Virus Vundo - HELP !Résolu/Fermé

Question

Bonjour,

Avant de commencer, je tiens à dire a "Marie" et à "le sioux" que je ne posterais plus d'autre post sur ce forum, j'ai bien compris les règles et compte les respecter ! Vous me laisserez bien, j'imagine cette dernière chance de sauvé mon pc d'un vol plané du 5ème étage, non ? Si vous le faite pas pour moi, faite le pour lui.... merci

Je suis infesté comme beaucoup de monde par Vundo et viens de lire la marche a suivre de "green day" que l'on trouve ici : http://www.commentcamarche.net/faq/sujet 6862 supprimer le trojan vundo virtumonde pour s'en débarassée.

Malheureusement même après avoir renomé mon Hijack.exe en CCM.exe je n'ai toujours pas de ligne 020 et mes lignes 02 m'ont l'air normal.

Quelqu'un est-il capable de lire mon rapport et de me dire ce que je peux faire pour eradiquer ce virus ? je remercie cette personne d'avance.

voila mon dernier rapport Hijack: 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:32:49, on 26.05.2008
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal

Running processes:
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
C:\Program Files\Lenovo\Zoom\TpScrex.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\System32undll32.exe
C:\Windows\System32\TpShocks.exe
C:\Program Files\ThinkPad\Utilities\EZEJMNAP.EXE
C:\Windows\System32undll32.exe
C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
C:\Program Files\Lenovo\AwayTask\AwaySch.EXE
C:\Program Files\ThinkVantage\PrdCtr\LPMGR.EXE
C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\ThinkVantage\PrdCtr\LPMLCHK.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Lenovo\NPDIRECT	pfnf7sp.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe
C:\Windows\System32undll32.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\greg\Desktop\CCM.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2flenovo.live.com%2f%3f
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2flenovo.live.com%2f%3f
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Password Manager Browser Helper Object - {BF468356-BB7E-42D7-9F15-4F3B9BCFCED2} - C:\Program Files\Lenovo\Client Security Solution	vtpwm_ie_com.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [TPHOTKEY] C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PWMTRV] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWMTR32V.DLL,PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BTVLogEx.DLL,StartBattLog
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TVT Scheduler Proxy] C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [AwaySch] C:\Program Files\Lenovo\AwayTask\AwaySch.EXE
O4 - HKLM\..\Run: [LPManager] C:\PROGRA~1\THINKV~2\PrdCtr\LPMGR.exe
O4 - HKLM\..\Run: [ACTray] C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
O4 - HKLM\..\Run: [ACWLIcon] C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
O4 - HKLM\..\Run: [LenovoOobeOffers] c:\SWTOOLS\LenovoWelcome\LenovoOobeOffers.exe /filePath="c:\swshare\firstrun.txt"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [LPMailChecker] C:\PROGRA~1\THINKV~2\PrdCtr\LPMLCHK.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto
O4 - HKLM\..\Run: [TPFNF7] C:\PROGRA~1\Lenovo\NPDIRECT\TPFNF7SP.exe /r
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\greg\AppData\Local\Temp\ssqRLfEV.dll,#1
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O8 - Extra context menu item: Ajouter au fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir les liens sélectionnés en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {F4F55DC8-0B69-4DFE-BA94-CB677B88B2A3} - C:\Program Files\Lenovo\Client Security Solution	vtpwm_ie_com.dll
O9 - Extra 'Tools' menuitem: Lenovo Password Manager... - {F4F55DC8-0B69-4DFE-BA94-CB677B88B2A3} - C:\Program Files\Lenovo\Client Security Solution	vtpwm_ie_com.dll
O13 - Gopher Prefix: 
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
O23 - Service: Access Connections Main Service (AcSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Andrea ADI Filters Service (AEADIFilters) - Andrea Electronics Corporation - C:\Windows\system32\AEADISRV.EXE
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Lenovo - C:\Windows\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de base IPS (IPSSVC) - Lenovo Group Limited - C:\Windows\system32\IPSSVC.EXE
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: System Update (SUService) - Lenovo Group Limited - C:\Program Files\Lenovo\System Update\SUService.exe
O23 - Service: ThinkVantage Registry Monitor Service - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo	vt_reg_monitor_svc.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\Windows\System32\TPHDEXLG.exe
O23 - Service: Incrustation (TPHKSVC) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
O23 - Service: TSS Core Service (TSSCoreService) - Lenovo - C:\Program Files\Lenovo\Client Security Solution	vttcsd.exe
O23 - Service: TVT Backup Protection Service - Unknown owner - C:\Program Files\Lenovo\Rescue and Recoveryrpservice.exe
O23 - Service: TVT Backup Service - Lenovo Group Limited - C:\Program Files\Lenovo\Rescue and Recoveryrservice.exe
O23 - Service: TVT Scheduler - Lenovo Group Limited - c:\Program Files\Common Files\Lenovo\Scheduler	vtsched.exe
O23 - Service: tvtnetwk - Unknown owner - C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe
O23 - Service: TVT Windows Update Monitor (TVT_UpdateMonitor) - Lenovo Group Limited - C:\Program Files\Lenovo\Rescue and Recovery\UpdateMonitor.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

green day · Answer

Salut

 où est-ce qu'il te le détecte ??

 fais la manip avec combo comme indiqué dans le lien sous vista et poste le rapport stp

++

gregrock · Answer

Merci de ton aide, 
Avast m'avertis d'un fichier infectés différent toute les deux heures. Je les ai tous mis en quarantaine mais ne me rappel plus ou il les trouve. 
Je fais la manip avec combo et poste le rapport A+

