13 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-04-19 17:36 . 2008-04-19 17:36 <REP> d-------- C:\Program Files\Lavasoft
2008-04-19 17:36 . 2008-04-19 17:36 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-04-19 17:36 . 2008-04-19 17:36 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft
2008-04-19 16:43 . 2008-04-19 16:43 1,160 --a------ C:\WINDOWS\mozver.dat
2008-04-19 16:21 . 2008-04-19 16:24 <REP> d-------- C:\Documents and Settings\Stèf.STEF-F68C337AD2\Contacts
2008-04-19 16:21 . 2008-04-19 16:24 <REP> d-------- C:\Documents and Settings\Stèf.STEF-F68C337AD2\Contacts
2008-04-19 16:00 . 2008-04-19 16:00 268 --ah----- C:\sqmdata02.sqm
2008-04-19 16:00 . 2008-04-19 16:00 244 --ah----- C:\sqmnoopt02.sqm
2008-04-19 15:59 . 2008-04-19 15:59 <REP> d-------- C:\Program Files\Alwil Software
2008-04-19 15:52 . 2008-04-19 15:52 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Messenger Plus!
2008-04-19 15:51 . 2008-04-19 15:51 268 --ah----- C:\sqmdata01.sqm
2008-04-19 15:51 . 2008-04-19 15:51 244 --ah----- C:\sqmnoopt01.sqm
2008-04-19 15:48 . 2008-04-19 15:48 <REP> d-------- C:\Program Files\Messenger Plus! Live
2008-04-19 15:48 . 2008-04-19 15:48 268 --ah----- C:\sqmdata00.sqm
2008-04-19 15:48 . 2008-04-19 15:48 244 --ah----- C:\sqmnoopt00.sqm
2008-04-19 15:40 . 2008-04-19 15:47 <REP> d-------- C:\Program Files\Windows Live
2008-04-19 15:40 . 2008-04-19 15:40 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\WLInstaller
2008-04-19 15:38 . 2008-04-19 15:38 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-04-19 15:38 . 2008-04-19 15:40 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2008-04-19 15:36 . 2008-04-19 15:36 <REP> d-------- C:\Program Files\CCleaner
2008-04-19 15:29 . 2008-04-19 17:59 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft Help
2008-04-19 15:09 . 2008-04-19 15:09 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav
2008-04-19 15:09 . 2008-04-19 15:09 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav
2008-04-19 14:14 . 2001-08-17 23:59 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2008-04-19 14:13 . 2004-08-04 02:39 58,496 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2008-04-19 14:13 . 2004-08-04 02:54 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2008-04-19 14:12 . 2004-08-04 02:54 77,312 --a------ C:\WINDOWS\system32\usbui.dll
2008-04-19 14:10 . 2008-04-19 14:10 <REP> d--h----- C:\Documents and Settings\Default User.WINDOWS\Voisinage réseau
2008-04-19 14:10 . 2008-04-19 14:10 <REP> d--h----- C:\Documents and Settings\Default User.WINDOWS\Voisinage d'impression
2008-04-19 14:10 . 2008-04-19 12:16 <REP> d--h----- C:\Documents and Settings\Default User.WINDOWS\Modèles
2008-04-19 14:10 . 2008-04-19 14:10 <REP> d-------- C:\Documents and Settings\Default User.WINDOWS\Mes documents
2008-04-19 14:10 . 2008-04-19 14:10 <REP> dr------- C:\Documents and Settings\Default User.WINDOWS\Menu Démarrer
2008-04-19 14:10 . 2008-04-19 14:10 <REP> d-------- C:\Documents and Settings\Default User.WINDOWS\Favoris
