Virus (bagle)
Résolu/Fermé
kwon
Messages postés
75
Date d'inscription
dimanche 15 juillet 2007
Statut
Membre
Dernière intervention
18 mai 2009
-
22 mai 2008 à 19:50
g!rly Messages postés 18209 Date d'inscription vendredi 17 août 2007 Statut Contributeur Dernière intervention 30 novembre 2014 - 13 déc. 2008 à 18:29
g!rly Messages postés 18209 Date d'inscription vendredi 17 août 2007 Statut Contributeur Dernière intervention 30 novembre 2014 - 13 déc. 2008 à 18:29
A voir également:
- Virus (bagle)
- Youtu.be virus - Accueil - Guide virus
- Svchost.exe virus - Guide
- Faux message virus ordinateur - Accueil - Arnaque
- Faux message virus iphone ✓ - Forum iPhone
- Je viens de recevoir une alerte aux virus sur mon iphone - Forum iPhone
76 réponses
kwon
Messages postés
75
Date d'inscription
dimanche 15 juillet 2007
Statut
Membre
Dernière intervention
18 mai 2009
1
25 mai 2008 à 23:23
25 mai 2008 à 23:23
j'ai fait la première video de Hijackthis, et voilà le rapport:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:18:46, on 25.05.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe
C:\Program Files\NTR global\NTRconnect\ntrconnect.exe
C:\Program Files\ZyXEL\Odyssey Client for ZyXEL\odClientService.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\ICO.EXE
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\ZyXEL\Odyssey Client for ZyXEL\OdTray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\System32\svchost.exe
C:\ESM2\Stms.exe
C:\ESM2\EBRR.EXE
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Sony Ericsson\Mobile\audevicemgr.exe
C:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\CONNMN~1.EXE
c:\PROGRA~1\INTUWA~1\Shared\MROUTE~1\mRouterRuntime.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.fr.msn.ch/0SEFRCH/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.fr.msn.ch/0SEFRCH/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.fr.msn.ch/0SEFRCH/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: Best Security Tips Toolbar - {da30eff8-ccc6-4162-a20d-67402a26a215} - C:\Program Files\Best_Security_Tips\tbBest.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4C907918-2338-4FC3-A890-4D7A72E1B00C} - C:\WINDOWS\system32\audiodfv.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Best Security Tips Toolbar - {da30eff8-ccc6-4162-a20d-67402a26a215} - C:\Program Files\Best_Security_Tips\tbBest.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Best Security Tips Toolbar - {da30eff8-ccc6-4162-a20d-67402a26a215} - C:\Program Files\Best_Security_Tips\tbBest.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SonyPowerCfg] C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
O4 - HKLM\..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe
O4 - HKLM\..\Run: [VAIO Update 2] "C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" /Stationary
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [OdTray.exe] "C:\Program Files\ZyXEL\Odyssey Client for ZyXEL\OdTray.exe"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl04b\BrStDvPt.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [Spn2006] C:\Program Files\Spn\emp.exe stw
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\RunOnce: [SymLnch] "C:\Documents and Settings\TANVIR_2\Application Data\Symantec\Layouts\Norton Internet Security\15.0\SymAllLanguages\NIS_RETAIL\20070828\Support\SymLnch\SymLnch.exe" "C:\Documents and Settings\TANVIR_2\Application Data\Symantec\Layouts\Norton Internet Security\15.0\SymAllLanguages\NIS_RETAIL\20070828\Setup.exe" "/UPREBOOT /temp /patched"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Wipe Expert] "C:\Program Files\Bodrag\Wipe Expert\WipeExpert.exe" /start
O4 - HKCU\..\Run: [EPSON Stylus DX4000 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "C:\WINDOWS\TEMP\E_S8D1.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - .DEFAULT User Startup: VAIO Launcher.lnk = C:\Program Files\Sony\VAIO Launcher\Launcher.exe (User 'Default user')
O4 - Startup: VAIO Launcher.lnk = C:\Program Files\Sony\VAIO Launcher\Launcher.exe
O4 - Global Startup: EPSON Background Monitor.lnk = C:\ESM2\Stms.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Phone Connection Monitor.lnk = ?
O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.club-vaio.com/fr/
O15 - Trusted Zone: *.sony-europe.com
O15 - Trusted Zone: *.sonystyle-europe.com
O15 - Trusted Zone: *.vaio-link.com
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - http://javadl-esd.sun.com/update/1.4.2/jinstall-1_4-windows-i586.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E6ACF817-0A85-4EBE-9F0A-096C6488CFEA} (NTR ActiveX 1.1.8) - https://www.ntrconnect.com/main/mod/setup/ntractivex118_24.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (file missing)
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NTRconnect (ntrconnect) - Net Transmit & Receive - C:\Program Files\NTR global\NTRconnect\ntrconnect.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Odyssey Client for ZyXEL (odClientService) - Funk Software, Inc. - C:\Program Files\ZyXEL\Odyssey Client for ZyXEL\odClientService.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: VAIO Entertainment Aggregation and Control Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
O23 - Service: VAIO Entertainment Task Scheduler - Sony Corporation - C:\Program Files\Sony\VAIO Entertainment\VzTaskScheduler.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
O23 - Service: VAIO Cooporated Initialisation (VCI) - Sony Corporation - C:\Program Files\Sony\VAIO Cooperated Initialisation\VCI_SVC.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:18:46, on 25.05.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe
C:\Program Files\NTR global\NTRconnect\ntrconnect.exe
C:\Program Files\ZyXEL\Odyssey Client for ZyXEL\odClientService.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\ICO.EXE
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\ZyXEL\Odyssey Client for ZyXEL\OdTray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\System32\svchost.exe
C:\ESM2\Stms.exe
C:\ESM2\EBRR.EXE
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Sony Ericsson\Mobile\audevicemgr.exe
C:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\CONNMN~1.EXE
c:\PROGRA~1\INTUWA~1\Shared\MROUTE~1\mRouterRuntime.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.fr.msn.ch/0SEFRCH/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.fr.msn.ch/0SEFRCH/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.fr.msn.ch/0SEFRCH/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: Best Security Tips Toolbar - {da30eff8-ccc6-4162-a20d-67402a26a215} - C:\Program Files\Best_Security_Tips\tbBest.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4C907918-2338-4FC3-A890-4D7A72E1B00C} - C:\WINDOWS\system32\audiodfv.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Best Security Tips Toolbar - {da30eff8-ccc6-4162-a20d-67402a26a215} - C:\Program Files\Best_Security_Tips\tbBest.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Best Security Tips Toolbar - {da30eff8-ccc6-4162-a20d-67402a26a215} - C:\Program Files\Best_Security_Tips\tbBest.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SonyPowerCfg] C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
O4 - HKLM\..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe
O4 - HKLM\..\Run: [VAIO Update 2] "C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" /Stationary
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [OdTray.exe] "C:\Program Files\ZyXEL\Odyssey Client for ZyXEL\OdTray.exe"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl04b\BrStDvPt.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [Spn2006] C:\Program Files\Spn\emp.exe stw
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\RunOnce: [SymLnch] "C:\Documents and Settings\TANVIR_2\Application Data\Symantec\Layouts\Norton Internet Security\15.0\SymAllLanguages\NIS_RETAIL\20070828\Support\SymLnch\SymLnch.exe" "C:\Documents and Settings\TANVIR_2\Application Data\Symantec\Layouts\Norton Internet Security\15.0\SymAllLanguages\NIS_RETAIL\20070828\Setup.exe" "/UPREBOOT /temp /patched"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Wipe Expert] "C:\Program Files\Bodrag\Wipe Expert\WipeExpert.exe" /start
O4 - HKCU\..\Run: [EPSON Stylus DX4000 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "C:\WINDOWS\TEMP\E_S8D1.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - .DEFAULT User Startup: VAIO Launcher.lnk = C:\Program Files\Sony\VAIO Launcher\Launcher.exe (User 'Default user')
O4 - Startup: VAIO Launcher.lnk = C:\Program Files\Sony\VAIO Launcher\Launcher.exe
O4 - Global Startup: EPSON Background Monitor.lnk = C:\ESM2\Stms.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Phone Connection Monitor.lnk = ?
O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.club-vaio.com/fr/
O15 - Trusted Zone: *.sony-europe.com
O15 - Trusted Zone: *.sonystyle-europe.com
O15 - Trusted Zone: *.vaio-link.com
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - http://javadl-esd.sun.com/update/1.4.2/jinstall-1_4-windows-i586.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E6ACF817-0A85-4EBE-9F0A-096C6488CFEA} (NTR ActiveX 1.1.8) - https://www.ntrconnect.com/main/mod/setup/ntractivex118_24.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (file missing)
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NTRconnect (ntrconnect) - Net Transmit & Receive - C:\Program Files\NTR global\NTRconnect\ntrconnect.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Odyssey Client for ZyXEL (odClientService) - Funk Software, Inc. - C:\Program Files\ZyXEL\Odyssey Client for ZyXEL\odClientService.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: VAIO Entertainment Aggregation and Control Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
O23 - Service: VAIO Entertainment Task Scheduler - Sony Corporation - C:\Program Files\Sony\VAIO Entertainment\VzTaskScheduler.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
O23 - Service: VAIO Cooporated Initialisation (VCI) - Sony Corporation - C:\Program Files\Sony\VAIO Cooperated Initialisation\VCI_SVC.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
g!rly
Messages postés
18209
Date d'inscription
vendredi 17 août 2007
Statut
Contributeur
Dernière intervention
30 novembre 2014
406
25 mai 2008 à 23:25
25 mai 2008 à 23:25
ok
c´est quoi ces deux programmes :
C:\Program Files\Spn
C:\Program Files\Bodrag
A propos de Boonty games
Utilises tu des jeux de boonty games depuis longtemps ?
Voici une petite information sur Boonty games
Leur politique :
"Il se peut que nous partageons aussi des informations payantes avec des tiers
qui fournissent des services payants et partage des données regroupées montrant le type
et le nombre de jeux vidéos que vous téléchargez, votre age, votre sexe, vos occupations,
niveau d'éducation, localité géographique, données sur l'équipement de votre ordinateur,
internet et intérêts pour les jeux vidéos, activités et entraînement des jeux édités.
De plus, nous partageons les adresses email avec des tiers fournisseurs de compte mails
qui nous assistent en envoyant nos mails a de nombreux clients en même temps..."
Si tu es d'accord avec eux, pas de problèmes sinon...
@+
c´est quoi ces deux programmes :
C:\Program Files\Spn
C:\Program Files\Bodrag
A propos de Boonty games
Utilises tu des jeux de boonty games depuis longtemps ?
Voici une petite information sur Boonty games
Leur politique :
"Il se peut que nous partageons aussi des informations payantes avec des tiers
qui fournissent des services payants et partage des données regroupées montrant le type
et le nombre de jeux vidéos que vous téléchargez, votre age, votre sexe, vos occupations,
niveau d'éducation, localité géographique, données sur l'équipement de votre ordinateur,
internet et intérêts pour les jeux vidéos, activités et entraînement des jeux édités.
De plus, nous partageons les adresses email avec des tiers fournisseurs de compte mails
qui nous assistent en envoyant nos mails a de nombreux clients en même temps..."
Si tu es d'accord avec eux, pas de problèmes sinon...
@+
kwon
Messages postés
75
Date d'inscription
dimanche 15 juillet 2007
Statut
Membre
Dernière intervention
18 mai 2009
1
25 mai 2008 à 23:56
25 mai 2008 à 23:56
A propos de C:\Program Files\Spn
C:\Program Files\Bodrag je n'en ai aucune idée de ce que c'est, ces dossier sont vides.
Et à propos de Boonty games le dossier est vide , a part celui de C:\Program Files\Boonty où il y a des jeux que j'avais téléchargé ,mai que je n'avais pas installé car c'etait payant. Mais pour leur politique ,est-ce sa signifie qu'ils observe mes mails?
Et est-ce que Bagle est bien et bel parti? Si oui, quel conseil pourai-tu me donner pour éviter de rerecevoir ce genre de virus?
C:\Program Files\Bodrag je n'en ai aucune idée de ce que c'est, ces dossier sont vides.
Et à propos de Boonty games le dossier est vide , a part celui de C:\Program Files\Boonty où il y a des jeux que j'avais téléchargé ,mai que je n'avais pas installé car c'etait payant. Mais pour leur politique ,est-ce sa signifie qu'ils observe mes mails?
Et est-ce que Bagle est bien et bel parti? Si oui, quel conseil pourai-tu me donner pour éviter de rerecevoir ce genre de virus?
g!rly
Messages postés
18209
Date d'inscription
vendredi 17 août 2007
Statut
Contributeur
Dernière intervention
30 novembre 2014
406
25 mai 2008 à 23:59
25 mai 2008 à 23:59
ok
on supprimera tous ca demain; je vais me coucher...
non il n´observe pas tes mails ;)
bonne nuit
je repasse demain en fin de journée
@+
on supprimera tous ca demain; je vais me coucher...
non il n´observe pas tes mails ;)
bonne nuit
je repasse demain en fin de journée
@+
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
kwon
Messages postés
75
Date d'inscription
dimanche 15 juillet 2007
Statut
Membre
Dernière intervention
18 mai 2009
1
26 mai 2008 à 00:05
26 mai 2008 à 00:05
Ok merci , Salut.
g!rly
Messages postés
18209
Date d'inscription
vendredi 17 août 2007
Statut
Contributeur
Dernière intervention
30 novembre 2014
406
26 mai 2008 à 19:19
26 mai 2008 à 19:19
salut know,
j´insiste avec mon combofix ;-)
Télécharge combofix.exe (par sUBs) sur ton Bureau.
-> http://download.bleepingcomputer.com/sUBs/ComboFix.exe
-> Double clique combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.
NOTE : Le rapport se trouve également ici : C:\Combofix.txt
Avant d'utiliser ComboFix :
-> Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.
-> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil.
Une fois fait, sur ton bureau double-clic sur Combofix.exe.
- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.
/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.
- En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.
- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)
-> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.
-> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.
-> Tutoriel https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
Post egalement un nouveau rapport hijack this stp
@+
j´insiste avec mon combofix ;-)
Télécharge combofix.exe (par sUBs) sur ton Bureau.
-> http://download.bleepingcomputer.com/sUBs/ComboFix.exe
-> Double clique combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.
NOTE : Le rapport se trouve également ici : C:\Combofix.txt
Avant d'utiliser ComboFix :
-> Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.
-> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil.
Une fois fait, sur ton bureau double-clic sur Combofix.exe.
- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.
/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.
- En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.
- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)
-> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.
-> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.
-> Tutoriel https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
Post egalement un nouveau rapport hijack this stp
@+
kwon
Messages postés
75
Date d'inscription
dimanche 15 juillet 2007
Statut
Membre
Dernière intervention
18 mai 2009
1
26 mai 2008 à 20:39
26 mai 2008 à 20:39
Salut, voilà :
ComboFix 08-05-25.5 - TANVIR_2 2008-05-26 19:47:06.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.33.1036.18.123 [GMT 2:00]
Endroit: C:\Documents and Settings\TANVIR_2\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\TANVIR_2\Bureau\WinXP_FR_PER_BF.EXE
* Création d'un nouveau point de restauration
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Tanvir\Application Data\HbTools
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1170435599.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1171016978.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1171210711.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1171536754.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1171994967.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1172271532.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1172695385.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1173352608.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1173720367.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1173887881.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1174231297.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1174474070.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1174672158.log
C:\Documents and Settings\Tanvir\Application Data\HbTools_Icons
C:\Documents and Settings\Tanvir\Application Data\HbTools_Icons\games2.ico
C:\Documents and Settings\Tanvir\Application Data\HbTools_Icons\Jamster2.ico
C:\Documents and Settings\Tanvir\Application Data\HbTools_Icons\wallpapere1.ico
C:\Documents and Settings\TANVIR_2\Application Data\macromedia\Flash Player\#SharedObjects\4HJE3BFM\iforex.com
C:\Documents and Settings\TANVIR_2\Application Data\macromedia\Flash Player\#SharedObjects\4HJE3BFM\iforex.com\Emerp\Events\flash_object.swf\user_data.sol
C:\Documents and Settings\TANVIR_2\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com
C:\Documents and Settings\TANVIR_2\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com\settings.sol
C:\WINDOWS\pack.epk
C:\WINDOWS\system32\bpcjwdqdky.dat
C:\WINDOWS\system32\bpcjwdqdky_nav.dat
C:\WINDOWS\system32\bpcjwdqdky_navps.dat
C:\WINDOWS\system32\drivers\downld
C:\WINDOWS\system32\drivers\downld\1251843.exe
C:\WINDOWS\system32\drivers\downld\1265546.exe
C:\WINDOWS\system32\drivers\downld\1267000.exe
C:\WINDOWS\system32\drivers\downld\1270437.exe
C:\WINDOWS\system32\drivers\downld\1286484.exe
C:\WINDOWS\system32\drivers\downld\1388671.exe
C:\WINDOWS\system32\drivers\downld\1396765.exe
C:\WINDOWS\system32\drivers\downld\14736250.exe
C:\WINDOWS\system32\drivers\downld\14785203.exe
C:\WINDOWS\system32\drivers\downld\14801406.exe
C:\WINDOWS\system32\drivers\downld\14952921.exe
C:\WINDOWS\system32\drivers\downld\14964515.exe
C:\WINDOWS\system32\drivers\downld\14971796.exe
C:\WINDOWS\system32\drivers\downld\15095078.exe
C:\WINDOWS\system32\drivers\downld\15160343.exe
C:\WINDOWS\system32\drivers\downld\15250000.exe
C:\WINDOWS\system32\drivers\downld\15262531.exe
C:\WINDOWS\system32\drivers\downld\15268421.exe
C:\WINDOWS\system32\drivers\downld\15689843.exe
C:\WINDOWS\system32\drivers\downld\15702156.exe
C:\WINDOWS\system32\drivers\downld\15744359.exe
C:\WINDOWS\system32\drivers\downld\15801171.exe
C:\WINDOWS\system32\drivers\downld\15806781.exe
C:\WINDOWS\system32\drivers\downld\15862421.exe
C:\WINDOWS\system32\drivers\downld\15871703.exe
C:\WINDOWS\system32\drivers\downld\15876031.exe
C:\WINDOWS\system32\drivers\downld\159500.exe
C:\WINDOWS\system32\drivers\downld\166171.exe
C:\WINDOWS\system32\drivers\downld\16630078.exe
C:\WINDOWS\system32\drivers\downld\16693796.exe
C:\WINDOWS\system32\drivers\downld\16708890.exe
C:\WINDOWS\system32\drivers\downld\176437.exe
C:\WINDOWS\system32\drivers\downld\204031.exe
C:\WINDOWS\system32\drivers\downld\220500.exe
C:\WINDOWS\system32\drivers\downld\223140.exe
C:\WINDOWS\system32\drivers\downld\229062.exe
C:\WINDOWS\system32\drivers\downld\231218.exe
C:\WINDOWS\system32\drivers\downld\257703.exe
C:\WINDOWS\system32\drivers\downld\271843.exe
C:\WINDOWS\system32\drivers\downld\278625.exe
C:\WINDOWS\system32\drivers\downld\279328.exe
C:\WINDOWS\system32\drivers\downld\290093.exe
C:\WINDOWS\system32\drivers\downld\296359.exe
C:\WINDOWS\system32\drivers\downld\300968.exe
C:\WINDOWS\system32\drivers\downld\303359.exe
C:\WINDOWS\system32\drivers\downld\314593.exe
C:\WINDOWS\system32\drivers\downld\323203.exe
C:\WINDOWS\system32\drivers\downld\324328.exe
C:\WINDOWS\system32\drivers\downld\353906.exe
C:\WINDOWS\system32\drivers\downld\383093.exe
C:\WINDOWS\system32\drivers\downld\384343.exe
C:\WINDOWS\system32\drivers\downld\408546.exe
C:\WINDOWS\system32\drivers\downld\411046.exe
C:\WINDOWS\system32\drivers\downld\417406.exe
C:\WINDOWS\system32\drivers\downld\438968.exe
C:\WINDOWS\system32\drivers\downld\451328.exe
C:\WINDOWS\system32\drivers\downld\4656218.exe
C:\WINDOWS\system32\drivers\downld\4687781.exe
C:\WINDOWS\system32\drivers\downld\4696078.exe
C:\WINDOWS\system32\drivers\downld\4766093.exe
C:\WINDOWS\system32\drivers\downld\478109.exe
C:\WINDOWS\system32\drivers\downld\5052187.exe
C:\WINDOWS\system32\drivers\downld\520484.exe
C:\WINDOWS\system32\drivers\downld\533000.exe
C:\WINDOWS\system32\drivers\downld\539109.exe
C:\WINDOWS\system32\drivers\downld\549046.exe
C:\WINDOWS\system32\drivers\downld\602671.exe
C:\WINDOWS\system32\drivers\downld\606296.exe
C:\WINDOWS\system32\drivers\downld\611703.exe
C:\WINDOWS\system32\drivers\downld\616562.exe
C:\WINDOWS\system32\drivers\downld\629750.exe
C:\WINDOWS\system32\drivers\downld\630281.exe
C:\WINDOWS\system32\drivers\downld\636312.exe
C:\WINDOWS\system32\drivers\downld\638375.exe
C:\WINDOWS\system32\drivers\downld\729203.exe
C:\WINDOWS\system32\drivers\downld\762593.exe
C:\WINDOWS\system32\drivers\downld\796234.exe
C:\WINDOWS\system32\drivers\downld\806250.exe
C:\WINDOWS\system32\drivers\downld\968218.exe
C:\WINDOWS\system32\nvs2.inf
D:\Autorun.inf
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_NPF
-------\Legacy_SROSA
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-04-26 to 2008-05-26 ))))))))))))))))))))))))))))))))))))
.