gregrock · Answer

voila le rapport de combofix: ComboFix 08-05-25.5 - greg 2008-05-26 16:56:44.1 - NTFSx86 Endroit: C:\Users\greg\Desktop\ComboFix.exe * Création d'un nouveau point de restauration . ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-04-26 to 2008-05-26 )))))))))))))))))))))))))))))))))))) . 2008-05-26 16:53 . 2008-05-26 00:27 58,368 --a------ C:\Windows\System32\ddcBSMcA.dll 2008-05-26 14:02 . 2008-05-26 14:02 d-------- C:\Program Files\Hewlett-Packard 2008-05-26 10:31 . 2007-03-23 04:05 29,272 -ra------ C:\Windows\System32\AdobePDF.dll 2008-05-26 09:11 . 2008-05-26 09:11 d-------- C:\Users\All Users\Macrovision 2008-05-26 09:11 . 2008-05-26 09:11 d-------- C:\ProgramData\Macrovision 2008-05-26 09:11 . 2008-05-26 09:11 d-------- C:\Program Files\Common Files\Adobe Systems Shared 2008-05-26 08:54 . 2008-05-26 08:54 d-------- C:\Windows\System32\Adobe 2008-05-26 08:54 . 2001-11-14 20:19 16,384 --a------ C:\Windows\System32\FileOps.exe 2008-05-26 00:25 . 2008-05-26 00:25 d-------- C:\Users\All Users\FLEXnet 2008-05-26 00:25 . 2008-05-26 00:25 d-------- C:\ProgramData\FLEXnet 2008-05-26 00:25 . 2008-05-26 00:25 d-------- C:\Program Files\Common Files\Macrovision Shared 2008-05-26 00:19 . 2008-05-26 13:30 d-------- C:\Users\All Users\Adobe 2008-05-26 00:19 . 2008-05-26 08:54 d-------- C:\Program Files\Common Files\Adobe 2008-05-26 00:00 . 2008-05-26 00:00 d-------- C:\Program Files\Common Files\McNeel Shared 2008-05-25 23:59 . 2008-05-25 23:59 d-------- C:\Users\All Users\McNeel 2008-05-25 23:59 . 2008-05-25 23:59 d-------- C:\ProgramData\McNeel 2008-05-25 23:59 . 2008-05-26 00:00 d-------- C:\Program Files\Rhinoceros 4.0 2008-05-25 23:22 . 2006-10-26 19:56 32,592 --a------ C:\Windows\System32\msonpmon.dll 2008-05-25 23:21 . 2008-05-25 23:21 d-------- C:\Program Files\Microsoft Works 2008-05-25 23:18 . 2008-05-25 23:18 d-------- C:\Windows\PCHEALTH 2008-05-25 23:18 . 2008-05-25 23:18 d-------- C:\Program Files\Microsoft.NET 2008-05-25 23:15 . 2008-05-25 23:15 d-------- C:\Program Files\Microsoft Visual Studio 8 2008-05-25 23:13 . 2008-05-25 23:33 d-------- C:\Users\All Users\Microsoft Help 2008-05-25 23:13 . 2008-05-25 23:33 d-------- C:\ProgramData\Microsoft Help 2008-05-25 23:13 . 2008-05-25 23:13 dr-h----- C:\MSOCache 2008-05-17 17:11 . 2008-05-26 08:06 d-------- C:\Users\greg\AppData\Roaming\skypePM 2008-05-17 17:11 . 2008-05-26 14:59 d-------- C:\Users\greg\AppData\Roaming\Skype 2008-05-17 17:11 . 2008-05-17 17:11 56 ---h----- C:\Users\All Users\ezsidmv.dat 2008-05-17 17:11 . 2008-05-17 17:11 56 ---h----- C:\ProgramData\ezsidmv.dat 2008-05-17 17:10 . 2008-05-25 16:08 d-------- C:\Users\All Users\Skype 2008-05-17 17:10 . 2008-05-25 16:08 d-------- C:\ProgramData\Skype 2008-05-17 17:10 . 2008-05-25 16:06 d-------- C:\Program Files\Skype 2008-05-17 17:10 . 2008-05-25 16:02 d-------- C:\Program Files\Common Files\Skype 2008-05-17 11:33 . 2008-05-17 11:33 188 --------- C:\Windows\x 2008-05-17 11:29 . 2007-03-15 03:45 390,144 --------- C:\Windows\System32\wlangpui.dll 2008-05-17 11:29 . 2007-03-15 03:43 225,792 --------- C:\Windows\System32\dot3gpui.dll 2008-05-17 11:29 . 2007-03-15 03:00 223,526 --------- C:\Windows\System32\onex.tmf 2008-05-17 11:29 . 2007-03-15 03:46 199,680 --------- C:\Windows\System32\wlanui.dll 2008-05-17 11:29 . 2007-03-15 03:45 162,816 --------- C:\Windows\System32\onex.dll 2008-05-17 11:29 . 2007-03-15 03:43 146,944 --------- C:\Windows\System32\dot3svc.dll 2008-05-17 11:29 . 2007-03-15 03:43 141,824 --------- C:\Windows\System32\dot3ui.dll 2008-05-17 11:29 . 2007-03-15 03:43 72,192 --------- C:\Windows\System32\dot3msm.dll 2008-05-17 11:29 . 2007-03-15 03:43 45,568 --------- C:\Windows\System32\dot3dlg.dll 2008-05-17 11:29 . 2007-03-15 03:43 26,112 --------- C:\Windows\System32\dot3api.dll 2008-05-17 11:07 . 2008-02-03 09:20 47,680 --------- C:\Windows\System32\drivers\tvtumon.sys 2008-05-17 10:43 . 2008-05-17 10:43 47 --------- C:\Windows\System32\drivers\IBM_6460_6XG.MRK 2008-05-17 09:55 . 2008-05-17 09:55 1,585,664 --------- C:\Windows\System32\setupapi.dll 2008-05-17 09:25 . 2008-05-17 09:25 694,784 --------- C:\Windows\System32\localspl.dll 2008-05-17 09:24 . 2008-05-17 09:24 2,923,520 --------- C:\Windows\explorer.exe 2008-05-17 09:22 . 2008-05-17 09:22 1,060,920 --------- C:\Windows\System32\drivers\ntfs.sys 2008-05-17 09:21 . 2008-05-17 09:21 8,147,968 --------- C:\Windows\System32\wmploc.DLL 2008-05-17 09:21 . 2008-05-17 09:21 356,864 --------- C:\Windows\System32\MediaMetadataHandler.dll 2008-05-17 09:21 . 2008-05-17 09:21 7,680 --------- C:\Windows\System32\spwmp.dll 2008-05-17 09:21 . 2008-05-17 09:21 4,096 --------- C:\Windows\System32\msdxm.ocx 2008-05-17 09:21 . 2008-05-17 09:21 4,096 --------- C:\Windows\System32\dxmasf.dll 2008-05-17 09:19 . 2008-05-17 09:19 803,328 --------- C:\Windows\System32\drivers\tcpip.sys 2008-05-17 09:19 . 2008-05-17 09:19 216,632 --------- C:\Windows\System32\drivers\netio.sys 2008-05-17 09:19 . 2008-05-17 09:19 167,424 --------- C:\Windows\System32\tcpipcfg.dll 2008-05-17 09:19 . 2008-05-17 09:19 24,064 --------- C:\Windows\System32\netcfg.exe 2008-05-17 09:19 . 2008-05-17 09:19 22,016 --------- C:\Windows\System32\netiougc.exe 2008-05-17 09:18 . 2008-05-17 09:18 1,327,104 --------- C:\Windows\System32\quartz.dll 2008-05-17 09:17 . 2008-05-17 09:17 2,027,008 --------- C:\Windows\System32\win32k.sys 2008-05-17 09:17 . 2008-05-17 09:17 296,448 --------- C:\Windows\System32\gdi32.dll 2008-05-17 09:17 . 2008-05-17 09:17 223,232 --------- C:\Windows\System32\WMASF.DLL 2008-05-17 09:17 . 2008-05-17 09:17 9,728 --------- C:\Windows\System32\LAPRXY.DLL 2008-05-17 09:17 . 2008-05-17 09:17 2,048 --------- C:\Windows\System32\asferror.dll 2008-05-17 09:16 . 2008-05-17 09:16 1,335,296 --------- C:\Windows\System32\msxml6.dll 2008-05-17 09:16 . 2008-05-17 09:16 2,048 --------- C:\Windows\System32\msxml6r.dll 2008-05-17 09:14 . 2008-05-17 09:14 737,792 --------- C:\Windows\System32\inetcomm.dll 2008-05-17 09:14 . 2008-05-17 09:14 84,480 --------- C:\Windows\System32\INETRES.dll 2008-05-17 09:14 . 2008-05-17 09:14 11,776 --------- C:\Windows\System32\sbunattend.exe 2008-05-17 09:13 . 2008-05-17 09:13 788,992 --------- C:\Windows\System32\rpcrt4.dll 2008-05-17 09:13 . 2008-05-17 09:13 130,048 --------- C:\Windows\System32\drivers\srv2.sys 2008-05-17 09:13 . 2008-05-17 09:13 101,888 --------- C:\Windows\System32\drivers\mrxsmb.sys 2008-05-17 09:13 . 2008-05-17 09:13 84,992 --------- C:\Windows\System32\drivers\srvnet.sys 2008-05-17 09:13 . 2008-05-17 09:13 83,968 --------- C:\Windows\System32\dnsrslvr.dll 2008-05-17 09:13 . 2008-05-17 09:13 58,368 --------- C:\Windows\System32\drivers\mrxsmb20.sys 2008-05-17 09:13 . 2008-05-17 09:13 24,576 --------- C:\Windows\System32\dnscacheugc.exe 2008-05-17 09:11 . 2008-05-17 09:11 d-------- C:\Program Files\MSXML 4.0 2008-05-17 09:08 . 2008-05-17 09:08 2,048 --------- C:\Windows\System32\tzres.dll 2008-05-17 09:07 . 2008-05-17 09:07 750,080 --------- C:\Windows\System32\qmgr.dll 2008-05-17 09:06 . 2008-05-17 09:06 1,244,672 --------- C:\Windows\System32\mcmde.dll 2008-05-17 08:53 . 2008-05-26 16:53 2,600 --a------ C:\Windows\System32\ICAutoUpdate.log.bak 2008-05-17 08:39 . 2008-05-17 08:39 33,536 --------- C:\Windows\System32\drivers\tvtfilter.sys 2008-05-17 08:22 . 2008-05-17 08:22 21,376 --------- C:\Windows\System32\drivers\psadd.sys 2008-05-17 08:21 . 2008-05-25 16:01 d-------- C:\Icons 2008-05-17 07:42 . 2008-05-17 12:45 dr-hs---- C:\RRbackups 2008-05-17 07:42 . 2007-02-07 02:04 158,456 --------- C:\Windows\System32\pxwma.dll 2008-05-17 07:42 . 2008-05-17 07:42 1,732 --------- C:\tvtpktfilter.dat 2008-05-17 07:31 . 2008-05-25 16:15 d-------- C:\Windows\Downloaded Installations 2008-05-17 07:30 . 2008-05-25 16:08 d-------- C:\Users\All Users\PC-Doctor 2008-05-17 07:30 . 2008-05-25 16:08 d-------- C:\ProgramData\PC-Doctor 2008-05-17 07:29 . 2008-05-25 16:06 d-------- C:\Program Files\PCDR5 2008-05-17 07:18 . 2008-05-25 16:03 d-------- C:\Program Files\InterVideo 2008-05-17 07:18 . 2008-05-17 07:26 13,959,168 --------- C:\Windows\ocsetup_install_OEMHelpCustomization.etl 2008-05-17 07:18 . 2002-11-22 11:57 204,800 --------- C:\Windows\System32\IVIresizeW7.dll 2008-05-17 07:18 . 2002-11-22 11:57 200,704 --------- C:\Windows\System32\IVIresizeA6.dll 2008-05-17 07:18 . 2008-05-17 07:26 196,608 --------- C:\Windows\ocsetup_cbs_install_OEMHelpCustomization.perf 2008-05-17 07:18 . 2002-11-22 11:57 192,512 --------- C:\Windows\System32\IVIresizeP6.dll 2008-05-17 07:18 . 2002-11-22 11:57 192,512 --------- C:\Windows\System32\IVIresizeM6.dll 2008-05-17 07:18 . 2002-11-22 11:57 188,416 --------- C:\Windows\System32\IVIresizePX.dll 2008-05-17 07:18 . 2008-05-17 07:26 65,536 --------- C:\Windows\ocsetup_cbs_install_OEMHelpCustomization.dpx 2008-05-17 07:18 . 2002-11-22 11:57 20,480 --------- C:\Windows\System32\IVIresize.dll 2008-05-17 07:16 . 2008-05-25 16:02 d-------- C:\Program Files\Common Files\InterVideo 2008-05-17 07:15 . 2008-05-25 16:08 d-------- C:\Users\All Users\Lenovo 2008-05-17 07:15 . 2008-05-25 16:08 d-------- C:\ProgramData\Lenovo 2008-05-17 07:15 . 2007-01-08 22:00 923,184 --------- C:\Windows\System32\ahlprun.exe 2008-05-17 07:15 . 2002-02-03 23:13 82,432 --------- C:\Windows\System32\msxml4r.dll 2008-05-17 07:15 . 2002-02-03 23:13 44,544 --------- C:\Windows\System32\msxml4a.dll 2008-05-17 07:15 . 2002-02-07 11:43 9,679 --------- C:\Windows\System32\msxml4r.cat 2008-05-17 07:15 . 2002-02-07 11:43 9,675 --------- C:\Windows\System32\msxml4.cat 2008-05-17 07:15 . 2002-02-06 13:31 3,489 --------- C:\Windows\System32\msxml4.Manifest 2008-05-17 07:15 . 2002-02-06 13:31 500 --------- C:\Windows\System32\msxml4r.Manifest 2008-05-17 07:14 . 2008-05-25 16:07 d-------- C:\Program Files\ThinkVantage 2008-05-17 07:14 . 2008-05-25 16:03 d-------- C:\Program Files\Diskeeper Corporation 2008-05-17 07:13 . 2008-05-25 16:20 d-------- C:\Windows\System32\Macromed 2008-05-17 07:13 . 2008-05-25 16:18 d-------- C:\Windows\System32\(null) 2008-05-17 07:12 . 2008-05-25 16:02 d-------- C:\Program Files\Common Files\Lenovo 2008-05-17 07:11 . 2008-05-26 16:55 d-------- C:\SWSHARE 2008-05-17 07:05 . 2008-05-25 16:02 d-------- C:\Program Files\Analog Devices 2008-05-17 07:05 . 2007-03-28 02:55 606,208 --------- C:\Windows\System32\AEADIExt.dll 2008-05-17 07:05 . 2007-04-04 22:44 129,024 --------- C:\Windows\System32\AEADIAPO.dll 2008-05-17 07:05 . 2007-02-05 23:44 69,632 --------- C:\Windows\System32\AEADISRV.EXE 2008-05-17 07:05 . 2007-01-10 06:40 50,176 --------- C:\Windows\System32\AEADIAPR.dll 2008-05-17 07:01 . 