2008-04-19 14:10 . 2008-04-19 14:10 <REP> d-------- C:\Documents and Settings\Default User.WINDOWS\Bureau
2008-04-19 14:10 . 2008-04-25 17:58 <REP> d--h----- C:\Documents and Settings\Default User.WINDOWS
2008-04-19 14:10 . 2008-04-19 14:10 <REP> d--h----- C:\Documents and Settings\All Users.WINDOWS\Modèles
2008-04-19 14:10 . 2008-04-19 12:21 <REP> dr------- C:\Documents and Settings\All Users.WINDOWS\Menu Démarrer
2008-04-19 14:10 . 2008-04-19 14:10 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Favoris
2008-04-19 14:10 . 2008-04-19 12:17 <REP> dr------- C:\Documents and Settings\All Users.WINDOWS\Documents
2008-04-19 14:10 . 2008-04-19 19:30 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Bureau
2008-04-19 14:09 . 2008-04-19 12:21 261 --a------ C:\WINDOWS\system32\$winnt$.inf
2008-04-19 14:00 . 2008-04-19 14:00 <REP> d-------- C:\Documents and Settings\Stèf.STEF-F68C337AD2\Application Data\ArcSoft
2008-04-19 14:00 . 2003-03-18 22:14 499,712 -ra------ C:\WINDOWS\system32\msvcp71.dll
2008-04-19 14:00 . 2003-02-21 04:42 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll
2008-04-19 14:00 . 2005-04-27 16:36 245,408 --a------ C:\WINDOWS\system32\unicows.dll
2008-04-19 14:00 . 1995-08-01 04:44 212,480 --a------ C:\WINDOWS\PCDLIB32.DLL
2008-04-19 14:00 . 2006-11-10 15:05 18,688 --a------ C:\WINDOWS\system32\drivers\afc.sys
2008-04-19 13:56 . 2008-04-19 13:55 28,672 --a------ C:\WINDOWS\system32\AF15BDAEX.dll
2008-04-19 13:56 . 2006-09-28 15:03 245 --a------ C:\WINDOWS\system32\AF15IRTBL.bin
2008-04-19 13:20 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
2008-04-19 13:19 . 2008-04-19 13:19 <REP> d-------- C:\Program Files\SLD Codec Pack
2008-04-19 13:14 . 2008-04-19 13:14 0 --a------ C:\WINDOWS\nsreg.dat
2008-04-19 13:13 . 2008-04-19 13:13 <REP> d--hs---- C:\Documents and Settings\Stèf.STEF-F68C337AD2\UserData
2008-04-19 13:13 . 2008-04-19 13:13 <REP> d--hs---- C:\Documents and Settings\Stèf.STEF-F68C337AD2\UserData
2008-04-19 13:07 . 2005-05-17 15:24 311,296 --a------ C:\WINDOWS\system32\AegisI5.exe
2008-04-19 13:07 . 2006-01-18 09:08 290,918 --a------ C:\WINDOWS\system32\Install7x.dll
2008-04-19 13:07 . 2006-01-12 19:46 252,928 --a------ C:\WINDOWS\system32\drivers\rt73.sys
2008-04-19 13:07 . 2005-10-17 19:50 245,376 --a------ C:\WINDOWS\system32\drivers\rt2500usb.SYS
2008-04-19 13:07 . 2008-04-19 13:07 20,747 --a------ C:\WINDOWS\system32\drivers\AegisP.sys
2008-04-19 13:07 . 2005-11-30 11:33 2,048 --a------ C:\WINDOWS\system32\drivers\rt73.bin
2008-04-19 13:07 . 2005-08-19 15:51 138 --a------ C:\WINDOWS\filespec7x
2008-04-19 12:34 . 2006-09-25 17:58 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-04-19 12:28 . 2006-10-31 08:35 208,896 --a------ C:\WINDOWS\system32\nvudisp.exe
2008-04-19 12:28 . 2008-04-25 17:22 81,496 --a------ C:\WINDOWS\system32\nvapps.xml
2008-04-19 12:28 . 2006-10-31 08:35 17,056 --a------ C:\WINDOWS\system32\nvdisp.nvu
2008-04-19 12:26 . 2008-04-19 12:26 <REP> d-------- C:\Documents and Settings\Stèf.STEF-F68C337AD2\Application Data\InstallShield