2008-05-26 16:33 . <REP> C:\WINDOWS\LastGood.Tmp
2008-05-26 16:32 . 2007-05-22 17:39 61,555 --a------ C:\WINDOWS\system32\jpicpl32.cpl
2008-05-24 13:03 . 2008-05-26 20:02 1,042,464 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-05-24 13:03 . 2008-05-26 19:57 14,264 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-05-24 12:57 . 2008-05-24 12:57 <REP> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-05-24 12:57 . 2008-05-24 13:01 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2008-05-24 12:56 . 2008-04-02 21:08 54,672 --a------ C:\WINDOWS\system32\vsutil_loc040c.dll
2008-05-24 12:56 . 2008-04-02 21:08 42,384 --a------ C:\WINDOWS\zllsputility_loc040c.dll
2008-05-24 12:56 . 2008-04-02 21:08 21,904 --a------ C:\WINDOWS\system32\imsinstall_loc040c.dll
2008-05-24 12:56 . 2008-04-02 21:08 17,808 --a------ C:\WINDOWS\system32\imslsp_install_loc040c.dll
2008-05-24 12:55 . 2008-04-02 21:07 75,248 --a------ C:\WINDOWS\zllsputility.exe
2008-05-24 12:53 . 2008-05-24 12:56 <REP> d-------- C:\WINDOWS\system32\ZoneLabs
2008-05-24 12:53 . 2008-05-24 12:53 <REP> d-------- C:\Program Files\Zone Labs
2008-05-24 12:53 . 2008-04-02 21:07 1,086,952 --a------ C:\WINDOWS\system32\zpeng24.dll
2008-05-24 12:53 . 2008-05-26 19:59 358,382 --a------ C:\WINDOWS\system32\vsconfig.xml
2008-05-24 12:52 . 2008-05-26 19:53 <REP> d-------- C:\WINDOWS\Internet Logs
2008-05-24 12:43 . 2008-05-24 12:43 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-05-24 12:43 . 2008-05-24 12:47 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-24 10:51 . 2008-05-24 10:51 <REP> d-------- C:\Program Files\Alwil Software
2008-05-23 21:02 . 2008-05-23 21:02 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\vlc
2008-05-23 21:01 . 2005-07-13 13:56 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau
2008-05-23 21:01 . 2005-07-13 13:56 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-05-23 21:01 . 2005-07-13 12:01 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
2008-05-23 21:01 . 2005-07-21 16:38 <REP> dr------- C:\Documents and Settings\Administrateur\Mes documents
2008-05-23 21:01 . 2005-07-13 15:35 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
2008-05-23 21:01 . 2005-07-21 16:38 <REP> dr------- C:\Documents and Settings\Administrateur\Favoris
2008-05-23 21:01 . 2005-07-13 15:46 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-05-23 21:01 . 2005-07-13 15:40 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Symantec
2008-05-23 21:01 . 2005-07-13 15:31 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Sony Corporation
2008-05-23 21:01 . 2008-05-23 21:01 <REP> d-------- C:\Documents and Settings\Administrateur
2008-05-22 22:09 . 2008-05-23 20:56 396,288 --a------ C:\HijackThis.exe
2008-05-22 21:00 . 2008-05-22 21:00 <REP> d-------- C:\Program Files\Trend Micro
2008-05-21 16:24 . 2008-05-21 16:24 303 --a------ C:\WINDOWS\ST6UNST.004
2008-05-20 19:12 . 2008-05-20 19:12 <REP> d-------- C:\Program Files\Windows Sidebar
2008-05-20 19:12 . 2008-05-20 19:12 <REP> d-------- C:\Program Files\Norton AntiVirus
2008-05-20 18:10 . 2008-05-21 16:24 4,236 --a------ C:\WINDOWS\SETUP.LST
2008-05-20 18:10 . 2008-05-20 18:10 303 --a------ C:\WINDOWS\ST6UNST.003
2008-05-20 18:03 . 2008-05-26 16:32 <REP> d-------- C:\Program Files\Java
2008-05-19 22:55 . 2008-05-19 22:55 <REP> d-------- C:\Documents and Settings\TANVIR_2\Application Data\Symantec
2008-05-19 22:27 . 2003-02-28 18:26 139,536 --a------ C:\WINDOWS\system32\javaee.dll
2008-05-19 16:50 . 2004-08-05 14:00 23,040 --a------ C:\WINDOWS\system32\lpdsvc.dll
2008-05-19 16:50 . 2004-08-05 14:00 23,040 --a--c--- C:\WINDOWS\system32\dllcache\lpdsvc.dll
2008-05-19 16:50 . 2004-08-05 14:00 19,456 --a------ C:\WINDOWS\system32\lprmon.dll
2008-05-19 16:50 . 2004-08-05 14:00 19,456 --a--c--- C:\WINDOWS\system32\dllcache\lprmon.dll
2008-05-19 16:44 . 2008-05-19 16:44 303 --a------ C:\WINDOWS\ST6UNST.002
2008-05-19 16:44 . 2008-05-19 16:44 28 --a------ C:\WINDOWS\_wi57.tmp
2008-05-15 20:52 . 2008-05-15 22:44 <REP> d-------- C:\Program Files\Incomplete
2008-05-15 20:13 . 2008-05-15 20:13 <REP> d-------- C:\Program Files\Sun
2008-05-08 19:34 . 2008-05-08 19:34 <REP> d-------- C:\Documents and Settings\TANVIR_2\Application Data\Ethereal
2008-05-08 19:02 . 2008-05-08 19:02 <REP> d-------- C:\Program Files\Conduit
2008-05-08 18:53 . 2008-05-08 19:04 <REP> d-------- C:\Program Files\Best_Security_Tips
2008-05-08 18:47 . 2008-05-16 17:46 <REP> d-------- C:\Program Files\LimeWire Turbo Accelerator
2008-05-08 18:01 . 2008-05-08 18:01 <REP> d-------- C:\Program Files\XviD
2008-05-08 18:00 . 2008-05-08 18:00 <REP> d-------- C:\Apex
2008-04-30 18:04 . 2008-04-30 18:04 <REP> d-------- C:\Program Files\Neoretix
2008-04-28 19:24 . 2008-04-28 19:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SlySoft
2008-04-28 19:22 . 2008-04-28 19:22 <REP> d-------- C:\Documents and Settings\TANVIR_2\Application Data\SlySoft
2008-04-28 19:21 . 2008-04-28 19:46 <REP> d-------- C:\Program Files\SlySoft
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-26 18:01 --------- d-----w C:\Program Files\Steam
2008-05-25 20:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-05-23 15:28 --------- d-----w C:\Program Files\Google
2008-05-23 15:14 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2008-05-21 15:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-05-21 14:38 806 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-05-21 14:38 10,652 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-05-19 16:02 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-05-19 15:12 --------- d-----w C:\Program Files\RTQDownloader
2008-05-16 15:58 --------- d-----w C:\Program Files\LimeWire
2008-05-15 20:44 --------- d-----w C:\Documents and Settings\TANVIR_2\Application Data\LimeWire
2008-05-15 20:34 --------- d-----w C:\Program Files\eMule
2008-05-08 16:00 --------- d-----w C:\Program Files\Apex
2008-04-23 15:03 --------- d-----w C:\Program Files\WinAVI MP4 Converter
2008-04-13 17:28 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-08 15:56 --------- d-----w C:\Documents and Settings\TANVIR_2\Application Data\ntr
2008-04-01 19:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\Adobe Systems
2008-04-01 13:10 --------- d-----w C:\Program Files\Zattoo
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 194,144 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-01 12:58 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2007-05-18 14:48 87,608 ----a-w C:\Documents and Settings\TANVIR_2\Application Data\ezpinst.exe
2007-05-18 14:48 47,360 ----a-w C:\Documents and Settings\TANVIR_2\Application Data\pcouffin.sys
2007-04-25 17:20 144,464 ----a-w C:\Documents and Settings\TANVIR_2\Application Data\GDIPFONTCACHEV1.DAT
2006-11-24 17:10 0 ---ha-w C:\Documents and Settings\TANVIR_2\hpothb07.dat
2006-11-24 17:06 627 ---ha-w C:\Documents and Settings\Tanvir\hpothb07.dat
2006-03-28 12:00 0 ---ha-w C:\Documents and Settings\NetworkService\hpothb07.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4C907918-2338-4FC3-A890-4D7A72E1B00C}]
C:\WINDOWS\system32\audiodfv.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{da30eff8-ccc6-4162-a20d-67402a26a215}]
2008-01-07 18:38 1530904 --a------ C:\Program Files\Best_Security_Tips\tbBest.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{DA30EFF8-CCC6-4162-A20D-67402A26A215}"= "C:\Program Files\Best_Security_Tips\tbBest.dll" [2008-01-07 18:38 1530904]
[HKEY_CLASSES_ROOT\clsid\{da30eff8-ccc6-4162-a20d-67402a26a215}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{DA30EFF8-CCC6-4162-A20D-67402A26A215}"= C:\Program Files\Best_Security_Tips\tbBest.dll [2008-01-07 18:38 1530904]
[HKEY_CLASSES_ROOT\clsid\{da30eff8-ccc6-4162-a20d-67402a26a215}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 14:00 15360]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [ ]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe" [ ]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ]
"Wipe Expert"="C:\Program Files\Bodrag\Wipe Expert\WipeExpert.exe" [ ]
"EPSON Stylus DX4000 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.exe" [2006-09-21 05:01 139264]
"Steam"="c:\program files\steam\steam.exe" [2008-03-28 13:08 1271032]
"ares"="C:\Program Files\Ares\Ares.exe" [ ]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2003-11-07 10:21 114688]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-06-09 09:56 6746112]
"Mouse Suite 98 Daemon"="ICO.EXE" [2002-03-14 16:46 45056 C:\WINDOWS\system32\ico.exe]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2005-06-29 07:33 114688]
"SonyPowerCfg"="C:\Program Files\Sony\VAIO Power Management\SPMgr.exe" [2005-05-15 05:51 184320]
"ISBMgr.exe"="C:\Program Files\Sony\ISB Utility\ISBMgr.exe" [2004-02-20 14:12 32768]
"VAIO Update 2"="C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" [2005-01-14 13:43 151552]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-06-29 07:33 94208]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-06-29 07:33 77824]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2005-03-03 21:47 483328]
"OdTray.exe"="C:\Program Files\ZyXEL\Odyssey Client for ZyXEL\OdTray.exe" [2004-03-15 18:26 626746]
"NWEReboot"="" []
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" []
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-07-19 10:06 98304]
"SSBkgdUpdate"="C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 11:22 155648]
"PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [2004-03-10 12:20 57393]
"IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2004-03-10 12:39 40960]
"SetDefPrt"="C:\Program Files\Brother\Brmfl04b\BrStDvPt.exe" [2004-05-25 10:16 49152]
"RTHDCPL"="RTHDCPL.EXE" [2005-06-29 06:25 14720000 C:\WINDOWS\RTHDCPL.EXE]
"AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [2005-04-29 07:56 45056]
"Spn2006"="C:\Program Files\Spn\emp.exe" [ ]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-08-25 20:16 1838592]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-04-02 21:07 919016]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_15\bin\jusched.exe" [2007-05-22 17:39 32881]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"SymLnch"="C:\Documents and Settings\TANVIR_2\Application Data\Symantec\Layouts\Norton Internet Security\15.0\SymAllLanguages\NIS_RETAIL\20070828\Support\SymLnch\SymLnch.exe" [2007-08-26 18:04 687976]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 14:00 15360]
"ALUAlert"="C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe" [ ]
"Symantec NetDriver Warning"="C:\PROGRA~1\SYMNET~1\SNDWarn.exe" [ ]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
VESWinlogon.dll 2005-05-20 17:42 73728 C:\WINDOWS\system32\VESWinlogon.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.dvsd"= C:\PROGRA~1\FICHIE~1\SONYSH~1\VideoLib\sonydv.dll
"vidc.xvid"= xvid.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\system32\\sessmgr.exe"=
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R2 MSSQL$VAIO_VEDB;MSSQL$VAIO_VEDB;C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe [2002-12-17 17:55]
R2 ntrconnect;NTRconnect;C:\Program Files\NTR global\NTRconnect\ntrconnect.exe [2006-11-17 17:12]
R3 AWINDIS5;AWINDIS5 Protocol Driver;C:\WINDOWS\system32\AWINDIS5.SYS [2002-04-11 17:43]
R3 odysseyIM3;Odyssey Network Services Miniport;C:\WINDOWS\system32\DRIVERS\odysseyIM3.sys [2004-03-15 17:36]
S3 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe" [2006-12-27 01:12]
S3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\Drivers\BrScnUsb.sys [2003-12-19 22:15]
S3 BrSerIf;Brother MFC Serial Port Interface WDM Driver;C:\WINDOWS\system32\Drivers\BrSerIf.sys [2004-06-12 06:27]
S3 BrUsbSer;Brother MFC USB Serial WDM Driver;C:\WINDOWS\system32\Drivers\BrUsbSer.sys [2004-01-10 05:28]
S3 FTLUND;Lundinova Filter Driver;C:\WINDOWS\system32\drivers\ftlund.sys [2004-01-19 17:27]
S3 SQLAgent$VAIO_VEDB;SQLAgent$VAIO_VEDB;C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlagent.EXE [2002-12-17 17:23]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 23:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - D:\setupSNK.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ae0fd882-fdab-11dc-ae0b-0014a415cd88}]
\Shell\AutoRun\command - G:\nideiect.com
\Shell\explore\Command - G:\nideiect.com
\Shell\open\Command - G:\nideiect.com
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-05-25 20:16:41 C:\WINDOWS\Tasks\User_Feed_Synchronization-{44684F64-8B35-4E53-A30D-204E94DA27E9}.job"
- C:\WINDOWS\system32\msfeedssync.exe
"2008-05-26 17:52:08 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"
ComboFix 08-05-25.5 - TANVIR_2 2008-05-26 19:47:06.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.33.1036.18.123 [GMT 2:00]
Endroit: C:\Documents and Settings\TANVIR_2\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\TANVIR_2\Bureau\WinXP_FR_PER_BF.EXE
* Création d'un nouveau point de restauration
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Tanvir\Application Data\HbTools
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1170435599.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1171016978.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1171210711.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1171536754.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1171994967.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1172271532.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1172695385.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1173352608.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1173720367.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1173887881.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1174231297.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1174474070.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1174672158.log
C:\Documents and Settings\Tanvir\Application Data\HbTools_Icons
C:\Documents and Settings\Tanvir\Application Data\HbTools_Icons\games2.ico
C:\Documents and Settings\Tanvir\Application Data\HbTools_Icons\Jamster2.ico
C:\Documents and Settings\Tanvir\Application Data\HbTools_Icons\wallpapere1.ico
C:\Documents and Settings\TANVIR_2\Application Data\macromedia\Flash Player\#SharedObjects\4HJE3BFM\iforex.com
C:\Documents and Settings\TANVIR_2\Application Data\macromedia\Flash Player\#SharedObjects\4HJE3BFM\iforex.com\Emerp\Events\flash_object.swf\user_data.sol
C:\Documents and Settings\TANVIR_2\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com
C:\Documents and Settings\TANVIR_2\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com\settings.sol
C:\WINDOWS\pack.epk
C:\WINDOWS\system32\bpcjwdqdky.dat
C:\WINDOWS\system32\bpcjwdqdky_nav.dat
C:\WINDOWS\system32\bpcjwdqdky_navps.dat
C:\WINDOWS\system32\drivers\downld
C:\WINDOWS\system32\drivers\downld\1251843.exe
C:\WINDOWS\system32\drivers\downld\1265546.exe
C:\WINDOWS\system32\drivers\downld\1267000.exe
C:\WINDOWS\system32\drivers\downld\1270437.exe
C:\WINDOWS\system32\drivers\downld\1286484.exe
C:\WINDOWS\system32\drivers\downld\1388671.exe
C:\WINDOWS\system32\drivers\downld\1396765.exe
C:\WINDOWS\system32\drivers\downld\14736250.exe
C:\WINDOWS\system32\drivers\downld\14785203.exe
C:\WINDOWS\system32\drivers\downld\14801406.exe
C:\WINDOWS\system32\drivers\downld\14952921.exe
C:\WINDOWS\system32\drivers\downld\14964515.exe
C:\WINDOWS\system32\drivers\downld\14971796.exe
C:\WINDOWS\system32\drivers\downld\15095078.exe
C:\WINDOWS\system32\drivers\downld\15160343.exe
C:\WINDOWS\system32\drivers\downld\15250000.exe
C:\WINDOWS\system32\drivers\downld\15262531.exe
C:\WINDOWS\system32\drivers\downld\15268421.exe
C:\WINDOWS\system32\drivers\downld\15689843.exe
C:\WINDOWS\system32\drivers\downld\15702156.exe
C:\WINDOWS\system32\drivers\downld\15744359.exe
C:\WINDOWS\system32\drivers\downld\15801171.exe
C:\WINDOWS\system32\drivers\downld\15806781.exe
C:\WINDOWS\system32\drivers\downld\15862421.exe
C:\WINDOWS\system32\drivers\downld\15871703.exe
C:\WINDOWS\system32\drivers\downld\15876031.exe
C:\WINDOWS\system32\drivers\downld\159500.exe
C:\WINDOWS\system32\drivers\downld\166171.exe
C:\WINDOWS\system32\drivers\downld\16630078.exe
C:\WINDOWS\system32\drivers\downld\16693796.exe
C:\WINDOWS\system32\drivers\downld\16708890.exe
C:\WINDOWS\system32\drivers\downld\176437.exe
C:\WINDOWS\system32\drivers\downld\204031.exe
C:\WINDOWS\system32\drivers\downld\220500.exe
C:\WINDOWS\system32\drivers\downld\223140.exe
C:\WINDOWS\system32\drivers\downld\229062.exe
C:\WINDOWS\system32\drivers\downld\231218.exe
C:\WINDOWS\system32\drivers\downld\257703.exe
C:\WINDOWS\system32\drivers\downld\271843.exe
C:\WINDOWS\system32\drivers\downld\278625.exe
C:\WINDOWS\system32\drivers\downld\279328.exe
C:\WINDOWS\system32\drivers\downld\290093.exe
C:\WINDOWS\system32\drivers\downld\296359.exe
C:\WINDOWS\system32\drivers\downld\300968.exe
C:\WINDOWS\system32\drivers\downld\303359.exe
C:\WINDOWS\system32\drivers\downld\314593.exe
C:\WINDOWS\system32\drivers\downld\323203.exe
C:\WINDOWS\system32\drivers\downld\324328.exe
C:\WINDOWS\system32\drivers\downld\353906.exe
C:\WINDOWS\system32\drivers\downld\383093.exe
C:\WINDOWS\system32\drivers\downld\384343.exe
C:\WINDOWS\system32\drivers\downld\408546.exe
C:\WINDOWS\system32\drivers\downld\411046.exe
C:\WINDOWS\system32\drivers\downld\417406.exe
C:\WINDOWS\system32\drivers\downld\438968.exe
C:\WINDOWS\system32\drivers\downld\451328.exe
C:\WINDOWS\system32\drivers\downld\4656218.exe
C:\WINDOWS\system32\drivers\downld\4687781.exe
C:\WINDOWS\system32\drivers\downld\4696078.exe
C:\WINDOWS\system32\drivers\downld\4766093.exe
C:\WINDOWS\system32\drivers\downld\478109.exe
C:\WINDOWS\system32\drivers\downld\5052187.exe
C:\WINDOWS\system32\drivers\downld\520484.exe
C:\WINDOWS\system32\drivers\downld\533000.exe
C:\WINDOWS\system32\drivers\downld\539109.exe
C:\WINDOWS\system32\drivers\downld\549046.exe
C:\WINDOWS\system32\drivers\downld\602671.exe
C:\WINDOWS\system32\drivers\downld\606296.exe
C:\WINDOWS\system32\drivers\downld\611703.exe
C:\WINDOWS\system32\drivers\downld\616562.exe
C:\WINDOWS\system32\drivers\downld\629750.exe
C:\WINDOWS\system32\drivers\downld\630281.exe
C:\WINDOWS\system32\drivers\downld\636312.exe
C:\WINDOWS\system32\drivers\downld\638375.exe
C:\WINDOWS\system32\drivers\downld\729203.exe
C:\WINDOWS\system32\drivers\downld\762593.exe
C:\WINDOWS\system32\drivers\downld\796234.exe
C:\WINDOWS\system32\drivers\downld\806250.exe
C:\WINDOWS\system32\drivers\downld\968218.exe
C:\WINDOWS\system32\nvs2.inf
D:\Autorun.inf
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_NPF
-------\Legacy_SROSA
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-04-26 to 2008-05-26 ))))))))))))))))))))))))))))))))))))
.