2008-05-25 16:19 d-------- C:\Windows\System32\es-MX . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-25 21:20 --------- d-----w C:\Program Files\MSBuild 2008-05-25 14:07 --------- d-----w C:\Program Files\Windows Photo Gallery 2008-05-25 14:07 --------- d-----w C:\Program Files\Windows Mail 2008-05-25 14:07 --------- d-----w C:\Program Files\Windows Journal 2008-05-25 14:07 --------- d-----w C:\Program Files\Windows Collaboration 2008-05-25 14:07 --------- d-----w C:\Program Files\Windows Calendar 2008-05-25 14:06 --------- d-----w C:\Program Files\Reference Assemblies 2008-05-25 14:05 --------- d-----w C:\Program Files\Microsoft Games 2008-05-17 07:54 54,784 ------w C:\Windows\system32\drivers\i8042prt.sys 2008-05-17 07:54 495,160 ------w C:\Windows\system32\drivers\Wdf01000.sys 2008-05-17 07:54 35,384 ------w C:\Windows\system32\drivers\WdfLdr.sys 2008-05-17 07:54 35,384 ------w C:\Windows\system32\drivers\kbdclass.sys 2008-05-17 07:54 34,360 ------w C:\Windows\system32\drivers\mouclass.sys 2008-05-17 07:54 19,968 ------w C:\Windows\system32\drivers\sermouse.sys 2008-05-17 07:54 15,872 ------w C:\Windows\system32\drivers\mouhid.sys 2008-05-17 07:33 174 --sh--w C:\Program Files\desktop.ini 2008-05-17 07:27 --------- d-----w C:\Program Files\Windows Sidebar 2008-05-17 07:25 70,144 ------w C:\Windows\system32\drivers\pacer.sys 2008-05-17 07:25 619,008 ------w C:\Windows\system32\drivers\dxgkrnl.sys 2008-05-17 07:25 61,952 ------w C:\Windows\system32\drivers\wanarp.sys 2008-05-17 07:25 48,640 ------w C:\Windows\system32\drivers\ndproxy.sys 2008-05-17 07:25 20,480 ------w C:\Windows\system32\drivers\ndistapi.sys 2008-05-17 07:24 28,344 ------w C:\Windows\system32\drivers\battc.sys 2008-05-17 07:24 258,232 ------w C:\Windows\system32\drivers\acpi.sys 2008-05-17 07:24 20,920 ------w C:\Windows\system32\drivers\compbatt.sys 2008-05-17 07:24 14,208 ------w C:\Windows\system32\drivers\CmBatt.sys 2008-05-17 07:24 110,080 ------w C:\Windows\system32\drivers\mrxdav.sys 2008-05-17 07:24 11,264 ------w C:\Windows\system32\drivers\wmiacpi.sys 2008-05-17 07:20 45,112 ------w C:\Windows\system32\drivers\pciidex.sys 2008-05-17 07:20 211,000 ------w C:\Windows\system32\drivers\volsnap.sys 2008-05-17 07:20 21,560 ------w C:\Windows\system32\drivers\atapi.sys 2008-05-17 07:20 17,464 ------w C:\Windows\system32\drivers\intelide.sys 2008-05-17 07:20 154,624 ------w C:\Windows\system32\drivers\nwifi.sys 2008-05-17 07:20 109,624 ------w C:\Windows\system32\drivers\ataport.sys 2008-05-17 07:15 537,600 ------w C:\Windows\AppPatch\AcLayers.dll 2008-05-17 07:15 449,536 ------w C:\Windows\AppPatch\AcSpecfc.dll 2008-05-17 07:15 320,000 ------w C:\Windows\system32\drivers\csc.sys 2008-05-17 07:15 2,560 ------w C:\Windows\AppPatch\AcRes.dll 2008-05-17 07:15 2,144,256 ------w C:\Windows\AppPatch\AcGenral.dll 2008-05-17 07:15 173,056 ------w C:\Windows\AppPatch\AcXtrnal.dll 2008-05-17 07:12 52,736 ------w C:\Windows\AppPatch\iebrshim.dll 2008-05-17 04:31 53,760 ------w C:\Windows\system32\drivers\hdaudbus.sys 2008-05-17 04:30 13,312 ------w C:\Windows\system32\drivers\sffdisk.sys 2008-05-17 04:30 12,800 ------w C:\Windows\system32\drivers\sffp_sd.sys 2008-05-17 04:30 12,800 ------w C:\Windows\system32\drivers\sffp_mmc.sys 2008-05-17 04:29 63,488 ------w C:\Windows\system32\drivers\mpsdrv.sys 2008-05-17 04:29 23,040 ------w C:\Windows\system32\drivers\tunnel.sys 2008-05-17 04:29 15,360 ------w C:\Windows\system32\drivers\TUNMP.SYS 2008-05-17 04:22 --------- d-----w C:\Program Files\Windows Defender 2008-05-17 04:12 5,888 ------w C:\Windows\system32\drivers\usbd.sys 2008-05-17 04:12 38,912 ------w C:\Windows\system32\drivers\hidclass.sys 2008-05-17 04:12 38,400 ------w C:\Windows\system32\drivers\usbehci.sys 2008-05-17 04:12 25,472 ------w C:\Windows\system32\drivers\hidparse.sys 2008-05-17 04:12 23,040 ------w C:\Windows\system32\drivers\usbuhci.sys 2008-05-17 04:12 224,768 ------w C:\Windows\system32\drivers\usbport.sys 2008-05-17 04:12 192,000 ------w C:\Windows\system32\drivers\usbhub.sys 2008-05-17 04:12 12,288 ------w C:\Windows\system32\drivers\hidusb.sys . ------- Sigcheck ------- . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BF468356-BB7E-42D7-9F15-4F3B9BCFCED2}] 2008-02-19 13:05 784960 --------- C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-05-17 09:14 1232896] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "TPHOTKEY"="C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe" [2008-01-24 10:21 66928] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-11-21 18:08 820520] "PWMTRV"="C:\PROGRA~1\ThinkPad\UTILIT~1\PWMTR32V.DLL" [2008-01-11 02:20 558368] "BLOG"="C:\PROGRA~1\ThinkPad\UTILIT~1\BTVLogEx.DLL" [2008-01-11 02:20 214576] "TpShocks"="TpShocks.exe" [2007-11-22 15:09 181536 C:\Windows\System32\TpShocks.exe] "EZEJMNAP"="C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2007-04-27 02:33 243248] "NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-07-27 09:57 86016] "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-07-27 09:57 8433664] "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-07-27 09:57 81920] "TVT Scheduler Proxy"="C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe" [2008-03-04 10:34 487424] "DiskeeperSystray"="C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe" [2006-11-16 01:21 217176] "AwaySch"="C:\Program Files\Lenovo\AwayTask\AwaySch.EXE" [2006-11-07 12:51 91688] "LPManager"="C:\PROGRA~1\THINKV~2\PrdCtr\LPMGR.exe" [2008-01-11 02:21 144728] "ACTray"="C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe" [2008-03-17 13:37 431392] "ACWLIcon"="C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe" [2008-03-17 13:37 128288] "LenovoOobeOffers"="c:\SWTOOLS\LenovoWelcome\LenovoOobeOffers.exe" [2006-12-29 19:01 28672] "LPMailChecker"="C:\PROGRA~1\THINKV~2\PrdCtr\LPMLCHK.exe" [2008-01-11 02:21 124248] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2007-12-07 10:13 1282048] "MSConfig"="C:\Windows\System32\msconfig.exe" [2006-11-02 11:45 222208] "TPFNF7"="C:\PROGRA~1\Lenovo\NPDIRECT\TPFNF7SP.exe" [2008-03-26 03:06 59680] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016] "Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-01-11 19:54 623992] "MSServer"="C:\Windows\system32\hgGxVPFw.dll" [2008-05-26 00:27 58368] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-05-26 08:50:43 110592] Bluetooth.lnk - C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe [2007-03-29 22:11:50 719664] Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2008-05-17 01:10:11 50688] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableLUA"= 0 (0x0) "DisableCAD"= 1 (0x1) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{81AA6A16-B8CA-43C4-A347-A487764FF528}"= C:\Windows\system32\hgGxVPFw.dll [2008-05-26 00:27 58368] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus] C:\Windows\system32\psqlpwd.dll 2007-03-15 07:17 89600 C:\Windows\System32\psqlpwd.dll [HKLM\~\startupfolder\C:^Users^greg^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^LenovoWelcome.lnk] path=C:\Users\greg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LenovoWelcome.lnk backup=C:\Windows\pss\LenovoWelcome.lnk.Startup backupExtension=.Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AMSG] --------- 2007-02-01 20:00 419376 C:\Program Files\ThinkVantage\AMSG\Amsg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cssauth] --------- 2007-11-29 18:36 2872632 C:\Program Files\Lenovo\Client Security Solution\cssauth.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPFNF7] --------- 2008-03-26 03:06 59680 C:\Program Files\Lenovo\NPDIRECT\TPFNF7SP.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{31656E5A-22D0-436A-857A-7CD86485D68D}"= UDP:C:\Program Files\Common Files\AOL\Loader\aolload.exe:AOL Loader "{89326607-E7DD-45E0-8A0C-B3D3DBC892D2}"= TCP:C:\Program Files\Common Files\AOL\Loader\aolload.exe:AOL Loader "{EE2BBB68-C915-4B68-8659-EE17F6510740}"= C:\Program Files\Skype\Phone\Skype.exe:Skype "{9F4841D1-16AB-408B-BE30-7FBBA704AD0E}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook "{CF993300-D66D-43AD-961B-196489870950}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{E1FB2FC0-695F-4B9D-9C3D-C01A56FB8E67}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{A561987B-FE9E-474B-A7B6-9F01D53A77EC}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{ECD8F275-1B6A-4CAD-8C14-689E7D728650}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System] "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic| R0 Shockprf;Shockprf;C:\Windows\system32\DRIVERS\Apsx86.sys [2007-10-16 18:33] R0 TPDIGIMN;TPDIGIMN;C:\Windows\system32\DRIVERS\ApsHM86.sys [2007-10-16 18:32] R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-05-16 01:20] R1 lenovo.smi;Lenovo System Interface Driver;C:\Windows\system32\DRIVERS\smiif32.sys [2006-08-30 12:04] R1 TPPWRIF;TPPWRIF;C:\Windows\system32\drivers\Tppwr32v.sys [2008-01-11 02:20] R1 tvtumon;tvtumon;C:\Windows\system32\DRIVERS\tvtumon.sys [2008-02-03 09:20] R2 AEADIFilters;Andrea ADI Filters Service;C:\Windows\system32\AEADISRV.EXE [2007-02-05 23:44] R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16] R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-05-16 01:18] R2 smihlp;SMI Helper Driver (smihlp);C:\Program Files\Common Files\ThinkVantage Fingerprint Software\Drivers\smihlp.sys [2007-03-15 07:10] R2 TPHKSVC;Incrustation;C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe [2007-12-14 16:37] R2 TVT Backup Protection Service;TVT Backup Protection Service;"C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe" [2007-12-05 17:32] R2 TVT_UpdateMonitor;TVT Windows Update Monitor;C:\Program Files\Lenovo\Rescue and Recovery\UpdateMonitor.exe [2008-02-03 09:20] R2 XAudio;XAudio;C:\Windows\system32\DRIVERS\xaudio.sys [2007-10-18 14:36] R3 TcUsb;TC USB Kernel Driver;C:\Windows\system32\Drivers\tcusb.sys [2007-03-15 06:50] R3 TVTI2C;Lenovo SM bus driver;C:\Windows\system32\DRIVERS\Tvti2c.sys [2007-05-22 21:59] S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\b57nd60x.sys [2006-11-02 09:30] S3 btwaudio;Bluetooth Audio Device Service;C:\Windows\system32\drivers\btwaudio.sys [2007-03-29 20:46] S3 btwavdt;Bluetooth AVDT;C:\Windows\system32\drivers\btwavdt.sys [2007-02-27 07:20] S3 btwrchid;btwrchid;C:\Windows\system32\DRIVERS\btwrchid.sys [2007-02-27 07:20] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs REG_MULTI_SZ BthServ . Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es' "2008-05-26 12:11:01 C:\Windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"