2008-04-19 12:26 . 2008-04-19 12:26 <REP> d-------- C:\Documents and Settings\STF~1~STE\LOCALS~1
2008-04-19 12:26 . 2008-04-19 12:26 <REP> d-------- C:\Documents and Settings\STF~1~STE
2008-04-19 12:26 . 2006-11-07 14:58 356,352 --a------ C:\WINDOWS\system32\nvunrm.exe
2008-04-19 12:26 . 2006-12-18 16:33 356,352 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2008-04-19 12:26 . 2006-10-05 16:35 356,352 --------- C:\WINDOWS\system32\nvuide.exe
2008-04-19 12:26 . 2006-10-19 09:36 3,903 --a------ C:\WINDOWS\system32\nvnrm.nvu
2008-04-19 12:26 . 2006-10-24 13:13 1,732 --a------ C:\WINDOWS\system32\drivers\nvphy.bin
2008-04-19 12:26 . 2006-09-11 15:14 1,570 --------- C:\WINDOWS\system32\nvide.nvu
2008-04-19 12:25 . 2008-04-19 14:05 14,656 --a------ C:\WINDOWS\gdrv.sys
2008-04-19 12:23 . 2008-04-19 14:10 <REP> d--h----- C:\Documents and Settings\Stèf.STEF-F68C337AD2\Voisinage réseau
2008-04-19 12:23 . 2008-04-19 14:10 <REP> d--h----- C:\Documents and Settings\Stèf.STEF-F68C337AD2\Voisinage réseau
2008-04-19 12:23 . 2008-04-19 14:10 <REP> d--h----- C:\Documents and Settings\Stèf.STEF-F68C337AD2\Voisinage d'impression
2008-04-19 12:23 . 2008-04-19 14:10 <REP> d--h----- C:\Documents and Settings\Stèf.STEF-F68C337AD2\Voisinage d'impression
2008-04-19 12:23 . 2008-04-19 12:16 <REP> d--h----- C:\Documents and Settings\Stèf.STEF-F68C337AD2\Modèles
2008-04-19 12:23 . 2008-04-19 12:16 <REP> d--h----- C:\Documents and Settings\Stèf.STEF-F68C337AD2\Modèles
2008-04-19 12:23 . 2008-04-22 06:37 <REP> dr------- C:\Documents and Settings\Stèf.STEF-F68C337AD2\Mes documents
2008-04-19 12:23 . 2008-04-22 06:37 <REP> dr------- C:\Documents and Settings\Stèf.STEF-F68C337AD2\Mes documents
2008-04-19 12:23 . 2008-04-19 14:10 <REP> dr------- C:\Documents and Settings\Stèf.STEF-F68C337AD2\Menu Démarrer
2008-04-19 12:23 . 2008-04-19 14:10 <REP> dr------- C:\Documents and Settings\Stèf.STEF-F68C337AD2\Menu Démarrer
2008-04-19 12:23 . 2008-04-22 06:37 <REP> dr------- C:\Documents and Settings\Stèf.STEF-F68C337AD2\Favoris
2008-04-19 12:23 . 2008-04-22 06:37 <REP> dr------- C:\Documents and Settings\Stèf.STEF-F68C337AD2\Favoris
2008-04-19 12:23 . 2008-04-25 17:55 <REP> d-------- C:\Documents and Settings\Stèf.STEF-F68C337AD2\Bureau
2008-04-19 12:23 . 2008-04-25 17:55 <REP> d-------- C:\Documents and Settings\Stèf.STEF-F68C337AD2\Bureau
2008-04-19 12:23 . 2008-04-25 12:36 <REP> d-------- C:\Documents and Settings\Stèf.STEF-F68C337AD2
2008-04-19 12:23 . 2008-04-25 17:58 434,176 --ah----- C:\Documents and Settings\Stèf.STEF-F68C337AD2\ntuser.dat.LOG
2008-04-19 12:23 . 2008-04-25 17:58 434,176 --ah----- C:\Documents and Settings\Stèf.STEF-F68C337AD2\ntuser.dat.LOG
2008-04-19 12:22 . 2008-04-19 12:22 <REP> d--hs---- C:\Documents and Settings\NetworkService.AUTORITE NT
2008-04-19 12:22 . 2008-04-19 12:22 <REP> d--hs---- C:\Documents and Settings\LocalService.AUTORITE NT
2008-04-19 12:22 . 2008-04-19 12:22 8,192 --a------ C:\WINDOWS\REGLOCS.OLD