2008-05-26 16:33 . <REP> C:\WINDOWS\LastGood.Tmp
2008-05-26 16:32 . 2007-05-22 17:39 61,555 --a------ C:\WINDOWS\system32\jpicpl32.cpl
2008-05-24 13:03 . 2008-05-26 20:02 1,042,464 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-05-24 13:03 . 2008-05-26 19:57 14,264 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-05-24 12:57 . 2008-05-24 12:57 <REP> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-05-24 12:57 . 2008-05-24 13:01 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2008-05-24 12:56 . 2008-04-02 21:08 54,672 --a------ C:\WINDOWS\system32\vsutil_loc040c.dll
2008-05-24 12:56 . 2008-04-02 21:08 42,384 --a------ C:\WINDOWS\zllsputility_loc040c.dll
2008-05-24 12:56 . 2008-04-02 21:08 21,904 --a------ C:\WINDOWS\system32\imsinstall_loc040c.dll
2008-05-24 12:56 . 2008-04-02 21:08 17,808 --a------ C:\WINDOWS\system32\imslsp_install_loc040c.dll
2008-05-24 12:55 . 2008-04-02 21:07 75,248 --a------ C:\WINDOWS\zllsputility.exe
2008-05-24 12:53 . 2008-05-24 12:56 <REP> d-------- C:\WINDOWS\system32\ZoneLabs
2008-05-24 12:53 . 2008-05-24 12:53 <REP> d-------- C:\Program Files\Zone Labs
2008-05-24 12:53 . 2008-04-02 21:07 1,086,952 --a------ C:\WINDOWS\system32\zpeng24.dll
2008-05-24 12:53 . 2008-05-26 19:59 358,382 --a------ C:\WINDOWS\system32\vsconfig.xml
2008-05-24 12:52 . 2008-05-26 19:53 <REP> d-------- C:\WINDOWS\Internet Logs
2008-05-24 12:43 . 2008-05-24 12:43 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-05-24 12:43 . 2008-05-24 12:47 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-24 10:51 . 2008-05-24 10:51 <REP> d-------- C:\Program Files\Alwil Software
2008-05-23 21:02 . 2008-05-23 21:02 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\vlc
2008-05-23 21:01 . 2005-07-13 13:56 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau
2008-05-23 21:01 . 2005-07-13 13:56 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-05-23 21:01 . 2005-07-13 12:01 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
2008-05-23 21:01 . 2005-07-21 16:38 <REP> dr------- C:\Documents and Settings\Administrateur\Mes documents
2008-05-23 21:01 . 2005-07-13 15:35 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
2008-05-23 21:01 . 2005-07-21 16:38 <REP> dr------- C:\Documents and Settings\Administrateur\Favoris
2008-05-23 21:01 . 2005-07-13 15:46 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-05-23 21:01 . 2005-07-13 15:40 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Symantec
2008-05-23 21:01 . 2005-07-13 15:31 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Sony Corporation
2008-05-23 21:01 . 2008-05-23 21:01 <REP> d-------- C:\Documents and Settings\Administrateur
2008-05-22 22:09 . 2008-05-23 20:56 396,288 --a------ C:\HijackThis.exe
2008-05-22 21:00 . 2008-05-22 21:00 <REP> d-------- C:\Program Files\Trend Micro
2008-05-21 16:24 . 2008-05-21 16:24 303 --a------ C:\WINDOWS\ST6UNST.004
2008-05-20 19:12 . 2008-05-20 19:12 <REP> d-------- C:\Program Files\Windows Sidebar
2008-05-20 19:12 . 2008-05-20 19:12 <REP> d-------- C:\Program Files\Norton AntiVirus
2008-05-20 18:10 . 2008-05-21 16:24 4,236 --a------ C:\WINDOWS\SETUP.LST
2008-05-20 18:10 . 2008-05-20 18:10 303 --a------ C:\WINDOWS\ST6UNST.003
2008-05-20 18:03 . 2008-05-26 16:32 <REP> d-------- C:\Program Files\Java
2008-05-19 22:55 . 2008-05-19 22:55 <REP> d-------- C:\Documents and Settings\TANVIR_2\Application Data\Symantec
2008-05-19 22:27 . 2003-02-28 18:26 139,536 --a------ C:\WINDOWS\system32\javaee.dll
2008-05-19 16:50 . 2004-08-05 14:00 23,040 --a------ C:\WINDOWS\system32\lpdsvc.dll
2008-05-19 16:50 . 2004-08-05 14:00 23,040 --a--c--- C:\WINDOWS\system32\dllcache\lpdsvc.dll
2008-05-19 16:50 . 2004-08-05 14:00 19,456 --a------ C:\WINDOWS\system32\lprmon.dll
2008-05-19 16:50 . 2004-08-05 14:00 19,456 --a--c--- C:\WINDOWS\system32\dllcache\lprmon.dll
2008-05-19 16:44 . 2008-05-19 16:44 303 --a------ C:\WINDOWS\ST6UNST.002
2008-05-19 16:44 . 2008-05-19 16:44 28 --a------ C:\WINDOWS\_wi57.tmp
2008-05-15 20:52 . 2008-05-15 22:44 <REP> d-------- C:\Program Files\Incomplete
2008-05-15 20:13 . 2008-05-15 20:13 <REP> d-------- C:\Program Files\Sun
2008-05-08 19:34 . 2008-05-08 19:34 <REP> d-------- C:\Documents and Settings\TANVIR_2\Application Data\Ethereal
2008-05-08 19:02 . 2008-05-08 19:02 <REP> d-------- C:\Program Files\Conduit
2008-05-08 18:53 . 2008-05-08 19:04 <REP> d-------- C:\Program Files\Best_Security_Tips
2008-05-08 18:47 . 2008-05-16 17:46 <REP> d-------- C:\Program Files\LimeWire Turbo Accelerator
2008-05-08 18:01 . 2008-05-08 18:01 <REP> d-------- C:\Program Files\XviD
2008-05-08 18:00 . 2008-05-08 18:00 <REP> d-------- C:\Apex
2008-04-30 18:04 . 2008-04-30 18:04 <REP> d-------- C:\Program Files\Neoretix
2008-04-28 19:24 . 2008-04-28 19:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SlySoft
2008-04-28 19:22 . 2008-04-28 19:22 <REP> d-------- C:\Documents and Settings\TANVIR_2\Application Data\SlySoft
2008-04-28 19:21 . 2008-04-28 19:46 <REP> d-------- C:\Program Files\SlySoft
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-26 18:01 --------- d-----w C:\Program Files\Steam
2008-05-25 20:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-05-23 15:28 --------- d-----w C:\Program Files\Google
2008-05-23 15:14 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2008-05-21 15:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-05-21 14:38 806 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-05-21 14:38 10,652 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-05-19 16:02 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-05-19 15:12 --------- d-----w C:\Program Files\RTQDownloader
2008-05-16 15:58 --------- d-----w C:\Program Files\LimeWire
2008-05-15 20:44 --------- d-----w C:\Documents and Settings\TANVIR_2\Application Data\LimeWire
2008-05-15 20:34 --------- d-----w C:\Program Files\eMule
2008-05-08 16:00 --------- d-----w C:\Program Files\Apex
2008-04-23 15:03 --------- d-----w C:\Program Files\WinAVI MP4 Converter
2008-04-13 17:28 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-08 15:56 --------- d-----w C:\Documents and Settings\TANVIR_2\Application Data\ntr
2008-04-01 19:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\Adobe Systems
2008-04-01 13:10 --------- d-----w C:\Program Files\Zattoo
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 194,144 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-01 12:58 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2007-05-18 14:48 87,608 ----a-w C:\Documents and Settings\TANVIR_2\Application Data\ezpinst.exe
2007-05-18 14:48 47,360 ----a-w C:\Documents and Settings\TANVIR_2\Application Data\pcouffin.sys
2007-04-25 17:20 144,464 ----a-w C:\Documents and Settings\TANVIR_2\Application Data\GDIPFONTCACHEV1.DAT
2006-11-24 17:10 0 ---ha-w C:\Documents and Settings\TANVIR_2\hpothb07.dat
2006-11-24 17:06 627 ---ha-w C:\Documents and Settings\Tanvir\hpothb07.dat
2006-03-28 12:00 0 ---ha-w C:\Documents and Settings\NetworkService\hpothb07.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4C907918-2338-4FC3-A890-4D7A72E1B00C}]
C:\WINDOWS\system32\audiodfv.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{da30eff8-ccc6-4162-a20d-67402a26a215}]
2008-01-07 18:38 1530904 --a------ C:\Program Files\Best_Security_Tips\tbBest.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{DA30EFF8-CCC6-4162-A20D-67402A26A215}"= "C:\Program Files\Best_Security_Tips\tbBest.dll" [2008-01-07 18:38 1530904]
[HKEY_CLASSES_ROOT\clsid\{da30eff8-ccc6-4162-a20d-67402a26a215}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{DA30EFF8-CCC6-4162-A20D-67402A26A215}"= C:\Program Files\Best_Security_Tips\tbBest.dll [2008-01-07 18:38 1530904]
[HKEY_CLASSES_ROOT\clsid\{da30eff8-ccc6-4162-a20d-67402a26a215}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 14:00 15360]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [ ]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe" [ ]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ]
"Wipe Expert"="C:\Program Files\Bodrag\Wipe Expert\WipeExpert.exe" [ ]
"EPSON Stylus DX4000 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.exe" [2006-09-21 05:01 139264]
"Steam"="c:\program files\steam\steam.exe" [2008-03-28 13:08 1271032]
"ares"="C:\Program Files\Ares\Ares.exe" [ ]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2003-11-07 10:21 114688]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-06-09 09:56 6746112]
"Mouse Suite 98 Daemon"="ICO.EXE" [2002-03-14 16:46 45056 C:\WINDOWS\system32\ico.exe]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2005-06-29 07:33 114688]
"SonyPowerCfg"="C:\Program Files\Sony\VAIO Power Management\SPMgr.exe" [2005-05-15 05:51 184320]
"ISBMgr.exe"="C:\Program Files\Sony\ISB Utility\ISBMgr.exe" [2004-02-20 14:12 32768]
"VAIO Update 2"="C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" [2005-01-14 13:43 151552]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-06-29 07:33 94208]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-06-29 07:33 77824]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2005-03-03 21:47 483328]
"OdTray.exe"="C:\Program Files\ZyXEL\Odyssey Client for ZyXEL\OdTray.exe" [2004-03-15 18:26 626746]
"NWEReboot"="" []
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" []
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-07-19 10:06 98304]
"SSBkgdUpdate"="C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 11:22 155648]
"PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [2004-03-10 12:20 57393]
"IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2004-03-10 12:39 40960]
"SetDefPrt"="C:\Program Files\Brother\Brmfl04b\BrStDvPt.exe" [2004-05-25 10:16 49152]
"RTHDCPL"="RTHDCPL.EXE" [2005-06-29 06:25 14720000 C:\WINDOWS\RTHDCPL.EXE]
"AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [2005-04-29 07:56 45056]
"Spn2006"="C:\Program Files\Spn\emp.exe" [ ]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-08-25 20:16 1838592]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-04-02 21:07 919016]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_15\bin\jusched.exe" [2007-05-22 17:39 32881]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"SymLnch"="C:\Documents and Settings\TANVIR_2\Application Data\Symantec\Layouts\Norton Internet Security\15.0\SymAllLanguages\NIS_RETAIL\20070828\Support\SymLnch\SymLnch.exe" [2007-08-26 18:04 687976]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 14:00 15360]
"ALUAlert"="C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe" [ ]
"Symantec NetDriver Warning"="C:\PROGRA~1\SYMNET~1\SNDWarn.exe" [ ]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
VESWinlogon.dll 2005-05-20 17:42 73728 C:\WINDOWS\system32\VESWinlogon.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.dvsd"= C:\PROGRA~1\FICHIE~1\SONYSH~1\VideoLib\sonydv.dll
"vidc.xvid"= xvid.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\system32\\sessmgr.exe"=
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R2 MSSQL$VAIO_VEDB;MSSQL$VAIO_VEDB;C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe [2002-12-17 17:55]
R2 ntrconnect;NTRconnect;C:\Program Files\NTR global\NTRconnect\ntrconnect.exe [2006-11-17 17:12]
R3 AWINDIS5;AWINDIS5 Protocol Driver;C:\WINDOWS\system32\AWINDIS5.SYS [2002-04-11 17:43]
R3 odysseyIM3;Odyssey Network Services Miniport;C:\WINDOWS\system32\DRIVERS\odysseyIM3.sys [2004-03-15 17:36]
S3 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe" [2006-12-27 01:12]
S3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\Drivers\BrScnUsb.sys [2003-12-19 22:15]
S3 BrSerIf;Brother MFC Serial Port Interface WDM Driver;C:\WINDOWS\system32\Drivers\BrSerIf.sys [2004-06-12 06:27]
S3 BrUsbSer;Brother MFC USB Serial WDM Driver;C:\WINDOWS\system32\Drivers\BrUsbSer.sys [2004-01-10 05:28]
S3 FTLUND;Lundinova Filter Driver;C:\WINDOWS\system32\drivers\ftlund.sys [2004-01-19 17:27]
S3 SQLAgent$VAIO_VEDB;SQLAgent$VAIO_VEDB;C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlagent.EXE [2002-12-17 17:23]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 23:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - D:\setupSNK.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ae0fd882-fdab-11dc-ae0b-0014a415cd88}]
\Shell\AutoRun\command - G:\nideiect.com
\Shell\explore\Command - G:\nideiect.com
\Shell\open\Command - G:\nideiect.com
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-05-25 20:16:41 C:\WINDOWS\Tasks\User_Feed_Synchronization-{44684F64-8B35-4E53-A30D-204E94DA27E9}.job"
- C:\WINDOWS\system32\msfeedssync.exe
"2008-05-26 17:52:08 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"
kwon
Messages postés
75
Date d'inscription
dimanche 15 juillet 2007
Statut
Membre
Dernière intervention
18 mai 2009
1
26 mai 2008 à 20:51
26 mai 2008 à 20:51
Voilà pour Hijackthis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:51, on 2008-05-26
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe
C:\Program Files\NTR global\NTRconnect\ntrconnect.exe
C:\Program Files\ZyXEL\Odyssey Client for ZyXEL\odClientService.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\ICO.EXE
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\ZyXEL\Odyssey Client for ZyXEL\OdTray.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\j2re1.4.2_15\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\ESM2\Stms.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\ESM2\EBRR.EXE
C:\Program Files\Sony Ericsson\Mobile\audevicemgr.exe
C:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\CONNMN~1.EXE
c:\PROGRA~1\INTUWA~1\Shared\MROUTE~1\mRouterRuntime.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.fr.msn.ch/0SEFRCH/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.fr.msn.ch/0SEFRCH/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.fr.msn.ch/0SEFRCH/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: Best Security Tips Toolbar - {da30eff8-ccc6-4162-a20d-67402a26a215} - C:\Program Files\Best_Security_Tips\tbBest.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4C907918-2338-4FC3-A890-4D7A72E1B00C} - C:\WINDOWS\system32\audiodfv.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Best Security Tips Toolbar - {da30eff8-ccc6-4162-a20d-67402a26a215} - C:\Program Files\Best_Security_Tips\tbBest.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: Best Security Tips Toolbar - {da30eff8-ccc6-4162-a20d-67402a26a215} - C:\Program Files\Best_Security_Tips\tbBest.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SonyPowerCfg] C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
O4 - HKLM\..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe
O4 - HKLM\..\Run: [VAIO Update 2] "C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" /Stationary
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [OdTray.exe] "C:\Program Files\ZyXEL\Odyssey Client for ZyXEL\OdTray.exe"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl04b\BrStDvPt.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [Spn2006] C:\Program Files\Spn\emp.exe stw
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\j2re1.4.2_15\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [SymLnch] "C:\Documents and Settings\TANVIR_2\Application Data\Symantec\Layouts\Norton Internet Security\15.0\SymAllLanguages\NIS_RETAIL\20070828\Support\SymLnch\SymLnch.exe" "C:\Documents and Settings\TANVIR_2\Application Data\Symantec\Layouts\Norton Internet Security\15.0\SymAllLanguages\NIS_RETAIL\20070828\Setup.exe" "/UPREBOOT /temp /patched"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Wipe Expert] "C:\Program Files\Bodrag\Wipe Expert\WipeExpert.exe" /start
O4 - HKCU\..\Run: [EPSON Stylus DX4000 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "C:\WINDOWS\TEMP\E_S8D1.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - .DEFAULT User Startup: VAIO Launcher.lnk = C:\Program Files\Sony\VAIO Launcher\Launcher.exe (User 'Default user')
O4 - Startup: VAIO Launcher.lnk = C:\Program Files\Sony\VAIO Launcher\Launcher.exe
O4 - Global Startup: EPSON Background Monitor.lnk = C:\ESM2\Stms.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Phone Connection Monitor.lnk = ?