green day · Answer

ok, poste un rapport vundofix stp

++

gregrock · Answer

je viens de faire un scan avec vundo fix et je n'ai rien eu d'autre que une fenêtre avec écris que aucun fichier n'était infecté ! 
Je ne sais pas établir un rapport avec vudofix...

gregrock · Answer

avast vient de me faire un avertissement voilà ou il trouve les fichiers infectés:
C:\Users\greg\AppData\Local\Temp\mlJDuspN.dll

d0ne · Answer

essaie de remplacer avast par antivir ! avast  est beaucoup moins performant qu'antivir ( en anglais certes )

gregrock · Answer

Je vais surement changer d'antivirus -ça c'est sur, mais es-ce qu'antivir arrivera à désinfecter mon ordi ?

d0ne · Answer

je pense - tout du moins je l'espere - car j'ai lu un comparatif serieux et antivir arrive largement devant avast .

gregrock · Answer

green day,

Je viens de relancer vundofix et toujours pas de rapport... je sais pas comment le générer ?
Sinon voilà que avast vient de découvrir un nouveau fichier infecté. Le voilà avec son chemin d'accès. Je sais pas si ça peut t'aider mais au cas ou : C:\Users\greg\AppData\Local\Temp\vtuSjIyy.dll 

A+

gregrock · Answer

en voilà un nouveau...
C:\Users\greg\AppData\Local\Temp\khfGabBt.dll

green day · Answer

Salut

 ok, c'est dans les fichiers temp !

 fais ce qui est indiqué ici stp :

 http://www.commentcamarche.net/faq/sujet 3174 virus methode preliminaire de desinfection version fr

++

gregrock · Answer

Hello,

Je te remercie encore de t'occuper de mon problème qui me stress énormément.  

Voilà j'ai fait ce que tu m'a demandé et voilà les rapports: 

A++

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

 + Créé à:	23:33 2008-05-28

 + Résultat de l'analyse:	



:mozilla.10:C:\Users\greg\AppData\Roaming\Mozilla\Firefox\Profiles\ykx20rxd.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.11:C:\Users\greg\AppData\Roaming\Mozilla\Firefox\Profiles\ykx20rxd.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.9:C:\Users\greg\AppData\Roaming\Mozilla\Firefox\Profiles\ykx20rxd.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.


Fin du rapport

--------------------------------------------------------------------------------------------------------------------------------------------------------

celui de Bitdefender:

BitDefender Online Scanner - Real Time Virus Report
	
Generated at: Thu, May 29, 2008 - 00:28:18

Scan Info
	
Scanned Files
	
464569

Infected Files
	
0

Virus Detected
	
No virus found.
	
This summary of the scan process will be used by the BitDefender Antivirus Lab to create agregate statistics about virus activity around the world.
	

--------------------------------------------------------------------------------------------------------------------------------------------------------

et enfin celui de Hijack: 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:30, on 2008-05-29
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal

Running processes:
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
C:\Program Files\Lenovo\Zoom\TpScrex.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\System32undll32.exe
C:\Windows\System32\TpShocks.exe
C:\Program Files\ThinkPad\Utilities\EZEJMNAP.EXE
C:\Windows\System32undll32.exe
C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
C:\Program Files\Lenovo\AwayTask\AwaySch.EXE
C:\Program Files\ThinkVantage\PrdCtr\LPMGR.EXE
C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
C:\Windows\System32undll32.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
C:\Program Files\ThinkVantage\PrdCtr\LPMLCHK.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Lenovo\NPDIRECT	pfnf7sp.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\greg\Desktop\CCM.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2flenovo.live.com%2f%3f
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Password Manager Browser Helper Object - {BF468356-BB7E-42D7-9F15-4F3B9BCFCED2} - C:\Program Files\Lenovo\Client Security Solution	vtpwm_ie_com.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [TPHOTKEY] C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PWMTRV] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWMTR32V.DLL,PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BTVLogEx.DLL,StartBattLog
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TVT Scheduler Proxy] C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [AwaySch] C:\Program Files\Lenovo\AwayTask\AwaySch.EXE
O4 - HKLM\..\Run: [LPManager] C:\PROGRA~1\THINKV~2\PrdCtr\LPMGR.exe
O4 - HKLM\..\Run: [ACTray] C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
O4 - HKLM\..\Run: [ACWLIcon] C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
O4 - HKLM\..\Run: [LenovoOobeOffers] c:\SWTOOLS\LenovoWelcome\LenovoOobeOffers.exe /filePath="c:\swshare\firstrun.txt"
O4 - HKLM\..\Run: [LPMailChecker] C:\PROGRA~1\THINKV~2\PrdCtr\LPMLCHK.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [MSConfig] "C:\Windows\System32\msconfig.exe" /auto
O4 - HKLM\..\Run: [TPFNF7] C:\PROGRA~1\Lenovo\NPDIRECT\TPFNF7SP.exe /r
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\hgGxVPFw.dll,#1
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\greg\AppData\Local\Temp\yaywvvuu.dll,#1
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Ajouter au fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {F4F55DC8-0B69-4DFE-BA94-CB677B88B2A3} - C:\Program Files\Lenovo\Client Security Solution	vtpwm_ie_com.dll
O9 - Extra 'Tools' menuitem: Lenovo Password Manager... - {F4F55DC8-0B69-4DFE-BA94-CB677B88B2A3} - C:\Program Files\Lenovo\Client Security Solution	vtpwm_ie_com.dll
O13 - Gopher Prefix: 
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
O23 - Service: Access Connections Main Service (AcSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Andrea ADI Filters Service (AEADIFilters) - Andrea Electronics Corporation - C:\Windows\system32\AEADISRV.EXE
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Lenovo - C:\Windows\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de base IPS (IPSSVC) - Lenovo Group Limited - C:\Windows\system32\IPSSVC.EXE
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: System Update (SUService) - Lenovo Group Limited - C:\Program Files\Lenovo\System Update\SUService.exe
O23 - Service: ThinkVantage Registry Monitor Service - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo	vt_reg_monitor_svc.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\Windows\System32\TPHDEXLG.exe
O23 - Service: Incrustation (TPHKSVC) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
O23 - Service: TSS Core Service (TSSCoreService) - Lenovo - C:\Program Files\Lenovo\Client Security Solution	vttcsd.exe
O23 - Service: TVT Backup Protection Service - Unknown owner - C:\Program Files\Lenovo\Rescue and Recoveryrpservice.exe
O23 - Service: TVT Backup Service - Lenovo Group Limited - C:\Program Files\Lenovo\Rescue and Recoveryrservice.exe
O23 - Service: TVT Scheduler - Lenovo Group Limited - c:\Program Files\Common Files\Lenovo\Scheduler	vtsched.exe
O23 - Service: tvtnetwk - Unknown owner - C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe
O23 - Service: TVT Windows Update Monitor (TVT_UpdateMonitor) - Lenovo Group Limited - C:\Program Files\Lenovo\Rescue and Recovery\UpdateMonitor.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