2008-04-19 12:22 . 2008-04-25 17:23 1,024 --ah----- C:\Documents and Settings\NetworkService.AUTORITE NT\ntuser.dat.LOG
2008-04-19 12:22 . 2008-04-25 17:23 1,024 --ah----- C:\Documents and Settings\LocalService.AUTORITE NT\ntuser.dat.LOG
2008-04-19 12:20 . 2001-08-28 14:00 13,463,552 --a--c--- C:\WINDOWS\system32\dllcache\hwxjpn.dll
2008-04-19 12:19 . 2004-05-13 00:39 876,653 --a--c--- C:\WINDOWS\system32\dllcache\fp4awel.dll
2008-04-19 12:18 . 2008-04-24 14:44 <REP> d--hs---- C:\Documents and Settings\All Users.WINDOWS\DRM
2008-04-19 12:18 . 2001-08-28 14:00 4,399,505 --a--c--- C:\WINDOWS\system32\dllcache\nls302en.lex
2008-04-19 12:17 . 2004-08-04 00:54 3,166,208 --a--c--- C:\WINDOWS\system32\dllcache\msgr3en.dll
2008-04-19 12:16 . 2004-08-04 00:54 1,352,704 --a--c--- C:\WINDOWS\system32\dllcache\cimwin32.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-19 11:55 283,776 ----a-w C:\WINDOWS\system32\drivers\AF15BDA.sys
2008-04-19 10:29 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-04-08 10:25 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-04-08 08:43 --------- d-----w C:\Program Files\microsoft frontpage
2008-04-08 08:41 --------- d-----w C:\Program Files\Services en ligne
2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-01 12:58 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:35 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:54 15360]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-31 08:35 7634944]
"nwiz"="nwiz.exe" [2006-10-31 08:35 1622016 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-31 08:35 86016]
"RTHDCPL"="RTHDCPL.EXE" [2007-01-30 12:54 16116224 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 12:04 2879488 C:\WINDOWS\SkyTel.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 19:37 79224]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:54 15360]
C:\Documents and Settings\All Users.WINDOWS\Menu D‚marrer\Programmes\D‚marrage\
Ralink Wireless Utility.lnk - C:\Program Files\RALINK\Common\RaUI.exe [2008-04-08 11:17:24 589824]
TMMonitor.lnk - C:\Program Files\ArcSoft\TotalMedia 3\TMMonitor.exe [2008-04-17 19:55:58 258048]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
R3 AF15BDA;AF9015 BDA Filter;C:\WINDOWS\system32\Drivers\AF15BDA.sys [2008-04-19 13:55]
S3 gdrv;gdrv;C:\WINDOWS\gdrv.sys [2008-04-19 14:05]
*Newly Created Service* - CATCHME
.
**************************************************************************
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-25 17:58:48
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cachés ...
Balayage caché autostart entries ...
Balayage des fichiers cachés ...
Scan terminé avec succès
Les fichiers cachés: 1
**************************************************************************
.
Temps d'accomplissement: 2008-04-25 17:59:22
ComboFix-quarantined-files.txt 2008-04-25 15:59:17
Pre-Run: 10,943,000,576 octets libres
Post-Run: 10,950,234,112 octets libres
195 --- E O F --- 2008-04-22 18:46:51
-
-
Contributeur sécuritéok
colle un scan en ligne pour voir