O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.club-vaio.com/fr/
O15 - Trusted Zone: *.sony-europe.com
O15 - Trusted Zone: *.sonystyle-europe.com
O15 - Trusted Zone: *.vaio-link.com
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.2) - http://javadl-esd.sun.com/update/1.4.2/jinstall-1_4-windows-i586.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E6ACF817-0A85-4EBE-9F0A-096C6488CFEA} (NTR ActiveX 1.1.8) - https://www.ntrconnect.com/main/mod/setup/ntractivex118_24.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NTRconnect (ntrconnect) - Net Transmit & Receive - C:\Program Files\NTR global\NTRconnect\ntrconnect.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Odyssey Client for ZyXEL (odClientService) - Funk Software, Inc. - C:\Program Files\ZyXEL\Odyssey Client for ZyXEL\odClientService.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: VAIO Entertainment Aggregation and Control Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
O23 - Service: VAIO Entertainment Task Scheduler - Sony Corporation - C:\Program Files\Sony\VAIO Entertainment\VzTaskScheduler.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
O23 - Service: VAIO Cooporated Initialisation (VCI) - Sony Corporation - C:\Program Files\Sony\VAIO Cooperated Initialisation\VCI_SVC.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:51, on 2008-05-26
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe
C:\Program Files\NTR global\NTRconnect\ntrconnect.exe
C:\Program Files\ZyXEL\Odyssey Client for ZyXEL\odClientService.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\ICO.EXE
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\ZyXEL\Odyssey Client for ZyXEL\OdTray.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\j2re1.4.2_15\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\ESM2\Stms.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\ESM2\EBRR.EXE
C:\Program Files\Sony Ericsson\Mobile\audevicemgr.exe
C:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\CONNMN~1.EXE
c:\PROGRA~1\INTUWA~1\Shared\MROUTE~1\mRouterRuntime.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.fr.msn.ch/0SEFRCH/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.fr.msn.ch/0SEFRCH/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.fr.msn.ch/0SEFRCH/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: Best Security Tips Toolbar - {da30eff8-ccc6-4162-a20d-67402a26a215} - C:\Program Files\Best_Security_Tips\tbBest.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4C907918-2338-4FC3-A890-4D7A72E1B00C} - C:\WINDOWS\system32\audiodfv.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Best Security Tips Toolbar - {da30eff8-ccc6-4162-a20d-67402a26a215} - C:\Program Files\Best_Security_Tips\tbBest.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: Best Security Tips Toolbar - {da30eff8-ccc6-4162-a20d-67402a26a215} - C:\Program Files\Best_Security_Tips\tbBest.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SonyPowerCfg] C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
O4 - HKLM\..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe
O4 - HKLM\..\Run: [VAIO Update 2] "C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" /Stationary
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [OdTray.exe] "C:\Program Files\ZyXEL\Odyssey Client for ZyXEL\OdTray.exe"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl04b\BrStDvPt.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [Spn2006] C:\Program Files\Spn\emp.exe stw
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\j2re1.4.2_15\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [SymLnch] "C:\Documents and Settings\TANVIR_2\Application Data\Symantec\Layouts\Norton Internet Security\15.0\SymAllLanguages\NIS_RETAIL\20070828\Support\SymLnch\SymLnch.exe" "C:\Documents and Settings\TANVIR_2\Application Data\Symantec\Layouts\Norton Internet Security\15.0\SymAllLanguages\NIS_RETAIL\20070828\Setup.exe" "/UPREBOOT /temp /patched"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Wipe Expert] "C:\Program Files\Bodrag\Wipe Expert\WipeExpert.exe" /start
O4 - HKCU\..\Run: [EPSON Stylus DX4000 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "C:\WINDOWS\TEMP\E_S8D1.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - .DEFAULT User Startup: VAIO Launcher.lnk = C:\Program Files\Sony\VAIO Launcher\Launcher.exe (User 'Default user')
O4 - Startup: VAIO Launcher.lnk = C:\Program Files\Sony\VAIO Launcher\Launcher.exe
O4 - Global Startup: EPSON Background Monitor.lnk = C:\ESM2\Stms.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Phone Connection Monitor.lnk = ?
O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.club-vaio.com/fr/
O15 - Trusted Zone: *.sony-europe.com
O15 - Trusted Zone: *.sonystyle-europe.com
O15 - Trusted Zone: *.vaio-link.com
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.2) - http://javadl-esd.sun.com/update/1.4.2/jinstall-1_4-windows-i586.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E6ACF817-0A85-4EBE-9F0A-096C6488CFEA} (NTR ActiveX 1.1.8) - https://www.ntrconnect.com/main/mod/setup/ntractivex118_24.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NTRconnect (ntrconnect) - Net Transmit & Receive - C:\Program Files\NTR global\NTRconnect\ntrconnect.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Odyssey Client for ZyXEL (odClientService) - Funk Software, Inc. - C:\Program Files\ZyXEL\Odyssey Client for ZyXEL\odClientService.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: VAIO Entertainment Aggregation and Control Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
O23 - Service: VAIO Entertainment Task Scheduler - Sony Corporation - C:\Program Files\Sony\VAIO Entertainment\VzTaskScheduler.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
O23 - Service: VAIO Cooporated Initialisation (VCI) - Sony Corporation - C:\Program Files\Sony\VAIO Cooperated Initialisation\VCI_SVC.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
g!rly
Messages postés
18209
Date d'inscription
vendredi 17 août 2007
Statut
Contributeur
Dernière intervention
30 novembre 2014
406
26 mai 2008 à 20:54
26 mai 2008 à 20:54
re,
Copie le texte ci-dessous :
File::
C:\WINDOWS\ST6UNST.002
C:\WINDOWS\_wi57.tmp
Folder::
C:\Program Files\Spn
C:\Program Files\Bodrag
C:\Program Files\Fichiers communs\BOONTY Shared
Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Wipe Expert"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Spn2006"=-
Driver::
Boonty Games
Ouvre le Bloc-Notes puis colle le texte copié.
(Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Sauvegarde ce fichier sous le nom de CFScript.txt.
Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :
http://sd-1.archive-host.com/membres/up/1366464061/CFScript.gif
Cela va relancer Combofix,
Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.
S'il n'y a pas de rédémarrage, poste quand même les rapports.
@+
Copie le texte ci-dessous :
File::
C:\WINDOWS\ST6UNST.002
C:\WINDOWS\_wi57.tmp
Folder::
C:\Program Files\Spn
C:\Program Files\Bodrag
C:\Program Files\Fichiers communs\BOONTY Shared
Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Wipe Expert"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Spn2006"=-
Driver::
Boonty Games
Ouvre le Bloc-Notes puis colle le texte copié.
(Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Sauvegarde ce fichier sous le nom de CFScript.txt.
Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :
http://sd-1.archive-host.com/membres/up/1366464061/CFScript.gif
Cela va relancer Combofix,
Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.
S'il n'y a pas de rédémarrage, poste quand même les rapports.
@+
g!rly
Messages postés
18209
Date d'inscription
vendredi 17 août 2007
Statut
Contributeur
Dernière intervention
30 novembre 2014
406
26 mai 2008 à 21:00
26 mai 2008 à 21:00
...
kwon
Messages postés
75
Date d'inscription
dimanche 15 juillet 2007
Statut
Membre
Dernière intervention
18 mai 2009
1
26 mai 2008 à 21:16
26 mai 2008 à 21:16
ComboFix 08-05-25.5 - TANVIR_2 2008-05-26 21:05:56.2 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.33.1036.18.122 [GMT 2:00]
Endroit: C:\Documents and Settings\TANVIR_2\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\TANVIR_2\Bureau\CFScript.txt..txt
* Création d'un nouveau point de restauration
FILE ::
G:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE
G:\WINDOWS\SYSTEM32\DRIVERS\MDELK.EXE
G:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS
G:\WINDOWS\SYSTEM32\WINTEMS.EXE
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\Documents and Settings\Tanvir\Application Data\HbTools
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1170435599.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1171016978.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1171210711.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1171536754.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1171994967.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1172271532.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1172695385.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1173352608.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1173720367.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1173887881.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1174231297.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1174474070.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1174672158.log
C:\Documents and Settings\Tanvir\Application Data\HbTools_Icons
C:\Documents and Settings\Tanvir\Application Data\HbTools_Icons\games2.ico
C:\Documents and Settings\Tanvir\Application Data\HbTools_Icons\Jamster2.ico
C:\Documents and Settings\Tanvir\Application Data\HbTools_Icons\wallpapere1.ico
C:\Documents and Settings\TANVIR_2\Application Data\macromedia\Flash Player\#SharedObjects\4HJE3BFM\iforex.com
C:\Documents and Settings\TANVIR_2\Application Data\macromedia\Flash Player\#SharedObjects\4HJE3BFM\iforex.com\Emerp\Events\flash_object.swf\user_data.sol
C:\Documents and Settings\TANVIR_2\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com
C:\Documents and Settings\TANVIR_2\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com\settings.sol
C:\WINDOWS\pack.epk
C:\WINDOWS\system32\bpcjwdqdky.dat
C:\WINDOWS\system32\bpcjwdqdky_nav.dat
C:\WINDOWS\system32\bpcjwdqdky_navps.dat
C:\WINDOWS\system32\drivers\downld
C:\WINDOWS\system32\drivers\downld\1251843.exe
C:\WINDOWS\system32\drivers\downld\1265546.exe
C:\WINDOWS\system32\drivers\downld\1267000.exe
C:\WINDOWS\system32\drivers\downld\1270437.exe
C:\WINDOWS\system32\drivers\downld\1286484.exe
C:\WINDOWS\system32\drivers\downld\1388671.exe
C:\WINDOWS\system32\drivers\downld\1396765.exe
C:\WINDOWS\system32\drivers\downld\14736250.exe
C:\WINDOWS\system32\drivers\downld\14785203.exe
C:\WINDOWS\system32\drivers\downld\14801406.exe
C:\WINDOWS\system32\drivers\downld\14952921.exe
C:\WINDOWS\system32\drivers\downld\14964515.exe
C:\WINDOWS\system32\drivers\downld\14971796.exe
C:\WINDOWS\system32\drivers\downld\15095078.exe
C:\WINDOWS\system32\drivers\downld\15160343.exe
C:\WINDOWS\system32\drivers\downld\15250000.exe
C:\WINDOWS\system32\drivers\downld\15262531.exe
C:\WINDOWS\system32\drivers\downld\15268421.exe
C:\WINDOWS\system32\drivers\downld\15689843.exe
C:\WINDOWS\system32\drivers\downld\15702156.exe
C:\WINDOWS\system32\drivers\downld\15744359.exe
C:\WINDOWS\system32\drivers\downld\15801171.exe
C:\WINDOWS\system32\drivers\downld\15806781.exe
C:\WINDOWS\system32\drivers\downld\15862421.exe
C:\WINDOWS\system32\drivers\downld\15871703.exe
C:\WINDOWS\system32\drivers\downld\15876031.exe
C:\WINDOWS\system32\drivers\downld\159500.exe
C:\WINDOWS\system32\drivers\downld\166171.exe
C:\WINDOWS\system32\drivers\downld\16630078.exe
C:\WINDOWS\system32\drivers\downld\16693796.exe
C:\WINDOWS\system32\drivers\downld\16708890.exe
C:\WINDOWS\system32\drivers\downld\176437.exe
C:\WINDOWS\system32\drivers\downld\204031.exe
C:\WINDOWS\system32\drivers\downld\220500.exe
C:\WINDOWS\system32\drivers\downld\223140.exe
C:\WINDOWS\system32\drivers\downld\229062.exe
C:\WINDOWS\system32\drivers\downld\231218.exe
C:\WINDOWS\system32\drivers\downld\257703.exe
C:\WINDOWS\system32\drivers\downld\271843.exe
C:\WINDOWS\system32\drivers\downld\278625.exe
C:\WINDOWS\system32\drivers\downld\279328.exe
C:\WINDOWS\system32\drivers\downld\290093.exe
C:\WINDOWS\system32\drivers\downld\296359.exe
C:\WINDOWS\system32\drivers\downld\300968.exe
C:\WINDOWS\system32\drivers\downld\303359.exe
C:\WINDOWS\system32\drivers\downld\314593.exe
C:\WINDOWS\system32\drivers\downld\323203.exe
C:\WINDOWS\system32\drivers\downld\324328.exe
C:\WINDOWS\system32\drivers\downld\353906.exe
C:\WINDOWS\system32\drivers\downld\383093.exe
C:\WINDOWS\system32\drivers\downld\384343.exe
C:\WINDOWS\system32\drivers\downld\408546.exe
C:\WINDOWS\system32\drivers\downld\411046.exe
C:\WINDOWS\system32\drivers\downld\417406.exe
C:\WINDOWS\system32\drivers\downld\438968.exe
C:\WINDOWS\system32\drivers\downld\451328.exe
C:\WINDOWS\system32\drivers\downld\4656218.exe
C:\WINDOWS\system32\drivers\downld\4687781.exe
C:\WINDOWS\system32\drivers\downld\4696078.exe
C:\WINDOWS\system32\drivers\downld\4766093.exe
C:\WINDOWS\system32\drivers\downld\478109.exe
C:\WINDOWS\system32\drivers\downld\5052187.exe
C:\WINDOWS\system32\drivers\downld\520484.exe
C:\WINDOWS\system32\drivers\downld\533000.exe
C:\WINDOWS\system32\drivers\downld\539109.exe
C:\WINDOWS\system32\drivers\downld\549046.exe
C:\WINDOWS\system32\drivers\downld\602671.exe
C:\WINDOWS\system32\drivers\downld\606296.exe
C:\WINDOWS\system32\drivers\downld\611703.exe
C:\WINDOWS\system32\drivers\downld\616562.exe
C:\WINDOWS\system32\drivers\downld\629750.exe
C:\WINDOWS\system32\drivers\downld\630281.exe
C:\WINDOWS\system32\drivers\downld\636312.exe
C:\WINDOWS\system32\drivers\downld\638375.exe
C:\WINDOWS\system32\drivers\downld\729203.exe
C:\WINDOWS\system32\drivers\downld\762593.exe
C:\WINDOWS\system32\drivers\downld\796234.exe
C:\WINDOWS\system32\drivers\downld\806250.exe
C:\WINDOWS\system32\drivers\downld\968218.exe
C:\WINDOWS\system32\nvs2.inf
D:\Autorun.inf
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_NPF
-------\Legacy_SROSA
((((((((((((((((((((((((((((( Fichiers créés 2008-04-26 to 2008-05-26 ))))))))))))))))))))))))))))))))))))
.