green day · Answer

Salut

    * Télécharger MalwareByte's Anti-Malware (by RubbeR DuckY) :
    * http://www.commentcamarche.net/telecharger/telecharger 34055379 malwarebyte s anti malware
    * Installez le programme sur le bureau :
          o S'il manque le fichier COMCTL32.OCX, vous pourrez le télécharger ici 
    * Faites les mises à jour (clic sur Mises à jour puis Recherche de mises à jour)
    * Démarrez en mode sans échec
    * Lancez le MalwareByte's Anti-Malware, cliquez sur Exécuter un examen complet puis Rechercher et sélectionnez tous tes disques durs
    * Une fois le scan terminé, cliquez sur supprimer (si un message demande à redémarrer le PC, acceptez !)

==> poste le rapport stp

@+

gregrock · Answer

OK je vais faire ça, mais comment  démarrer en mode sans échec  sous vista ?

Ladycha01 · Answer

Salut, mon ordi est infecté avec le même virus, est-il possible d'avoir de l'aide s'il vous plait?

Ladycha01 · Answer

Voilà mon rapport



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:53:42, on 29/05/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgfws8.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
C:\WINDOWS\vsnpstd2.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\antiviirus.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files	mp0.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files	mp1.exe
C:\Program Files	mp2.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
F:\Program Files\WinZip\WZQKPICK.EXE
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\MessengerDiscovery\MessengerDiscovery Live.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O2 - BHO: (no name) - {25714611-2CFB-4984-9B29-AC6F10BBE6C1} - C:\WINDOWS\system32\efcbaAPG.dll (file missing)
O2 - BHO: (no name) - {27796771-8D05-4EE6-B478-43CE759F2106} - C:\WINDOWS\system32\ssqQkkjh.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVGTOOLBAR - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O3 - Toolbar: AVGTOOLBAR - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [TXP] f:\program files	opthemesxp	xp.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [MyWebSearch Plugin] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL,UPF
O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe" /m=0
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKLM\..\Run: [SNPSTD2] C:\WINDOWS\vsnpstd2.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [antiviirus] C:\Program Files\antiviirus.exe
O4 - HKLM\..\Run: [dc08ea4d] rundll32.exe "C:\WINDOWS\system32\omjiiwfh.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKCU\..\Run: [obpaeyfhv] c:\documents and settings\ericka stephen\local settings\application data\obpaeyfhv.exe obpaeyfhv
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: WinZip Quick Pick.lnk = F:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNxpt407YYGP
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-3/SmileyCentralFWBInitialSetup1.0.1.0.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - https://sdlc-esd.oracle.com/ESD40/JSCDL/jre/6u5-b19/jinstall-6u5-windows-i586-jc.cab?GroupName=JSC&FilePath=/ESD40/JSCDL/jre/6u5-b19/jinstall-6u5-windows-i586-jc.cab&BHost=javadl.sun.com&File=jinstall-6u5-windows-i586-jc.cab&AuthParam=1580944752_ad714b48b0d186f5adbe4ba05260ecbd&ext=.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D71F9A27-723E-4B8B-B428-B725E47CBA3E} (Imikimi_activex_plugin Control) - http://imikimi.com/download/imikimi_plugin_0.5.1.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: ssqQkkjh - C:\WINDOWS\SYSTEM32\ssqQkkjh.dll
O21 - SSODL: ServiceMon - {64a6e79e-cd24-4d89-9e71-e3926ca3e7ed} - C:\WINDOWS\Resources\ServiceMon.dll (file missing)
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgfws8.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: My Web Search Service (MyWebSearchService) - MyWebSearch.com - C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

gregrock · Answer

Hello green day,

Je vais te dire ou j'en suis. 

Je n'ai pas encore installer ni utiliser "MalwareByte's Anti-Malware" car je me demande comment on fait pour redémarrer en mode "sans échec".

De plus mon ordi me signal deux erreurs au démarage, je les recopie:
"Erreur de chargement de c:\Windows\system32\hgGxVPFw.dll Accès refusé."
"Erreur de chargement de c:\Users\greg\AppData\Local\Temp\byXNhgfg.dll Accès refusé." 
Que puis-je faire ?

Et crois tu que je suis encore infecté car Vista ne se manifeste plus pour me dire qu'il y a un cheval de troy ?

merci
A+

green day · Answer

Salut

 oui, il y a encore des bébéttes !

 pour le démarrage en mode sans échec sous vista, c'est comme pour xp !

# Démarre en mode sans échec : 
Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter 
Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée. 
Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal ! 
(Si F8 ne marche pas utilise la touche F5). 

@+

gregrock · Answer

Hello, 
voila le rapport de Malwarebytes' Anti-Malware : 


Malwarebytes' Anti-Malware 1.14
Version de la base de données: 800

08:57:11 2008-05-30
mbam-log-5-30-2008 (08-57-11).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 178525
Temps écoulé: 26 minute(s), 40 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 3
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 13

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\CLSID\{81aa6a16-b8ca-43c4-a347-a487764ff528} (Trojan.Vundo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSServer (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSServer (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{81aa6a16-b8ca-43c4-a347-a487764ff528} (Trojan.Vundo) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Users\greg\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\63CE1B52\css4[3] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\greg\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQWTPUUG\css4[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\greg\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQWTPUUG\css4[3] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\greg\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ERS1WV36\css4[3] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\greg\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ILC16X2O\css4[3] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\greg\AppData\Local\Temp\byXPGASK.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\greg\AppData\Local\Temp\cbXOIcaW.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\greg\AppData\Local\Temp\efcDSICS.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\greg\AppData\Local\Temp\xxyaxVoP.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\greg\AppData\Local\Temp\xxyxWPhI.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\greg\AppData\Roaming\Desktopicon\eBayShortcuts.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\hgGxVPFw.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\greg\AppData\Local\Temp\byXNhgfG.dll (Trojan.Agent) -> Quarantined and deleted successfully.

green day · Answer

Salut

 ok, comment évolue la situation à présent ?

 poste un rapport combo stp

++

gregrock · Answer

bin ca fait déja un moment que Avast ne m'embête plus...

Voilà le rapport combo:

ComboFix 08-05-25.5 - greg 2008-06-01 23:51:56.3 - NTFSx86 MINIMAL
Microsoft® Windows Vista™ Édition Intégrale   6.0.6000.0.1252.1.1036.18.1622 [GMT 2:00]
Endroit: C:\Users\greg\Desktop\ComboFix.exe
.

(((((((((((((((((((((((((((((   Fichiers créés 2008-05-01 to 2008-06-01  ))))))))))))))))))))))))))))))))))))
.

Pas de nouveau fichier créé dans cet espace de temps

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-01 21:47	---------	d-----w	C:\Users\greg\AppData\Roaming\Skype
2008-06-01 20:24	---------	d-----w	C:\Users\greg\AppData\Roaming\skypePM
2008-05-30 06:57	---------	d-----w	C:\Users\greg\AppData\Roaming\Desktopicon
2008-05-30 06:28	---------	d-----w	C:\ProgramData\FLEXnet
2008-05-30 06:20	---------	d-----w	C:\Users\greg\AppData\Roaming\Malwarebytes
2008-05-30 06:20	---------	d-----w	C:\ProgramData\Malwarebytes
2008-05-30 06:20	---------	d-----w	C:\Program Files\Malwarebytes' Anti-Malware
2008-05-29 23:06	34,296	----a-w	C:\Windows\system32\drivers\mbamcatchme.sys
2008-05-29 23:06	15,864	----a-w	C:\Windows\system32\drivers\mbam.sys
2008-05-28 20:39	---------	d-----w	C:\Users\greg\AppData\Roaming\Grisoft
2008-05-28 20:39	---------	d-----w	C:\ProgramData\Grisoft
2008-05-28 20:33	---------	d-----w	C:\Program Files\CCleaner
2008-05-26 21:24	---------	d-----w	C:\ProgramData\Microsoft Help
2008-05-26 21:22	---------	d-----w	C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-05-26 18:59	---------	d-----w	C:\Program Files\Unlocker
2008-05-26 14:54	27,240	----a-w	C:\Users\greg\AppData\Roaming\nvModes.dat
2008-05-26 12:02	---------	d-----w	C:\Program Files\Hewlett-Packard
2008-05-26 07:11	---------	d-----w	C:\ProgramData\Macrovision
2008-05-26 07:11	---------	d-----w	C:\Program Files\Common Files\Adobe Systems Shared
2008-05-26 06:54	---------	d-----w	C:\Program Files\Common Files\Adobe
2008-05-26 06:51	---------	d--h--w	C:\Program Files\InstallShield Installation Information
2008-05-25 22:25	---------	d-----w	C:\Program Files\Common Files\Macrovision Shared
2008-05-25 22:00	---------	d-----w	C:\Program Files\Rhinoceros 4.0
2008-05-25 22:00	---------	d-----w	C:\Program Files\Common Files\McNeel Shared
2008-05-25 21:59	---------	d-----w	C:\ProgramData\McNeel
2008-05-25 21:21	---------	d-----w	C:\Program Files\Microsoft Works
2008-05-25 21:20	---------	d-----w	C:\Program Files\MSBuild
2008-05-25 21:18	---------	d-----w	C:\Program Files\Microsoft.NET
2008-05-25 21:15	---------	d-----w	C:\Program Files\Microsoft Visual Studio 8
2008-05-25 14:12	---------	d-----w	C:\Users\greg\AppData\Roaming\Lenovo
2008-05-25 14:12	---------	d-----w	C:\Users\greg\AppData\Roaming\InstallShield
2008-05-25 14:12	---------	d-----w	C:\Users\greg\AppData\Roaming\acccore
2008-05-25 14:08	---------	d-----w	C:\ProgramData\Viewpoint
2008-05-25 14:08	---------	d-----w	C:\ProgramData\UIB
2008-05-25 14:08	---------	d-----w	C:\ProgramData\Skype
2008-05-25 14:08	---------	d-----w	C:\ProgramData\PC-Doctor
2008-05-25 14:08	---------	d-----w	C:\ProgramData\Lenovo
2008-05-25 14:08	---------	d-----w	C:\ProgramData\Intel
2008-05-25 14:08	---------	d-----w	C:\ProgramData\AOL OCP
2008-05-25 14:08	---------	d-----w	C:\ProgramData\AOL Downloads
2008-05-25 14:08	---------	d-----w	C:\ProgramData\AOL
2008-05-25 14:07	---------	d-----w	C:\Program Files\Windows Photo Gallery
2008-05-25 14:07	---------	d-----w	C:\Program Files\Windows Mail
2008-05-25 14:07	---------	d-----w	C:\Program Files\Windows Live Toolbar
2008-05-25 14:07	---------	d-----w	C:\Program Files\Windows Journal
2008-05-25 14:07	---------	d-----w	C:\Program Files\Windows Collaboration
2008-05-25 14:07	---------	d-----w	C:\Program Files\Windows Calendar
2008-05-25 14:07	---------	d-----w	C:\Program Files\Viewpoint
2008-05-25 14:07	---------	d-----w	C:\Program Files\ThinkVantage
2008-05-25 14:06	---------	d-----w	C:\Program Files\Synaptics
2008-05-25 14:06	---------	d-----w	C:\Program Files\Skype
2008-05-25 14:06	---------	d-----w	C:\Program Files\Reference Assemblies
2008-05-25 14:06	---------	d-----w	C:\Program Files\PCDR5
2008-05-25 14:05	---------	d-----w	C:\Program Files\NetWaiting
2008-05-25 14:05	---------	d-----w	C:\Program Files\Microsoft Games
2008-05-25 14:03	---------	d-----w	C:\Program Files\InterVideo
2008-05-25 14:03	---------	d-----w	C:\Program Files\DivX
2008-05-25 14:03	---------	d-----w	C:\Program Files\DIFX
2008-05-25 14:03	---------	d-----w	C:\Program Files\CONEXANT
2008-05-25 14:03	---------	d-----w	C:\Program Files\Common Files\ThinkVantage Fingerprint Software
2008-05-25 14:02	---------	d-----w	C:\Program Files\Common Files\Skype
2008-05-25 14:02	---------	d-----w	C:\Program Files\Common Files\Lenovo
2008-05-25 14:02	---------	d-----w	C:\Program Files\Common Files\InterVideo
2008-05-25 14:02	---------	d-----w	C:\Program Files\Common Files\InstallShield
2008-05-25 14:02	---------	d-----w	C:\Program Files\Common Files\AOL
2008-05-25 14:02	---------	d-----w	C:\Program Files\Cisco
2008-05-25 14:02	---------	d-----w	C:\Program Files\Analog Devices
2008-05-25 14:02	---------	d-----w	C:\Program Files\Alwil Software
2008-05-25 14:02	---------	d-----w	C:\Program Files\AIM6
2008-05-17 15:11	56	---h--w	C:\Users\All Users\ezsidmv.dat
2008-05-17 15:11	56	---h--w	C:\ProgramData\ezsidmv.dat
2008-05-17 08:43	47	------w	C:\Windows\system32\drivers\IBM_6460_6XG.MRK
2008-05-17 08:43	---------	d-----w	C:\Program Files\Lenovo
2008-05-17 07:55	1,585,664	------w	C:\Windows\System32\setupapi.dll
2008-05-17 07:33	174	--sh--w	C:\Program Files\desktop.ini
2008-05-17 07:27	---------	d-----w	C:\Program Files\Windows Sidebar
2008-05-17 07:24	704,000	------w	C:\Windows\System32\PhotoScreensaver.scr
2008-05-17 07:22	1,060,920	------w	C:\Windows\system32\drivers\ntfs.sys
2008-05-17 07:21	8,147,968	------w	C:\Windows\System32\wmploc.DLL
2008-05-17 07:21	7,680	------w	C:\Windows\System32\spwmp.dll
2008-05-17 07:21	4,096	------w	C:\Windows\System32\dxmasf.dll
2008-05-17 07:21	356,864	------w	C:\Windows\System32\MediaMetadataHandler.dll
2008-05-17 07:19	803,328	------w	C:\Windows\system32\drivers\tcpip.sys
2008-05-17 07:19	24,064	------w	C:\Windows\System32\netcfg.exe
2008-05-17 07:19	22,016	------w	C:\Windows\System32\netiougc.exe
2008-05-17 07:19	216,632	------w	C:\Windows\system32\drivers\netio.sys
2008-05-17 07:19	167,424	------w	C:\Windows\System32\tcpipcfg.dll
2008-05-17 07:18	1,327,104	------w	C:\Windows\System32\quartz.dll
2008-05-17 07:17	9,728	------w	C:\Windows\System32\LAPRXY.DLL
2008-05-17 07:17	296,448	------w	C:\Windows\System32\gdi32.dll
2008-05-17 07:17	223,232	------w	C:\Windows\System32\WMASF.DLL
2008-05-17 07:17	2,048	------w	C:\Windows\System32\asferror.dll
2008-05-17 07:17	2,027,008	------w	C:\Windows\System32\win32k.sys
2008-05-17 07:16	2,048	------w	C:\Windows\System32\msxml6r.dll
2008-05-17 07:16	1,335,296	------w	C:\Windows\System32\msxml6.dll
2008-05-17 07:14	84,480	------w	C:\Windows\System32\INETRES.dll
2008-05-17 07:14	737,792	------w	C:\Windows\System32\inetcomm.dll
2008-05-17 07:14	11,776	------w	C:\Windows\System32\sbunattend.exe
2008-05-17 07:13	84,992	------w	C:\Windows\system32\drivers\srvnet.sys
2008-05-17 07:13	83,968	------w	C:\Windows\System32\dnsrslvr.dll
.