2008-05-26 16:32 . 2007-05-22 17:39 61,555 --a------ C:\WINDOWS\system32\jpicpl32.cpl
2008-05-24 13:03 . 2008-05-26 21:10 1,083,424 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-05-24 13:03 . 2008-05-26 20:29 14,432 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-05-24 12:57 . 2008-05-24 12:57 <REP> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-05-24 12:57 . 2008-05-24 13:01 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2008-05-24 12:56 . 2008-04-02 21:08 54,672 --a------ C:\WINDOWS\system32\vsutil_loc040c.dll
2008-05-24 12:56 . 2008-04-02 21:08 42,384 --a------ C:\WINDOWS\zllsputility_loc040c.dll
2008-05-24 12:56 . 2008-04-02 21:08 21,904 --a------ C:\WINDOWS\system32\imsinstall_loc040c.dll
2008-05-24 12:56 . 2008-04-02 21:08 17,808 --a------ C:\WINDOWS\system32\imslsp_install_loc040c.dll
2008-05-24 12:55 . 2008-04-02 21:07 75,248 --a------ C:\WINDOWS\zllsputility.exe
2008-05-24 12:53 . 2008-05-24 12:56 <REP> d-------- C:\WINDOWS\system32\ZoneLabs
2008-05-24 12:53 . 2008-05-24 12:53 <REP> d-------- C:\Program Files\Zone Labs
2008-05-24 12:53 . 2008-04-02 21:07 1,086,952 --a------ C:\WINDOWS\system32\zpeng24.dll
2008-05-24 12:53 . 2008-05-26 20:33 358,382 --a------ C:\WINDOWS\system32\vsconfig.xml
2008-05-24 12:52 . 2008-05-26 20:57 <REP> d-------- C:\WINDOWS\Internet Logs
2008-05-24 12:43 . 2008-05-24 12:43 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-05-24 12:43 . 2008-05-24 12:47 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-24 10:51 . 2008-05-24 10:51 <REP> d-------- C:\Program Files\Alwil Software
2008-05-23 21:02 . 2008-05-23 21:02 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\vlc
2008-05-23 21:01 . 2005-07-13 13:56 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage réseau
2008-05-23 21:01 . 2005-07-13 13:56 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-05-23 21:01 . 2005-07-13 12:01 <REP> d--h----- C:\Documents and Settings\Administrateur\Modèles
2008-05-23 21:01 . 2005-07-21 16:38 <REP> dr------- C:\Documents and Settings\Administrateur\Mes documents
2008-05-23 21:01 . 2005-07-13 15:35 <REP> dr------- C:\Documents and Settings\Administrateur\Menu Démarrer
2008-05-23 21:01 . 2005-07-21 16:38 <REP> dr------- C:\Documents and Settings\Administrateur\Favoris
2008-05-23 21:01 . 2005-07-13 15:46 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-05-23 21:01 . 2005-07-13 15:40 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Symantec
2008-05-23 21:01 . 2005-07-13 15:31 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Sony Corporation
2008-05-23 21:01 . 2008-05-23 21:01 <REP> d-------- C:\Documents and Settings\Administrateur
2008-05-22 22:09 . 2008-05-23 20:56 396,288 --a------ C:\HijackThis.exe
2008-05-22 21:00 . 2008-05-22 21:00 <REP> d-------- C:\Program Files\Trend Micro
2008-05-21 16:24 . 2008-05-21 16:24 303 --a------ C:\WINDOWS\ST6UNST.004
2008-05-20 19:12 . 2008-05-20 19:12 <REP> d-------- C:\Program Files\Windows Sidebar
2008-05-20 19:12 . 2008-05-20 19:12 <REP> d-------- C:\Program Files\Norton AntiVirus
2008-05-20 18:10 . 2008-05-21 16:24 4,236 --a------ C:\WINDOWS\SETUP.LST
2008-05-20 18:10 . 2008-05-20 18:10 303 --a------ C:\WINDOWS\ST6UNST.003
2008-05-20 18:03 . 2008-05-26 16:32 <REP> d-------- C:\Program Files\Java
2008-05-19 22:55 . 2008-05-19 22:55 <REP> d-------- C:\Documents and Settings\TANVIR_2\Application Data\Symantec
2008-05-19 22:27 . 2003-02-28 18:26 139,536 --a------ C:\WINDOWS\system32\javaee.dll
2008-05-19 16:50 . 2004-08-05 14:00 23,040 --a------ C:\WINDOWS\system32\lpdsvc.dll
2008-05-19 16:50 . 2004-08-05 14:00 23,040 --a--c--- C:\WINDOWS\system32\dllcache\lpdsvc.dll
2008-05-19 16:50 . 2004-08-05 14:00 19,456 --a------ C:\WINDOWS\system32\lprmon.dll
2008-05-19 16:50 . 2004-08-05 14:00 19,456 --a--c--- C:\WINDOWS\system32\dllcache\lprmon.dll
2008-05-19 16:44 . 2008-05-19 16:44 303 --a------ C:\WINDOWS\ST6UNST.002
2008-05-19 16:44 . 2008-05-19 16:44 28 --a------ C:\WINDOWS\_wi57.tmp
2008-05-15 20:52 . 2008-05-15 22:44 <REP> d-------- C:\Program Files\Incomplete
2008-05-15 20:13 . 2008-05-15 20:13 <REP> d-------- C:\Program Files\Sun
2008-05-08 19:34 . 2008-05-08 19:34 <REP> d-------- C:\Documents and Settings\TANVIR_2\Application Data\Ethereal
2008-05-08 19:02 . 2008-05-08 19:02 <REP> d-------- C:\Program Files\Conduit
2008-05-08 18:53 . 2008-05-08 19:04 <REP> d-------- C:\Program Files\Best_Security_Tips
2008-05-08 18:47 . 2008-05-16 17:46 <REP> d-------- C:\Program Files\LimeWire Turbo Accelerator
2008-05-08 18:01 . 2008-05-08 18:01 <REP> d-------- C:\Program Files\XviD
2008-05-08 18:00 . 2008-05-08 18:00 <REP> d-------- C:\Apex
2008-04-30 18:04 . 2008-04-30 18:04 <REP> d-------- C:\Program Files\Neoretix
2008-04-28 19:24 . 2008-04-28 19:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SlySoft
2008-04-28 19:22 . 2008-04-28 19:22 <REP> d-------- C:\Documents and Settings\TANVIR_2\Application Data\SlySoft
2008-04-28 19:21 . 2008-04-28 19:46 <REP> d-------- C:\Program Files\SlySoft
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-26 18:34 --------- d-----w C:\Program Files\Steam
2008-05-25 20:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-05-23 15:28 --------- d-----w C:\Program Files\Google
2008-05-23 15:14 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2008-05-21 15:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-05-21 14:38 806 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-05-21 14:38 10,652 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-05-19 16:02 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-05-19 15:12 --------- d-----w C:\Program Files\RTQDownloader
2008-05-16 15:58 --------- d-----w C:\Program Files\LimeWire
2008-05-15 20:44 --------- d-----w C:\Documents and Settings\TANVIR_2\Application Data\LimeWire
2008-05-15 20:34 --------- d-----w C:\Program Files\eMule
2008-05-08 16:00 --------- d-----w C:\Program Files\Apex
2008-04-23 15:03 --------- d-----w C:\Program Files\WinAVI MP4 Converter
2008-04-13 17:28 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-08 15:56 --------- d-----w C:\Documents and Settings\TANVIR_2\Application Data\ntr
2008-04-01 19:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\Adobe Systems
2008-04-01 13:10 --------- d-----w C:\Program Files\Zattoo
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 194,144 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-01 12:58 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2007-05-18 14:48 87,608 ----a-w C:\Documents and Settings\TANVIR_2\Application Data\ezpinst.exe
2007-05-18 14:48 47,360 ----a-w C:\Documents and Settings\TANVIR_2\Application Data\pcouffin.sys
2007-04-25 17:20 144,464 ----a-w C:\Documents and Settings\TANVIR_2\Application Data\GDIPFONTCACHEV1.DAT
2006-11-24 17:10 0 ---ha-w C:\Documents and Settings\TANVIR_2\hpothb07.dat
2006-11-24 17:06 627 ---ha-w C:\Documents and Settings\Tanvir\hpothb07.dat
2006-03-28 12:00 0 ---ha-w C:\Documents and Settings\NetworkService\hpothb07.dat
.
((((((((((((((((((((((((((((( snapshot@2008-05-26_20.10.16.71 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-26 17:58:44 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-26 18:30:18 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-26 18:30:46 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_130.dat
+ 2008-05-26 18:31:01 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_640.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4C907918-2338-4FC3-A890-4D7A72E1B00C}]
C:\WINDOWS\system32\audiodfv.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{da30eff8-ccc6-4162-a20d-67402a26a215}]
2008-01-07 18:38 1530904 --a------ C:\Program Files\Best_Security_Tips\tbBest.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{DA30EFF8-CCC6-4162-A20D-67402A26A215}"= "C:\Program Files\Best_Security_Tips\tbBest.dll" [2008-01-07 18:38 1530904]
[HKEY_CLASSES_ROOT\clsid\{da30eff8-ccc6-4162-a20d-67402a26a215}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{DA30EFF8-CCC6-4162-A20D-67402A26A215}"= C:\Program Files\Best_Security_Tips\tbBest.dll [2008-01-07 18:38 1530904]
[HKEY_CLASSES_ROOT\clsid\{da30eff8-ccc6-4162-a20d-67402a26a215}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 14:00 15360]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [ ]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe" [ ]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ]
"Wipe Expert"="C:\Program Files\Bodrag\Wipe Expert\WipeExpert.exe" [ ]
"EPSON Stylus DX4000 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.exe" [2006-09-21 05:01 139264]
"Steam"="c:\program files\steam\steam.exe" [2008-03-28 13:08 1271032]
"ares"="C:\Program Files\Ares\Ares.exe" [ ]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2003-11-07 10:21 114688]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-06-09 09:56 6746112]
"Mouse Suite 98 Daemon"="ICO.EXE" [2002-03-14 16:46 45056 C:\WINDOWS\system32\ico.exe]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2005-06-29 07:33 114688]
"SonyPowerCfg"="C:\Program Files\Sony\VAIO Power Management\SPMgr.exe" [2005-05-15 05:51 184320]
"ISBMgr.exe"="C:\Program Files\Sony\ISB Utility\ISBMgr.exe" [2004-02-20 14:12 32768]
"VAIO Update 2"="C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" [2005-01-14 13:43 151552]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-06-29 07:33 94208]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-06-29 07:33 77824]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2005-03-03 21:47 483328]
"OdTray.exe"="C:\Program Files\ZyXEL\Odyssey Client for ZyXEL\OdTray.exe" [2004-03-15 18:26 626746]
"NWEReboot"="" []
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" []
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-07-19 10:06 98304]
"SSBkgdUpdate"="C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 11:22 155648]
"PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [2004-03-10 12:20 57393]
"IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2004-03-10 12:39 40960]
"SetDefPrt"="C:\Program Files\Brother\Brmfl04b\BrStDvPt.exe" [2004-05-25 10:16 49152]
"RTHDCPL"="RTHDCPL.EXE" [2005-06-29 06:25 14720000 C:\WINDOWS\RTHDCPL.EXE]
"AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [2005-04-29 07:56 45056]
"Spn2006"="C:\Program Files\Spn\emp.exe" [ ]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-08-25 20:16 1838592]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-04-02 21:07 919016]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_15\bin\jusched.exe" [2007-05-22 17:39 32881]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"SymLnch"="C:\Documents and Settings\TANVIR_2\Application Data\Symantec\Layouts\Norton Internet Security\15.0\SymAllLanguages\NIS_RETAIL\20070828\Support\SymLnch\SymLnch.exe" [2007-08-26 18:04 687976]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 14:00 15360]
"ALUAlert"="C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe" [ ]
"Symantec NetDriver Warning"="C:\PROGRA~1\SYMNET~1\SNDWarn.exe" [ ]
C:\Documents and Settings\Administrateur\Menu D‚marrer\Programmes\D‚marrage\
VAIO Launcher.lnk - C:\Program Files\Sony\VAIO Launcher\Launcher.exe [2005-10-28 23:47:04 778240]
C:\Documents and Settings\Invit‚\Menu D‚marrer\Programmes\D‚marrage\
VAIO Launcher.lnk - C:\Program Files\Sony\VAIO Launcher\Launcher.exe [2005-10-28 23:47:04 778240]
C:\Documents and Settings\Tanvir\Menu D‚marrer\Programmes\D‚marrage\
VAIO Launcher.lnk - C:\Program Files\Sony\VAIO Launcher\Launcher.exe [2005-10-28 23:47:04 778240]
C:\Documents and Settings\TANVIR_2\Menu D‚marrer\Programmes\D‚marrage\
VAIO Launcher.lnk - C:\Program Files\Sony\VAIO Launcher\Launcher.exe [2005-10-28 23:47:04 778240]
C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
EPSON Background Monitor.lnk - C:\ESM2\Stms.exe [2007-11-11 21:16:48 224768]
Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 08:05:26 29696]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
VESWinlogon.dll 2005-05-20 17:42 73728 C:\WINDOWS\system32\VESWinlogon.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.dvsd"= C:\PROGRA~1\FICHIE~1\SONYSH~1\VideoLib\sonydv.dll
"vidc.xvid"= xvid.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\system32\\sessmgr.exe"=
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R2 MSSQL$VAIO_VEDB;MSSQL$VAIO_VEDB;C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe [2002-12-17 17:55]
R2 ntrconnect;NTRconnect;C:\Program Files\NTR global\NTRconnect\ntrconnect.exe [2006-11-17 17:12]
R3 AWINDIS5;AWINDIS5 Protocol Driver;C:\WINDOWS\system32\AWINDIS5.SYS [2002-04-11 17:43]
R3 odysseyIM3;Odyssey Network Services Miniport;C:\WINDOWS\system32\DRIVERS\odysseyIM3.sys [2004-03-15 17:36]
S3 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe" [2006-12-27 01:12]
S3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\Drivers\BrScnUsb.sys [2003-12-19 22:15]
S3 BrSerIf;Brother MFC Serial Port Interface WDM Driver;C:\WINDOWS\system32\Drivers\BrSerIf.sys [2004-06-12 06:27]
S3 BrUsbSer;Brother MFC USB Serial WDM Driver;C:\WINDOWS\system32\Drivers\BrUsbSer.sys [2004-01-10 05:28]
S3 FTLUND;Lundinova Filter Driver;C:\WINDOWS\system32\drivers\ftlund.sys [2004-01-19 17:27]
S3 SQLAgent$VAIO_VEDB;SQLAgent$VAIO_VEDB;C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlagent.EXE [2002-12-17 17:23]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 23:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ae0fd882-fdab-11dc-ae0b-0014a415cd88}]
\Shell\AutoRun\command - G:\nideiect.com
\Shell\explore\Command - G:\nideiect.com
\Shell\open\Command - G:\nideiect.com
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-05-25 20:16:41 C:\WINDOWS\Tasks\User_Feed_Synchronization-{44684F64-8B35-4E53-A30D-204E94DA27E9}.job"
- C:\WINDOWS\system32\msfeedssync.exe
"2008-05-26 18:52:02 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-26 21:10:11
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cachés ...
Balayage caché autostart entries ...
Balayage des fichiers cachés ...
Scan terminé avec succès
Les fichiers cachés: 0
**************************************************************************
.
Temps d'accomplissement: 2008-05-26 21:14:08
ComboFix-quarantined-files.txt 2008-05-26 19:13:45
Pre-Run: 15,440,203,776 octets libres
Post-Run: 15,427,706,880 octets libres
360 --- E O F --- 2008-05-19 20:28:06
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.33.1036.18.122 [GMT 2:00]
Endroit: C:\Documents and Settings\TANVIR_2\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\TANVIR_2\Bureau\CFScript.txt..txt
* Création d'un nouveau point de restauration
FILE ::
G:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE
G:\WINDOWS\SYSTEM32\DRIVERS\MDELK.EXE
G:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS
G:\WINDOWS\SYSTEM32\WINTEMS.EXE
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\Documents and Settings\Tanvir\Application Data\HbTools
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1170435599.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1171016978.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1171210711.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1171536754.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1171994967.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1172271532.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1172695385.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1173352608.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1173720367.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1173887881.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1174231297.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1174474070.log
C:\Documents and Settings\Tanvir\Application Data\HbTools\HbTools_1174672158.log
C:\Documents and Settings\Tanvir\Application Data\HbTools_Icons
C:\Documents and Settings\Tanvir\Application Data\HbTools_Icons\games2.ico
C:\Documents and Settings\Tanvir\Application Data\HbTools_Icons\Jamster2.ico
C:\Documents and Settings\Tanvir\Application Data\HbTools_Icons\wallpapere1.ico
C:\Documents and Settings\TANVIR_2\Application Data\macromedia\Flash Player\#SharedObjects\4HJE3BFM\iforex.com
C:\Documents and Settings\TANVIR_2\Application Data\macromedia\Flash Player\#SharedObjects\4HJE3BFM\iforex.com\Emerp\Events\flash_object.swf\user_data.sol
C:\Documents and Settings\TANVIR_2\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com
C:\Documents and Settings\TANVIR_2\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com\settings.sol
C:\WINDOWS\pack.epk
C:\WINDOWS\system32\bpcjwdqdky.dat
C:\WINDOWS\system32\bpcjwdqdky_nav.dat
C:\WINDOWS\system32\bpcjwdqdky_navps.dat
C:\WINDOWS\system32\drivers\downld
C:\WINDOWS\system32\drivers\downld\1251843.exe
C:\WINDOWS\system32\drivers\downld\1265546.exe
C:\WINDOWS\system32\drivers\downld\1267000.exe
C:\WINDOWS\system32\drivers\downld\1270437.exe
C:\WINDOWS\system32\drivers\downld\1286484.exe
C:\WINDOWS\system32\drivers\downld\1388671.exe
C:\WINDOWS\system32\drivers\downld\1396765.exe
C:\WINDOWS\system32\drivers\downld\14736250.exe
C:\WINDOWS\system32\drivers\downld\14785203.exe
C:\WINDOWS\system32\drivers\downld\14801406.exe
C:\WINDOWS\system32\drivers\downld\14952921.exe
C:\WINDOWS\system32\drivers\downld\14964515.exe
C:\WINDOWS\system32\drivers\downld\14971796.exe
C:\WINDOWS\system32\drivers\downld\15095078.exe
C:\WINDOWS\system32\drivers\downld\15160343.exe
C:\WINDOWS\system32\drivers\downld\15250000.exe
C:\WINDOWS\system32\drivers\downld\15262531.exe
C:\WINDOWS\system32\drivers\downld\15268421.exe
C:\WINDOWS\system32\drivers\downld\15689843.exe
C:\WINDOWS\system32\drivers\downld\15702156.exe
C:\WINDOWS\system32\drivers\downld\15744359.exe
C:\WINDOWS\system32\drivers\downld\15801171.exe
C:\WINDOWS\system32\drivers\downld\15806781.exe
C:\WINDOWS\system32\drivers\downld\15862421.exe
C:\WINDOWS\system32\drivers\downld\15871703.exe
C:\WINDOWS\system32\drivers\downld\15876031.exe
C:\WINDOWS\system32\drivers\downld\159500.exe
C:\WINDOWS\system32\drivers\downld\166171.exe
C:\WINDOWS\system32\drivers\downld\16630078.exe
C:\WINDOWS\system32\drivers\downld\16693796.exe
C:\WINDOWS\system32\drivers\downld\16708890.exe
C:\WINDOWS\system32\drivers\downld\176437.exe
C:\WINDOWS\system32\drivers\downld\204031.exe
C:\WINDOWS\system32\drivers\downld\220500.exe
C:\WINDOWS\system32\drivers\downld\223140.exe
C:\WINDOWS\system32\drivers\downld\229062.exe
C:\WINDOWS\system32\drivers\downld\231218.exe
C:\WINDOWS\system32\drivers\downld\257703.exe
C:\WINDOWS\system32\drivers\downld\271843.exe
C:\WINDOWS\system32\drivers\downld\278625.exe
C:\WINDOWS\system32\drivers\downld\279328.exe
C:\WINDOWS\system32\drivers\downld\290093.exe
C:\WINDOWS\system32\drivers\downld\296359.exe
C:\WINDOWS\system32\drivers\downld\300968.exe
C:\WINDOWS\system32\drivers\downld\303359.exe
C:\WINDOWS\system32\drivers\downld\314593.exe
C:\WINDOWS\system32\drivers\downld\323203.exe
C:\WINDOWS\system32\drivers\downld\324328.exe
C:\WINDOWS\system32\drivers\downld\353906.exe
C:\WINDOWS\system32\drivers\downld\383093.exe
C:\WINDOWS\system32\drivers\downld\384343.exe
C:\WINDOWS\system32\drivers\downld\408546.exe
C:\WINDOWS\system32\drivers\downld\411046.exe
C:\WINDOWS\system32\drivers\downld\417406.exe
C:\WINDOWS\system32\drivers\downld\438968.exe
C:\WINDOWS\system32\drivers\downld\451328.exe
C:\WINDOWS\system32\drivers\downld\4656218.exe
C:\WINDOWS\system32\drivers\downld\4687781.exe
C:\WINDOWS\system32\drivers\downld\4696078.exe
C:\WINDOWS\system32\drivers\downld\4766093.exe
C:\WINDOWS\system32\drivers\downld\478109.exe
C:\WINDOWS\system32\drivers\downld\5052187.exe
C:\WINDOWS\system32\drivers\downld\520484.exe
C:\WINDOWS\system32\drivers\downld\533000.exe
C:\WINDOWS\system32\drivers\downld\539109.exe
C:\WINDOWS\system32\drivers\downld\549046.exe
C:\WINDOWS\system32\drivers\downld\602671.exe
C:\WINDOWS\system32\drivers\downld\606296.exe
C:\WINDOWS\system32\drivers\downld\611703.exe
C:\WINDOWS\system32\drivers\downld\616562.exe
C:\WINDOWS\system32\drivers\downld\629750.exe
C:\WINDOWS\system32\drivers\downld\630281.exe
C:\WINDOWS\system32\drivers\downld\636312.exe
C:\WINDOWS\system32\drivers\downld\638375.exe
C:\WINDOWS\system32\drivers\downld\729203.exe
C:\WINDOWS\system32\drivers\downld\762593.exe
C:\WINDOWS\system32\drivers\downld\796234.exe
C:\WINDOWS\system32\drivers\downld\806250.exe
C:\WINDOWS\system32\drivers\downld\968218.exe
C:\WINDOWS\system32\nvs2.inf
D:\Autorun.inf
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_NPF
-------\Legacy_SROSA
((((((((((((((((((((((((((((( Fichiers créés 2008-04-26 to 2008-05-26 ))))))))))))))))))))))))))))))))))))
.