------- Sigcheck -------

.
(((((((((((((((((((((((((((((   snapshot@2008-05-26_17.08.09.21   )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-05-28 21:37:26	45,056	----a-w	C:\Windows\BDOSCAN8\avxdisk.dll
+ 2008-05-28 21:37:27	10,240	----a-w	C:\Windows\BDOSCAN8\avxs.dll
+ 2008-05-28 21:37:27	27,136	----a-w	C:\Windows\BDOSCAN8\avxt.dll
+ 2008-05-28 21:37:32	181,760	----a-w	C:\Windows\BDOSCAN8\bdcore.dll
+ 2008-01-09 13:01:48	118,784	----a-w	C:\Windows\BDOSCAN8\bdupd.dll
+ 2008-01-09 13:01:48	53,248	----a-w	C:\Windows\BDOSCAN8\ipsupd.dll
+ 2008-05-28 21:37:34	142,848	----a-w	C:\Windows\BDOSCAN8\libfn.dll
+ 2008-05-28 21:37:28	86,016	----a-w	C:\Windows\BDOSCAN8\librtvr.dll
+ 2008-01-09 13:01:48	53,248	----a-w	C:\Windows\bdoscandel.exe
- 2008-05-26 15:03:39	67,584	--s-a-w	C:\Windows\bootstat.dat
+ 2008-06-01 21:50:31	67,584	--s-a-w	C:\Windows\bootstat.dat
+ 2008-01-09 13:01:48	118,784	----a-w	C:\Windows\Downloaded Program Files\bdupd.dll
+ 2008-01-09 13:01:48	53,248	----a-w	C:\Windows\Downloaded Program Files\ipsupd.dll
+ 2006-10-27 13:16:36	133,936	----a-r	C:\Windows\Installer\$PatchCache$\Managed\[u]0/u0002109030000000000000000F01FEC\12.0.4518\CONTAB32.DLL
+ 2006-10-26 18:55:32	87,344	----a-r	C:\Windows\Installer\$PatchCache$\Managed\[u]0/u0002109030000000000000000F01FEC\12.0.4518\DLGSETP.DLL
+ 2006-10-27 13:07:36	17,891,112	----a-r	C:\Windows\Installer\$PatchCache$\Managed\[u]0/u0002109030000000000000000F01FEC\12.0.4518\EXCEL.EXE
+ 2006-10-26 18:55:48	340,248	----a-r	C:\Windows\Installer\$PatchCache$\Managed\[u]0/u0002109030000000000000000F01FEC\12.0.4518\MIMEDIR.DLL
+ 2006-10-27 13:04:08	497,504	----a-r	C:\Windows\Installer\$PatchCache$\Managed\[u]0/u0002109030000000000000000F01FEC\12.0.4518\MORPH9.DLL
+ 2006-10-27 13:04:10	9,581,360	----a-r	C:\Windows\Installer\$PatchCache$\Managed\[u]0/u0002109030000000000000000F01FEC\12.0.4518\MSPUB.EXE
+ 2006-10-27 13:16:46	2,939,704	----a-r	C:\Windows\Installer\$PatchCache$\Managed\[u]0/u0002109030000000000000000F01FEC\12.0.4518\OLMAPI32.DLL
+ 2006-10-26 18:34:12	660,792	----a-r	C:\Windows\Installer\$PatchCache$\Managed\[u]0/u0002109030000000000000000F01FEC\12.0.4518\OMSMAIN.DLL
+ 2006-10-26 18:34:10	192,848	----a-r	C:\Windows\Installer\$PatchCache$\Managed\[u]0/u0002109030000000000000000F01FEC\12.0.4518\OMSXP32.DLL
+ 2006-09-15 14:25:18	3,611,416	----a-r	C:\Windows\Installer\$PatchCache$\Managed\[u]0/u0002109030000000000000000F01FEC\12.0.4518\OUTLFLTR.DAT
+ 2006-10-27 13:16:44	594,256	----a-r	C:\Windows\Installer\$PatchCache$\Managed\[u]0/u0002109030000000000000000F01FEC\12.0.4518\OUTLMIME.DLL
+ 2006-10-27 13:16:48	12,813,096	----a-r	C:\Windows\Installer\$PatchCache$\Managed\[u]0/u0002109030000000000000000F01FEC\12.0.4518\OUTLOOK.EXE
+ 2006-10-27 13:16:40	176,976	----a-r	C:\Windows\Installer\$PatchCache$\Managed\[u]0/u0002109030000000000000000F01FEC\12.0.4518\OUTLPH.DLL
+ 2006-10-26 18:09:36	136,008	----a-r	C:\Windows\Installer\$PatchCache$\Managed\[u]0/u0002109030000000000000000F01FEC\12.0.4518\PRTF9.DLL
+ 2006-10-26 18:55:54	413,472	----a-r	C:\Windows\Installer\$PatchCache$\Managed\[u]0/u0002109030000000000000000F01FEC\12.0.4518\PSTPRX32.DLL
+ 2006-10-27 13:04:06	624,456	----a-r	C:\Windows\Installer\$PatchCache$\Managed\[u]0/u0002109030000000000000000F01FEC\12.0.4518\PTXT9.DLL
+ 2006-10-26 18:09:44	590,144	----a-r	C:\Windows\Installer\$PatchCache$\Managed\[u]0/u0002109030000000000000000F01FEC\12.0.4518\PUBCONV.DLL
+ 2006-10-26 18:55:44	263,520	----a-r	C:\Windows\Installer\$PatchCache$\Managed\[u]0/u0002109030000000000000000F01FEC\12.0.4518\SCNPST32.DLL
+ 2006-10-26 18:55:44	272,744	----a-r	C:\Windows\Installer\$PatchCache$\Managed\[u]0/u0002109030000000000000000F01FEC\12.0.4518\SCNPST64.DLL
+ 2006-10-27 13:23:04	347,432	----a-r	C:\Windows\Installer\$PatchCache$\Managed\[u]0/u0002109030000000000000000F01FEC\12.0.4518\WINWORD.EXE
+ 2006-10-27 13:11:38	4,235,560	----a-r	C:\Windows\Installer\$PatchCache$\Managed\[u]0/u0002109030000000000000000F01FEC\12.0.4518\WRD12CNV.DLL
+ 2006-10-27 13:11:36	21,264	----a-r	C:\Windows\Installer\$PatchCache$\Managed\[u]0/u0002109030000000000000000F01FEC\12.0.4518\WRD12EXE.EXE
+ 2006-10-27 13:23:08	17,483,560	----a-r	C:\Windows\Installer\$PatchCache$\Managed\[u]0/u0002109030000000000000000F01FEC\12.0.4518\WWLIB.DLL
+ 2006-10-26 19:13:08	14,674,216	----a-r	C:\Windows\Installer\$PatchCache$\Managed\[u]0/u0002109030000000000000000F01FEC\12.0.4518\XL12CNV.EXE
+ 2006-10-26 19:17:08	11,072	----a-r	C:\Windows\Installer\$PatchCache$\Managed\[u]0/u0002109030000000000000000F01FEC\12.0.4518\XLCALL32.DLL
- 2008-05-25 21:23:05	1,165,584	----a-r	C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\accicons.exe
+ 2008-05-26 21:24:43	1,165,584	----a-r	C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\accicons.exe
- 2008-05-25 21:23:05	20,240	----a-r	C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\cagicon.exe
+ 2008-05-26 21:24:43	20,240	----a-r	C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\cagicon.exe
- 2008-05-25 21:23:05	159,504	----a-r	C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\inficon.exe
+ 2008-05-26 21:24:43	159,504	----a-r	C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\inficon.exe
- 2008-05-25 21:23:05	184,080	----a-r	C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\joticon.exe
+ 2008-05-26 21:24:43	184,080	----a-r	C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\joticon.exe
- 2008-05-25 21:23:05	217,864	----a-r	C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\misc.exe
+ 2008-05-26 21:24:43	217,864	----a-r	C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\misc.exe
- 2008-05-25 21:23:05	18,704	----a-r	C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\mspicons.exe
+ 2008-05-26 21:24:43	18,704	----a-r	C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\mspicons.exe
- 2008-05-25 21:23:05	35,088	----a-r	C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\oisicon.exe
+ 2008-05-26 21:24:43	35,088	----a-r	C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\oisicon.exe
- 2008-05-25 21:23:05	845,584	----a-r	C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe
+ 2008-05-26 21:24:43	845,584	----a-r	C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe
- 2008-05-25 21:23:05	922,384	----a-r	C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pptico.exe
+ 2008-05-26 21:24:43	922,384	----a-r	C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pptico.exe
- 2008-05-25 21:23:05	272,648	----a-r	C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pubs.exe
+ 2008-05-26 21:24:43	272,648	----a-r	C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pubs.exe
- 2008-05-25 21:23:05	888,080	----a-r	C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\wordicon.exe
+ 2008-05-26 21:24:43	888,080	----a-r	C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\wordicon.exe
- 2008-05-25 21:23:05	1,172,240	----a-r	C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\xlicons.exe
+ 2008-05-26 21:24:43	1,172,240	----a-r	C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\xlicons.exe
+ 2006-11-02 09:46:13	41,472	----a-w	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
- 2008-05-26 15:03:55	262,144	--sha-w	C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-06-01 21:49:19	262,144	--sha-w	C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-06-01 21:49:19	262,144	---ha-w	C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1
- 2008-05-26 15:03:55	262,144	--sha-w	C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-06-01 21:49:19	262,144	--sha-w	C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-06-01 21:49:19	262,144	---ha-w	C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
- 2008-05-26 14:54:28	16,384	--sh--w	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-06-01 18:27:48	16,384	--sh--w	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-05-26 14:54:28	32,768	--sh--w	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-06-01 18:27:48	32,768	--sh--w	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-05-26 14:54:28	16,384	--sh--w	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-06-01 18:27:48	16,384	--sh--w	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2007-05-30 12:10:42	10,872	----a-w	C:\Windows\System32\drivers\AvgAsCln.sys
+ 2006-11-02 09:46:14	664,576	----a-w	C:\Windows\System32\drivers\UMDF\WpdMtpDr.dll
+ 2006-11-02 09:04:23	39,936	----a-w	C:\Windows\System32\drivers\WpdUsb.sys
- 2008-05-26 06:31:39	373,512	----a-w	C:\Windows\System32\FNTCACHE.DAT
+ 2008-05-30 06:59:07	511,304	----a-w	C:\Windows\System32\FNTCACHE.DAT
- 2008-05-26 14:56:15	4,676	----a-w	C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2696429381-2222186485-2678389321-1000_UserData.bin
+ 2008-06-01 09:30:01	5,648	----a-w	C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2696429381-2222186485-2678389321-1000_UserData.bin
- 2008-05-26 14:56:15	69,280	----a-w	C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-06-01 09:30:00	71,138	----a-w	C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2008-05-26 14:56:08	36,988	----a-w	C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-06-01 09:29:58	39,924	----a-w	C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 09:46:14	33,280	----a-w	C:\Windows\System32\WpdConns.dll
+ 2006-11-02 09:46:14	151,552	----a-w	C:\Windows\System32\WpdMtp.dll
+ 2006-11-02 09:46:14	60,416	----a-w	C:\Windows\System32\WpdMtpUS.dll
.
-- Snapshot reset to current date --
.
(((((((((((((((((((((((((((((((((   Point de chargement Reg   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BF468356-BB7E-42D7-9F15-4F3B9BCFCED2}]
2008-02-19 13:05	784960	---------	C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-05-17 09:14 1232896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TPHOTKEY"="C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe" [2008-01-24 10:21 66928]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-11-21 18:08 820520]
"PWMTRV"="C:\PROGRA~1\ThinkPad\UTILIT~1\PWMTR32V.DLL" [2008-01-11 02:20 558368]
"BLOG"="C:\PROGRA~1\ThinkPad\UTILIT~1\BTVLogEx.DLL" [2008-01-11 02:20 214576]
"TpShocks"="TpShocks.exe" [2007-11-22 15:09 181536 C:\Windows\System32\TpShocks.exe]
"EZEJMNAP"="C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2007-04-27 02:33 243248]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-07-27 09:57 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-07-27 09:57 8433664]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-07-27 09:57 81920]
"TVT Scheduler Proxy"="C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe" [2008-03-04 10:34 487424]
"DiskeeperSystray"="C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe" [2006-11-16 01:21 217176]
"AwaySch"="C:\Program Files\Lenovo\AwayTask\AwaySch.EXE" [2006-11-07 12:51 91688]
"LPManager"="C:\PROGRA~1\THINKV~2\PrdCtr\LPMGR.exe" [2008-01-11 02:21 144728]
"ACTray"="C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe" [2008-03-17 13:37 431392]
"ACWLIcon"="C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe" [2008-03-17 13:37 128288]
"LenovoOobeOffers"="c:\SWTOOLS\LenovoWelcome\LenovoOobeOffers.exe" [2006-12-29 19:01 28672]
"LPMailChecker"="C:\PROGRA~1\THINKV~2\PrdCtr\LPMLCHK.exe" [2008-01-11 02:21 124248]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2007-12-07 10:13 1282048]
"MSConfig"="C:\Windows\System32\msconfig.exe" [2006-11-02 11:45 222208]
"TPFNF7"="C:\PROGRA~1\Lenovo\NPDIRECT\TPFNF7SP.exe" [2008-03-26 03:06 59680]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]
"Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-01-11 19:54 623992]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25 6731312]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"@"="" []
"GrpConv"="grpconv -o" []

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-05-26 08:50:43 110592]
Bluetooth.lnk - C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe [2007-03-29 22:11:50 719664]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2008-05-17 01:10:11 50688]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"DisableCAD"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
C:\Windows\system32\psqlpwd.dll 2007-03-15 07:17 89600 C:\Windows\System32\psqlpwd.dll

[HKLM\~\startupfolder\C:^Users^greg^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^LenovoWelcome.lnk]
path=C:\Users\greg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LenovoWelcome.lnk
backup=C:\Windows\pss\LenovoWelcome.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AMSG]
--------- 2007-02-01 20:00 419376 C:\Program Files\ThinkVantage\AMSG\Amsg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cssauth]
--------- 2007-11-29 18:36 2872632 C:\Program Files\Lenovo\Client Security Solution\cssauth.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPFNF7]
--------- 2008-03-26 03:06 59680 C:\Program Files\Lenovo\NPDIRECT\TPFNF7SP.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{31656E5A-22D0-436A-857A-7CD86485D68D}"= UDP:C:\Program Files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{89326607-E7DD-45E0-8A0C-B3D3DBC892D2}"= TCP:C:\Program Files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{EE2BBB68-C915-4B68-8659-EE17F6510740}"= C:\Program Files\Skype\Phone\Skype.exe:Skype
"{9F4841D1-16AB-408B-BE30-7FBBA704AD0E}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{CF993300-D66D-43AD-961B-196489870950}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{E1FB2FC0-695F-4B9D-9C3D-C01A56FB8E67}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{A561987B-FE9E-474B-A7B6-9F01D53A77EC}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{ECD8F275-1B6A-4CAD-8C14-689E7D728650}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

R0 Shockprf;Shockprf;C:\Windows\system32\DRIVERS\Apsx86.sys [2007-10-16 18:33]
R0 TPDIGIMN;TPDIGIMN;C:\Windows\system32\DRIVERS\ApsHM86.sys [2007-10-16 18:32]
S1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-05-16 01:20]
S1 lenovo.smi;Lenovo System Interface Driver;C:\Windows\system32\DRIVERS\smiif32.sys [2006-08-30 12:04]
S1 TPPWRIF;TPPWRIF;C:\Windows\system32\drivers\Tppwr32v.sys [2008-01-11 02:20]
S1 tvtumon;tvtumon;C:\Windows\system32\DRIVERS\tvtumon.sys [2008-02-03 09:20]
S2 AEADIFilters;Andrea ADI Filters Service;C:\Windows\system32\AEADISRV.EXE [2007-02-05 23:44]
S2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
S2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-05-16 01:18]
S2 smihlp;SMI Helper Driver (smihlp);C:\Program Files\Common Files\ThinkVantage Fingerprint Software\Drivers\smihlp.sys [2007-03-15 07:10]
S2 TPHKSVC;Incrustation;C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe [2007-12-14 16:37]
S2 TVT Backup Protection Service;TVT Backup Protection Service;"C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe" [2007-12-05 17:32]
S2 TVT_UpdateMonitor;TVT Windows Update Monitor;C:\Program Files\Lenovo\Rescue and Recovery\UpdateMonitor.exe [2008-02-03 09:20]
S2 XAudio;XAudio;C:\Windows\system32\DRIVERS\xaudio.sys [2007-10-18 14:36]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\b57nd60x.sys [2006-11-02 09:30]
S3 btwaudio;Bluetooth Audio Device Service;C:\Windows\system32\drivers\btwaudio.sys [2007-03-29 20:46]
S3 btwavdt;Bluetooth AVDT;C:\Windows\system32\drivers\btwavdt.sys [2007-02-27 07:20]
S3 btwrchid;btwrchid;C:\Windows\system32\DRIVERS\btwrchid.sys [2007-02-27 07:20]
S3 MBAMCatchMe;MBAMCatchMe;C:\Windows\system32\drivers\mbamcatchme.sys [2008-05-30 01:06]
S3 TcUsb;TC USB Kernel Driver;C:\Windows\system32\Drivers\tcusb.sys [2007-03-15 06:50]
S3 TVTI2C;Lenovo SM bus driver;C:\Windows\system32\DRIVERS\Tvti2c.sys [2007-05-22 21:59]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs	REG_MULTI_SZ   	BthServ

*Newly Created Service* - ECACHE
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-06-01 21:11:00 C:\Windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-01 23:57:08
Windows 6.0.6000  NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-06-01 23:58:04
ComboFix-quarantined-files.txt  2008-06-01 21:58:00

      Le texte du message associé au numéro 0x2379 est introuvable dans le fichier de messages pour Application.
      Le texte du message associé au numéro 0x2379 est introuvable dans le fichier de messages pour Application.

317	--- E O F ---	2008-05-30 12:42:24

green day · Answer

Salut

je crois que le problème est a présent résolu :-)

 à toi de me dire quoi ...

@+

gregrock · Answer

Bin ça m'en a tout l'aire aussi... La seule chose que je puisse dire c'est que Avast ne se manifeste plus ! Mais comme la dernière fois que je t'ai dis ça tu as très justement su me dire qu'il y avait encore des bébêtes... Je n'ose qu'espérer que cette fois c'est tout bon.

En tout cas je te remercie énormément pour le temps et la patience que tu as su me vouer ces derniers jours. Sans toi mon ordi aurait sans nul doute fusionné avec le mur à l’heure qu’il est !

J’ai malheureusement encore une ou deux petites questions :
1- Que dois-je faire avec mes disques durs externes. Dois-je les scanner avec avast (ou autre) avant de les utiliser? 
2-Es-ce que je peux supprimer les logiciels que j’ai du installer lors de la procédure ? (AVG – Hijack – Ccleaner – Vundo fix – Combofix - MalwareByte's Anti-Malware)
Si oui -  Es-ce qu’il y a qqch à savoir de particulier pour les supprimer ou puis-je le faire de façon « classique » ?  
Et dernière question :
3-Es-ce que tu me conseille de changer Avast contre Antivir ? As-tu peut-être encore autre chose à me conseiller ?

Merci encore pour tout !

gregrock · Answer

Re salut green day, 

Qu'es que tu me conseilles pour les programmes installés ? les supprimer ? en garder ? 

++

green day · Answer

Salut

 fusionner le pc avec le mur ! :D

 joliment imagé ! :)

1- Que dois-je faire avec mes disques durs externes. Dois-je les scanner avec avast (ou autre) avant de les utiliser? 

ça dépend de la nature des documents qui y sont stockés ! si ce sont des documents téléchargés, il vaut mieux les scanner oui !

2-Es-ce que je peux supprimer les logiciels que j’ai du installer lors de la procédure ? (AVG – Hijack – Ccleaner – Vundo fix – Combofix - MalwareByte's Anti-Malware) 

tu peux tout supprimer ( de manière classique ! )sauf avg, ccleaner et MalwareByte's Anti-Malware, très très bien, gratuits et à utiliser régulièrement en les mettant à jour régulièrement aussi !


3-Es-ce que tu me conseille de changer Avast contre Antivir ?


oui, mais antivir est en anglais pour vista, sinon c'est vrai qu'il semble ces temps si être un peu plus performant qu'avast !


As-tu peut-être encore autre chose à me conseiller ? 

installe un parefeu si tu n'en as pas !

 tout ce qu'il y a à faire est résumé ici :

 http://www.commentcamarche.net/faq/sujet 2432 securite proteger un ordinateur contre les malwares d internet

pas d'quoi ! ;-))

@+

gregrock · Answer

OK - cette fois je suis complètement au claire!
Je te remercie une dernière fois pour ton aide.
A +

Virus Vundo - HELP !

27 réponses

Discussions similaires

Newsletters