2008-05-26 16:32 . 2007-05-22 17:39 61,555 --a------ C:\WINDOWS\system32\jpicpl32.cpl
2008-05-24 13:03 . 2008-05-26 21:10 1,083,424 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-05-24 13:03 . 2008-05-26 20:29 14,432 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-05-24 12:57 . 2008-05-24 12:57 <REP> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-05-24 12:57 . 2008-05-24 13:01 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2008-05-24 12:56 . 2008-04-02 21:08 54,672 --a------ C:\WINDOWS\system32\vsutil_loc040c.dll
2008-05-24 12:56 . 2008-04-02 21:08 42,384 --a------ C:\WINDOWS\zllsputility_loc040c.dll
2008-05-24 12:56 . 2008-04-02 21:08 21,904 --a------ C:\WINDOWS\system32\imsinstall_loc040c.dll
2008-05-24 12:56 . 2008-04-02 21:08 17,808 --a------ C:\WINDOWS\system32\imslsp_install_loc040c.dll
2008-05-24 12:55 . 2008-04-02 21:07 75,248 --a------ C:\WINDOWS\zllsputility.exe
2008-05-24 12:53 . 2008-05-24 12:56 <REP> d-------- C:\WINDOWS\system32\ZoneLabs
2008-05-24 12:53 . 2008-05-24 12:53 <REP> d-------- C:\Program Files\Zone Labs
2008-05-24 12:53 . 2008-04-02 21:07 1,086,952 --a------ C:\WINDOWS\system32\zpeng24.dll
2008-05-24 12:53 . 2008-05-26 20:33 358,382 --a------ C:\WINDOWS\system32\vsconfig.xml
2008-05-24 12:52 . 2008-05-26 20:57 <REP> d-------- C:\WINDOWS\Internet Logs
2008-05-24 12:43 . 2008-05-24 12:43 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-05-24 12:43 . 2008-05-24 12:47 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-24 10:51 . 2008-05-24 10:51 <REP> d-------- C:\Program Files\Alwil Software
2008-05-23 21:02 . 2008-05-23 21:02 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\vlc
2008-05-23 21:01 . 2005-07-13 13:56 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage réseau
2008-05-23 21:01 . 2005-07-13 13:56 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-05-23 21:01 . 2005-07-13 12:01 <REP> d--h----- C:\Documents and Settings\Administrateur\Modèles
2008-05-23 21:01 . 2005-07-21 16:38 <REP> dr------- C:\Documents and Settings\Administrateur\Mes documents
2008-05-23 21:01 . 2005-07-13 15:35 <REP> dr------- C:\Documents and Settings\Administrateur\Menu Démarrer
2008-05-23 21:01 . 2005-07-21 16:38 <REP> dr------- C:\Documents and Settings\Administrateur\Favoris
2008-05-23 21:01 . 2005-07-13 15:46 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-05-23 21:01 . 2005-07-13 15:40 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Symantec
2008-05-23 21:01 . 2005-07-13 15:31 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Sony Corporation
2008-05-23 21:01 . 2008-05-23 21:01 <REP> d-------- C:\Documents and Settings\Administrateur
2008-05-22 22:09 . 2008-05-23 20:56 396,288 --a------ C:\HijackThis.exe
2008-05-22 21:00 . 2008-05-22 21:00 <REP> d-------- C:\Program Files\Trend Micro
2008-05-21 16:24 . 2008-05-21 16:24 303 --a------ C:\WINDOWS\ST6UNST.004
2008-05-20 19:12 . 2008-05-20 19:12 <REP> d-------- C:\Program Files\Windows Sidebar
2008-05-20 19:12 . 2008-05-20 19:12 <REP> d-------- C:\Program Files\Norton AntiVirus
2008-05-20 18:10 . 2008-05-21 16:24 4,236 --a------ C:\WINDOWS\SETUP.LST
2008-05-20 18:10 . 2008-05-20 18:10 303 --a------ C:\WINDOWS\ST6UNST.003
2008-05-20 18:03 . 2008-05-26 16:32 <REP> d-------- C:\Program Files\Java
2008-05-19 22:55 . 2008-05-19 22:55 <REP> d-------- C:\Documents and Settings\TANVIR_2\Application Data\Symantec
2008-05-19 22:27 . 2003-02-28 18:26 139,536 --a------ C:\WINDOWS\system32\javaee.dll
2008-05-19 16:50 . 2004-08-05 14:00 23,040 --a------ C:\WINDOWS\system32\lpdsvc.dll
2008-05-19 16:50 . 2004-08-05 14:00 23,040 --a--c--- C:\WINDOWS\system32\dllcache\lpdsvc.dll
2008-05-19 16:50 . 2004-08-05 14:00 19,456 --a------ C:\WINDOWS\system32\lprmon.dll
2008-05-19 16:50 . 2004-08-05 14:00 19,456 --a--c--- C:\WINDOWS\system32\dllcache\lprmon.dll
2008-05-19 16:44 . 2008-05-19 16:44 303 --a------ C:\WINDOWS\ST6UNST.002
2008-05-19 16:44 . 2008-05-19 16:44 28 --a------ C:\WINDOWS\_wi57.tmp
2008-05-15 20:52 . 2008-05-15 22:44 <REP> d-------- C:\Program Files\Incomplete
2008-05-15 20:13 . 2008-05-15 20:13 <REP> d-------- C:\Program Files\Sun
2008-05-08 19:34 . 2008-05-08 19:34 <REP> d-------- C:\Documents and Settings\TANVIR_2\Application Data\Ethereal
2008-05-08 19:02 . 2008-05-08 19:02 <REP> d-------- C:\Program Files\Conduit
2008-05-08 18:53 . 2008-05-08 19:04 <REP> d-------- C:\Program Files\Best_Security_Tips
2008-05-08 18:47 . 2008-05-16 17:46 <REP> d-------- C:\Program Files\LimeWire Turbo Accelerator
2008-05-08 18:01 . 2008-05-08 18:01 <REP> d-------- C:\Program Files\XviD
2008-05-08 18:00 . 2008-05-08 18:00 <REP> d-------- C:\Apex
2008-04-30 18:04 . 2008-04-30 18:04 <REP> d-------- C:\Program Files\Neoretix
2008-04-28 19:24 . 2008-04-28 19:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SlySoft
2008-04-28 19:22 . 2008-04-28 19:22 <REP> d-------- C:\Documents and Settings\TANVIR_2\Application Data\SlySoft
2008-04-28 19:21 . 2008-04-28 19:46 <REP> d-------- C:\Program Files\SlySoft
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-26 18:34 --------- d-----w C:\Program Files\Steam
2008-05-25 20:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-05-23 15:28 --------- d-----w C:\Program Files\Google
2008-05-23 15:14 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2008-05-21 15:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-05-21 14:38 806 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-05-21 14:38 10,652 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-05-19 16:02 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-05-19 15:12 --------- d-----w C:\Program Files\RTQDownloader
2008-05-16 15:58 --------- d-----w C:\Program Files\LimeWire
2008-05-15 20:44 --------- d-----w C:\Documents and Settings\TANVIR_2\Application Data\LimeWire
2008-05-15 20:34 --------- d-----w C:\Program Files\eMule
2008-05-08 16:00 --------- d-----w C:\Program Files\Apex
2008-04-23 15:03 --------- d-----w C:\Program Files\WinAVI MP4 Converter
2008-04-13 17:28 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-08 15:56 --------- d-----w C:\Documents and Settings\TANVIR_2\Application Data\ntr
2008-04-01 19:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\Adobe Systems
2008-04-01 13:10 --------- d-----w C:\Program Files\Zattoo
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 194,144 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-01 12:58 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2007-05-18 14:48 87,608 ----a-w C:\Documents and Settings\TANVIR_2\Application Data\ezpinst.exe
2007-05-18 14:48 47,360 ----a-w C:\Documents and Settings\TANVIR_2\Application Data\pcouffin.sys
2007-04-25 17:20 144,464 ----a-w C:\Documents and Settings\TANVIR_2\Application Data\GDIPFONTCACHEV1.DAT
2006-11-24 17:10 0 ---ha-w C:\Documents and Settings\TANVIR_2\hpothb07.dat
2006-11-24 17:06 627 ---ha-w C:\Documents and Settings\Tanvir\hpothb07.dat
2006-03-28 12:00 0 ---ha-w C:\Documents and Settings\NetworkService\hpothb07.dat
.
((((((((((((((((((((((((((((( snapshot@2008-05-26_20.10.16.71 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-26 17:58:44 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-26 18:30:18 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-26 18:30:46 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_130.dat
+ 2008-05-26 18:31:01 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_640.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4C907918-2338-4FC3-A890-4D7A72E1B00C}]
C:\WINDOWS\system32\audiodfv.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{da30eff8-ccc6-4162-a20d-67402a26a215}]
2008-01-07 18:38 1530904 --a------ C:\Program Files\Best_Security_Tips\tbBest.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{DA30EFF8-CCC6-4162-A20D-67402A26A215}"= "C:\Program Files\Best_Security_Tips\tbBest.dll" [2008-01-07 18:38 1530904]
[HKEY_CLASSES_ROOT\clsid\{da30eff8-ccc6-4162-a20d-67402a26a215}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{DA30EFF8-CCC6-4162-A20D-67402A26A215}"= C:\Program Files\Best_Security_Tips\tbBest.dll [2008-01-07 18:38 1530904]
[HKEY_CLASSES_ROOT\clsid\{da30eff8-ccc6-4162-a20d-67402a26a215}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 14:00 15360]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [ ]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe" [ ]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ]
"Wipe Expert"="C:\Program Files\Bodrag\Wipe Expert\WipeExpert.exe" [ ]
"EPSON Stylus DX4000 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.exe" [2006-09-21 05:01 139264]
"Steam"="c:\program files\steam\steam.exe" [2008-03-28 13:08 1271032]
"ares"="C:\Program Files\Ares\Ares.exe" [ ]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2003-11-07 10:21 114688]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-06-09 09:56 6746112]
"Mouse Suite 98 Daemon"="ICO.EXE" [2002-03-14 16:46 45056 C:\WINDOWS\system32\ico.exe]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2005-06-29 07:33 114688]
"SonyPowerCfg"="C:\Program Files\Sony\VAIO Power Management\SPMgr.exe" [2005-05-15 05:51 184320]
"ISBMgr.exe"="C:\Program Files\Sony\ISB Utility\ISBMgr.exe" [2004-02-20 14:12 32768]
"VAIO Update 2"="C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" [2005-01-14 13:43 151552]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-06-29 07:33 94208]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-06-29 07:33 77824]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2005-03-03 21:47 483328]
"OdTray.exe"="C:\Program Files\ZyXEL\Odyssey Client for ZyXEL\OdTray.exe" [2004-03-15 18:26 626746]
"NWEReboot"="" []
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" []
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-07-19 10:06 98304]
"SSBkgdUpdate"="C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 11:22 155648]
"PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [2004-03-10 12:20 57393]
"IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2004-03-10 12:39 40960]
"SetDefPrt"="C:\Program Files\Brother\Brmfl04b\BrStDvPt.exe" [2004-05-25 10:16 49152]
"RTHDCPL"="RTHDCPL.EXE" [2005-06-29 06:25 14720000 C:\WINDOWS\RTHDCPL.EXE]
"AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [2005-04-29 07:56 45056]
"Spn2006"="C:\Program Files\Spn\emp.exe" [ ]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-08-25 20:16 1838592]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-04-02 21:07 919016]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_15\bin\jusched.exe" [2007-05-22 17:39 32881]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"SymLnch"="C:\Documents and Settings\TANVIR_2\Application Data\Symantec\Layouts\Norton Internet Security\15.0\SymAllLanguages\NIS_RETAIL\20070828\Support\SymLnch\SymLnch.exe" [2007-08-26 18:04 687976]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 14:00 15360]
"ALUAlert"="C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe" [ ]
"Symantec NetDriver Warning"="C:\PROGRA~1\SYMNET~1\SNDWarn.exe" [ ]
C:\Documents and Settings\Administrateur\Menu D‚marrer\Programmes\D‚marrage\
VAIO Launcher.lnk - C:\Program Files\Sony\VAIO Launcher\Launcher.exe [2005-10-28 23:47:04 778240]
C:\Documents and Settings\Invit‚\Menu D‚marrer\Programmes\D‚marrage\
VAIO Launcher.lnk - C:\Program Files\Sony\VAIO Launcher\Launcher.exe [2005-10-28 23:47:04 778240]
C:\Documents and Settings\Tanvir\Menu D‚marrer\Programmes\D‚marrage\
VAIO Launcher.lnk - C:\Program Files\Sony\VAIO Launcher\Launcher.exe [2005-10-28 23:47:04 778240]
C:\Documents and Settings\TANVIR_2\Menu D‚marrer\Programmes\D‚marrage\
VAIO Launcher.lnk - C:\Program Files\Sony\VAIO Launcher\Launcher.exe [2005-10-28 23:47:04 778240]
C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
EPSON Background Monitor.lnk - C:\ESM2\Stms.exe [2007-11-11 21:16:48 224768]
Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 08:05:26 29696]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
VESWinlogon.dll 2005-05-20 17:42 73728 C:\WINDOWS\system32\VESWinlogon.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.dvsd"= C:\PROGRA~1\FICHIE~1\SONYSH~1\VideoLib\sonydv.dll
"vidc.xvid"= xvid.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\system32\\sessmgr.exe"=
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R2 MSSQL$VAIO_VEDB;MSSQL$VAIO_VEDB;C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe [2002-12-17 17:55]
R2 ntrconnect;NTRconnect;C:\Program Files\NTR global\NTRconnect\ntrconnect.exe [2006-11-17 17:12]
R3 AWINDIS5;AWINDIS5 Protocol Driver;C:\WINDOWS\system32\AWINDIS5.SYS [2002-04-11 17:43]
R3 odysseyIM3;Odyssey Network Services Miniport;C:\WINDOWS\system32\DRIVERS\odysseyIM3.sys [2004-03-15 17:36]
S3 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe" [2006-12-27 01:12]
S3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\Drivers\BrScnUsb.sys [2003-12-19 22:15]
S3 BrSerIf;Brother MFC Serial Port Interface WDM Driver;C:\WINDOWS\system32\Drivers\BrSerIf.sys [2004-06-12 06:27]
S3 BrUsbSer;Brother MFC USB Serial WDM Driver;C:\WINDOWS\system32\Drivers\BrUsbSer.sys [2004-01-10 05:28]
S3 FTLUND;Lundinova Filter Driver;C:\WINDOWS\system32\drivers\ftlund.sys [2004-01-19 17:27]
S3 SQLAgent$VAIO_VEDB;SQLAgent$VAIO_VEDB;C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlagent.EXE [2002-12-17 17:23]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 23:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ae0fd882-fdab-11dc-ae0b-0014a415cd88}]
\Shell\AutoRun\command - G:\nideiect.com
\Shell\explore\Command - G:\nideiect.com
\Shell\open\Command - G:\nideiect.com
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-05-25 20:16:41 C:\WINDOWS\Tasks\User_Feed_Synchronization-{44684F64-8B35-4E53-A30D-204E94DA27E9}.job"
- C:\WINDOWS\system32\msfeedssync.exe
"2008-05-26 18:52:02 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-26 21:10:11
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cachés ...
Balayage caché autostart entries ...
Balayage des fichiers cachés ...
Scan terminé avec succès
Les fichiers cachés: 0
**************************************************************************
.
Temps d'accomplissement: 2008-05-26 21:14:08
ComboFix-quarantined-files.txt 2008-05-26 19:13:45
Pre-Run: 15,440,203,776 octets libres
Post-Run: 15,427,706,880 octets libres
360 --- E O F --- 2008-05-19 20:28:06
g!rly
Messages postés
18209
Date d'inscription
vendredi 17 août 2007
Statut
Contributeur
Dernière intervention
30 novembre 2014
406
26 mai 2008 à 21:19
26 mai 2008 à 21:19
tu n´as pas utilisé ce script ?!
tu as utilisé celui du debut ? pk ?
Copie le texte ci-dessous :
File::
C:\WINDOWS\ST6UNST.002
C:\WINDOWS\_wi57.tmp
Folder::
C:\Program Files\Spn
C:\Program Files\Bodrag
C:\Program Files\Fichiers communs\BOONTY Shared
Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Wipe Expert"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Spn2006"=-
Driver::
Boonty Games
Ouvre le Bloc-Notes puis colle le texte copié.
(Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Sauvegarde ce fichier sous le nom de CFScript.txt.
Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :
http://sd-1.archive-host.com/membres/up/1366464061/CFScript.gif
Cela va relancer Combofix,
Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.
S'il n'y a pas de rédémarrage, poste quand même les rapports.
recommence
@+
tu as utilisé celui du debut ? pk ?
Copie le texte ci-dessous :
File::
C:\WINDOWS\ST6UNST.002
C:\WINDOWS\_wi57.tmp
Folder::
C:\Program Files\Spn
C:\Program Files\Bodrag
C:\Program Files\Fichiers communs\BOONTY Shared
Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Wipe Expert"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Spn2006"=-
Driver::
Boonty Games
Ouvre le Bloc-Notes puis colle le texte copié.
(Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Sauvegarde ce fichier sous le nom de CFScript.txt.
Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :
http://sd-1.archive-host.com/membres/up/1366464061/CFScript.gif
Cela va relancer Combofix,
Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.
S'il n'y a pas de rédémarrage, poste quand même les rapports.
recommence
@+
kwon
Messages postés
75
Date d'inscription
dimanche 15 juillet 2007
Statut
Membre
Dernière intervention
18 mai 2009
1
26 mai 2008 à 22:23
26 mai 2008 à 22:23
Avant j'aivai confondu avec le premier truc que tu m'avai donné, et voilà le rapport (jespère que cette fois ci g réussi^^):
ComboFix 08-05-25.5 - TANVIR_2 2008-05-26 21:55:02.3 - NTFSx86
Endroit: C:\Documents and Settings\TANVIR_2\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\TANVIR_2\Bureau\CFScript.txt
* Création d'un nouveau point de restauration
FILE ::
C:\WINDOWS\_wi57.tmp
C:\WINDOWS\ST6UNST.002
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Program Files\Bodrag
C:\Program Files\Bodrag\Wipe Expert\WipeExpert.log
C:\Program Files\Fichiers communs\BOONTY Shared
C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
C:\Program Files\Spn
C:\WINDOWS\_wi57.tmp
C:\WINDOWS\ST6UNST.002
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_BOONTY_GAMES
-------\Service_Boonty Games
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-04-26 to 2008-05-26 ))))))))))))))))))))))))))))))))))))
.
2008-05-26 16:32 . 2007-05-22 17:39 61,555 --a------ C:\WINDOWS\system32\jpicpl32.cpl
2008-05-24 13:03 . 2008-05-26 22:10 1,122,336 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-05-24 13:03 . 2008-05-26 22:00 15,224 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-05-24 12:57 . 2008-05-24 12:57 <REP> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-05-24 12:57 . 2008-05-24 13:01 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2008-05-24 12:56 . 2008-04-02 21:08 54,672 --a------ C:\WINDOWS\system32\vsutil_loc040c.dll
2008-05-24 12:56 . 2008-04-02 21:08 42,384 --a------ C:\WINDOWS\zllsputility_loc040c.dll
2008-05-24 12:56 . 2008-04-02 21:08 21,904 --a------ C:\WINDOWS\system32\imsinstall_loc040c.dll
2008-05-24 12:56 . 2008-04-02 21:08 17,808 --a------ C:\WINDOWS\system32\imslsp_install_loc040c.dll
2008-05-24 12:55 . 2008-04-02 21:07 75,248 --a------ C:\WINDOWS\zllsputility.exe
2008-05-24 12:53 . 2008-05-24 12:56 <REP> d-------- C:\WINDOWS\system32\ZoneLabs
2008-05-24 12:53 . 2008-05-24 12:53 <REP> d-------- C:\Program Files\Zone Labs
2008-05-24 12:53 . 2008-04-02 21:07 1,086,952 --a------ C:\WINDOWS\system32\zpeng24.dll
2008-05-24 12:53 . 2008-05-26 22:03 358,382 --a------ C:\WINDOWS\system32\vsconfig.xml
2008-05-24 12:52 . 2008-05-26 22:02 <REP> d-------- C:\WINDOWS\Internet Logs
2008-05-24 12:43 . 2008-05-24 12:43 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-05-24 12:43 . 2008-05-24 12:47 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-24 10:51 . 2008-05-24 10:51 <REP> d-------- C:\Program Files\Alwil Software
2008-05-23 21:02 . 2008-05-23 21:02 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\vlc
2008-05-23 21:01 . 2005-07-13 13:56 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau
2008-05-23 21:01 . 2005-07-13 13:56 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-05-23 21:01 . 2005-07-13 12:01 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
2008-05-23 21:01 . 2005-07-21 16:38 <REP> dr------- C:\Documents and Settings\Administrateur\Mes documents
2008-05-23 21:01 . 2005-07-13 15:35 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
2008-05-23 21:01 . 2005-07-21 16:38 <REP> dr------- C:\Documents and Settings\Administrateur\Favoris
2008-05-23 21:01 . 2005-07-13 15:46 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-05-23 21:01 . 2005-07-13 15:40 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Symantec
2008-05-23 21:01 . 2005-07-13 15:31 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Sony Corporation
2008-05-23 21:01 . 2008-05-23 21:01 <REP> d-------- C:\Documents and Settings\Administrateur
2008-05-22 22:09 . 2008-05-23 20:56 396,288 --a------ C:\HijackThis.exe
2008-05-22 21:00 . 2008-05-22 21:00 <REP> d-------- C:\Program Files\Trend Micro
2008-05-21 16:24 . 2008-05-21 16:24 303 --a------ C:\WINDOWS\ST6UNST.004
2008-05-20 19:12 . 2008-05-20 19:12 <REP> d-------- C:\Program Files\Windows Sidebar
2008-05-20 19:12 . 2008-05-20 19:12 <REP> d-------- C:\Program Files\Norton AntiVirus
2008-05-20 18:10 . 2008-05-21 16:24 4,236 --a------ C:\WINDOWS\SETUP.LST
2008-05-20 18:10 . 2008-05-20 18:10 303 --a------ C:\WINDOWS\ST6UNST.003
2008-05-20 18:03 . 2008-05-26 16:32 <REP> d-------- C:\Program Files\Java
2008-05-19 22:55 . 2008-05-19 22:55 <REP> d-------- C:\Documents and Settings\TANVIR_2\Application Data\Symantec
2008-05-19 22:27 . 2003-02-28 18:26 139,536 --a------ C:\WINDOWS\system32\javaee.dll
2008-05-19 16:50 . 2004-08-05 14:00 23,040 --a------ C:\WINDOWS\system32\lpdsvc.dll
2008-05-19 16:50 . 2004-08-05 14:00 23,040 --a--c--- C:\WINDOWS\system32\dllcache\lpdsvc.dll
2008-05-19 16:50 . 2004-08-05 14:00 19,456 --a------ C:\WINDOWS\system32\lprmon.dll
2008-05-19 16:50 . 2004-08-05 14:00 19,456 --a--c--- C:\WINDOWS\system32\dllcache\lprmon.dll
2008-05-15 20:52 . 2008-05-15 22:44 <REP> d-------- C:\Program Files\Incomplete
2008-05-15 20:13 . 2008-05-15 20:13 <REP> d-------- C:\Program Files\Sun
2008-05-08 19:34 . 2008-05-08 19:34 <REP> d-------- C:\Documents and Settings\TANVIR_2\Application Data\Ethereal
2008-05-08 19:02 . 2008-05-08 19:02 <REP> d-------- C:\Program Files\Conduit
2008-05-08 18:53 . 2008-05-08 19:04 <REP> d-------- C:\Program Files\Best_Security_Tips
2008-05-08 18:47 . 2008-05-16 17:46 <REP> d-------- C:\Program Files\LimeWire Turbo Accelerator
2008-05-08 18:01 . 2008-05-08 18:01 <REP> d-------- C:\Program Files\XviD
2008-05-08 18:00 . 2008-05-08 18:00 <REP> d-------- C:\Apex
2008-04-30 18:04 . 2008-04-30 18:04 <REP> d-------- C:\Program Files\Neoretix
2008-04-28 19:24 . 2008-04-28 19:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SlySoft
2008-04-28 19:22 . 2008-04-28 19:22 <REP> d-------- C:\Documents and Settings\TANVIR_2\Application Data\SlySoft
2008-04-28 19:21 . 2008-04-28 19:46 <REP> d-------- C:\Program Files\SlySoft
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-26 20:10 --------- d-----w C:\Program Files\Steam
2008-05-25 20:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-05-23 15:28 --------- d-----w C:\Program Files\Google
2008-05-23 15:14 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2008-05-21 15:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-05-21 14:38 806 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-05-21 14:38 10,652 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-05-19 16:02 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-05-19 15:12 --------- d-----w C:\Program Files\RTQDownloader
2008-05-16 15:58 --------- d-----w C:\Program Files\LimeWire
2008-05-15 20:44 --------- d-----w C:\Documents and Settings\TANVIR_2\Application Data\LimeWire
2008-05-15 20:34 --------- d-----w C:\Program Files\eMule
2008-05-08 16:00 --------- d-----w C:\Program Files\Apex
2008-04-23 15:03 --------- d-----w C:\Program Files\WinAVI MP4 Converter
2008-04-13 17:28 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-08 15:56 --------- d-----w C:\Documents and Settings\TANVIR_2\Application Data\ntr
2008-04-01 19:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\Adobe Systems
2008-04-01 13:10 --------- d-----w C:\Program Files\Zattoo
2007-05-18 14:48 87,608 ----a-w C:\Documents and Settings\TANVIR_2\Application Data\ezpinst.exe
2007-05-18 14:48 47,360 ----a-w C:\Documents and Settings\TANVIR_2\Application Data\pcouffin.sys
2007-04-25 17:20 144,464 ----a-w C:\Documents and Settings\TANVIR_2\Application Data\GDIPFONTCACHEV1.DAT
2006-11-24 17:10 0 ---ha-w C:\Documents and Settings\TANVIR_2\hpothb07.dat
2006-11-24 17:06 627 ---ha-w C:\Documents and Settings\Tanvir\hpothb07.dat
2006-03-28 12:00 0 ---ha-w C:\Documents and Settings\NetworkService\hpothb07.dat
.
((((((((((((((((((((((((((((( snapshot@2008-05-26_20.10.16.71 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-26 17:58:44 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-26 20:01:25 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-26 20:01:53 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_210.dat
+ 2008-05-26 20:01:47 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_748.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4C907918-2338-4FC3-A890-4D7A72E1B00C}]
C:\WINDOWS\system32\audiodfv.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{da30eff8-ccc6-4162-a20d-67402a26a215}]
2008-01-07 18:38 1530904 --a------ C:\Program Files\Best_Security_Tips\tbBest.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{DA30EFF8-CCC6-4162-A20D-67402A26A215}"= "C:\Program Files\Best_Security_Tips\tbBest.dll" [2008-01-07 18:38 1530904]
[HKEY_CLASSES_ROOT\clsid\{da30eff8-ccc6-4162-a20d-67402a26a215}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{DA30EFF8-CCC6-4162-A20D-67402A26A215}"= C:\Program Files\Best_Security_Tips\tbBest.dll [2008-01-07 18:38 1530904]
[HKEY_CLASSES_ROOT\clsid\{da30eff8-ccc6-4162-a20d-67402a26a215}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 14:00 15360]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [ ]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe" [ ]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ]
"EPSON Stylus DX4000 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.exe" [2006-09-21 05:01 139264]
"Steam"="c:\program files\steam\steam.exe" [2008-03-28 13:08 1271032]
"ares"="C:\Program Files\Ares\Ares.exe" [ ]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2003-11-07 10:21 114688]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-06-09 09:56 6746112]
"Mouse Suite 98 Daemon"="ICO.EXE" [2002-03-14 16:46 45056 C:\WINDOWS\system32\ico.exe]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2005-06-29 07:33 114688]
"SonyPowerCfg"="C:\Program Files\Sony\VAIO Power Management\SPMgr.exe" [2005-05-15 05:51 184320]
"ISBMgr.exe"="C:\Program Files\Sony\ISB Utility\ISBMgr.exe" [2004-02-20 14:12 32768]
"VAIO Update 2"="C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" [2005-01-14 13:43 151552]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-06-29 07:33 94208]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-06-29 07:33 77824]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2005-03-03 21:47 483328]
"OdTray.exe"="C:\Program Files\ZyXEL\Odyssey Client for ZyXEL\OdTray.exe" [2004-03-15 18:26 626746]
"NWEReboot"="" []
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" []
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-07-19 10:06 98304]
"SSBkgdUpdate"="C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 11:22 155648]
"PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [2004-03-10 12:20 57393]
"IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2004-03-10 12:39 40960]
"SetDefPrt"="C:\Program Files\Brother\Brmfl04b\BrStDvPt.exe" [2004-05-25 10:16 49152]
"RTHDCPL"="RTHDCPL.EXE" [2005-06-29 06:25 14720000 C:\WINDOWS\RTHDCPL.EXE]
"AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [2005-04-29 07:56 45056]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-08-25 20:16 1838592]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-04-02 21:07 919016]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_15\bin\jusched.exe" [2007-05-22 17:39 32881]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"SymLnch"="C:\Documents and Settings\TANVIR_2\Application Data\Symantec\Layouts\Norton Internet Security\15.0\SymAllLanguages\NIS_RETAIL\20070828\Support\SymLnch\SymLnch.exe" [2007-08-26 18:04 687976]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 14:00 15360]
"ALUAlert"="C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe" [ ]
"Symantec NetDriver Warning"="C:\PROGRA~1\SYMNET~1\SNDWarn.exe" [ ]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
VESWinlogon.dll 2005-05-20 17:42 73728 C:\WINDOWS\system32\VESWinlogon.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.dvsd"= C:\PROGRA~1\FICHIE~1\SONYSH~1\VideoLib\sonydv.dll
"vidc.xvid"= xvid.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\system32\\sessmgr.exe"=
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R2 MSSQL$VAIO_VEDB;MSSQL$VAIO_VEDB;C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe [2002-12-17 17:55]
R2 ntrconnect;NTRconnect;C:\Program Files\NTR global\NTRconnect\ntrconnect.exe [2006-11-17 17:12]
R3 AWINDIS5;AWINDIS5 Protocol Driver;C:\WINDOWS\system32\AWINDIS5.SYS [2002-04-11 17:43]
R3 odysseyIM3;Odyssey Network Services Miniport;C:\WINDOWS\system32\DRIVERS\odysseyIM3.sys [2004-03-15 17:36]
S3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\Drivers\BrScnUsb.sys [2003-12-19 22:15]
S3 BrSerIf;Brother MFC Serial Port Interface WDM Driver;C:\WINDOWS\system32\Drivers\BrSerIf.sys [2004-06-12 06:27]
S3 BrUsbSer;Brother MFC USB Serial WDM Driver;C:\WINDOWS\system32\Drivers\BrUsbSer.sys [2004-01-10 05:28]
S3 FTLUND;Lundinova Filter Driver;C:\WINDOWS\system32\drivers\ftlund.sys [2004-01-19 17:27]
S3 SQLAgent$VAIO_VEDB;SQLAgent$VAIO_VEDB;C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlagent.EXE [2002-12-17 17:23]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 23:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ae0fd882-fdab-11dc-ae0b-0014a415cd88}]
\Shell\AutoRun\command - nideiect.com
\Shell\explore\Command - nideiect.com
\Shell\open\Command - nideiect.com
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-05-25 20:16:41 C:\WINDOWS\Tasks\User_Feed_Synchronization-{44684F64-8B35-4E53-A30D-204E94DA27E9}.job"
- C:\WINDOWS\system32\msfeedssync.exe
"2008-05-26 19:52:05 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"
ComboFix 08-05-25.5 - TANVIR_2 2008-05-26 21:55:02.3 - NTFSx86
Endroit: C:\Documents and Settings\TANVIR_2\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\TANVIR_2\Bureau\CFScript.txt
* Création d'un nouveau point de restauration
FILE ::
C:\WINDOWS\_wi57.tmp
C:\WINDOWS\ST6UNST.002
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Program Files\Bodrag
C:\Program Files\Bodrag\Wipe Expert\WipeExpert.log
C:\Program Files\Fichiers communs\BOONTY Shared
C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
C:\Program Files\Spn
C:\WINDOWS\_wi57.tmp
C:\WINDOWS\ST6UNST.002
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_BOONTY_GAMES
-------\Service_Boonty Games
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-04-26 to 2008-05-26 ))))))))))))))))))))))))))))))))))))
.
2008-05-26 16:32 . 2007-05-22 17:39 61,555 --a------ C:\WINDOWS\system32\jpicpl32.cpl
2008-05-24 13:03 . 2008-05-26 22:10 1,122,336 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-05-24 13:03 . 2008-05-26 22:00 15,224 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-05-24 12:57 . 2008-05-24 12:57 <REP> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-05-24 12:57 . 2008-05-24 13:01 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2008-05-24 12:56 . 2008-04-02 21:08 54,672 --a------ C:\WINDOWS\system32\vsutil_loc040c.dll
2008-05-24 12:56 . 2008-04-02 21:08 42,384 --a------ C:\WINDOWS\zllsputility_loc040c.dll
2008-05-24 12:56 . 2008-04-02 21:08 21,904 --a------ C:\WINDOWS\system32\imsinstall_loc040c.dll
2008-05-24 12:56 . 2008-04-02 21:08 17,808 --a------ C:\WINDOWS\system32\imslsp_install_loc040c.dll
2008-05-24 12:55 . 2008-04-02 21:07 75,248 --a------ C:\WINDOWS\zllsputility.exe
2008-05-24 12:53 . 2008-05-24 12:56 <REP> d-------- C:\WINDOWS\system32\ZoneLabs
2008-05-24 12:53 . 2008-05-24 12:53 <REP> d-------- C:\Program Files\Zone Labs
2008-05-24 12:53 . 2008-04-02 21:07 1,086,952 --a------ C:\WINDOWS\system32\zpeng24.dll
2008-05-24 12:53 . 2008-05-26 22:03 358,382 --a------ C:\WINDOWS\system32\vsconfig.xml
2008-05-24 12:52 . 2008-05-26 22:02 <REP> d-------- C:\WINDOWS\Internet Logs
2008-05-24 12:43 . 2008-05-24 12:43 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-05-24 12:43 . 2008-05-24 12:47 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-24 10:51 . 2008-05-24 10:51 <REP> d-------- C:\Program Files\Alwil Software
2008-05-23 21:02 . 2008-05-23 21:02 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\vlc
2008-05-23 21:01 . 2005-07-13 13:56 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau
2008-05-23 21:01 . 2005-07-13 13:56 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-05-23 21:01 . 2005-07-13 12:01 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
2008-05-23 21:01 . 2005-07-21 16:38 <REP> dr------- C:\Documents and Settings\Administrateur\Mes documents
2008-05-23 21:01 . 2005-07-13 15:35 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
2008-05-23 21:01 . 2005-07-21 16:38 <REP> dr------- C:\Documents and Settings\Administrateur\Favoris
2008-05-23 21:01 . 2005-07-13 15:46 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-05-23 21:01 . 2005-07-13 15:40 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Symantec
2008-05-23 21:01 . 2005-07-13 15:31 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Sony Corporation
2008-05-23 21:01 . 2008-05-23 21:01 <REP> d-------- C:\Documents and Settings\Administrateur
2008-05-22 22:09 . 2008-05-23 20:56 396,288 --a------ C:\HijackThis.exe
2008-05-22 21:00 . 2008-05-22 21:00 <REP> d-------- C:\Program Files\Trend Micro
2008-05-21 16:24 . 2008-05-21 16:24 303 --a------ C:\WINDOWS\ST6UNST.004
2008-05-20 19:12 . 2008-05-20 19:12 <REP> d-------- C:\Program Files\Windows Sidebar
2008-05-20 19:12 . 2008-05-20 19:12 <REP> d-------- C:\Program Files\Norton AntiVirus
2008-05-20 18:10 . 2008-05-21 16:24 4,236 --a------ C:\WINDOWS\SETUP.LST
2008-05-20 18:10 . 2008-05-20 18:10 303 --a------ C:\WINDOWS\ST6UNST.003
2008-05-20 18:03 . 2008-05-26 16:32 <REP> d-------- C:\Program Files\Java
2008-05-19 22:55 . 2008-05-19 22:55 <REP> d-------- C:\Documents and Settings\TANVIR_2\Application Data\Symantec
2008-05-19 22:27 . 2003-02-28 18:26 139,536 --a------ C:\WINDOWS\system32\javaee.dll
2008-05-19 16:50 . 2004-08-05 14:00 23,040 --a------ C:\WINDOWS\system32\lpdsvc.dll
2008-05-19 16:50 . 2004-08-05 14:00 23,040 --a--c--- C:\WINDOWS\system32\dllcache\lpdsvc.dll
2008-05-19 16:50 . 2004-08-05 14:00 19,456 --a------ C:\WINDOWS\system32\lprmon.dll
2008-05-19 16:50 . 2004-08-05 14:00 19,456 --a--c--- C:\WINDOWS\system32\dllcache\lprmon.dll
2008-05-15 20:52 . 2008-05-15 22:44 <REP> d-------- C:\Program Files\Incomplete
2008-05-15 20:13 . 2008-05-15 20:13 <REP> d-------- C:\Program Files\Sun
2008-05-08 19:34 . 2008-05-08 19:34 <REP> d-------- C:\Documents and Settings\TANVIR_2\Application Data\Ethereal
2008-05-08 19:02 . 2008-05-08 19:02 <REP> d-------- C:\Program Files\Conduit
2008-05-08 18:53 . 2008-05-08 19:04 <REP> d-------- C:\Program Files\Best_Security_Tips
2008-05-08 18:47 . 2008-05-16 17:46 <REP> d-------- C:\Program Files\LimeWire Turbo Accelerator
2008-05-08 18:01 . 2008-05-08 18:01 <REP> d-------- C:\Program Files\XviD
2008-05-08 18:00 . 2008-05-08 18:00 <REP> d-------- C:\Apex
2008-04-30 18:04 . 2008-04-30 18:04 <REP> d-------- C:\Program Files\Neoretix
2008-04-28 19:24 . 2008-04-28 19:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SlySoft
2008-04-28 19:22 . 2008-04-28 19:22 <REP> d-------- C:\Documents and Settings\TANVIR_2\Application Data\SlySoft
2008-04-28 19:21 . 2008-04-28 19:46 <REP> d-------- C:\Program Files\SlySoft
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-26 20:10 --------- d-----w C:\Program Files\Steam
2008-05-25 20:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-05-23 15:28 --------- d-----w C:\Program Files\Google
2008-05-23 15:14 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2008-05-21 15:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-05-21 14:38 806 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-05-21 14:38 10,652 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-05-19 16:02 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-05-19 15:12 --------- d-----w C:\Program Files\RTQDownloader
2008-05-16 15:58 --------- d-----w C:\Program Files\LimeWire
2008-05-15 20:44 --------- d-----w C:\Documents and Settings\TANVIR_2\Application Data\LimeWire
2008-05-15 20:34 --------- d-----w C:\Program Files\eMule
2008-05-08 16:00 --------- d-----w C:\Program Files\Apex
2008-04-23 15:03 --------- d-----w C:\Program Files\WinAVI MP4 Converter
2008-04-13 17:28 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-08 15:56 --------- d-----w C:\Documents and Settings\TANVIR_2\Application Data\ntr
2008-04-01 19:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\Adobe Systems
2008-04-01 13:10 --------- d-----w C:\Program Files\Zattoo
2007-05-18 14:48 87,608 ----a-w C:\Documents and Settings\TANVIR_2\Application Data\ezpinst.exe
2007-05-18 14:48 47,360 ----a-w C:\Documents and Settings\TANVIR_2\Application Data\pcouffin.sys
2007-04-25 17:20 144,464 ----a-w C:\Documents and Settings\TANVIR_2\Application Data\GDIPFONTCACHEV1.DAT
2006-11-24 17:10 0 ---ha-w C:\Documents and Settings\TANVIR_2\hpothb07.dat
2006-11-24 17:06 627 ---ha-w C:\Documents and Settings\Tanvir\hpothb07.dat
2006-03-28 12:00 0 ---ha-w C:\Documents and Settings\NetworkService\hpothb07.dat
.
((((((((((((((((((((((((((((( snapshot@2008-05-26_20.10.16.71 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-26 17:58:44 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-26 20:01:25 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-26 20:01:53 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_210.dat
+ 2008-05-26 20:01:47 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_748.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4C907918-2338-4FC3-A890-4D7A72E1B00C}]
C:\WINDOWS\system32\audiodfv.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{da30eff8-ccc6-4162-a20d-67402a26a215}]
2008-01-07 18:38 1530904 --a------ C:\Program Files\Best_Security_Tips\tbBest.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{DA30EFF8-CCC6-4162-A20D-67402A26A215}"= "C:\Program Files\Best_Security_Tips\tbBest.dll" [2008-01-07 18:38 1530904]
[HKEY_CLASSES_ROOT\clsid\{da30eff8-ccc6-4162-a20d-67402a26a215}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{DA30EFF8-CCC6-4162-A20D-67402A26A215}"= C:\Program Files\Best_Security_Tips\tbBest.dll [2008-01-07 18:38 1530904]
[HKEY_CLASSES_ROOT\clsid\{da30eff8-ccc6-4162-a20d-67402a26a215}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 14:00 15360]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [ ]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe" [ ]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ]
"EPSON Stylus DX4000 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.exe" [2006-09-21 05:01 139264]
"Steam"="c:\program files\steam\steam.exe" [2008-03-28 13:08 1271032]
"ares"="C:\Program Files\Ares\Ares.exe" [ ]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2003-11-07 10:21 114688]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-06-09 09:56 6746112]
"Mouse Suite 98 Daemon"="ICO.EXE" [2002-03-14 16:46 45056 C:\WINDOWS\system32\ico.exe]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2005-06-29 07:33 114688]
"SonyPowerCfg"="C:\Program Files\Sony\VAIO Power Management\SPMgr.exe" [2005-05-15 05:51 184320]
"ISBMgr.exe"="C:\Program Files\Sony\ISB Utility\ISBMgr.exe" [2004-02-20 14:12 32768]
"VAIO Update 2"="C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" [2005-01-14 13:43 151552]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-06-29 07:33 94208]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-06-29 07:33 77824]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2005-03-03 21:47 483328]
"OdTray.exe"="C:\Program Files\ZyXEL\Odyssey Client for ZyXEL\OdTray.exe" [2004-03-15 18:26 626746]
"NWEReboot"="" []
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" []
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-07-19 10:06 98304]
"SSBkgdUpdate"="C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 11:22 155648]
"PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [2004-03-10 12:20 57393]
"IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2004-03-10 12:39 40960]
"SetDefPrt"="C:\Program Files\Brother\Brmfl04b\BrStDvPt.exe" [2004-05-25 10:16 49152]
"RTHDCPL"="RTHDCPL.EXE" [2005-06-29 06:25 14720000 C:\WINDOWS\RTHDCPL.EXE]
"AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [2005-04-29 07:56 45056]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-08-25 20:16 1838592]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-04-02 21:07 919016]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_15\bin\jusched.exe" [2007-05-22 17:39 32881]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"SymLnch"="C:\Documents and Settings\TANVIR_2\Application Data\Symantec\Layouts\Norton Internet Security\15.0\SymAllLanguages\NIS_RETAIL\20070828\Support\SymLnch\SymLnch.exe" [2007-08-26 18:04 687976]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 14:00 15360]
"ALUAlert"="C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe" [ ]
"Symantec NetDriver Warning"="C:\PROGRA~1\SYMNET~1\SNDWarn.exe" [ ]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
VESWinlogon.dll 2005-05-20 17:42 73728 C:\WINDOWS\system32\VESWinlogon.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.dvsd"= C:\PROGRA~1\FICHIE~1\SONYSH~1\VideoLib\sonydv.dll
"vidc.xvid"= xvid.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\system32\\sessmgr.exe"=
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R2 MSSQL$VAIO_VEDB;MSSQL$VAIO_VEDB;C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe [2002-12-17 17:55]
R2 ntrconnect;NTRconnect;C:\Program Files\NTR global\NTRconnect\ntrconnect.exe [2006-11-17 17:12]
R3 AWINDIS5;AWINDIS5 Protocol Driver;C:\WINDOWS\system32\AWINDIS5.SYS [2002-04-11 17:43]
R3 odysseyIM3;Odyssey Network Services Miniport;C:\WINDOWS\system32\DRIVERS\odysseyIM3.sys [2004-03-15 17:36]
S3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\Drivers\BrScnUsb.sys [2003-12-19 22:15]
S3 BrSerIf;Brother MFC Serial Port Interface WDM Driver;C:\WINDOWS\system32\Drivers\BrSerIf.sys [2004-06-12 06:27]
S3 BrUsbSer;Brother MFC USB Serial WDM Driver;C:\WINDOWS\system32\Drivers\BrUsbSer.sys [2004-01-10 05:28]
S3 FTLUND;Lundinova Filter Driver;C:\WINDOWS\system32\drivers\ftlund.sys [2004-01-19 17:27]
S3 SQLAgent$VAIO_VEDB;SQLAgent$VAIO_VEDB;C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlagent.EXE [2002-12-17 17:23]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 23:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ae0fd882-fdab-11dc-ae0b-0014a415cd88}]
\Shell\AutoRun\command - nideiect.com
\Shell\explore\Command - nideiect.com
\Shell\open\Command - nideiect.com
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-05-25 20:16:41 C:\WINDOWS\Tasks\User_Feed_Synchronization-{44684F64-8B35-4E53-A30D-204E94DA27E9}.job"
- C:\WINDOWS\system32\msfeedssync.exe
"2008-05-26 19:52:05 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"
g!rly
Messages postés
18209
Date d'inscription
vendredi 17 août 2007
Statut
Contributeur
Dernière intervention
30 novembre 2014
406
26 mai 2008 à 23:04
26 mai 2008 à 23:04
re,
oui ca l´a fait ;)
fais analyser ceci :
C:\Program Files\Best_Security_Tips\tbBest.dll
sur ce site :
http://virusscan.jotti.org/de/
puis passe ceci :
Fais un scan avec cet antispyware :
Telecharge malwarebytes + tutoriel :
-> https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
Tu l´instale; le programme va se mettre automatiquement a jour.
Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression".
Click maintenant sur l´onglet recherche et coche la case : "executer un examun complet".
Puis click sur "rechercher".
Laisse le scanner le pc...
Si des elements on ete trouvés > click sur supprimer la selection.
si il t´es demandé de redemarrer > click sur "yes".
A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum.
Copie et colle le rapport stp.
@+
oui ca l´a fait ;)
fais analyser ceci :
C:\Program Files\Best_Security_Tips\tbBest.dll
sur ce site :
http://virusscan.jotti.org/de/
puis passe ceci :
Fais un scan avec cet antispyware :
Telecharge malwarebytes + tutoriel :
-> https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
Tu l´instale; le programme va se mettre automatiquement a jour.
Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression".
Click maintenant sur l´onglet recherche et coche la case : "executer un examun complet".
Puis click sur "rechercher".
Laisse le scanner le pc...
Si des elements on ete trouvés > click sur supprimer la selection.
si il t´es demandé de redemarrer > click sur "yes".
A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum.
Copie et colle le rapport stp.
@+
kwon
Messages postés
75
Date d'inscription
dimanche 15 juillet 2007
Statut
Membre
Dernière intervention
18 mai 2009
1
27 mai 2008 à 12:29
27 mai 2008 à 12:29
Salut ,voilà le rapport du site:
Datei: tbBest.dll
Auslastung: 0% 100%
Status: INFIZIERT/MALWARE
Entdeckte Packprogramme: -
Bit9 rapportiert: {BIT9_THREAT}
A-Squared Keine Viren gefunden
AntiVir Keine Viren gefunden
ArcaVir Keine Viren gefunden
Avast Keine Viren gefunden
AVG Antivirus Keine Viren gefunden
BitDefender Keine Viren gefunden
ClamAV Keine Viren gefunden
CPsecure AdWare.W32.Shopper.t gefunden
Dr.Web Keine Viren gefunden
F-Prot Antivirus Keine Viren gefunden
F-Secure Anti-Virus Keine Viren gefunden
Fortinet Keine Viren gefunden
Ikarus Keine Viren gefunden
Kaspersky Anti-Virus Keine Viren gefunden
NOD32 Keine Viren gefunden
Norman Virus Control W32/Shopper.X gefunden
Panda Antivirus Keine Viren gefunden
Sophos Antivirus Keine Viren gefunden
VirusBuster Keine Viren gefunden
VBA32 Keine Viren gefunden
Scanner Name der Malware
A-Squared X
AntiVir X
ArcaVir X
Avast X
AVG Antivirus PSW.Steam
BitDefender X
ClamAV X
CPsecure X
Dr.Web X
F-Prot Antivirus X
F-Secure Anti-Virus X
Fortinet X
Ikarus X
Kaspersky Anti-Virus X
NOD32 X
Norman Virus Control X
Panda Antivirus X
Sophos Antivirus Troj/Dropper-SM
VirusBuster X
VBA32 X
Datei: tbBest.dll
Auslastung: 0% 100%
Status: INFIZIERT/MALWARE
Entdeckte Packprogramme: -
Bit9 rapportiert: {BIT9_THREAT}
A-Squared Keine Viren gefunden
AntiVir Keine Viren gefunden
ArcaVir Keine Viren gefunden
Avast Keine Viren gefunden
AVG Antivirus Keine Viren gefunden
BitDefender Keine Viren gefunden
ClamAV Keine Viren gefunden
CPsecure AdWare.W32.Shopper.t gefunden
Dr.Web Keine Viren gefunden
F-Prot Antivirus Keine Viren gefunden
F-Secure Anti-Virus Keine Viren gefunden
Fortinet Keine Viren gefunden
Ikarus Keine Viren gefunden
Kaspersky Anti-Virus Keine Viren gefunden
NOD32 Keine Viren gefunden
Norman Virus Control W32/Shopper.X gefunden
Panda Antivirus Keine Viren gefunden
Sophos Antivirus Keine Viren gefunden
VirusBuster Keine Viren gefunden
VBA32 Keine Viren gefunden
Scanner Name der Malware
A-Squared X
AntiVir X
ArcaVir X
Avast X
AVG Antivirus PSW.Steam
BitDefender X
ClamAV X
CPsecure X
Dr.Web X
F-Prot Antivirus X
F-Secure Anti-Virus X
Fortinet X
Ikarus X
Kaspersky Anti-Virus X
NOD32 X
Norman Virus Control X
Panda Antivirus X
Sophos Antivirus Troj/Dropper-SM
VirusBuster X
VBA32 X
kwon
Messages postés
75
Date d'inscription
dimanche 15 juillet 2007
Statut
Membre
Dernière intervention
18 mai 2009
1
27 mai 2008 à 13:25
27 mai 2008 à 13:25
voilà pour malwarebytes:
Malwarebytes' Anti-Malware 1.12
Version de la base de données: 789
Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 129151
Temps écoulé: 35 minute(s), 2 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\Software\Trymedia Systems (Adware.Trymedia) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
(Aucun élément nuisible détecté)
Malwarebytes' Anti-Malware 1.12
Version de la base de données: 789
Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 129151
Temps écoulé: 35 minute(s), 2 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\Software\Trymedia Systems (Adware.Trymedia) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
(Aucun élément nuisible détecté)
g!rly
Messages postés
18209
Date d'inscription
vendredi 17 août 2007
Statut
Contributeur
Dernière intervention
30 novembre 2014
406
27 mai 2008 à 20:16
27 mai 2008 à 20:16
Salut kwon,
comment ca va de ton coté ?
tu as passé une analyse anti virus en ligne ? ?
post un nouveau hijack this stp
@+
comment ca va de ton coté ?
tu as passé une analyse anti virus en ligne ? ?
post un nouveau hijack this stp
@+
kwon
Messages postés
75
Date d'inscription
dimanche 15 juillet 2007
Statut
Membre
Dernière intervention
18 mai 2009
1
27 mai 2008 à 23:27
27 mai 2008 à 23:27
salut ,ca bien et toi?
je t'ai envoyer le rapport de l'analyse anti-virus en ligne au poste 35.
je t'ai envoyer le rapport de l'analyse anti-virus en ligne au poste 35.
g!rly
Messages postés
18209
Date d'inscription
vendredi 17 août 2007
Statut
Contributeur
Dernière intervention
30 novembre 2014
406
27 mai 2008 à 23:35
27 mai 2008 à 23:35
re,
supprime ce programme/dossier : ( mince j´avais meme pas vu qu´il etait pas catholique d´apres le rapport de virus total o_Ö)
C:\Program Files\Best_Security_Tips
je fatigue
en faite ma question etait de savoir si tu avais fais un scan complet de ta machine avec un antivirus ?
@+
supprime ce programme/dossier : ( mince j´avais meme pas vu qu´il etait pas catholique d´apres le rapport de virus total o_Ö)
C:\Program Files\Best_Security_Tips
je fatigue
en faite ma question etait de savoir si tu avais fais un scan complet de ta machine avec un antivirus ?
@+
kwon
Messages postés
75
Date d'inscription
dimanche 15 juillet 2007
Statut
Membre
Dernière intervention
18 mai 2009
1
28 mai 2008 à 00:04
28 mai 2008 à 00:04
je n arrive pas a effacer le dossier il mette erreur. Et ,oui j'ai fait une analyse complète.
